fix issue

apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts

@@ -1,6 +1,7 @@
 import {
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   Inject,
   Injectable,
   NotFoundException,
@@ -199,6 +200,12 @@ export class RatesService {
     if (rate.status !== 'PENDING_APPROVAL') {
       throw new BadRequestException('Only PENDING_APPROVAL rates can be approved');
     }
+    // Separation of duties: the proposer cannot approve their own rate.
+    // TODO: split approval into a distinct CEO/approver permission — a proposer
+    // who also holds the approve permission is still the wrong person to sign off.
+    if (approverUserId === rate.proposedByStaffId) {
+      throw new ForbiddenException('You cannot approve a rate you proposed');
+    }
     const updated = await this.repository.update(id, {
       status: 'LIVE',
       approvedByCeoId: approverUserId,