fix: block the user from booking if not approved

apps/edr-freight-api/src/modules/bookings/bookings.service.ts

@@ -361,6 +361,17 @@ export class BookingsService {
           tradeDirection,
           fallbackType,
         );
+
+      // A customer booking under their own account may only do so once the
+      // resolved operational profile has been approved by the backoffice. Staff-
+      // and government-initiated bookings (companyId supplied explicitly) bypass
+      // this gate.
+      const customerSelfBooking = !dto.companyId && !!userId;
+      if (customerSelfBooking && companyProfileId) {
+        await this.companiesService.assertCompanyProfileApprovedForBooking(
+          companyProfileId,
+        );
+      }
     }
 
     const allowConsolidation =