From 43be6892aa7bcd1379388e16f854a22f71d7707c Mon Sep 17 00:00:00 2001 From: Nathnael Date: Wed, 24 Jun 2026 11:50:04 +0000 Subject: [PATCH] fix: block the user from booking if not approved --- .../src/modules/bookings/bookings.service.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.service.ts b/apps/edr-freight-api/src/modules/bookings/bookings.service.ts index b6f3ee220..1f93eccc3 100644 --- a/apps/edr-freight-api/src/modules/bookings/bookings.service.ts +++ b/apps/edr-freight-api/src/modules/bookings/bookings.service.ts @@ -361,6 +361,17 @@ export class BookingsService { tradeDirection, fallbackType, ); + + // A customer booking under their own account may only do so once the + // resolved operational profile has been approved by the backoffice. Staff- + // and government-initiated bookings (companyId supplied explicitly) bypass + // this gate. + const customerSelfBooking = !dto.companyId && !!userId; + if (customerSelfBooking && companyProfileId) { + await this.companiesService.assertCompanyProfileApprovedForBooking( + companyProfileId, + ); + } } const allowConsolidation =