Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-30 12:18:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1307 from Tria-plc/alpha

Browse Source 
fix: ( payments ) restrict force-confirm to tickets:generate permission
This commit is contained in:
Abubeker Yasin
2026-08-17 09:48:40 +03:00
committed by GitHub
parent a2c30a3c96 b9e000729d
commit 70663f91da
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
apps/edr-passenger-api/src/modules/payments/payments.controller.ts
View File

@@ -218,17 +218,14 @@ export class PaymentsController {
} }
@Post(":bookingId/force-confirm") @Post(":bookingId/force-confirm")
@PassengerStaff([ @PassengerStaff([PASSENGER_PERMS.tickets.generate, PASSENGER_PERMS.admin])
PASSENGER_PERMS.payments.manage,
PASSENGER_PERMS.payments.manageMethods,
PASSENGER_PERMS.admin,
])
@ApiBearerAuth("IAM-auth") @ApiBearerAuth("IAM-auth")
@ApiOperation({ @ApiOperation({
summary: "Force-confirm payment & generate ticket (back-office only)", summary: "Force-confirm payment & generate ticket (ticket-generate permission)",
description: description:
"Marks the payment as SUCCEEDED, confirms the booking, and generates the ticket. " + "Marks the payment as SUCCEEDED, confirms the booking, and generates the ticket. " +
"Use when a vendor payment completed but the webhook was never delivered. Idempotent.", "Use when a vendor payment completed but the webhook was never delivered. Idempotent. " +
"Requires `edr_passenger_app:tickets:generate` (admins bypass).",
}) })
forceConfirm( forceConfirm(
@Param("bookingId") bookingId: string, @Param("bookingId") bookingId: string,