Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ( payments ) restrict force-confirm to tickets:generate permission

Browse Source
This commit is contained in:
Abubeker Yasin
2026-08-17 09:47:36 +03:00
parent d952792e15
commit b9e000729d
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
apps/edr-passenger-api/src/modules/payments/payments.controller.ts
View File

@@ -211,17 +211,14 @@ export class PaymentsController {
}
@Post(":bookingId/force-confirm")
@PassengerStaff([
PASSENGER_PERMS.payments.manage,
PASSENGER_PERMS.payments.manageMethods,
PASSENGER_PERMS.admin,
])
@PassengerStaff([PASSENGER_PERMS.tickets.generate, PASSENGER_PERMS.admin])
@ApiBearerAuth("IAM-auth")
@ApiOperation({
summary: "Force-confirm payment & generate ticket (back-office only)",
summary: "Force-confirm payment & generate ticket (ticket-generate permission)",
description:
"Marks the payment as SUCCEEDED, confirms the booking, and generates the ticket. " +
"Use when a vendor payment completed but the webhook was never delivered. Idempotent.",
"Use when a vendor payment completed but the webhook was never delivered. Idempotent. " +
"Requires `edr_passenger_app:tickets:generate` (admins bypass).",
})
forceConfirm(
@Param("bookingId") bookingId: string,