Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-28 04:20:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ( bookings ) require explicit tickets:generate to issue reservations

Browse Source
This commit is contained in:
Abubeker Yasin
2026-07-28 12:18:25 +03:00
parent 0d46f3715e
commit ed09bfd8b6
7 changed files with 79 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts
View File

@@ -35,7 +35,7 @@ import {
IssueReservationBookingDto,
} from "./guest-booking.dto";
import { JwtGuard } from "../../common/jwt.guard";
import { PassengerAdmin, PassengerStaff } from "../../common/passenger-guards";
import { PassengerAdmin, PassengerStaff, PassengerStaffStrict } from "../../common/passenger-guards";
import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";
@ApiTags("Booking")
@@ -352,12 +352,12 @@ export class BookingsController {
}
@Post("reservations/:seatId/issue")
@PassengerAdmin()
@PassengerStaffStrict(PASSENGER_PERMS.tickets.generate)
@ApiBearerAuth("IAM-auth")
@ApiOperation({
summary: "Issue a booking from a reserved (blocked) seat — admin only",
summary: "Issue a booking from a reserved (blocked) seat — requires tickets:generate",
description:
"Converts an admin-reserved seat into a real booking for one traveler. bookingKind STAFF waives the fee and issues the ticket immediately; bookingKind PASSENGER creates the booking as PENDING_PAYMENT and texts a payment link to the traveler's phone. Restricted to admins (edr_passenger_app:admin) because STAFF issuance waives the fare.",
"Converts an admin-reserved seat into a real booking for one traveler. bookingKind STAFF waives the fee and issues the ticket immediately; bookingKind PASSENGER creates the booking as PENDING_PAYMENT and texts a payment link to the traveler's phone. Because STAFF issuance waives the fare, this requires edr_passenger_app:tickets:generate to be explicitly granted — super admins and org admins do NOT bypass it.",
})
@ApiBody({ type: IssueReservationBookingDto })
issueBookingFromReservation(