Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-09-02 01:13:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix issue

Browse Source
This commit is contained in:
Marshal
2026-07-16 01:05:57 +00:00
parent 41fe04652f
commit fe29b38377
18 changed files with 518 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
apps/edr-freight-api/src/modules/rule-engine/controllers/priority-rule-change-requests.controller.ts
View File

@@ -12,6 +12,7 @@ import { CurrentUser } from '@edr/api-common';
import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
import { isSuperAdmin } from '../../../common/freight-permission.util';
import {
DecidePriorityRuleChangeDto,
SubmitPriorityRuleChangeDto,
@@ -56,7 +57,9 @@ export class PriorityRuleChangeRequestsController {
@Body() dto: DecidePriorityRuleChangeDto,
@CurrentUser() user: TCurrentUser,
) {
return this.service.approve(id, user?.id, dto.decisionNote);
// Super admins have full backoffice authority — they may approve a change
// they submitted; everyone else is held to separation of duties.
return this.service.approve(id, user?.id, dto.decisionNote, isSuperAdmin(user));
}
@Post(':id/reject')

8
apps/edr-freight-api/src/modules/rule-engine/controllers/rates.controller.ts
View File

@@ -4,7 +4,9 @@ import {
} from '@nestjs/common';
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
import { CurrentUser } from '@edr/api-common';
import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
import { isSuperAdmin } from '../../../common/freight-permission.util';
import { CreateRateDto } from '../dto/create-rate.dto';
import { ListRatesQueryDto } from '../dto/list-rule-engine-query.dto';
import {
@@ -70,9 +72,11 @@ export class RatesController {
@ApiOperation({ summary: 'CEO approves a rate' })
approve(
@Param('id', ParseUUIDPipe) id: string,
@CurrentUser() user: AuthUserPayload,
@CurrentUser() user: TCurrentUser,
) {
return this.service.approve(id, resolveAuthUserId(user));
// Super admins have full backoffice authority — they may approve a rate
// they proposed; everyone else is held to separation of duties.
return this.service.approve(id, resolveAuthUserId(user), isSuperAdmin(user));
}
@Delete(':id')

6
apps/edr-freight-api/src/modules/rule-engine/services/priority-rule-change-requests.service.ts
View File

@@ -80,13 +80,15 @@ export class PriorityRuleChangeRequestsService {
id: string,
userId?: string | null,
decisionNote?: string,
canSelfApprove = false,
): Promise<PriorityRuleChangeRequest> {
const request = await this.findPending(id);
// Separation of duties: the requester cannot approve their own change.
// Separation of duties: the requester cannot approve their own change —
// except super admins, who have full backoffice authority.
// TODO: split approval into a distinct approver permission rather than
// relying on this id check.
if (userId && userId === request.requestedByUserId) {
if (!canSelfApprove && userId && userId === request.requestedByUserId) {
throw new ForbiddenException(
'You cannot approve a change request you submitted',
);

11
apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts
View File

@@ -195,15 +195,16 @@ export class RatesService {
}
/** CEO approves a rate — moves to LIVE. */
async approve(id: string, approverUserId: string): Promise<Rate> {
async approve(id: string, approverUserId: string, canSelfApprove = false): Promise<Rate> {
const rate = await this.findById(id);
if (rate.status !== 'PENDING_APPROVAL') {
throw new BadRequestException('Only PENDING_APPROVAL rates can be approved');
}
// Separation of duties: the proposer cannot approve their own rate.
// TODO: split approval into a distinct CEO/approver permission — a proposer
// who also holds the approve permission is still the wrong person to sign off.
if (approverUserId === rate.proposedByStaffId) {
// Separation of duties: the proposer cannot approve their own rate — except
// super admins, who have full backoffice authority (propose + approve).
// TODO: split approval into a distinct CEO/approver permission — a normal
// proposer who also holds the approve permission is still the wrong signer.
if (!canSelfApprove && approverUserId === rate.proposedByStaffId) {
throw new ForbiddenException('You cannot approve a rate you proposed');
}
const updated = await this.repository.update(id, {