fix issue

This commit is contained in:
Marshal
2026-07-16 01:05:57 +00:00
parent 41fe04652f
commit fe29b38377
18 changed files with 518 additions and 51 deletions

View File

@@ -80,13 +80,15 @@ export class PriorityRuleChangeRequestsService {
id: string,
userId?: string | null,
decisionNote?: string,
canSelfApprove = false,
): Promise<PriorityRuleChangeRequest> {
const request = await this.findPending(id);
// Separation of duties: the requester cannot approve their own change.
// Separation of duties: the requester cannot approve their own change
// except super admins, who have full backoffice authority.
// TODO: split approval into a distinct approver permission rather than
// relying on this id check.
if (userId && userId === request.requestedByUserId) {
if (!canSelfApprove && userId && userId === request.requestedByUserId) {
throw new ForbiddenException(
'You cannot approve a change request you submitted',
);