admin/zapishis-client
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api/orders): add validation to prevent masters from recording other masters as clients

Browse Source
This commit is contained in:
vchikalkin 2025-07-03 22:31:41 +03:00
parent 1e4e4aa336
commit 686fe60b80
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packages/graphql/api/orders.ts
View File

@ -67,6 +67,15 @@ export class OrdersService extends BaseService {
}
}
if (isMaster) {
const { customers: myMasters } = await customersService.getMasters(this.customer);
const clientId = variables.input.client;
const isTryingToRecordMaster = myMasters.some((master) => master?.documentId === clientId);
if (isTryingToRecordMaster) throw new Error(ERRORS.INVALID_CLIENT);
}
if (isMaster && slot?.master?.documentId !== customer.documentId) {
throw new Error(ERRORS.INVALID_MASTER);
}