From e6bc4cf734ae891e21737a48bd4520e13f31d45b Mon Sep 17 00:00:00 2001
From: unknown <acs@itcenter.local>
Date: Mon, 20 Jul 2026 18:18:17 +0900
Subject: [PATCH] fix: limit self approval to admins

---
 .../com/itcenter/acs/controller/VisitRequestController.java | 6 +++---
 server/routes/business.ts                                   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/backend/src/main/java/com/itcenter/acs/controller/VisitRequestController.java b/backend/src/main/java/com/itcenter/acs/controller/VisitRequestController.java
index 8078385..d642dc9 100644
--- a/backend/src/main/java/com/itcenter/acs/controller/VisitRequestController.java
+++ b/backend/src/main/java/com/itcenter/acs/controller/VisitRequestController.java
@@ -37,15 +37,15 @@ public class VisitRequestController {
     /**
      * Create pre-registration(s); current user becomes the host. One request is issued per
      * selected server room, so the response may contain more than one (e.g. 4층+5층전산실 → 2건).
-     * When the registrant already holds approval authority (ADMIN/SECURITY), each request is
-     * self-approved immediately (QR issued) — HOST registrations stay PENDING.
+     * When the registrant is ADMIN, each request is self-approved immediately
+     * (QR issued) — SECURITY/HOST registrations stay PENDING.
      */
     @PostMapping
     public ResponseEntity<ApiResponse<List<VisitRequestResponse>>> create(
             @Valid @RequestBody VisitRequestCreateRequest request) {
         Long userId = SecurityUtils.currentUserId();
         List<VisitRequest> created = visitRequestService.createRequests(request, userId);
-        if (SecurityUtils.hasRole("ADMIN") || SecurityUtils.hasRole("SECURITY")) {
+        if (SecurityUtils.hasRole("ADMIN")) {
             List<VisitRequest> approved = new java.util.ArrayList<>(created.size());
             for (VisitRequest vr : created) {
                 approved.add(approvalService.approve(vr.getId(), userId, "본인 등록 자동승인"));
diff --git a/server/routes/business.ts b/server/routes/business.ts
index 7db72b5..d2e205d 100644
--- a/server/routes/business.ts
+++ b/server/routes/business.ts
@@ -273,7 +273,7 @@ async function retryPassDelivery(dbQuery: QueryFn, deliveryId: number) {
 }
 
 function canSelfApprove(user: UserRow): boolean {
-  return user.roles.includes('ADMIN') || user.roles.includes('SECURITY');
+  return user.roles.includes('ADMIN');
 }
 
 async function approveVisit(dbQuery: QueryFn, visitId: number, actor: UserRow, comment: string | null): Promise<VisitRow> {