fix: limit self approval to admins

2026-07-20 18:18:17 +09:00
parent 104d2f531a
commit e6bc4cf734
2 changed files with 4 additions and 4 deletions
--- a/server/routes/business.ts
+++ b/server/routes/business.ts
@@ -273,7 +273,7 @@ async function retryPassDelivery(dbQuery: QueryFn, deliveryId: number) {
 }

 function canSelfApprove(user: UserRow): boolean {
-  return user.roles.includes('ADMIN') || user.roles.includes('SECURITY');
+  return user.roles.includes('ADMIN');
 }

 async function approveVisit(dbQuery: QueryFn, visitId: number, actor: UserRow, comment: string | null): Promise<VisitRow> {