playground/acs
121
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: limit self approval to admins

Browse Source
This commit is contained in:
unknown
2026-07-20 18:18:17 +09:00
parent 104d2f531a
commit e6bc4cf734
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/main/java/com/itcenter/acs/controller/VisitRequestController.java
View File

@@ -37,15 +37,15 @@ public class VisitRequestController {
/** /**
* Create pre-registration(s); current user becomes the host. One request is issued per * Create pre-registration(s); current user becomes the host. One request is issued per
* selected server room, so the response may contain more than one (e.g. 4층+5층전산실 → 2건). * selected server room, so the response may contain more than one (e.g. 4층+5층전산실 → 2건).
* When the registrant already holds approval authority (ADMIN/SECURITY), each request is * When the registrant is ADMIN, each request is self-approved immediately
* self-approved immediately (QR issued) — HOST registrations stay PENDING. * (QR issued) — SECURITY/HOST registrations stay PENDING.
*/ */
@PostMapping @PostMapping
public ResponseEntity<ApiResponse<List<VisitRequestResponse>>> create( public ResponseEntity<ApiResponse<List<VisitRequestResponse>>> create(
@Valid @RequestBody VisitRequestCreateRequest request) { @Valid @RequestBody VisitRequestCreateRequest request) {
Long userId = SecurityUtils.currentUserId(); Long userId = SecurityUtils.currentUserId();
List<VisitRequest> created = visitRequestService.createRequests(request, userId); List<VisitRequest> created = visitRequestService.createRequests(request, userId);
if (SecurityUtils.hasRole("ADMIN") || SecurityUtils.hasRole("SECURITY")) { if (SecurityUtils.hasRole("ADMIN")) {
List<VisitRequest> approved = new java.util.ArrayList<>(created.size()); List<VisitRequest> approved = new java.util.ArrayList<>(created.size());
for (VisitRequest vr : created) { for (VisitRequest vr : created) {
approved.add(approvalService.approve(vr.getId(), userId, "본인 등록 자동승인")); approved.add(approvalService.approve(vr.getId(), userId, "본인 등록 자동승인"));

2
server/routes/business.ts
View File

@@ -273,7 +273,7 @@ async function retryPassDelivery(dbQuery: QueryFn, deliveryId: number) {
} }
function canSelfApprove(user: UserRow): boolean { function canSelfApprove(user: UserRow): boolean {
return user.roles.includes('ADMIN') || user.roles.includes('SECURITY'); return user.roles.includes('ADMIN');
} }
async function approveVisit(dbQuery: QueryFn, visitId: number, actor: UserRow, comment: string | null): Promise<VisitRow> { async function approveVisit(dbQuery: QueryFn, visitId: number, actor: UserRow, comment: string | null): Promise<VisitRow> {