berechtigungen

myteamwallet_backend/src/transactions/transactions.module.ts

@@ -6,19 +6,14 @@ import { TransactionsService } from './transactions.service';
 import { TransactionsController } from './transactions.controller';
 import { Player } from 'src/players/entities/player.entity';
 import { User } from 'src/users/entities/user.entity';
-import { TeamSetting } from 'src/team-settings/entities/team-setting.entity';
 import { LoggingModule } from 'src/database/logging/logging.module';
+import { TeamsModule } from 'src/teams/teams.module';
 
 @Module({
   imports: [
-    TypeOrmModule.forFeature([
-      TransactionType,
-      Transaction,
-      Player,
-      User,
-      TeamSetting,
-    ]),
+    TypeOrmModule.forFeature([TransactionType, Transaction, Player, User]),
     LoggingModule,
+    TeamsModule,
   ],
   providers: [TransactionsService],
   controllers: [TransactionsController],

myteamwallet_backend/src/transactions/transactions.service.ts

@@ -1,6 +1,5 @@
 import {
   BadRequestException,
-  ForbiddenException,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
@@ -8,6 +7,8 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { LoggingService } from 'src/database/logging/logging.service';
 import { Player } from 'src/players/entities/player.entity';
 import { RoleEnum } from 'src/roles/roles.enum';
+import { TeamRolesEnum } from 'src/team-roles/team-roles.enum';
+import { TeamAccessService } from 'src/teams/team-access.service';
 import { User } from 'src/users/entities/user.entity';
 import { Repository } from 'typeorm';
 import { CreateTransactionDto } from './dto/create-transaction.dto';
@@ -27,6 +28,7 @@ export class TransactionsService {
     @InjectRepository(User)
     private usersRepository: Repository<User>,
     private logger: LoggingService,
+    private access: TeamAccessService,
   ) {}
 
   async createTransactions(data: CreateTransactionDto[], userId: string) {
@@ -40,50 +42,35 @@ export class TransactionsService {
   async create(data: CreateTransactionDto, userId: string) {
     const player = await this.playersRepository.findOne({
       where: { id: data.playerId },
+      relations: ['team'],
     });
 
     const creatingUser = await this.usersRepository.findOne({
       where: {
         id: Number(userId),
       },
-      relations: ['players'],
     });
 
     const transactionType = await this.transactionTypesRepository.findOne({
       where: { id: TransactionTypeEnum[TransactionTypeEnum[data.type]] },
     });
 
+    if (!player || !transactionType || !creatingUser) {
+      await this.logger.warn({
+        event: 'transaction_create_fail',
+        details: `Player: ${data.playerId}, amount: ${data.amount}, typeEnum: ${data.type}`,
+        userId: Number(userId),
+      });
+      throw new NotFoundException('Spieler oder Buchungstyp nicht gefunden.');
+    }
+
     if (creatingUser.role.id != RoleEnum.admin) {
-      if (
-        !player ||
-        !transactionType ||
-        !creatingUser ||
-        !creatingUser.players ||
-        creatingUser.players.length == 0
-      ) {
-        await this.logger.warn({
-          event: 'transaction_create_fail',
-          details: `Player: ${data.playerId}, amount: ${data.amount}, typeEnum: ${data.type}`,
-          userId: Number(userId),
-        });
-
-        return;
-      }
-
-      const teamPlayer = creatingUser.players.find(
-        (p) =>
-          p.team.id == player.team.id &&
-          p.teamRole.id >=
-            Number(
-              player.team.settings.find(
-                (s) => s.key == 'transaction_create_min_role',
-              )['value'],
-            ),
+      await this.access.assertAtLeast(
+        Number(userId),
+        player.team.id,
+        'transaction_create_min_role',
+        TeamRolesEnum.scnd_treasurer,
       );
-
-      if (!teamPlayer) {
-        return;
-      }
     }
 
     const transaction = this.transactionsRepository.create({
@@ -131,26 +118,15 @@ export class TransactionsService {
 
     const creatingUser = await this.usersRepository.findOne({
       where: { id: Number(userId) },
-      relations: ['players'],
     });
 
     if (creatingUser.role.id != RoleEnum.admin) {
-      const teamPlayer = creatingUser.players?.find(
-        (p) =>
-          p.team.id == original.player.team.id &&
-          p.teamRole.id >=
-            Number(
-              original.player.team.settings.find(
-                (s) => s.key == 'transaction_create_min_role',
-              )?.['value'] ?? 0,
-            ),
+      await this.access.assertAtLeast(
+        Number(userId),
+        original.player.team.id,
+        'transaction_reverse_min_role',
+        TeamRolesEnum.scnd_treasurer,
       );
-
-      if (!teamPlayer) {
-        throw new ForbiddenException(
-          'Keine Berechtigung, diese Buchung zu stornieren',
-        );
-      }
     }
 
     const originalAmount = Math.abs(Number(original.amount));