melabidi/carmanagement
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

apply security fix
Build & Push / Build & Push Docker Image (push) Failing after 3m46s
Details

Browse Source
This commit is contained in:
root
2026-07-19 22:22:33 -04:00
parent ec03e783e5
commit a010ad6811
41 changed files with 626 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/modules/companies/company.routes.ts
+22 -22
View File
@@ -1,7 +1,7 @@
import { Router } from 'express'
import { requireCompanyAuth } from '../../middleware/requireCompanyAuth'
import { requireTenant } from '../../middleware/requireTenant'
import { requireSubscription } from '../../middleware/requireSubscription'
import { requireSubscriptionRead, requireSubscriptionWrite } from '../../middleware/requireSubscription'
import { requireRole } from '../../middleware/requireRole'
import { requireCompanyPolicy } from '../../middleware/requireCompanyPolicy'
import { parseBody, parseParams } from '../../http/validate'
@@ -22,7 +22,7 @@ import {
const router = Router()
router.use(requireCompanyAuth, requireTenant, requireSubscription)
router.use(requireCompanyAuth, requireTenant, requireSubscriptionRead)
router.get('/me', async (req, res, next) => {
try {
@@ -31,7 +31,7 @@ router.get('/me', async (req, res, next) => {
} catch (err) { next(err) }
})
router.patch('/me', requireRole('OWNER'), async (req, res, next) => {
router.patch('/me', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const body = parseBody(companySchema, req)
const company = await service.updateCompany(req.companyId, body)
@@ -46,7 +46,7 @@ router.get('/me/brand', async (req, res, next) => {
} catch (err) { next(err) }
})
router.patch('/me/brand', requireRole('OWNER'), requireSettingsFeature('settings.branding_basic'), async (req, res, next) => {
router.patch('/me/brand', requireSubscriptionWrite, requireRole('OWNER'), requireSettingsFeature('settings.branding_basic'), async (req, res, next) => {
try {
const body = parseBody(brandSchema, req)
const brand = await service.updateBrand(req.companyId, body, req.company.name, req.company.slug)
@@ -54,7 +54,7 @@ router.patch('/me/brand', requireRole('OWNER'), requireSettingsFeature('settings
} catch (err) { next(err) }
})
router.post('/me/brand/logo', requireRole('OWNER'), requireSettingsFeature('settings.branding_basic'), imageUpload.single('file'), async (req, res, next) => {
router.post('/me/brand/logo', requireSubscriptionWrite, requireRole('OWNER'), requireSettingsFeature('settings.branding_basic'), imageUpload.single('file'), async (req, res, next) => {
try {
assertImageFile(req.file, 'logo')
const brand = await service.uploadLogo(req.companyId, req.company.name, req.company.slug, req.file.buffer)
@@ -62,7 +62,7 @@ router.post('/me/brand/logo', requireRole('OWNER'), requireSettingsFeature('sett
} catch (err) { next(err) }
})
router.post('/me/brand/hero', requireRole('OWNER'), requireSettingsFeature('settings.branding_hero'), imageUpload.single('file'), async (req, res, next) => {
router.post('/me/brand/hero', requireSubscriptionWrite, requireRole('OWNER'), requireSettingsFeature('settings.branding_hero'), imageUpload.single('file'), async (req, res, next) => {
try {
assertImageFile(req.file, 'hero image')
const brand = await service.uploadHeroImage(req.companyId, req.company.name, req.company.slug, req.file.buffer)
@@ -82,7 +82,7 @@ router.get('/me/settings-entitlements', async (req, res, next) => {
} catch (err) { next(err) }
})
router.post('/me/brand/subdomain/check', requireRole('OWNER'), async (req, res, next) => {
router.post('/me/brand/subdomain/check', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const { subdomain } = parseBody(subdomainSchema, req)
const result = await service.checkSubdomainAvailability(subdomain, req.companyId)
@@ -90,7 +90,7 @@ router.post('/me/brand/subdomain/check', requireRole('OWNER'), async (req, res,
} catch (err) { next(err) }
})
router.post('/me/brand/custom-domain', requireRole('OWNER'), async (req, res, next) => {
router.post('/me/brand/custom-domain', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const { customDomain } = parseBody(customDomainSchema, req)
const brand = await service.setCustomDomain(req.companyId, req.company.name, req.company.slug, customDomain)
@@ -105,21 +105,21 @@ router.get('/me/brand/custom-domain/status', async (req, res, next) => {
} catch (err) { next(err) }
})
router.delete('/me/brand/custom-domain', requireRole('OWNER'), async (req, res, next) => {
router.delete('/me/brand/custom-domain', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const result = await service.removeCustomDomain(req.companyId)
ok(res, result)
} catch (err) { next(err) }
})
router.get('/me/contract-settings', async (req, res, next) => {
router.get('/me/contract-settings', requireRole('MANAGER'), async (req, res, next) => {
try {
const settings = await service.getContractSettings(req.companyId)
ok(res, settings)
} catch (err) { next(err) }
})
router.patch('/me/contract-settings', requireRole('MANAGER'), requireSettingsFeature('settings.rental_policies_basic'), async (req, res, next) => {
router.patch('/me/contract-settings', requireSubscriptionWrite, requireRole('MANAGER'), requireSettingsFeature('settings.rental_policies_basic'), async (req, res, next) => {
try {
const body = parseBody(contractSettingsSchema, req)
const settings = await service.updateContractSettings(req.companyId, body)
@@ -127,14 +127,14 @@ router.patch('/me/contract-settings', requireRole('MANAGER'), requireSettingsFea
} catch (err) { next(err) }
})
router.get('/me/insurance-policies', async (req, res, next) => {
router.get('/me/insurance-policies', requireRole('MANAGER'), async (req, res, next) => {
try {
const policies = await service.getInsurancePolicies(req.companyId)
ok(res, policies)
} catch (err) { next(err) }
})
router.post('/me/insurance-policies', requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
router.post('/me/insurance-policies', requireSubscriptionWrite, requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
try {
const body = parseBody(insurancePolicySchema, req)
const policy = await service.createInsurancePolicy(req.companyId, body)
@@ -142,7 +142,7 @@ router.post('/me/insurance-policies', requireRole('MANAGER'), requireSettingsFea
} catch (err) { next(err) }
})
router.patch('/me/insurance-policies/:id', requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
router.patch('/me/insurance-policies/:id', requireSubscriptionWrite, requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
const body = parseBody(insurancePolicySchema.partial(), req)
@@ -151,7 +151,7 @@ router.patch('/me/insurance-policies/:id', requireRole('MANAGER'), requireSettin
} catch (err) { next(err) }
})
router.delete('/me/insurance-policies/:id', requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
router.delete('/me/insurance-policies/:id', requireSubscriptionWrite, requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
await service.deleteInsurancePolicy(id, req.companyId)
@@ -159,14 +159,14 @@ router.delete('/me/insurance-policies/:id', requireRole('MANAGER'), requireSetti
} catch (err) { next(err) }
})
router.get('/me/pricing-rules', async (req, res, next) => {
router.get('/me/pricing-rules', requireRole('MANAGER'), async (req, res, next) => {
try {
const rules = await service.getPricingRules(req.companyId)
ok(res, rules)
} catch (err) { next(err) }
})
router.post('/me/pricing-rules', requireRole('MANAGER'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
router.post('/me/pricing-rules', requireSubscriptionWrite, requireRole('MANAGER'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
try {
const body = parseBody(pricingRuleSchema, req)
const rule = await service.createPricingRule(req.companyId, body)
@@ -174,7 +174,7 @@ router.post('/me/pricing-rules', requireRole('MANAGER'), requireSettingsFeature(
} catch (err) { next(err) }
})
router.patch('/me/pricing-rules/:id', requireRole('MANAGER'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
router.patch('/me/pricing-rules/:id', requireSubscriptionWrite, requireRole('MANAGER'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
const body = parseBody(pricingRuleSchema.partial(), req)
@@ -183,7 +183,7 @@ router.patch('/me/pricing-rules/:id', requireRole('MANAGER'), requireSettingsFea
} catch (err) { next(err) }
})
router.delete('/me/pricing-rules/:id', requireCompanyPolicy('deletePricingRule'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
router.delete('/me/pricing-rules/:id', requireSubscriptionWrite, requireCompanyPolicy('deletePricingRule'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
await service.deletePricingRule(id, req.companyId)
@@ -191,14 +191,14 @@ router.delete('/me/pricing-rules/:id', requireCompanyPolicy('deletePricingRule')
} catch (err) { next(err) }
})
router.get('/me/accounting-settings', async (req, res, next) => {
router.get('/me/accounting-settings', requireRole('MANAGER'), async (req, res, next) => {
try {
const settings = await service.getAccountingSettings(req.companyId)
ok(res, settings)
} catch (err) { next(err) }
})
router.patch('/me/accounting-settings', requireCompanyPolicy('updateAccountingSettings'), requireSettingsFeature('settings.accounting_defaults'), async (req, res, next) => {
router.patch('/me/accounting-settings', requireSubscriptionWrite, requireCompanyPolicy('updateAccountingSettings'), requireSettingsFeature('settings.accounting_defaults'), async (req, res, next) => {
try {
const body = parseBody(accountingSettingsSchema, req)
const settings = await service.updateAccountingSettings(req.companyId, body)
@@ -213,7 +213,7 @@ router.get('/me/api-key', requireCompanyPolicy('viewApiKey'), async (req, res, n
} catch (err) { next(err) }
})
router.post('/me/api-key/regenerate', requireCompanyPolicy('regenerateApiKey'), async (req, res, next) => {
router.post('/me/api-key/regenerate', requireSubscriptionWrite, requireCompanyPolicy('regenerateApiKey'), async (req, res, next) => {
try {
const company = await service.regenerateApiKey(req.companyId)
ok(res, company)