apply security fix

apps/api/src/modules/complaints/complaint.routes.ts

@@ -1,7 +1,8 @@
 import { Router } from 'express'
 import { requireCompanyAuth } from '../../middleware/requireCompanyAuth'
 import { requireTenant } from '../../middleware/requireTenant'
-import { requireSubscription } from '../../middleware/requireSubscription'
+import { requireSubscriptionRead, requireSubscriptionWrite } from '../../middleware/requireSubscription'
+import { requireRole } from '../../middleware/requireRole'
 import { parseBody, parseQuery, parseParams } from '../../http/validate'
 import { ok, created } from '../../http/respond'
 import * as service from './complaint.service'
@@ -9,7 +10,7 @@ import { createSchema, updateSchema, listQuerySchema, idParamSchema } from './co
 
 const router = Router()
 
-router.use(requireCompanyAuth, requireTenant, requireSubscription)
+router.use(requireCompanyAuth, requireTenant, requireSubscriptionRead)
 
 router.get('/', async (req, res, next) => {
   try {
@@ -19,7 +20,7 @@ router.get('/', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.post('/', async (req, res, next) => {
+router.post('/', requireSubscriptionWrite, async (req, res, next) => {
   try {
     const body = parseBody(createSchema, req)
     const complaint = await service.createComplaint(req.companyId, body)
@@ -35,7 +36,7 @@ router.get('/:id', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.patch('/:id', async (req, res, next) => {
+router.patch('/:id', requireSubscriptionWrite, requireRole('MANAGER'), async (req, res, next) => {
   try {
     const { id } = parseParams(idParamSchema, req)
     const body = parseBody(updateSchema, req)
@@ -44,7 +45,7 @@ router.patch('/:id', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.delete('/:id', async (req, res, next) => {
+router.delete('/:id', requireSubscriptionWrite, requireRole('MANAGER'), async (req, res, next) => {
   try {
     const { id } = parseParams(idParamSchema, req)
     const result = await service.deleteComplaint(id, req.companyId)