melabidi/carmanagement
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

apply security fix
Build & Push / Build & Push Docker Image (push) Failing after 3m46s
Details

Browse Source
This commit is contained in:
root
2026-07-19 22:22:33 -04:00
parent ec03e783e5
commit a010ad6811
41 changed files with 626 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/modules/subscriptions/subscription.routes.ts
+9 -8
View File
@@ -1,6 +1,7 @@
import { Router } from 'express'
import { requireCompanyAuth } from '../../middleware/requireCompanyAuth'
import { requireTenant } from '../../middleware/requireTenant'
import { requireSubscriptionRead, requireSubscriptionFull } from '../../middleware/requireSubscription'
import { requireRole } from '../../middleware/requireRole'
import { parseBody } from '../../http/validate'
import { ok } from '../../http/respond'
@@ -63,7 +64,7 @@ webhookRouter.post('/webhooks/paypal', async (req, res, next) => {
// ─── PayPal capture (auth but no subscription check) ──────────
router.post('/capture-paypal', requireCompanyAuth, requireTenant, async (req, res, next) => {
router.post('/capture-paypal', requireCompanyAuth, requireTenant, requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try {
const { paypalOrderId } = parseBody(capturePaypalSchema, req)
ok(res, await service.capturePaypal(req.companyId, paypalOrderId))
@@ -72,7 +73,7 @@ router.post('/capture-paypal', requireCompanyAuth, requireTenant, async (req, re
// ─── Authenticated ─────────────────────────────────────────────
router.use(requireCompanyAuth, requireTenant)
router.use(requireCompanyAuth, requireTenant, requireSubscriptionRead)
router.get('/me', async (req, res, next) => {
try { ok(res, await service.getSubscription(req.companyId)) } catch (err) { next(err) }
@@ -90,42 +91,42 @@ router.get('/entitlement', async (req, res, next) => {
try { ok(res, await service.getEntitlement(req.companyId)) } catch (err) { next(err) }
})
router.post('/trial', requireRole('OWNER'), async (req, res, next) => {
router.post('/trial', requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try {
const body = parseBody(startTrialSchema, req)
ok(res, await service.startTrial(req.companyId, body.plan, body.billingPeriod, body.currency))
} catch (err) { next(err) }
})
router.post('/checkout', requireRole('OWNER'), async (req, res, next) => {
router.post('/checkout', requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try {
const body = parseBody(checkoutSchema, req)
ok(res, await service.checkout(req.companyId, body))
} catch (err) { next(err) }
})
router.post('/reactivate', requireRole('OWNER'), async (req, res, next) => {
router.post('/reactivate', requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try {
const body = parseBody(reactivateSchema, req)
ok(res, await service.reactivate(req.companyId, body))
} catch (err) { next(err) }
})
router.post('/change-plan', requireRole('OWNER'), async (req, res, next) => {
router.post('/change-plan', requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try {
const body = parseBody(changePlanSchema, req)
ok(res, await service.changePlan(req.companyId, body))
} catch (err) { next(err) }
})
router.post('/cancel', requireRole('OWNER'), async (req, res, next) => {
router.post('/cancel', requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try {
const { mode, reason } = parseBody(cancelSchema, req)
ok(res, await service.cancel(req.companyId, mode, reason))
} catch (err) { next(err) }
})
router.post('/resume', requireRole('OWNER'), async (req, res, next) => {
router.post('/resume', requireSubscriptionFull, requireRole('OWNER'), async (req, res, next) => {
try { ok(res, await service.resume(req.companyId)) } catch (err) { next(err) }
})