Merge pull request #274 from AgenceBio/feature/changement_oc

feat: interdit la modification de statut de parcelle au autre OC
AgenceBio · Jan 10, 2025 · 3b355d9 · 3b355d9
2 parents 9139c25 + e57952f
commit 3b355d9
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/lib/errors.js b/lib/errors.js
@@ -9,6 +9,7 @@ const InvalidCredentialsApiError = createError('INVALID_CREDENTIALS', 'Accès re
 const InvalidRequestApiError = createError('INVALID_API_REQUEST', '%s', 400)
 const NotFoundApiError = createError('NOT_FOUND', '%s', 404)
 const UnauthorizedApiError = createError('UNAUTHORIZED', 'Accès refusé : %s', 401)
+const ForbiddenApiError = createError('FORBIDDEN', 'Accès refusé : %s', 403)
 const BadGatewayApiError = createError('BAD_GATEWAY', 'Erreur serveur : %s', 502)
 const PreconditionFailedApiError = createError('PRECONDITION_FAILED', 'La ressource a été modifiée depuis la dernière requête.', 412)
 
@@ -59,6 +60,7 @@ module.exports = {
   InvalidRequestApiError,
   NotFoundApiError,
   UnauthorizedApiError,
+  ForbiddenApiError,
   BadGatewayApiError,
   PreconditionFailedApiError,
   isHandledError,

diff --git a/lib/providers/cartobio.js b/lib/providers/cartobio.js
@@ -19,7 +19,7 @@ const { randomUUID } = require('crypto')
 const { fromCodePacStrict } = require('@agencebio/rosetta-cultures')
 const { fromCepageCode } = require('@agencebio/rosetta-cultures/cepages')
 const { createNewEvent } = require('../outputs/history.js')
-const { InvalidRequestApiError, BadGatewayApiError, NotFoundApiError } = require('../errors.js')
+const { InvalidRequestApiError, BadGatewayApiError, NotFoundApiError, ForbiddenApiError } = require('../errors.js')
 const { getRandomFeatureId, populateWithMultipleCultures } = require('../outputs/features.js')
 const Cursor = require('pg-cursor')
 const bboxPolygon = require('@turf/bbox-polygon').default
@@ -1236,6 +1236,10 @@ async function updateAuditRecordState ({ user, record }, patch) {
   })
 
   if (state) {
+    // @ts-ignore
+    if (user.organismeCertificateur && record.oc_id !== user.organismeCertificateur.id) {
+      throw new ForbiddenApiError("vous n'êtes pas autorisé·e à modifier le statut de ce parcellaire.")
+    }
     columns.push('audit_history')
     placeholders.push(`audit_history || $${columns.length + 1}::jsonb`)
     values.push(createNewEvent(