@@ -20,7 +20,7 @@ class ExternalPaymentWorkflow
|
||||
{
|
||||
private function actor(User $user, int $tenantId): void
|
||||
{
|
||||
abort_unless(auth()->id() === $user->id && $user->tenant_id === $tenantId && $user->purchasing_role === PurchasingRole::Finance, 403);
|
||||
abort_unless(auth()->id() === $user->id && $user->tenant_id === $tenantId && $user->hasFunctions([PurchasingRole::Finance]), 403);
|
||||
}
|
||||
|
||||
private function invalid(string $message): never
|
||||
@@ -127,7 +127,7 @@ class ExternalPaymentWorkflow
|
||||
}
|
||||
$this->bank($user, $invoice, $payment->supplier_bank_detail_id, $payment->amount_minor);
|
||||
$author = User::query()->where('tenant_id', $user->tenant_id)->lockForUpdate()->find($payment->created_by);
|
||||
if (! $author || $author->purchasing_role !== PurchasingRole::Finance) {
|
||||
if (! $author || ! $author->hasFunctions([PurchasingRole::Finance])) {
|
||||
$this->invalid('O autor do registo deixou de ser elegível.');
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user