commit5

2026-10-30 10:55:18 +02:00
parent 0235c7609e
commit 48347e2d3a
161 changed files with 11814 additions and 265 deletions
@@ -20,6 +20,7 @@ class RequisitionWorkflow
        return DB::transaction(function () use ($user, $data, $existing) {
            app(ConflictGuard::class)->lockCompany($user);
            $user = app(CurrentActor::class)->lock($user);
+            abort_unless(app(OrganizationAccess::class)->canRequest($user), 403);
            if (! $user->department_id || ! CostCenter::query()->whereKey($data['cost_center_id'])->where('department_id', $user->department_id)->exists()) {
                throw ValidationException::withMessages(['cost_center_id' => 'O departamento ou centro de custo mudou. Actualize o pedido antes de guardar.']);
            }
@@ -76,6 +77,7 @@ class RequisitionWorkflow
        DB::transaction(function () use ($user, $requisition) {
            app(ConflictGuard::class)->lockCompany($user);
            $user = app(CurrentActor::class)->lock($user);
+            abort_unless(app(OrganizationAccess::class)->canRequest($user), 403);
            $requisition = Requisition::query()->lockForUpdate()->findOrFail($requisition->id);
            abort_unless($requisition->requester_id === $user->id && $requisition->status === 'draft', 403);
            if ($user->department_id !== $requisition->department_id) {