Corrige autorizacao transaccional e valida modulos implementados

This commit is contained in:
2026-10-28 17:19:33 +02:00
parent 95dd2cc1ed
commit 5ff8d78803
30 changed files with 601 additions and 97 deletions
+9 -1
View File
@@ -66,6 +66,7 @@ class EquipmentWorkflow
{
return DB::transaction(function () use ($user, $requisition, $basis, $decision, $reason) {
app(ConflictGuard::class)->lockCompany($user);
$user = app(CurrentActor::class)->lock($user, [PurchasingRole::DepartmentHead]);
$requisition = Requisition::query()->lockForUpdate()->findOrFail($requisition->id);
abort_unless($this->canReview($user, $requisition), 403);
app(ConflictGuard::class)->assertParticipation($user, $requisition);
@@ -88,7 +89,14 @@ class EquipmentWorkflow
return;
}
$review = TechnicalReview::query()->where('requisition_id', $requisition->id)->where('basis_hash', $this->basis($requisition))->first();
$user = $review ? User::query()->where('tenant_id', $requisition->tenant_id)->find($review->reviewed_by) : null;
$user = null;
if ($review) {
$query = User::query()->where('tenant_id', $requisition->tenant_id);
if (DB::connection()->transactionLevel() > 0) {
$query->lockForUpdate();
}
$user = $query->find($review->reviewed_by);
}
if (! $review || $review->decision !== 'approved' || ! $user || ! $this->eligible($user, $requisition)) {
throw ValidationException::withMessages(['technical' => 'É necessária validação técnica válida do responsável da área, distinto do solicitante, para a versão actual.']);
}