MythEclipse/imphnen-backend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(dimentorin): session mentor can confirm their payments (not just admins)

Browse Source 
- mentor can confirm payments of sessions they own (see transfer arrive)
- admin/Admin Pembayaran still allowed; others forbidden
- e2e verified: mentor confirm QRIS payment -> paid + session confirmed
This commit is contained in:
asepharyana
2026-08-05 15:56:35 +07:00
parent 495e043088
commit 9af1c2d163
1 changed files with 27 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
imphnen-dimentorin/src/payments/application/payment_service.rs
+27 -20
View File
@@ -152,32 +152,39 @@ impl PaymentService for PaymentServiceImpl {
id: Uuid,
actor_id: Uuid,
) -> Result<PaymentEntity, AppError> {
// Admin / "Admin Pembayaran" only — check role via users table.
let user = UsersEntity::find_by_id(actor_id)
.one(self.db.as_ref())
.await
.map_err(|e| AppError::InternalServerError(e.to_string()))?
.ok_or_else(|| AppError::NotFoundError("Actor not found".into()))?;
let role_id = user.role_id.ok_or_else(|| {
AppError::ForbiddenError("User has no role assigned".into())
})?;
let roles = imphnen_entities::seaorm::auth::roles::Entity::find_by_id(role_id)
.one(self.db.as_ref())
.await
.map_err(|e| AppError::InternalServerError(e.to_string()))?
.ok_or_else(|| AppError::ForbiddenError("Role not found".into()))?;
if roles.name != "Admin" && roles.name != "Admin Pembayaran" {
return Err(AppError::ForbiddenError(
"Only payment admin can confirm payments".into(),
));
}
// Payment can be confirmed by the session's mentor (they see the
// transfer arrive) or by an Admin / "Admin Pembayaran".
let payment = self.payment_repo.find_by_id(id).await?;
if payment.status != "pending" {
return Err(AppError::ConflictError(
"Payment is not pending".into(),
));
}
let user = UsersEntity::find_by_id(actor_id)
.one(self.db.as_ref())
.await
.map_err(|e| AppError::InternalServerError(e.to_string()))?
.ok_or_else(|| AppError::NotFoundError("Actor not found".into()))?;
// Mentor of the linked session may confirm; otherwise an
// Admin / "Admin Pembayaran" role is required.
let is_mentor = payment.mentor_id == actor_id;
if !is_mentor {
let role_id = user.role_id.ok_or_else(|| {
AppError::ForbiddenError("User has no role assigned".into())
})?;
let roles =
imphnen_entities::seaorm::auth::roles::Entity::find_by_id(role_id)
.one(self.db.as_ref())
.await
.map_err(|e| AppError::InternalServerError(e.to_string()))?
.ok_or_else(|| AppError::ForbiddenError("Role not found".into()))?;
if roles.name != "Admin" && roles.name != "Admin Pembayaran" {
return Err(AppError::ForbiddenError(
"Only the session mentor or a payment admin can confirm payments".into(),
));
}
}
let paid = self.payment_repo
.update_status(id, "paid", Some(payment.external_ref.clone().unwrap_or_default()))
.await?;