esdras/sistema-de-chamados
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix attachment previews and comment permissions

Browse source
This commit is contained in:
Esdras Renan 2025-10-06 23:41:03 -03:00
parent 1cccb852a5
commit e491becbc4
4 changed files with 62 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

28
convex/tickets.ts
View file

@ -723,6 +723,10 @@ export const updateComment = mutation({
throw new ConvexError("Ticket não encontrado")
}
const ticketDoc = ticket as Doc<"tickets">
const actor = (await ctx.db.get(actorId)) as Doc<"users"> | null
if (!actor || actor.tenantId !== ticketDoc.tenantId) {
throw new ConvexError("Autor do comentário inválido")
}
const comment = await ctx.db.get(commentId);
if (!comment || comment.ticketId !== ticketId) {
throw new ConvexError("Comentário não encontrado");
@ -730,8 +734,15 @@ export const updateComment = mutation({
if (comment.authorId !== actorId) {
throw new ConvexError("Você não tem permissão para editar este comentário");
}
const normalizedRole = (actor.role ?? "AGENT").toUpperCase()
if (ticketDoc.requesterId === actorId) {
await requireCustomer(ctx, actorId, ticketDoc.tenantId)
if (normalizedRole === "CUSTOMER") {
await requireCustomer(ctx, actorId, ticketDoc.tenantId)
} else if (STAFF_ROLES.has(normalizedRole)) {
await requireTicketStaff(ctx, actorId, ticketDoc)
} else {
throw new ConvexError("Autor não possui permissão para editar")
}
} else {
await requireTicketStaff(ctx, actorId, ticketDoc)
}
@ -742,7 +753,6 @@ export const updateComment = mutation({
updatedAt: now,
});
const actor = (await ctx.db.get(actorId)) as Doc<"users"> | null;
await ctx.db.insert("ticketEvents", {
ticketId,
type: "COMMENT_EDITED",
@ -772,6 +782,10 @@ export const removeCommentAttachment = mutation({
throw new ConvexError("Ticket não encontrado")
}
const ticketDoc = ticket as Doc<"tickets">
const actor = (await ctx.db.get(actorId)) as Doc<"users"> | null
if (!actor || actor.tenantId !== ticketDoc.tenantId) {
throw new ConvexError("Autor do comentário inválido")
}
const comment = await ctx.db.get(commentId);
if (!comment || comment.ticketId !== ticketId) {
throw new ConvexError("Comentário não encontrado");
@ -780,8 +794,15 @@ export const removeCommentAttachment = mutation({
throw new ConvexError("Você não pode alterar anexos de outro usuário")
}
const normalizedRole = (actor.role ?? "AGENT").toUpperCase()
if (ticketDoc.requesterId === actorId) {
await requireCustomer(ctx, actorId, ticketDoc.tenantId)
if (normalizedRole === "CUSTOMER") {
await requireCustomer(ctx, actorId, ticketDoc.tenantId)
} else if (STAFF_ROLES.has(normalizedRole)) {
await requireTicketStaff(ctx, actorId, ticketDoc)
} else {
throw new ConvexError("Autor não possui permissão para alterar anexos")
}
} else {
await requireTicketStaff(ctx, actorId, ticketDoc)
}
@ -800,7 +821,6 @@ export const removeCommentAttachment = mutation({
updatedAt: now,
});
const actor = (await ctx.db.get(actorId)) as Doc<"users"> | null;
await ctx.db.insert("ticketEvents", {
ticketId,
type: "ATTACHMENT_REMOVED",