openclaw/helpyourneighbour
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: implement RBAC for dispute endpoints
Some checks are pending
Docker Test / test (push) Waiting to run
Details

Browse source
This commit is contained in:
J.A.R.V.I.S. 2026-03-20 08:07:25 +00:00
parent 30a94a7ddd
commit 83185aea1a
3 changed files with 17 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

13
backend/src/routes/disputes.js
View file

@ -1,12 +1,13 @@
import express from 'express';
import { DisputeService } from '../disputes/dispute-service.js';
import { DB } from '../db/index.js';
import { requireRole } from '../middleware/requireRole.js';
const router = express.Router();
const disputeService = new DisputeService(new DB());
// Create a new dispute
router.post('/', async (req, res) => {
// Create a new dispute - accessible to 'user' role
router.post('/', requireRole(['user']), async (req, res) => {
try {
const { deal_id, opened_by_user_id, reason_code, summary, requested_outcome } = req.body;
@ -42,8 +43,8 @@ router.get('/:id', async (req, res) => {
}
});
// Update dispute status
router.post('/:id/status', async (req, res) => {
// Update dispute status - accessible to 'moderator' and 'admin' roles
router.post('/:id/status', requireRole(['moderator', 'admin']), async (req, res) => {
try {
const { id } = req.params;
const { status, updated_by_user_id } = req.body;
@ -72,8 +73,8 @@ router.post('/:id/evidence', async (req, res) => {
}
});
// Resolve a dispute
router.post('/:id/resolve', async (req, res) => {
// Resolve a dispute - accessible to 'admin' role only
router.post('/:id/resolve', requireRole(['admin']), async (req, res) => {
try {
const { id } = req.params;
const { resolved_by_user_id, decision, reason } = req.body;