Restrict assignments to staff

This commit is contained in:
2026-04-05 16:03:29 -06:00
parent 890391f982
commit 153ec836cf
6 changed files with 18 additions and 31 deletions

View File

@@ -201,7 +201,7 @@ public class DropdownController {
return false;
}
return userRepository.findById(userId)
.filter(user -> user.getRole() == User.Role.STAFF || user.getRole() == User.Role.ADMIN)
.filter(user -> user.getRole() == User.Role.STAFF)
.filter(user -> Boolean.TRUE.equals(user.getActive()))
.isPresent();
}

View File

@@ -173,7 +173,7 @@ public class AdoptionService {
return false;
}
return userRepository.findById(userId)
.filter(user -> user.getRole() == User.Role.STAFF || user.getRole() == User.Role.ADMIN)
.filter(user -> user.getRole() == User.Role.STAFF)
.filter(user -> Boolean.TRUE.equals(user.getActive()))
.isPresent();
}

View File

@@ -337,7 +337,7 @@ public class AppointmentService {
return false;
}
return userRepository.findById(userId)
.filter(user -> user.getRole() == User.Role.STAFF || user.getRole() == User.Role.ADMIN)
.filter(user -> user.getRole() == User.Role.STAFF)
.filter(user -> Boolean.TRUE.equals(user.getActive()))
.isPresent();
}

View File

@@ -86,7 +86,7 @@ class DropdownControllerTest {
}
@Test
void getStoreEmployeesReturnsBothStaffAndAdminLinkedEmployees() {
void getStoreEmployeesReturnsOnlyStaffLinkedEmployees() {
StoreLocation store = new StoreLocation();
store.setStoreId(1L);
@@ -121,9 +121,8 @@ class DropdownControllerTest {
var response = controller.getStoreEmployees(1L);
assertEquals(2, response.getBody().size());
assertEquals(1, response.getBody().size());
assertEquals(Long.valueOf(7L), response.getBody().get(0).getId());
assertEquals(Long.valueOf(8L), response.getBody().get(1).getId());
}
@Test

View File

@@ -87,11 +87,11 @@ class AdoptionServiceTest {
}
@Test
void createAdoptionAutoAssignsFirstAssignableEmployee() {
void createAdoptionAutoAssignsFirstStaffEmployee() {
when(petRepository.findById(1L)).thenReturn(Optional.of(pet));
when(customerRepository.findById(1L)).thenReturn(Optional.of(customer));
// resolveAdoptionEmployee uses the first one from the list returned by repo
when(employeeRepository.findAllByIsActiveTrueOrderByEmployeeIdAsc()).thenReturn(List.of(staffEmployee, adminEmployee));
// resolveAdoptionEmployee filters for staff
when(employeeRepository.findAllByIsActiveTrueOrderByEmployeeIdAsc()).thenReturn(List.of(adminEmployee, staffEmployee));
when(adoptionRepository.save(any(Adoption.class))).thenAnswer(invocation -> {
Adoption adoption = invocation.getArgument(0);
adoption.setAdoptionId(10L);
@@ -111,15 +111,10 @@ class AdoptionServiceTest {
}
@Test
void createAdoptionAllowsAdminEmployeeSelection() {
void createAdoptionRejectsAdminEmployeeSelection() {
when(petRepository.findById(1L)).thenReturn(Optional.of(pet));
when(customerRepository.findById(1L)).thenReturn(Optional.of(customer));
when(employeeRepository.findById(8L)).thenReturn(Optional.of(adminEmployee));
when(adoptionRepository.save(any(Adoption.class))).thenAnswer(invocation -> {
Adoption adoption = invocation.getArgument(0);
adoption.setAdoptionId(10L);
return adoption;
});
AdoptionRequest request = new AdoptionRequest();
request.setPetId(1L);
@@ -128,9 +123,7 @@ class AdoptionServiceTest {
request.setAdoptionDate(LocalDate.now());
request.setAdoptionStatus("Pending");
var response = adoptionService.createAdoption(request);
assertEquals(8L, response.getEmployeeId());
assertThrows(IllegalArgumentException.class, () -> adoptionService.createAdoption(request));
}
@Test

View File

@@ -264,10 +264,13 @@ class AppointmentServiceTest {
}
@Test
void createAppointmentAllowsAdminEmployeeSelection() {
setAuthentication(7L, User.Role.STAFF);
when(employeeRepository.findByUserId(7L)).thenReturn(Optional.of(employee));
when(employeeStoreRepository.findByEmployeeEmployeeId(7L)).thenReturn(Optional.of(new EmployeeStore(employee, store)));
void createAppointmentRejectsAdminEmployeeSelection() {
setAuthentication(99L, User.Role.ADMIN);
User adminUser = new User();
adminUser.setId(99L);
adminUser.setRole(User.Role.ADMIN);
adminUser.setActive(true);
when(userRepository.findById(99L)).thenReturn(Optional.of(adminUser));
Employee adminEmployee = new Employee();
adminEmployee.setEmployeeId(8L);
@@ -290,11 +293,6 @@ class AppointmentServiceTest {
when(customerPetRepository.findById(11L)).thenReturn(Optional.of(customerPet));
when(employeeStoreRepository.findActiveByStoreStoreIdOrderByEmployeeEmployeeIdAsc(1L))
.thenReturn(List.of(new EmployeeStore(adminEmployee, store), new EmployeeStore(employee, store)));
when(appointmentRepository.save(any(Appointment.class))).thenAnswer(invocation -> {
Appointment appointment = invocation.getArgument(0);
appointment.setAppointmentId(102L);
return appointment;
});
var request = new com.petshop.backend.dto.appointment.AppointmentRequest();
request.setCustomerId(1L);
@@ -306,10 +304,7 @@ class AppointmentServiceTest {
request.setAppointmentStatus("Booked");
request.setCustomerPetIds(List.of(11L));
var response = appointmentService.createAppointment(request);
assertEquals(102L, response.getAppointmentId());
assertEquals(8L, response.getEmployeeId());
assertThrows(IllegalArgumentException.class, () -> appointmentService.createAppointment(request));
}
@Test