hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): make commission_percent & active admin-only on PATCH representation

Browse Source 
A representation editing its own record could raise its own commission or
self-activate (privilege escalation). Restrict both fields to ROLE_ADMIN and
range-check commission (0–100). Owner can still edit name/city/bank.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
hamed
2026-06-28 17:36:48 +03:30
co-authored by Claude Opus 4.8
parent e456809b55
commit 6bd49c2d3e
3 changed files with 112 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api/representation.md
+4
View File
@@ -121,6 +121,8 @@ Update representation.
All fields optional.
**Privileged fields:** `commission_percent` and `active` are **admin-only** — a representation editing its own record may change `full_name`, `city_id`, `bank_account` but **not** these two. `commission_percent` must be within `0–100`.
### Response `200`
Updated representation object.
@@ -129,6 +131,8 @@ Updated representation object.
|------|------|-------------|
| `ERR_AUTH_001` | 401 | Missing token |
| `ERR_FORBIDDEN_001` | 403 | Not owner or admin |
| `ERR_AUTH_006` | 403 | Non-admin tried to change `commission_percent` or `active` |
| `ERR_VALIDATION_001` | 422 | `commission_percent` خارج از بازه ۰ تا ۱۰۰ (`field: commission_percent`) |
| `ERR_NOT_FOUND_001` | 404 | Representation not found |
---