Validate field region/zone directors have the appropriate role

Author: CarsonF

src/components/field-region/field-region.service.ts

@@ -1,13 +1,16 @@
 import { Injectable } from '@nestjs/common';
 import {
   type ID,
+  InputException,
+  NotFoundException,
   type ObjectView,
   ServerException,
   type UnsecuredDto,
 } from '~/common';
 import { HandleIdLookup } from '~/core';
 import { IEventBus } from '~/core/events';
 import { Privileges } from '../authorization';
+import { UserService } from '../user';
 import {
   type CreateFieldRegion,
   FieldRegion,
@@ -23,11 +26,13 @@ export class FieldRegionService {
   constructor(
     private readonly privileges: Privileges,
     private readonly events: IEventBus,
+    private readonly users: UserService,
     private readonly repo: FieldRegionRepository,
   ) {}
 
   async create(input: CreateFieldRegion): Promise<FieldRegion> {
     this.privileges.for(FieldRegion).verifyCan('create');
+    await this.validateDirectorRole(input.directorId);
     const dto = await this.repo.create(input);
     return this.secure(dto);
   }
@@ -53,6 +58,10 @@ export class FieldRegionService {
     const changes = this.repo.getActualChanges(fieldRegion, input);
     this.privileges.for(FieldRegion, fieldRegion).verifyChanges(changes);
 
+    if (changes.directorId) {
+      await this.validateDirectorRole(changes.directorId);
+    }
+
     if (Object.keys(changes).length === 0) {
       return this.secure(fieldRegion);
     }
@@ -68,6 +77,25 @@ export class FieldRegionService {
     return this.secure(updated);
   }
 
+  private async validateDirectorRole(directorId: ID<'User'>) {
+    let director;
+    try {
+      director = await this.users.readOneUnsecured(directorId);
+    } catch (e) {
+      if (e instanceof NotFoundException) {
+        throw e.withField('fieldRegion.directorId');
+      }
+      throw e;
+    }
+    if (!director.roles.includes('RegionalDirector')) {
+      throw new InputException(
+        'User does not have the Regional Director role',
+        'fieldRegion.directorId',
+      );
+    }
+    return director;
+  }
+
   async delete(id: ID): Promise<void> {
     const object = await this.readOne(id);
 

src/components/field-zone/field-zone.service.ts

@@ -1,13 +1,16 @@
 import { Injectable } from '@nestjs/common';
 import {
   type ID,
+  InputException,
+  NotFoundException,
   type ObjectView,
   ServerException,
   type UnsecuredDto,
 } from '~/common';
 import { HandleIdLookup } from '~/core';
 import { IEventBus } from '~/core/events';
 import { Privileges } from '../authorization';
+import { UserService } from '../user';
 import {
   type CreateFieldZone,
   FieldZone,
@@ -23,11 +26,13 @@ export class FieldZoneService {
   constructor(
     private readonly privileges: Privileges,
     private readonly events: IEventBus,
+    private readonly users: UserService,
     private readonly repo: FieldZoneRepository,
   ) {}
 
   async create(input: CreateFieldZone): Promise<FieldZone> {
     this.privileges.for(FieldZone).verifyCan('create');
+    await this.validateDirectorRole(input.directorId);
     const dto = await this.repo.create(input);
     return this.secure(dto);
   }
@@ -53,6 +58,10 @@ export class FieldZoneService {
     const changes = this.repo.getActualChanges(fieldZone, input);
     this.privileges.for(FieldZone, fieldZone).verifyChanges(changes);
 
+    if (changes.directorId) {
+      await this.validateDirectorRole(changes.directorId);
+    }
+
     if (Object.keys(changes).length === 0) {
       return this.secure(fieldZone);
     }
@@ -68,6 +77,25 @@ export class FieldZoneService {
     return this.secure(updated);
   }
 
+  private async validateDirectorRole(directorId: ID<'User'>) {
+    let director;
+    try {
+      director = await this.users.readOneUnsecured(directorId);
+    } catch (e) {
+      if (e instanceof NotFoundException) {
+        throw e.withField('fieldZone.directorId');
+      }
+      throw e;
+    }
+    if (!director.roles.includes('FieldOperationsDirector')) {
+      throw new InputException(
+        'User does not have the Field Operations Director role',
+        'fieldZone.directorId',
+      );
+    }
+    return director;
+  }
+
   async delete(id: ID): Promise<void> {
     const object = await this.readOne(id);