Restrict booking list to non-agent roles

2026-01-29 09:50:19 +05:30
parent 22b996cdf2
commit 52f9b94031
1 changed files with 10 additions and 1 deletions
--- a/src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt
+++ b/src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt
@@ -136,7 +136,16 @@ class BookingFlow(
        @AuthenticationPrincipal principal: MyPrincipal?,
        @RequestParam(required = false) status: String?
    ): List<BookingListItem> {
-        requireMember(propertyAccess, propertyId, principal)
+        requireRole(
+            propertyAccess,
+            propertyId,
+            principal,
+            Role.ADMIN,
+            Role.MANAGER,
+            Role.STAFF,
+            Role.HOUSEKEEPING,
+            Role.FINANCE
+        )
        val statuses = parseStatuses(status)
        val bookings = if (statuses.isEmpty()) {
            bookingRepo.findByPropertyIdOrderByCreatedAtDesc(propertyId)