From b5666e43799c497f608304e6451e3ae74056474e Mon Sep 17 00:00:00 2001
From: Vzart <vo.dang.khoa.main@gmail.com>
Date: Wed, 12 Jul 2023 13:29:51 +0700
Subject: [PATCH 1/2] fix: admin can see borrow request by id

---
 .../Borrows/Queries/GetBorrowRequestById.cs   | 32 +++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/src/Application/Borrows/Queries/GetBorrowRequestById.cs b/src/Application/Borrows/Queries/GetBorrowRequestById.cs
index 64486fc5..d747f7c4 100644
--- a/src/Application/Borrows/Queries/GetBorrowRequestById.cs
+++ b/src/Application/Borrows/Queries/GetBorrowRequestById.cs
@@ -1,4 +1,5 @@
 using Application.Common.Exceptions;
+using Application.Common.Extensions;
 using Application.Common.Interfaces;
 using Application.Common.Models.Dtos;
 using Application.Common.Models.Dtos.Physical;
@@ -34,6 +35,10 @@ public async Task<BorrowDto> Handle(Query request, CancellationToken cancellatio
                 .Include(x => x.Borrower)
                 .Include(x => x.Document)
                 .ThenInclude(y => y.Department)
+                .Include(x => x.Document)
+                .ThenInclude(x => x.Folder)
+                .ThenInclude(x => x.Locker)
+                .ThenInclude(x => x.Room)
                 .FirstOrDefaultAsync(x => x.Id == request.BorrowId, cancellationToken);
 
             if (borrow is null)
@@ -41,13 +46,36 @@ public async Task<BorrowDto> Handle(Query request, CancellationToken cancellatio
                 throw new KeyNotFoundException("Borrow request does not exist.");
             }
 
-            if (!request.User.Role.Equals(IdentityData.Roles.Employee))
+            if (request.User.Role.IsAdmin())
+            {
+                return _mapper.Map<BorrowDto>(borrow);
+            }
+
+            if (request.User.Role.IsStaff())
             {
+                var staff = _context.Staffs
+                    .Include(x => x.Room)
+                    .FirstOrDefault(x => x.Id == request.User.Id);
+                if (staff is null)
+                {
+                    throw new KeyNotFoundException("Staff does not exist.");
+                }
+
+                if (staff.Room is null)
+                {
+                    throw new ConflictException("Staff does not manage a room.");
+                }
+                
+                if (staff.Room.Id != borrow.Document.Folder!.Locker.Room.Id )
+                {
+                    throw new UnauthorizedAccessException("User can not access this resource.");
+                }
+                
                 return _mapper.Map<BorrowDto>(borrow);
             }
             
             return borrow.Borrower.Id != request.User.Id
-                ? throw new UnauthorizedAccessException()
+                ? throw new UnauthorizedAccessException("User can not access this resource")
                 : _mapper.Map<BorrowDto>(borrow);
         }
     }

From ea0013f04327970e0a187ad1c54491eca71c5ee7 Mon Sep 17 00:00:00 2001
From: Vzart <vo.dang.khoa.main@gmail.com>
Date: Wed, 12 Jul 2023 13:32:21 +0700
Subject: [PATCH 2/2] la la la la

---
 src/Api/Controllers/BorrowsController.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Api/Controllers/BorrowsController.cs b/src/Api/Controllers/BorrowsController.cs
index 0503bb34..7f49b61e 100644
--- a/src/Api/Controllers/BorrowsController.cs
+++ b/src/Api/Controllers/BorrowsController.cs
@@ -51,7 +51,7 @@ public async Task<ActionResult<Result<BorrowDto>>> BorrowDocument(
     /// Get a borrow request by id
     /// </summary>
     /// <returns>A BorrowDto of the retrieved borrow</returns>
-    [RequiresRole(IdentityData.Roles.Staff, IdentityData.Roles.Employee)]
+    [RequiresRole(IdentityData.Roles.Admin ,IdentityData.Roles.Staff, IdentityData.Roles.Employee)]
     [HttpGet("{borrowId:guid}")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status403Forbidden)]