@chevre/domain 21.20.0-alpha.75 → 21.20.0-alpha.76

package/lib/chevre/service/offer/event/authorize.js

@@ -114,7 +114,7 @@ function authorize(params) {
 exports.authorize = authorize;
 function validateCreateRequest(params) {
     return (repos) => __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        var _a, _b, _c;
         const transaction = yield repos.transaction.findInProgressById({
             typeOf: factory.transactionType.PlaceOrder,
             id: params.transaction.id
@@ -122,7 +122,11 @@ function validateCreateRequest(params) {
         if (transaction.agent.id !== params.agent.id) {
             throw new factory.errors.Forbidden('Transaction not yours');
         }
-        if (typeof ((_a = params.object.reservationFor) === null || _a === void 0 ? void 0 : _a.id) !== 'string' || params.object.reservationFor.id.length === 0) {
+        // クライアント検証(2024-02-07~)
+        if (((_a = transaction.object.clientUser) === null || _a === void 0 ? void 0 : _a.client_id) !== params.store.id) {
+            throw new factory.errors.Forbidden('client not match that of the transaction');
+        }
+        if (typeof ((_b = params.object.reservationFor) === null || _b === void 0 ? void 0 : _b.id) !== 'string' || params.object.reservationFor.id.length === 0) {
             throw new factory.errors.ArgumentNull('object.reservationFor.id');
         }
         // イベント取得属性最適化(2023-01-23~)
@@ -130,7 +134,7 @@ function validateCreateRequest(params) {
         const event = yield repos.event.findMinimizedIndividualEventById({
             id: params.object.reservationFor.id
         });
-        let offeredThrough = (_b = event.offers) === null || _b === void 0 ? void 0 : _b.offeredThrough;
+        let offeredThrough = (_c = event.offers) === null || _c === void 0 ? void 0 : _c.offeredThrough;
         if (offeredThrough === undefined) {
             offeredThrough = { typeOf: 'WebAPI', identifier: factory.service.webAPI.Identifier.Chevre };
         }

package/lib/chevre/service/offer/eventServiceByCOA/authorize.d.ts

@@ -38,6 +38,12 @@ export declare function authorize(params: {
     transaction: {
         id: string;
     };
+    store: {
+        /**
+         * 販売アプリケーションID
+         */
+        id: string;
+    };
     result: {
         requestBody: factory.action.authorize.offer.eventService.IRequestBody<WebAPIIdentifier.COA>;
         responseBody: factory.action.authorize.offer.eventService.IResponseBody<WebAPIIdentifier.COA>;

package/lib/chevre/service/offer/eventServiceByCOA/authorize.js

@@ -22,6 +22,7 @@ exports.WebAPIIdentifier = factory.service.webAPI.Identifier;
 function authorize(params) {
     // tslint:disable-next-line:max-func-body-length
     return (repos) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const transaction = yield repos.transaction.findInProgressById({
             typeOf: factory.transactionType.PlaceOrder,
             id: params.transaction.id
@@ -29,6 +30,10 @@ function authorize(params) {
         if (transaction.agent.id !== params.agent.id) {
             throw new factory.errors.Forbidden('Transaction not yours');
         }
+        // クライアント検証(2024-02-07~)
+        if (((_a = transaction.object.clientUser) === null || _a === void 0 ? void 0 : _a.client_id) !== params.store.id) {
+            throw new factory.errors.Forbidden('client not match that of the transaction');
+        }
         let screeningEvent;
         let acceptedOffers;
         const pendingTransaction = {

package/package.json

@@ -111,5 +111,5 @@
     "postversion": "git push origin --tags",
     "prepublishOnly": "npm run clean && npm run build && npm test && npm run doc"
   },
-  "version": "21.20.0-alpha.75"
+  "version": "21.20.0-alpha.76"
 }