diff --git a/backend/src/graphql/resolver/AdminResolver.ts b/backend/src/graphql/resolver/AdminResolver.ts index f7d675aaa..fff84686f 100644 --- a/backend/src/graphql/resolver/AdminResolver.ts +++ b/backend/src/graphql/resolver/AdminResolver.ts @@ -1,4 +1,4 @@ -import { Resolver, Query, Arg, Args, Authorized, Mutation } from 'type-graphql' +import { Resolver, Query, Arg, Args, Authorized, Mutation, Ctx } from 'type-graphql' import { getCustomRepository, Raw } from 'typeorm' import { UserAdmin } from '../model/UserAdmin' import { PendingCreation } from '../model/PendingCreation' @@ -160,12 +160,18 @@ export class AdminResolver { return !!res } + @Authorized([RIGHTS.CONFIRM_PENDING_CREATION]) @Mutation(() => Boolean) - async confirmPendingCreation(@Arg('id') id: number): Promise { + async confirmPendingCreation(@Arg('id') id: number, @Ctx() context: any): Promise { const loginPendingTasksAdminRepository = getCustomRepository(LoginPendingTasksAdminRepository) const pendingCreation = await loginPendingTasksAdminRepository.findOneOrFail(id) + const userRepository = getCustomRepository(UserRepository) + const moderatorUser = await userRepository.findByPubkeyHex(context.pubKey) + if (moderatorUser.id === pendingCreation.userId) + throw new Error('Moderator can not confirm own pending creation') + const transactionRepository = getCustomRepository(TransactionRepository) const receivedCallDate = new Date() let transaction = new Transaction()