You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
48 lines
1.2 KiB
48 lines
1.2 KiB
import { parseServiceAuth } from "@/lib/api/auth-context";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { fail, ok } from "@/lib/response";
|
|
import { AuthError } from "@/modules/auth/errors";
|
|
import { recordSecurityEvent } from "@/modules/audit/service";
|
|
import { serializeQuoteDetail } from "@/modules/quote/quote-serializer";
|
|
|
|
type RouteContext = {
|
|
params: Promise<{ quote_id: string }>;
|
|
};
|
|
|
|
export async function GET(request: Request, context: RouteContext) {
|
|
let auth;
|
|
try {
|
|
auth = await parseServiceAuth(request);
|
|
} catch (error) {
|
|
if (error instanceof AuthError) {
|
|
return fail(error.code, error.message, error.httpStatus);
|
|
}
|
|
throw error;
|
|
}
|
|
|
|
const { quote_id: quoteId } = await context.params;
|
|
|
|
const record = await prisma.quoteRecord.findFirst({
|
|
where: { quoteId, isDeleted: false },
|
|
});
|
|
|
|
if (!record) {
|
|
return fail("QUOTE_NOT_FOUND", "报价不存在", 404);
|
|
}
|
|
|
|
if (record.customerId !== auth.customerId) {
|
|
void recordSecurityEvent(
|
|
"FORBIDDEN_ACCESS",
|
|
auth.customerId,
|
|
quoteId,
|
|
{
|
|
attempted_quote_id: quoteId,
|
|
owner_customer_id: record.customerId,
|
|
},
|
|
);
|
|
return fail("FORBIDDEN", "无权访问该报价", 403);
|
|
}
|
|
|
|
return ok(serializeQuoteDetail(record));
|
|
}
|