diff --git a/backend/finboostplus_server/src/main/java/com/finboostplus/controller/GroupController.java b/backend/finboostplus_server/src/main/java/com/finboostplus/controller/GroupController.java index c1af2943..f0adff04 100644 --- a/backend/finboostplus_server/src/main/java/com/finboostplus/controller/GroupController.java +++ b/backend/finboostplus_server/src/main/java/com/finboostplus/controller/GroupController.java @@ -31,7 +31,6 @@ import com.finboostplus.DTO.SwitchAuthorityRequestDTO; import com.finboostplus.model.Group; import com.finboostplus.projection.GroupProjection; -import com.finboostplus.repository.GroupRepository; import com.finboostplus.repository.UserRepository; import com.finboostplus.service.CategoryService; import com.finboostplus.service.ExpenseService; diff --git a/backend/finboostplus_server/src/main/java/com/finboostplus/service/ExpenseService.java b/backend/finboostplus_server/src/main/java/com/finboostplus/service/ExpenseService.java index 3594ea14..246860bd 100644 --- a/backend/finboostplus_server/src/main/java/com/finboostplus/service/ExpenseService.java +++ b/backend/finboostplus_server/src/main/java/com/finboostplus/service/ExpenseService.java @@ -146,7 +146,7 @@ public boolean createNewExpense(ExpenseCreateDTO expenseDTO, Long groupId) { @Transactional(readOnly = true) public UserExpenseDivisionDTO getExpenseInfoDetails(Long groupId, Long expenseId) { - userRepository.findByEmailIgnoreCase(userService.authenticated()) + User user = userRepository.findByEmailIgnoreCase(userService.authenticated()) .orElseThrow(() -> new UserNotFoundException("Usuário não encontrado")); Group group = groupRepository.findById(groupId) .orElseThrow(() -> new GroupNotFoundException("Grupo não encontrado")); @@ -154,11 +154,17 @@ public UserExpenseDivisionDTO getExpenseInfoDetails(Long groupId, Long expenseId () -> new ForbiddenResourceException("Despesa nao encontrada")); Category category = expense.getCategory(); List memberList = getExpenseDivisionDetails(group.getId(), expenseId); - return new UserExpenseDivisionDTO(expense.getId(), expense.getTitle(), + boolean hasAuthority = groupMemberRepository.doesUserHasAnyAuthority(user.getId(), groupId, AUTHLEVELS); + boolean doesListContainMember = memberList.stream() + .anyMatch(item -> item.getUserId().equals(user.getId())); + if (hasAuthority || doesListContainMember) { + return new UserExpenseDivisionDTO(expense.getId(), expense.getTitle(), expense.getDescription(), groupId, group.getName(), expense.getStatus(), expense.getValue(), category.getId(), category.getName(), expense.getCreatedAt(), expense.getDeadlineDate(), memberList); + } + throw new ForbiddenResourceException("Acesso negado"); } private List getExpenseDivisionDetails(Long groupId, Long expenseId) { diff --git a/backend/finboostplus_server/src/main/java/com/finboostplus/service/GroupService.java b/backend/finboostplus_server/src/main/java/com/finboostplus/service/GroupService.java index 1c4a064e..55fab1af 100644 --- a/backend/finboostplus_server/src/main/java/com/finboostplus/service/GroupService.java +++ b/backend/finboostplus_server/src/main/java/com/finboostplus/service/GroupService.java @@ -197,8 +197,10 @@ public void removeGroupMember(Long groupId, Long memberId) { String loggedAuth = loggedInMember.getAuthorization(); if ("OWNER".equals(loggedAuth)) { groupMemberRepository.deleteByUserIdAndGroupId(memberId, groupId); + return; } else if ("ADMIN".equals(loggedAuth) && "USER".equals(targetAuth)) { groupMemberRepository.deleteByUserIdAndGroupId(memberId, groupId); + return; } throw new ForbiddenResourceException("Recurso não permitido"); }