fix: memberikan akses ke mentor untuk /project/{id_project} route

2026-07-10 15:57:57 +07:00
parent 54ad32137f
commit bbfa152fc2
3 changed files with 307 additions and 5 deletions
@@ -221,10 +221,21 @@ class CertificateService {
  async getProjectCertificates(id_project, actor) {
    try {
      if (!actor?.id) {
-        return error(new BadRequestError('Admin ID is required'));
+        return error(new BadRequestError('User ID is required'));
      }

-      if (actor.role !== 'admin') {
+      const project = await certificateRepository.findProjectById(id_project);
+      if (!project) {
+        return error(new NotFoundError('Project not found'));
+      }
+
+      if (actor.role === 'mentor') {
+        if (project.id_admin !== parseInt(actor.id)) {
+          return error(
+            new ForbiddenError('Access denied: you are not the mentor of this project'),
+          );
+        }
+      } else if (actor.role !== 'admin') {
        return error(
          new ForbiddenError('Access denied: only admins/mentors can view project certificates'),
        );