Stop disabled users from performing operations after account deactivation
Changes: - Added authorization state tracking to authenticated sessions. - Revoked authorization immediately when an account-disabled event is received. - Added authorization validation before protected service operations. - Cleared authorization state on logout. Fixes #2078
This commit is contained in:
+6
-1
@@ -15,6 +15,7 @@ Date: 20-May-2026
|
||||
#include "Invoice.h"
|
||||
#include "JobCard.h"
|
||||
#include "PaymentManagementService.h"
|
||||
#include "AuthenticationManagementService.h"
|
||||
#include "DataStoreLockGuard.h"
|
||||
#include "Service.h"
|
||||
#include "ServiceBooking.h"
|
||||
@@ -233,6 +234,7 @@ Returns:
|
||||
*/
|
||||
util::Map<std::string, Invoice*> PaymentManagementService::getInvoices(const std::string& customerID)
|
||||
{
|
||||
AuthenticationManagementService::ensureAuthorization();
|
||||
DataStoreLockGuard lock(m_dataStore);
|
||||
auto& currentTrackedInvoices = m_dataStore.getInvoices();
|
||||
util::Map<std::string, Invoice*> currentUserInvoices;
|
||||
@@ -261,6 +263,7 @@ Throws:
|
||||
*/
|
||||
void PaymentManagementService::completePayment(const std::string& invoiceID, util::PaymentMode paymentMode)
|
||||
{
|
||||
AuthenticationManagementService::ensureAuthorization();
|
||||
DataStoreLockGuard lock(m_dataStore);
|
||||
auto& currentTrackedInvoices = m_dataStore.getInvoices();
|
||||
int invoiceIndex = currentTrackedInvoices.find(invoiceID);
|
||||
@@ -289,7 +292,7 @@ void PaymentManagementService::completePayment(const std::string& invoiceID, uti
|
||||
}
|
||||
|
||||
/*
|
||||
Function: getAllInvoice
|
||||
Function: getAllInvoices
|
||||
Description: Provides access to all invoices stored in the data store.
|
||||
Parameters:
|
||||
- none
|
||||
@@ -298,6 +301,7 @@ Returns:
|
||||
*/
|
||||
util::Map<std::string, Invoice*> PaymentManagementService::getAllInvoices()
|
||||
{
|
||||
AuthenticationManagementService::ensureAuthorization();
|
||||
DataStoreLockGuard lock(m_dataStore);
|
||||
util::Map<std::string, Invoice*> invoices;
|
||||
invoices = util::getObjects(m_dataStore.getInvoices());
|
||||
@@ -317,6 +321,7 @@ Throws:
|
||||
*/
|
||||
void PaymentManagementService::confirmPayment(const std::string& invoiceID)
|
||||
{
|
||||
AuthenticationManagementService::ensureAuthorization();
|
||||
DataStoreLockGuard lock(m_dataStore);
|
||||
auto& currentTrackedInvoices = m_dataStore.getInvoices();
|
||||
int invoiceIndex = currentTrackedInvoices.find(invoiceID);
|
||||
|
||||
Reference in New Issue
Block a user