case 4232

server/AyaNova/biz/QuoteBiz.cs

@@ -9,6 +9,7 @@ using System.Linq;
 using System;
 using Newtonsoft.Json.Linq;
 using System.Collections.Generic;
+using EnumsNET;
 
 namespace AyaNova.Biz
 {
@@ -1130,14 +1131,38 @@ namespace AyaNova.Biz
         //
         internal async Task<QuoteState> StateCreateAsync(QuoteState newObject)
         {
-            await StateValidateAsync(newObject, null);
+            await StatePreliminaryValidateCanAddAsync(newObject);
             if (HasErrors)
                 return null;
             else
             {
-                await ct.QuoteState.AddAsync(newObject);
+
                 var quote = await ct.Quote.FirstOrDefaultAsync(x => x.Id == newObject.QuoteId);
-                var newStatusInfo = await ct.QuoteStatus.AsNoTracking().FirstOrDefaultAsync(x => x.Id == newObject.QuoteStatusId);
+                var NewStatusInfo = await ct.QuoteStatus.AsNoTracking().FirstOrDefaultAsync(x => x.Id == newObject.QuoteStatusId);
+
+                QuoteStatus LastStatusInfo = null;
+                if (quote.LastStatusId != null)
+                    LastStatusInfo = await ct.QuoteStatus.AsNoTracking().FirstOrDefaultAsync(x => x.Id == quote.LastStatusId);
+
+                //Level 2 validation - Quote status RemoveRoles, SelectRoles and User roles
+
+                //If we have a last role, can it be removed by this User?
+                if (LastStatusInfo != null && CurrentUserRoles.HasAnyFlags(LastStatusInfo.RemoveRoles) == false)
+                {
+                    AddError(ApiErrorCode.NOT_AUTHORIZED, "generalerror", "LT:QuoteQuoteStatusType -> LT:RemoveRoles");
+                    return null;
+                }
+                //Can the new role be selected by this user?
+                if (CurrentUserRoles.HasAnyFlags(NewStatusInfo.SelectRoles) == false)
+                {
+                    AddError(ApiErrorCode.NOT_AUTHORIZED, "generalerror", "LT:QuoteQuoteStatusType -> LT:SelectRoles");
+                    return null;
+                }
+                //Seems legit, we'll allow it
+
+
+
+                await ct.QuoteState.AddAsync(newObject);
                 quote.LastStatusId = newObject.QuoteStatusId;
                 await ct.SaveChangesAsync();
                 newObject.NewQuoteConcurrency = quote.Concurrency;
@@ -1218,7 +1243,12 @@ namespace AyaNova.Biz
         ////////////////////////////////////////////////////////////////////////////////////////////////
         //VALIDATION
         //  
-        private async Task StateValidateAsync(QuoteState proposedObj, QuoteState currentObj)
+        //NOTE: states are only ever *added* to a quote order when validation is called
+        //never deleted, there is deeper validation needed for states related to roles etc
+        //so this validation just does the preliminary check to see if a change of state is even possible
+        //before further processing inside the actual update code in the caller
+        //     
+        private async Task StatePreliminaryValidateCanAddAsync(QuoteState proposedObj)
         {
 
             //of all restricted users, only a restricted tech can change status
@@ -1228,8 +1258,7 @@ namespace AyaNova.Biz
                 return;
             }
 
-            //run validation and biz rules
+
-            bool isNew = currentObj == null;
 
             //does it have a valid quote id
             if (proposedObj.QuoteId == 0)