server/AyaNova/biz/Review.cs

@@ -216,14 +216,24 @@ namespace AyaNova.Biz
             - RULE Limited roles can only set completed date and enter completion notes not otherwise change or create or delete.
             - BIZ RULE  users with more than limited roles can assign other users to follow up. Limited roles can only set completed status not otherwise change or create or delete. 
             */
-           
+
             bool isNew = currentObj == null;
 
+            bool HasSupervisorRole =
+            CurrentUserRoles.HasFlag(AuthorizationRoles.BizAdminFull) ||
+            CurrentUserRoles.HasFlag(AuthorizationRoles.DispatchFull) ||
+            CurrentUserRoles.HasFlag(AuthorizationRoles.InventoryFull) ||
+            CurrentUserRoles.HasFlag(AuthorizationRoles.SalesFull) ||
+            CurrentUserRoles.HasFlag(AuthorizationRoles.AccountingFull);
+
+
             //Name required
             if (string.IsNullOrWhiteSpace(proposedObj.Name))
                 AddError(ApiErrorCode.VALIDATION_REQUIRED, "Name");
 
-
+            if(!HasSupervisorRole && proposedObj.Self){
+                 AddError(ApiErrorCode.NOT_AUTHORIZED, "UserId");
+            }
 
 
             //Any form customizations to validate?