fix(orders): fix permissions issue on get-all orders (#165)

atlp-rwanda · Jul 26, 2024 · 3f0ef95 · 3f0ef95
1 parent 4844c5c
commit 3f0ef95
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/controller/cartController.ts b/src/controller/cartController.ts
@@ -282,7 +282,7 @@ export const deleteAllOrders = errorHandler(
 
 export const getAllOrders = errorHandler(
   async (req: Request, res: Response) => {
-    const orders = await orderRepository.find({ relations: ['orderDetails'] });
+    const orders = await orderRepository.find({ relations: ['orderDetails','orderDetails.product','orderDetails.product.vendor'] });
     return res.status(200).json({ orders });
   }
 );

diff --git a/src/routes/checkoutRoutes.ts b/src/routes/checkoutRoutes.ts
@@ -10,7 +10,7 @@ import {
 } from '../controller/cartController';
 
 const checkoutRoutes = Router();
-checkoutRoutes.use(IsLoggedIn, checkRole(['Buyer', 'Admin']));
+checkoutRoutes.use(IsLoggedIn, checkRole(['Buyer','Vendor', 'Admin']));
 checkoutRoutes.route('/').post(checkout);
 checkoutRoutes.route('/removeall-order').delete(deleteAllOrders);
 checkoutRoutes.route('/getall-order').get(getAllOrders);