Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const vehicle = await ctx.vehicleList.get(vin);
if (organization instanceof Manufacturer && !vehicle.madeByOrg(participant.orgId)) {
throw new Error('Manufacturers may only get a vehicle produced by their organisation');
}
// DON'T LIMIT THE INSURER AS WHEN GIVEN A VIN AS PART OF A REQUEST THEY NEED TO SEE THE CAR
// REMEMBER READ ACCESS CONTROL IN HERE IS JUST AS ITS USEFUL TO THE ORGANISATION IT LIMITS.
// THEY COULD GET FULL DATA IF THEY WISH AS NO DATA IS PRIVATE
return vehicle;
}
@Transaction()
@Param('endDate', 'number', 'end date as timestamp in seconds')
@Returns('Policy')
public async createPolicy(
ctx: VehicleManufactureNetContext, vin: string, holderId: string, policyType: PolicyType, endDate: number,
): Promise {
const { participant } = ctx.clientIdentity;
if (!participant.hasRole(Roles.POLICY_CREATE)) {
throw new Error(`Only callers with role ${Roles.POLICY_CREATE} can create policies`);
}
const vehicle = await ctx.vehicleList.get(vin);
if (vehicle.vehicleStatus !== VehicleStatus.ACTIVE) {
throw new Error('Cannot insure vehicle which is not active');
}