feat: add canOperateReports and canFlagReportContent functions for report management

services/ReportService.cc

@@ -109,6 +109,20 @@ bool canModifyReport(const auth::UserContext &user, long long reportId)
     return !result.empty();
 }
 
+bool canFlagReportContent(const auth::UserContext &user, long long reportId)
+{
+    if (!auth::canOperateReports(user))
+    {
+        return false;
+    }
+
+    const auto result = drogon::app().getDbClient()->execSqlSync(
+        "SELECT id FROM reports WHERE id = ? AND assigned_operator_id = ?",
+        reportId,
+        user.id);
+    return !result.empty();
+}
+
 bool ownsReport(const auth::UserContext &user, long long reportId)
 {
     const auto result = drogon::app().getDbClient()->execSqlSync(
@@ -616,7 +630,7 @@ Json::Value ReportService::updateStatus(const auth::UserContext &user,
 Json::Value ReportService::takeReport(const auth::UserContext &user,
                                       long long reportId)
 {
-    if (!auth::canManageReports(user))
+    if (!auth::canOperateReports(user))
     {
         return failure("forbidden");
     }
@@ -737,6 +751,10 @@ Json::Value ReportService::assignTeam(const auth::UserContext &user,
         return failure("team_not_found");
     }
 
+    db->execSqlSync(
+        "UPDATE assignments SET ended_at = NOW() "
+        "WHERE report_id = ? AND ended_at IS NULL",
+        reportId);
     db->execSqlSync(
         "INSERT INTO assignments (report_id, team_id, assigned_by_user_id) "
         "VALUES (?, ?, ?)",
@@ -814,16 +832,7 @@ Json::Value ReportService::flagReport(const auth::UserContext &user,
         return failure("invalid_flag");
     }
 
-    const auto owner = reportOwner(reportId);
-    if (!owner)
-    {
-        return failure("report_not_found");
-    }
-    if (*owner == user.id)
-    {
-        return failure("cannot_flag_own_report");
-    }
-    if (!canAccessReport(user, reportId))
+    if (!canFlagReportContent(user, reportId))
     {
         return failure("forbidden");
     }
@@ -853,7 +862,7 @@ Json::Value ReportService::flagMessage(const auth::UserContext &user,
     {
         return failure("invalid_flag");
     }
-    if (!canInteractWithReport(user, reportId))
+    if (!canFlagReportContent(user, reportId))
     {
         return failure("forbidden");
     }