fix: prohibit updating rent related field by user

2026-03-16 10:34:08 +03:30
parent 02a7979c6b
commit 0d81e62e8a
1 changed files with 2 additions and 1 deletions
@@ -288,7 +288,8 @@ export class CompaniesService {
    const em = this.em.fork();
    try {
      await em.begin();
-      const { services, products, ...rest } = updateDto;
+      // rental related field should not be update by user
+      const { services, products, isRented, rentEndAt, rentContractImages, ...rest } = updateDto;

      const company = await em.findOne(Company, { id, business: { id: businessId }, user: { id: userId }, deletedAt: null });
      if (!company) throw new BadRequestException(CompanyMessage.COMPANY_NOT_FOUND);