up

src/modules/review/providers/review.service.ts

@@ -10,6 +10,7 @@ import { RequiredEntityData } from '@mikro-orm/core';
 import { Review } from '../entities/review.entity';
 import { FoodMessage, UserMessage, ReviewMessage } from 'src/common/enums/message.enum';
 import { Order } from '../../orders/entities/order.entity';
+import { OrderItem } from '../../orders/entities/order-item.entity';
 
 @Injectable()
 export class ReviewService {
@@ -33,9 +34,19 @@ export class ReviewService {
       throw new NotFoundException(UserMessage.USER_NOT_FOUND);
     }
 
-    const order = await this.em.findOne(Order, { id: orderId });
+    // Find order and verify it belongs to the user
+    const order = await this.em.findOne(Order, { id: orderId, user: { id: userId } });
     if (!order) {
-      throw new NotFoundException('Order not found');
+      throw new NotFoundException('Order not found or does not belong to the current user');
+    }
+
+    // Verify the food is in the order
+    const orderItem = await this.em.findOne(OrderItem, {
+      order: { id: orderId },
+      food: { id: foodId },
+    });
+    if (!orderItem) {
+      throw new BadRequestException('Food is not in the specified order');
     }
 
     // Check if user already commented on this food for this order
@@ -62,7 +73,7 @@ export class ReviewService {
 
     const review = this.reviewRepository.create(data);
     if (!review) {
-      throw new Error('Failed to create review entity');
+      throw new BadRequestException('Failed to create review entity');
     }
 
     await this.em.persistAndFlush(review);