40 lines
1.4 KiB
TypeScript
40 lines
1.4 KiB
TypeScript
|
import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Body of POST customer/me/complete-profile.
|
||
|
|
*
|
||
|
|
* The three ids are the reference's exactly
|
||
|
|
* (henza_server Major/CustomerController::complete:73-79):
|
||
|
|
*
|
||
|
|
* 'business_license_image_id' => 'required',
|
||
|
|
* 'shop_image_id' => 'required',
|
||
|
|
* 'ncode_image_id' => 'required',
|
||
|
|
*
|
||
|
|
* and the PWA sends those same three keys (completeProfile.vue:136-140, :193).
|
||
|
|
* They are kept verbatim rather than camelCased so the app's payload is
|
||
|
|
* byte-identical to the reference's.
|
||
|
|
*
|
||
|
|
* Deliberately NOT accepted: anything else. The reference did
|
||
|
|
* `$customer->update($request->all())` (:87), so ANY column the caller named —
|
||
|
|
* `gram_level`, `percent`, `active`, `remain` — was written straight onto the
|
||
|
|
* customer row from the app. That is a privilege-escalation and money hole, not
|
||
|
|
* a feature, so only these three ids are read (whitelist, not mass-assign).
|
||
|
|
* Recorded in ISSUES.md as SEC-14.
|
||
|
|
*/
|
||
|
|
export class CompleteProfileDto {
|
||
|
|
@IsString()
|
||
|
|
@IsNotEmpty({ message: 'تصویر جواز کسب الزامی است' })
|
||
|
|
@MaxLength(64)
|
||
|
|
business_license_image_id!: string;
|
||
|
|
|
||
|
|
@IsString()
|
||
|
|
@IsNotEmpty({ message: 'تصویر سردر مغازه الزامی است' })
|
||
|
|
@MaxLength(64)
|
||
|
|
shop_image_id!: string;
|
||
|
|
|
||
|
|
@IsString()
|
||
|
|
@IsNotEmpty({ message: 'تصویر کارت ملی الزامی است' })
|
||
|
|
@MaxLength(64)
|
||
|
|
ncode_image_id!: string;
|
||
|
|
}
|