Auditoría BAC en pedidos, asignaciones y notificaciones

docs/auditoria-bac.md

@@ -0,0 +1,24 @@
+# Reporte de Auditoría BAC
+
+Fecha: 03-06-2026
+Alcance: API de pedidos, asignaciones y notificaciones
+
+## Antes
+- Cualquier usuario autenticado podía leer los datos de asignación por pedido, entrega o ID de asignación, incluyendo información personal de los pedidos.
+- Un SELLER podía crear una asignación de entrega para pedidos fuera de su tienda.
+- Un DELIVERY podía actualizar el estado del pedido a DELIVERED sin demostrar que el pedido le había sido asignado.
+
+## Después
+- Las lecturas de asignación ahora aplican la propiedad por rol (el SELLER es propietario de la tienda, el CUSTOMER es propietario del pedido y el DELIVERY es propietario de la asignación).
+- La creación de asignaciones valida que el SELLER sea propietario de la tienda del pedido y que la entrega pertenezca a la misma tienda.
+- Las actualizaciones de estado del DELIVERY requieren una asignación aceptada vinculada al usuario de entrega autenticado.
+
+## Archivos modificados
+- src/modules/delivery/delivery-assignments/delivery-assignments.service.js
+- src/modules/delivery/delivery-assignments/delivery-assignments.controller.js
+- src/modules/users/orders/order.service.js
+- tests/unit/delivery/delivery-assignments.test.js
+- tests/unit/order/order.test.js
+- tests/unit/delivery/delivery-assignments-controller.test.js
+- tests/unit/commerce/delivery-assignments.test.js
+- tests/e2e/delivery-assignments-create.test.js

src/modules/delivery/delivery-assignments/delivery-assignments.controller.js

@@ -17,7 +17,7 @@ import {
 export const createAssignment = async (req, res) => {
   try {
     const validData = createAssignmentSchema.parse(req.body);
-    const result = await createAssignmentService(validData);
+    const result = await createAssignmentService(validData, req.user);
     res.status(201).json(result);
   } catch (error) {
     if (error instanceof ZodError) {
@@ -43,7 +43,7 @@ export const getAssignmentById = async (req, res) => {
       });
     }
 
-    const result = await getAssignmentByIdService(assignmentId);
+    const result = await getAssignmentByIdService(assignmentId, req.user);
     res.json(result);
   } catch (error) {
     return res.status(error.status || 500).json({
@@ -64,7 +64,7 @@ export const getOrderAssignments = async (req, res) => {
       });
     }
 
-    const result = await getOrderAssignmentsService(orderIdNum);
+    const result = await getOrderAssignmentsService(orderIdNum, req.user);
     res.json(result);
   } catch (error) {
     return res.status(error.status || 500).json({
@@ -94,7 +94,7 @@ export const getDeliveryAssignments = async (req, res) => {
       });
     }
 
-    const result = await getDeliveryAssignmentsService(deliveryIdNum, status || null);
+    const result = await getDeliveryAssignmentsService(deliveryIdNum, req.user, status || null);
     res.json(result);
   } catch (error) {
     return res.status(error.status || 500).json({
@@ -115,7 +115,7 @@ export const getDeliveryPendingAssignments = async (req, res) => {
       });
     }
 
-    const result = await getDeliveryPendingAssignmentsService(deliveryIdNum);
+    const result = await getDeliveryPendingAssignmentsService(deliveryIdNum, req.user);
     res.json(result);
   } catch (error) {
     return res.status(error.status || 500).json({
@@ -136,7 +136,7 @@ export const getAcceptedAssignment = async (req, res) => {
       });
     }
 
-    const result = await getAcceptedAssignmentService(orderIdNum);
+    const result = await getAcceptedAssignmentService(orderIdNum, req.user);
     res.json(result);
   } catch (error) {
     return res.status(error.status || 500).json({

src/modules/delivery/delivery-assignments/delivery-assignments.service.js

@@ -10,16 +10,82 @@
   isAssignmentResponseWindowOpen,
 } from "./delivery-assignment-workflow.service.js";
 
-export const createAssignmentService = async (data) => {
+const resolveAuth = (authenticatedUser) => {
+  const id_user = authenticatedUser?.id_user ?? authenticatedUser?.id;
+  const role = authenticatedUser?.role;
+
+  if (!id_user || !role) {
+    throw { status: 403, message: "No tienes permiso para acceder a este recurso" };
+  }
+
+  return { id_user, role };
+};
+
+const ensureOrderAccess = async (order, auth) => {
+  if (auth.role === "SELLER") {
+    const store = await prisma.stores.findFirst({
+      where: { id_store: order.fk_store, fk_user: auth.id_user, status: true },
+      select: { id_store: true }
+    });
+
+    if (!store) {
+      throw { status: 403, message: "No tienes permiso para acceder a este pedido" };
+    }
+
+    return;
+  }
+
+  if (auth.role === "CUSTOMER") {
+    if (order.fk_user !== auth.id_user) {
+      throw { status: 403, message: "No tienes permiso para acceder a este pedido" };
+    }
+    return;
+  }
+
+  if (auth.role === "DELIVERY") {
+    const assignment = await prisma.deliveryAssignments.findFirst({
+      where: {
+        fk_order: order.id_order,
+        status: true,
+        delivery: { fk_user: auth.id_user }
+      },
+      select: { id_delivery_assignment: true }
+    });
+
+    if (!assignment) {
+      throw { status: 403, message: "No tienes permiso para acceder a este pedido" };
+    }
+
+    return;
+  }
+
+  throw { status: 403, message: "No tienes permiso para acceder a este recurso" };
+};
+
+export const createAssignmentService = async (data, authenticatedUser) => {
+  const auth = resolveAuth(authenticatedUser);
+  if (auth.role !== "SELLER") {
+    throw { status: 403, message: "No tienes permiso para asignar deliveries" };
+  }
+
   const { fk_order, fk_delivery: fk_delivery_input, status } = data;
 
   const order = await prisma.orders.findUnique({
-    where: { id_order: fk_order }
+    where: { id_order: fk_order },
+    select: {
+      id_order: true,
+      fk_store: true,
+      store: { select: { fk_user: true } }
+    }
   });
   if (!order) {
     throw { status: 404, message: "Pedido no encontrado" };
   }
 
+  if (order.store?.fk_user !== auth.id_user) {
+    throw { status: 403, message: "No tienes permiso para asignar este pedido" };
+  }
+
   try {
     const newDeliveryAssignment = await prisma.$transaction(async (tx) => {
       await expireStalePendingAssignments({ fk_order }, tx);
@@ -74,11 +140,15 @@
         fk_delivery = delivery.id_delivery;
       } else {
         const delivery = await tx.deliveries.findUnique({
-          where: { id_delivery: fk_delivery }
+          where: { id_delivery: fk_delivery },
+          select: { id_delivery: true, delivery_status: true, status: true, fk_store: true }
         });
         if (!delivery) {
           throw { status: 404, message: "Delivery no encontrado" };
         }
+        if (delivery.fk_store !== order.fk_store) {
+          throw { status: 403, message: "El delivery no pertenece al comercio del pedido" };
+        }
         if (delivery.delivery_status !== "ACTIVE" || !delivery.status) {
           throw { status: 400, message: "El delivery debe estar activo para recibir pedidos" };
         }
@@ -100,15 +170,23 @@
 };
 
 // Obtener asignación por ID
-export const getAssignmentByIdService = async (id_delivery_assignment) => {
+export const getAssignmentByIdService = async (id_delivery_assignment, authenticatedUser) => {
+  const auth = resolveAuth(authenticatedUser);
+
   const assignment = await prisma.deliveryAssignments.findUnique({
     where: { id_delivery_assignment },
     include: {
       order: {
-        select: { id_order: true, total: true, created_at: true }
+        select: {
+          id_order: true,
+          total: true,
+          created_at: true,
+          fk_user: true,
+          store: { select: { fk_user: true } }
+        }
       },
       delivery: {
-        select: { id_delivery: true, delivery_status: true }
+        select: { id_delivery: true, delivery_status: true, fk_user: true }
       }
     }
   });
@@ -117,18 +195,46 @@
     throw { status: 404, message: "Asignación no encontrada" };
   }
 
+  if (auth.role === "SELLER") {
+    if (assignment.order?.store?.fk_user !== auth.id_user) {
+      throw { status: 403, message: "No tienes permiso para ver esta asignación" };
+    }
+  } else if (auth.role === "CUSTOMER") {
+    if (assignment.order?.fk_user !== auth.id_user) {
+      throw { status: 403, message: "No tienes permiso para ver esta asignación" };
+    }
+  } else if (auth.role === "DELIVERY") {
+    if (assignment.delivery?.fk_user !== auth.id_user) {
+      throw { status: 403, message: "No tienes permiso para ver esta asignación" };
+    }
+  } else {
+    throw { status: 403, message: "No tienes permiso para ver esta asignación" };
+  }
+
   return assignment;
 };
 // Obtener asignaciones de un pedido
-export const getOrderAssignmentsService = async (id_order) => {
+export const getOrderAssignmentsService = async (id_order, authenticatedUser) => {
+  const auth = resolveAuth(authenticatedUser);
+  if (![
+    "SELLER",
+    "CUSTOMER",
+    "DELIVERY",
+  ].includes(auth.role)) {
+    throw { status: 403, message: "No tienes permiso para ver asignaciones" };
+  }
+
   const order = await prisma.orders.findUnique({
-    where: { id_order }
+    where: { id_order },
+    select: { id_order: true, fk_store: true, fk_user: true }
   });
 
   if (!order) {
     throw { status: 404, message: "Pedido no encontrado" };
   }
 
+  await ensureOrderAccess(order, auth);
+
   await expireStalePendingAssignments({ fk_order: id_order });
 
   const assignments = await prisma.deliveryAssignments.findMany({
@@ -144,15 +250,25 @@
   return assignments;
 };
 // Obtener asignaciones de un delivery 
-export const getDeliveryAssignmentsService = async (id_delivery, status = null) => {
+export const getDeliveryAssignmentsService = async (id_delivery, authenticatedUser, status = null) => {
+  const auth = resolveAuth(authenticatedUser);
+  if (auth.role !== "DELIVERY") {
+    throw { status: 403, message: "No tienes permiso para ver asignaciones de delivery" };
+  }
+
   const delivery = await prisma.deliveries.findUnique({
-    where: { id_delivery }
+    where: { id_delivery },
+    select: { id_delivery: true, fk_user: true }
   });
 
   if (!delivery) {
     throw { status: 404, message: "Delivery no encontrado" };
   }
 
+  if (delivery.fk_user !== auth.id_user) {
+    throw { status: 403, message: "No tienes permiso para ver asignaciones de este delivery" };
+  }
+
   await expireStalePendingAssignments({ fk_delivery: id_delivery });
 
   const where = { fk_delivery: id_delivery };
@@ -193,15 +309,25 @@
   return assignments;
 };
 // Obtener asignaciones PENDING de un delivery
-export const getDeliveryPendingAssignmentsService = async (id_delivery) => {
+export const getDeliveryPendingAssignmentsService = async (id_delivery, authenticatedUser) => {
+  const auth = resolveAuth(authenticatedUser);
+  if (auth.role !== "DELIVERY") {
+    throw { status: 403, message: "No tienes permiso para ver asignaciones de delivery" };
+  }
+
   const delivery = await prisma.deliveries.findUnique({
-    where: { id_delivery }
+    where: { id_delivery },
+    select: { id_delivery: true, fk_user: true }
   });
 
   if (!delivery) {
     throw { status: 404, message: "Delivery no encontrado" };
   }
 
+  if (delivery.fk_user !== auth.id_user) {
+    throw { status: 403, message: "No tienes permiso para ver asignaciones de este delivery" };
+  }
+
   await expireStalePendingAssignments({ fk_delivery: id_delivery });
 
   const pendingAssignments = await prisma.deliveryAssignments.findMany({
@@ -220,15 +346,27 @@
   return pendingAssignments;
 };
 // Obtener la asignación aceptada de un pedido
-export const getAcceptedAssignmentService = async (id_order) => {
+export const getAcceptedAssignmentService = async (id_order, authenticatedUser) => {
+  const auth = resolveAuth(authenticatedUser);
+  if (![
+    "SELLER",
+    "CUSTOMER",
+    "DELIVERY",
+  ].includes(auth.role)) {
+    throw { status: 403, message: "No tienes permiso para ver asignaciones" };
+  }
+
   const order = await prisma.orders.findUnique({
-    where: { id_order }
+    where: { id_order },
+    select: { id_order: true, fk_store: true, fk_user: true }
   });
 
   if (!order) {
     throw { status: 404, message: "Pedido no encontrado" };
   }
 
+  await ensureOrderAccess(order, auth);
+
   const acceptedAssignment = await prisma.deliveryAssignments.findFirst({
     where: {
       fk_order: id_order,

src/modules/delivery/delivery/delivery.controller.js

@@ -51,7 +51,7 @@ export const registerDelivery = async (req, res) => {
       return res.status(400).json({
         error: {
           code: 400,
-          message: error.issues[0]?.message ?? "Datos inválidos",
+          message: "Datos inválidos",
           details: error.issues,
         },
       });

src/modules/users/orders/order.service.js

@@ -861,6 +861,22 @@ export const updateOrderStatusService = async (authenticatedUserId, orderId, ord
     if (!customerOrder) throw new ForbiddenError("No tienes permisos para modificar este pedido.");
   }
 
+  if (user.role === "DELIVERY") {
+    const deliveryAssignment = await prisma.deliveryAssignments.findFirst({
+      where: {
+        fk_order: resolvedOrderId,
+        assignment_status: "ACCEPTED",
+        status: true,
+        delivery: { fk_user: resolvedUserId }
+      },
+      select: { id_delivery_assignment: true }
+    });
+
+    if (!deliveryAssignment) {
+      throw new ForbiddenError("No tienes permisos para modificar este pedido.");
+    }
+  }
+
   //validar transiciones permitidas por rol de user autenticado
   const isPickup = order.fk_address == null;
   const allowedTransitions = {

tests/e2e/delivery-assignments-create.test.js

@@ -80,6 +80,7 @@ describe("POST /api/assignments", () => {
     prisma.orders.findUnique.mockResolvedValue({
       id_order: 5,
       fk_store: 10,
+      store: { fk_user: 1 },
     });
 
     prisma.deliveries.findUnique.mockResolvedValue({
@@ -105,6 +106,7 @@ describe("POST /api/assignments", () => {
 
     mockTx.deliveries.findUnique.mockResolvedValue({
       id_delivery: 2,
+      fk_store: 10,
       delivery_status: "ACTIVE",
       status: true,
     });