proposal-system/api/src/ProposalSystem.Api/Controllers/VendorProposalsController.cs
Adam Moussa 8d73e66a17 fix(api): API-M2, M5, M7, M9, M10, M12, M13 — Medium audit findings
- API-M2: Add comment for fail-loud auth config guard (already implemented)
- API-M5: Add FluentValidation validators for VendorProposal, GeneratedPdf,
  and SimilarReference DTOs; move request records to Application DTOs
- API-M7: Add AsNoTracking() to all read-only queries in ProposalService,
  LineItemService, AdminController, UsersController, FilesController
- API-M9: Log stderr from dev PDF generation instead of returning to client
- API-M10: Return generic "Authentication service unavailable" in auth
  callbacks instead of leaking Cognito/DevMode configuration state
- API-M12: Enrich audit logging with before/after values for status changes,
  proposal edits, and line item operations using structured JSON
- API-M13: Log previous role alongside new role on user role changes in
  both UsersController and Cognito-synced role updates in AuthController
2026-05-27 18:18:44 -04:00

66 lines
2.2 KiB
C#

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using ProposalSystem.Application.DTOs;
using ProposalSystem.Domain.Entities;
using ProposalSystem.Infrastructure.Data;
namespace ProposalSystem.Api.Controllers;
[ApiController]
[Route("api/vendor-proposals")]
[Authorize(Roles = "admins,sysadmins")]
public class VendorProposalsController : ControllerBase
{
private readonly ProposalDbContext _db;
public VendorProposalsController(ProposalDbContext db)
{
_db = db;
}
[HttpPut("{id:guid}")]
public async Task<IActionResult> Update(Guid id, [FromBody] UpdateVendorProposalRequest request, CancellationToken ct)
{
var vendor = await _db.VendorProposals.FindAsync(new object[] { id }, ct);
if (vendor == null) return NotFound();
if (request.VendorName != null)
vendor.VendorName = request.VendorName;
if (request.ExtractedData != null)
vendor.ExtractedData = request.ExtractedData;
if (request.TotalVendorCost.HasValue)
vendor.TotalVendorCost = request.TotalVendorCost.Value;
if (request.ProcessingStatus != null && Enum.TryParse<ProcessingStatus>(request.ProcessingStatus, out var status))
vendor.ProcessingStatus = status;
await _db.SaveChangesAsync(ct);
var proposal = await _db.Proposals.FindAsync(new object[] { vendor.ProposalId }, ct);
if (proposal != null)
{
proposal.VendorTotalCost = await _db.VendorProposals
.Where(v => v.ProposalId == vendor.ProposalId)
.SumAsync(v => v.TotalVendorCost, ct);
await _db.SaveChangesAsync(ct);
}
return NoContent();
}
[HttpPut("{id:guid}/status")]
public async Task<IActionResult> UpdateStatus(Guid id, [FromBody] UpdateStatusRequest request, CancellationToken ct)
{
var vendor = await _db.VendorProposals.FindAsync(new object[] { id }, ct);
if (vendor == null) return NotFound();
if (Enum.TryParse<ProcessingStatus>(request.ProcessingStatus, out var status))
vendor.ProcessingStatus = status;
await _db.SaveChangesAsync(ct);
return NoContent();
}
}