Multi-Tenant Branch & Multi-Level Approval Engine

// Branch RBAC Guard & Multi-Level Approval Engine di NestJS
@Injectable()
export class BranchRbacGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<string[]>('roles', [
      context.getHandler(),
      context.getClass(),
    ]);
    const request = context.switchToHttp().getRequest();
    const user = request.user;

    if (!user || !user.branchId) {
      throw new UnauthorizedException('Konteks cabang dan kredensial pengguna tidak valid');
    }

    // Superadmin HQ memiliki akses bypass lintas cabang
    if (user.role === 'superadmin') return true;

    // Validasi izin peran (RBAC)
    if (requiredRoles && !requiredRoles.includes(user.role)) {
      throw new ForbiddenException('Akses ditolak: peran Anda tidak berwenang mengeksekusi aksi cabang ini');
    }

    return true;
  }
}

@Injectable()
export class OrderApprovalWorkflowService {
  constructor(@InjectRepository(ServiceOrder) private orderRepo: Repository<ServiceOrder>) {}

  async advanceApprovalStep(orderId: string, user: AuthenticatedUser, step: 'NOC' | 'FINANCE'): Promise<ServiceOrder> {
    const order = await this.orderRepo.findOneBy({ id: orderId });
    if (!order) throw new NotFoundException('SPK Order tidak ditemukan');

    if (step === 'NOC') {
      if (user.role !== 'noc_engineer') throw new ForbiddenException('Hanya NOC yang berwenang approve kelayakan fiber');
      order.nocApprovedAt = new Date();
      order.status = 'NOC_VERIFIED';
    } else if (step === 'FINANCE') {
      if (user.role !== 'finance_lead') throw new ForbiddenException('Hanya Finance yang berwenang approve diskon');
      order.financeApprovedAt = new Date();
      order.status = 'READY_FOR_DISPATCH';
    }

    return this.orderRepo.save(order);
  }
}