tweaks

scripts/api-check.js

@@ -194,6 +194,20 @@ async function run(port) {
 
   const dealerToken = await approveDealer('94772222222', adminToken);
 
+  const ownStock = await request(port, 'POST', '/api/stocks', {
+    token: dealerToken,
+    body: {
+      chassisNumber: 'CH-OWN',
+      engineNumber: 'EN-OWN',
+      model: 'gn125',
+      color: 'Red',
+      currentDealerId: dealerA.json.data.id,
+    },
+  });
+  assert(
+    ownStock.status === 201 && ownStock.json.data.currentDealerId === dealerA.json.data.id,
+    `dealer should add stock to their own dealership ${ownStock.status}`
+  );
   const forbiddenStock = await request(port, 'POST', '/api/stocks', {
     token: dealerToken,
     body: {
@@ -201,10 +215,10 @@ async function run(port) {
       engineNumber: 'ENG-NOPE',
       model: 'gn125',
       color: 'Red',
-      currentDealerId: dealerA.json.data.id,
+      currentDealerId: dealerB.json.data.id,
     },
   });
-  assert(forbiddenStock.status === 403, 'dealer should not add stock');
+  assert(forbiddenStock.status === 403, 'dealer should not add stock to another dealership');
 
   async function addStock(chassis, engine, days, dealerId) {
     const created = await request(port, 'POST', '/api/stocks', {

src/routes/stocks.js

@@ -42,15 +42,23 @@ router.get(
 
 router.post(
   '/',
-  requireRole('salesRep', 'superAdmin'),
+  requireRole('dealer', 'salesRep', 'superAdmin'),
   asyncHandler(async (req, res) => {
     const chassisNumber = String(req.body?.chassisNumber || '').trim();
     const engineNumber = String(req.body?.engineNumber || '').trim();
     const model = String(req.body?.model || '').trim();
     const color = String(req.body?.color || '').trim();
-    const currentDealerId = String(req.body?.currentDealerId || '').trim();
+    let currentDealerId = String(req.body?.currentDealerId || '').trim();
     const dateReceived = req.body?.dateReceived ? new Date(req.body.dateReceived) : new Date();
 
+    if (req.user.role === 'dealer') {
+      if (!req.user.dealerId) throw httpError(403, 'Forbidden');
+      if (currentDealerId && currentDealerId !== req.user.dealerId) {
+        throw httpError(403, 'Forbidden');
+      }
+      currentDealerId = req.user.dealerId;
+    }
+
     if (!chassisNumber || !engineNumber || !color || !currentDealerId) {
       throw httpError(400, 'Chassis, engine, color, and dealer are required');
     }