Project

General

Profile

Edit Copy Actions

Bug #11770

open

Correct User Attribution & Null-Safety in Product Quote Admin Approval

Added by Yalavarthi Thriveni 5 days ago. Updated 5 days ago.

Status:
Resolved
Priority:
High
Target version:
-
Start date:
10/28/2026
Due date:
10/28/2026 (5 days late)
% Done:

100%

Estimated time:
1:00 h
Spent time:
Tested Date:
10/28/2026
Raised by Tester:
Page/ Module (POS):
Product Qoutations

Description

In the

acceptQuoteViaAdmin product quote controller.js file
endpoint:

When an administrator manually approves a product quotation, the audit trail records:

performedBy: quote.customer._id,
note: "Customer accepted product quotation"
This creates a false audit log claiming the customer accepted it directly, masking the admin's action (req.user.id).
If quote.customer is null or undefined (e.g., if the client profile was deleted or detached), dereferencing quote.customer._id throws an unhandled runtime error (TypeError: Cannot read property '_id' of null), crashing the request with a 500 error.

Acceptance Criteria
AC 1.1 (Accurate Attribution): Given an authenticated admin approves a product quotation via acceptQuoteViaAdmin, When the quote status updates to "approved", Then the actionHistory record MUST set performedBy to req.user.id (or userId) and the note MUST clearly state "Admin approved product quotation on behalf of customer".
AC 1.2 (Null-Safety): Given a product quotation whose customer reference is null or unpopulated, When an admin approves it, Then the operation MUST proceed without throwing a TypeError, falling back gracefully to null or a placeholder client reference.
AC 1.3 (Audit Log Inspection): When fetching action history via getActionHistory, the approval entry must render the admin's name/ID rather than the customer's.
3. Recommended Implementation Note
javascript
// Replace lines 2271-2281 with:
quote.actionHistory.push({
action: status === "approved" ? "admin_approved" : "draft",
performedBy: userId, // from req.user.id
note: status === "approved"
? `Admin approved product quotation on behalf of customer (${quote.customer?.firstName || "N/A"} ${quote.customer?.lastName || ""})`.trim()
: "Admin marked product quotation as draft",
timestamp: new Date(),
changes,
});


Files


Add

Subtasks


Add

Related issues

Actions #1

Updated by Yalavarthi Thriveni 5 days ago

  • Description updated (diff)
Edit Copy Actions

Also available in: Atom PDF