From 3a22534c04c7c2be65156d08113e7b5b58f8e93e Mon Sep 17 00:00:00 2001 From: counterweight Date: Tue, 23 Dec 2025 10:37:32 +0100 Subject: [PATCH] fix: Use COMPLETE_EXCHANGE permission for complete/no-show endpoints The complete_trade and mark_no_show endpoints now use the dedicated COMPLETE_EXCHANGE permission instead of CANCEL_ANY_EXCHANGE, which better reflects the semantics of these operations. --- backend/routes/exchange.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/routes/exchange.py b/backend/routes/exchange.py index cd2f07a..26b2603 100644 --- a/backend/routes/exchange.py +++ b/backend/routes/exchange.py @@ -684,7 +684,7 @@ async def get_past_trades( async def complete_trade( exchange_id: int, db: AsyncSession = Depends(get_db), - _current_user: User = Depends(require_permission(Permission.CANCEL_ANY_EXCHANGE)), + _current_user: User = Depends(require_permission(Permission.COMPLETE_EXCHANGE)), ) -> AdminExchangeResponse: """Mark a trade as completed. Only possible after slot time has passed.""" @@ -730,7 +730,7 @@ async def complete_trade( async def mark_no_show( exchange_id: int, db: AsyncSession = Depends(get_db), - _current_user: User = Depends(require_permission(Permission.CANCEL_ANY_EXCHANGE)), + _current_user: User = Depends(require_permission(Permission.COMPLETE_EXCHANGE)), ) -> AdminExchangeResponse: """Mark a trade as no-show. Only possible after slot time has passed."""