Fix: refuse borrowing against another member's membership

Library-Management-System-Version-2/src/main/java/app/adapters/input/rest/TransactionController.java

@@ -93,12 +93,21 @@ public ResponseEntity<TransactionResponse> returnBook(@PathVariable UUID bookId,
         }
     }
 
+    /** Only the member themselves or an administrator may borrow against a membership. */
     @PostMapping(value = "/borrowBook/{customerId}/{bookId}",
             produces = {"application/transaction-response+json;version=1", MediaType.APPLICATION_JSON_VALUE})
     @Operation(summary = "Borrow a book")
     public ResponseEntity<String> borrowBook(
             @PathVariable UUID customerId,
-            @PathVariable UUID bookId) {
+            @PathVariable UUID bookId,
+            Authentication authentication) {
+        // The customer id comes from the path, so without this a member could borrow against
+        // somebody else's membership and spend their loan limit. Matches returnBook and extendLoan.
+        if (!isAdmin(authentication) && !isOwner(authentication, customerId)) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body("You can only borrow against your own membership.");
+        }
+
         try {
             transactionUseCase.borrowBook(customerId, bookId);
             return ResponseEntity.ok("Book borrowed successfully.");

Library-Management-System-Version-2/src/test/java/app/adapters/input/TransactionControllerTestIT.java

@@ -125,6 +125,7 @@ void testCreateNewTransaction_BadRequest() throws Exception {
                 .andExpect(status().isBadRequest());
     }
     @Test
+    @WithMockUser(username = "member")
     void testBorrowBook() throws Exception {
         UUID customerId = customer.getCustomerId();
         UUID bookId = book.getBookId();
@@ -137,6 +138,7 @@ void testBorrowBook() throws Exception {
         assertEquals(1, transactionCount);
     }
     @Test
+    @WithMockUser(username = "member")
     void testBorrowBook_bookNotAvailable() throws Exception {
         UUID customerId = customer.getCustomerId();
         UUID bookId = book.getBookId();
@@ -292,4 +294,16 @@ public void tearDown() {
         bookRepository.deleteAll();
         authorRepository.deleteAll();
     }
+
+    /** A member borrowing against somebody else's membership would spend their loan limit. */
+    @Test
+    @WithMockUser(username = "member", roles = "USER")
+    void borrowingAgainstAnotherMembershipIsRefused() throws Exception {
+        Customer otherMember = customerUseCase.createNewCustomer(
+                new CreateNewCustomer("Someone Else", "someone.else@example.com", true));
+
+        mockMvc.perform(post("/transactions/borrowBook/" + otherMember.getCustomerId() + "/"
+                        + book.getBookId()))
+                .andExpect(status().isForbidden());
+    }
 }