pembatasan akses delete dari pengelola rumah ibadah dan fitur upload bukti penyerahan bantuan

api/distributionRouter.ts

@@ -59,6 +59,7 @@ export const distributionRouter = createRouter({
         quantity: z.number().min(1).default(1),
         unit: z.string().default("package"),
         notes: z.string().optional(),
+        handoverPhoto: z.string().min(1),
       })
     )
     .mutation(async ({ input, ctx }) => {
@@ -77,6 +78,7 @@ export const distributionRouter = createRouter({
         amount: input.amount.toString(),
         distributedBy: input.distributedBy ?? null,
         notes: input.notes ?? null,
+        handoverPhoto: input.handoverPhoto,
       });
 
       if (created) {

api/recipientRouter.ts

@@ -250,13 +250,10 @@ export const recipientRouter = createRouter({
       }
 
       if (ctx.user.role === "manager") {
-        const placeIds = await findPlaceIdsByManagerId(ctx.user.id);
-        if (!placeIds.includes(target.placeOfWorshipId)) {
-          throw new TRPCError({
-            code: "FORBIDDEN",
-            message: "Anda tidak berwenang menghapus data penerima ini.",
-          });
-        }
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Pengelola rumah ibadah tidak berwenang menghapus data penerima.",
+        });
       }
 
       await deleteRecipient(input.id);