From 0281b08374e3f6dda0449d5e1a28e1d1134ed706 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernardo=20Jord=C3=A3o?=
 <bernardo.jordao@tecnico.ulisboa.pt>
Date: Thu, 28 Aug 2025 12:45:48 +0100
Subject: [PATCH] verify createPlatform permissions

---
 apps/api/src/app/import/import.controller.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/apps/api/src/app/import/import.controller.ts b/apps/api/src/app/import/import.controller.ts
index 2681444df..3b223b4fe 100644
--- a/apps/api/src/app/import/import.controller.ts
+++ b/apps/api/src/app/import/import.controller.ts
@@ -56,6 +56,17 @@ export class ImportController {
       );
     }
 
+    if (
+      importData.platforms &&
+      importData.platforms.length > 0 &&
+      !hasPermission(this.request.user.permissions, permissions.createPlatform)
+    ) {
+      throw new HttpException(
+        getReasonPhrase(StatusCodes.FORBIDDEN),
+        StatusCodes.FORBIDDEN
+      );
+    }
+
     let maxActivitiesToImport = this.configurationService.get(
       'MAX_ACTIVITIES_TO_IMPORT'
     );