From 1bb9f38d56c6719f1bd922e8898437fc6c87aba0 Mon Sep 17 00:00:00 2001 From: Ying Date: Sat, 4 Jul 2026 11:54:25 +0100 Subject: [PATCH] fix: prevent mentees from self-approving via profileStatus Mark Mentee.profileStatus as read-only for deserialization so a client cannot set or change their approval status through the public mentee registration payload. Status is now managed server-side (defaults to PENDING on creation, changed only via the admin approval flow), mirroring the existing protection on MentorDto. Closes #727 --- .../wcc/platform/domain/platform/mentorship/Mentee.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/main/java/com/wcc/platform/domain/platform/mentorship/Mentee.java b/src/main/java/com/wcc/platform/domain/platform/mentorship/Mentee.java index e054c001..16d45f23 100644 --- a/src/main/java/com/wcc/platform/domain/platform/mentorship/Mentee.java +++ b/src/main/java/com/wcc/platform/domain/platform/mentorship/Mentee.java @@ -1,5 +1,6 @@ package com.wcc.platform.domain.platform.mentorship; +import com.fasterxml.jackson.annotation.JsonProperty; import com.wcc.platform.domain.cms.attributes.Country; import com.wcc.platform.domain.cms.attributes.Image; import com.wcc.platform.domain.cms.attributes.PronounCategory; @@ -29,6 +30,12 @@ @SuppressWarnings({"PMD.ExcessiveParameterList", "PMD.ImmutableField"}) public class Mentee extends Member { + /** + * Approval status of the mentee. Read-only over the API: clients cannot set or change it through + * the registration payload; it is managed server-side (defaults to PENDING on creation and is + * only changed via the admin approval flow). + */ + @JsonProperty(access = JsonProperty.Access.READ_ONLY) private ProfileStatus profileStatus; @NotNull(message = "Skills must be provided")