fix mượn trả

backend/server.js

@@ -3230,42 +3230,67 @@ app.post('/api/asset-borrows/:id/process', requireAssetOrAdmin, async (req, res)
     }
 });
 
-app.delete('/api/asset-borrows/:id', requireAssetOrAdmin, async (req, res) => {
+app.delete('/api/asset-borrows/:id', async (req, res) => {
     try {
+        const requesterRole = normalizeRole(req.headers['x-user-role'] || req.query.userRole);
+        const requesterId = getUserIdFromRequest(req);
+        const canManageRequests = requesterRole === 'admin' || requesterRole === 'asset';
         const borrowId = Number(req.params.id);
+
         if (!Number.isInteger(borrowId) || borrowId <= 0) {
-            return res.status(400).json({ success: false, message: 'Mã đơn không hợp lệ' });
+            return res.status(400).json({ success: false, message: 'Ma don khong hop le' });
+        }
+
+        if (!canManageRequests && (!Number.isInteger(requesterId) || requesterId <= 0)) {
+            return res.status(401).json({ success: false, message: 'Yeu cau xac thuc nguoi dung' });
         }
 
         const deleteResult = await pool.request()
             .input('borrowId', sql.Int, borrowId)
+            .input('requesterId', sql.Int, requesterId || -1)
             .query(`
                 DELETE FROM AssetBorrowRequests
                 OUTPUT DELETED.BorrowId
                 WHERE BorrowId = @borrowId
                   AND LOWER(LTRIM(RTRIM(ISNULL(RequestStatus, '')))) = 'pending'
+                  ${canManageRequests ? '' : 'AND CreatedBy = @requesterId'}
             `);
 
         if (Array.isArray(deleteResult.recordset) && deleteResult.recordset.length > 0) {
-            return res.json({ success: true, message: 'Đã xóa đơn chờ' });
+            return res.json({ success: true, message: 'Da huy don cho' });
         }
 
         const existed = await pool.request()
             .input('borrowId', sql.Int, borrowId)
             .query(`
-                SELECT TOP 1 BorrowId, RequestStatus
+                SELECT TOP 1 BorrowId, RequestStatus, CreatedBy
                 FROM AssetBorrowRequests
                 WHERE BorrowId = @borrowId
             `);
 
         const row = existed.recordset?.[0];
         if (!row) {
-            return res.status(404).json({ success: false, message: 'Không tìm thấy đơn cần xóa' });
+            return res.status(404).json({ success: false, message: 'Khong tim thay don can xoa' });
+        }
+
+        if (!canManageRequests && Number(row.CreatedBy) !== requesterId) {
+            return res.status(403).json({
+                success: false,
+                message: 'Ban chi duoc huy don do chinh minh tao'
+            });
+        }
+
+        const currentStatus = normalizeAssetRequestStatus(row.RequestStatus);
+        if (currentStatus !== 'pending') {
+            return res.status(400).json({
+                success: false,
+                message: 'Chi duoc huy don o trang thai cho xu ly'
+            });
         }
 
         return res.status(400).json({
             success: false,
-            message: 'Chỉ được xóa đơn ở trạng thái chờ xử lý'
+            message: 'Khong the huy don vao luc nay'
         });
     } catch (err) {
         return res.status(500).json({ success: false, message: err.message });