From 45edaccb88feb33805c0710aa925e64c7f4ef75a Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Thu, 18 Jun 2026 16:10:52 +0000
Subject: [PATCH] Inline company portability authorization guard

---
 server/src/routes/companies.ts | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/server/src/routes/companies.ts b/server/src/routes/companies.ts
index d6fd3f02294..038ddaa8856 100644
--- a/server/src/routes/companies.ts
+++ b/server/src/routes/companies.ts
@@ -84,10 +84,6 @@ export function companyRoutes(db: Db, storage?: StorageService) {
     }
   }
 
-  async function assertCanManagePortability(req: Request, companyId: string, capability: "imports" | "exports") {
-    await assertSameCompanyCeoAgentOrBoard(req, companyId, `company ${capability}`);
-  }
-
   router.get("/", async (req, res) => {
     assertBoard(req);
     const result = await svc.list();
@@ -172,7 +168,7 @@ export function companyRoutes(db: Db, storage?: StorageService) {
 
   router.post("/:companyId/export", async (req, res) => {
     const companyId = req.params.companyId as string;
-    await assertCanManagePortability(req, companyId, "exports");
+    await assertSameCompanyCeoAgentOrBoard(req, companyId, "company exports");
     const body = companyPortabilityExportSchema.parse(req.body);
     const result = await portability.exportBundle(companyId, body);
     res.json(result);
@@ -232,7 +228,7 @@ export function companyRoutes(db: Db, storage?: StorageService) {
 
   router.post("/:companyId/exports/preview", async (req, res) => {
     const companyId = req.params.companyId as string;
-    await assertCanManagePortability(req, companyId, "exports");
+    await assertSameCompanyCeoAgentOrBoard(req, companyId, "company exports");
     const body = companyPortabilityExportSchema.parse(req.body);
     const preview = await portability.previewExport(companyId, body);
     res.json(preview);
@@ -240,7 +236,7 @@ export function companyRoutes(db: Db, storage?: StorageService) {
 
   router.post("/:companyId/exports", async (req, res) => {
     const companyId = req.params.companyId as string;
-    await assertCanManagePortability(req, companyId, "exports");
+    await assertSameCompanyCeoAgentOrBoard(req, companyId, "company exports");
     const body = companyPortabilityExportSchema.parse(req.body);
     const result = await portability.exportBundle(companyId, body);
     res.json(result);
@@ -248,7 +244,7 @@ export function companyRoutes(db: Db, storage?: StorageService) {
 
   router.post("/:companyId/imports/preview", async (req, res) => {
     const companyId = req.params.companyId as string;
-    await assertCanManagePortability(req, companyId, "imports");
+    await assertSameCompanyCeoAgentOrBoard(req, companyId, "company imports");
     const body = companyPortabilityPreviewSchema.parse(req.body);
     if (body.target.mode === "existing_company" && body.target.companyId !== companyId) {
       throw forbidden("Safe import route can only target the route company");
@@ -265,7 +261,7 @@ export function companyRoutes(db: Db, storage?: StorageService) {
 
   router.post("/:companyId/imports/apply", async (req, res) => {
     const companyId = req.params.companyId as string;
-    await assertCanManagePortability(req, companyId, "imports");
+    await assertSameCompanyCeoAgentOrBoard(req, companyId, "company imports");
     const body = companyPortabilityImportSchema.parse(req.body);
     if (body.target.mode === "existing_company" && body.target.companyId !== companyId) {
       throw forbidden("Safe import route can only target the route company");