fix(f4): restrict SMTP administration to system admin

api-v3/src/inspection-reports/document-delivery.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post, Put, Req } from '@nestjs/common';
+import { Body, Controller, ForbiddenException, Get, Param, ParseUUIDPipe, Patch, Post, Put, Req } from '@nestjs/common';
 import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
 import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
 import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
@@ -37,7 +37,8 @@ export class DocumentDeliveryController {
 
   @Get('smtp')
   @RequirePermissions('document_delivery.manage')
-  smtpSettings() {
+  smtpSettings(@CurrentAuth() principal: AuthPrincipal) {
+    this.assertSystemAdmin(principal);
     return this.smtp.publicSettings();
   }
 
@@ -48,6 +49,7 @@ export class DocumentDeliveryController {
     @CurrentAuth() principal: AuthPrincipal,
     @Req() request: RequestWithContext,
   ) {
+    this.assertSystemAdmin(principal);
     const before = await this.smtp.publicSettings();
     const after = await this.smtp.saveSettings(dto, principal.userId);
     await this.audit.record({
@@ -57,7 +59,7 @@ export class DocumentDeliveryController {
       entityId: 'singleton',
       beforeData: before as Record<string, unknown>,
       afterData: after as Record<string, unknown>,
-      metadata: { passwordNeverReturned: true },
+      metadata: { passwordNeverReturned: true, restrictedToRole: 'admin' },
     });
     return after;
   }
@@ -69,6 +71,7 @@ export class DocumentDeliveryController {
     @CurrentAuth() principal: AuthPrincipal,
     @Req() request: RequestWithContext,
   ) {
+    this.assertSystemAdmin(principal);
     const sent = await this.smtp.send({
       to: dto.email,
       subject: 'DH Inspección · Prueba SMTP',
@@ -85,6 +88,7 @@ export class DocumentDeliveryController {
       entityType: 'system_smtp_settings',
       entityId: 'singleton',
       afterData: { recipient: dto.email, messageId: sent.messageId },
+      metadata: { restrictedToRole: 'admin' },
     });
     return { ok: true, recipient: dto.email, messageId: sent.messageId };
   }
@@ -113,4 +117,12 @@ export class DocumentDeliveryController {
   ) {
     return this.delivery.retryPending(principal, request);
   }
+
+  private assertSystemAdmin(principal: AuthPrincipal): void {
+    if (principal.roles.includes('admin')) return;
+    throw new ForbiddenException({
+      code: 'SMTP_SUPERADMIN_REQUIRED',
+      message: 'La configuración SMTP está reservada al Superadmin del sistema',
+    });
+  }
 }