From 81d92e16bb9c70ff5971db7095297997787295da Mon Sep 17 00:00:00 2001
From: DeepnaPooja <poojathmideepna@gmail.com>
Date: Tue, 8 Sep 2026 16:07:28 +0530
Subject: [PATCH] Fix user ID handling in purchase return creation when auth is
 unavailable

---
 .../Features/PurchaseReturn/PurchaseReturnController.cs    | 7 +++++--
 Distribution/Features/PurchaseReturn/PurchaseReturnDTOs.cs | 6 +++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/Distribution/Features/PurchaseReturn/PurchaseReturnController.cs b/Distribution/Features/PurchaseReturn/PurchaseReturnController.cs
index 54285c9..8c8c0bb 100644
--- a/Distribution/Features/PurchaseReturn/PurchaseReturnController.cs
+++ b/Distribution/Features/PurchaseReturn/PurchaseReturnController.cs
@@ -20,10 +20,13 @@ public class PurchaseReturnController(PurchaseReturnService service, ICurrentUse
     [HttpPost("api/purchase-orders/{id:guid}/returns")]
     public async Task<IActionResult> Create(Guid id, CreatePurchaseReturnRequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
+        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
+        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
+        var userId = currentUser.UserId ?? request.CreatedByUserId;
+        if (userId is null) return BadRequest(new { error = "CreatedByUserId is required while auth is unavailable" });
         try
         {
-            var result = await service.CreateAsync(id, request, userId, ct);
+            var result = await service.CreateAsync(id, request, userId.Value, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
diff --git a/Distribution/Features/PurchaseReturn/PurchaseReturnDTOs.cs b/Distribution/Features/PurchaseReturn/PurchaseReturnDTOs.cs
index cc5ed88..aade556 100644
--- a/Distribution/Features/PurchaseReturn/PurchaseReturnDTOs.cs
+++ b/Distribution/Features/PurchaseReturn/PurchaseReturnDTOs.cs
@@ -2,7 +2,11 @@ namespace Distribution.Features.PurchaseReturn;
 
 public record PurchaseReturnItemRequest(Guid ItemId, int Quantity);
 
-public record CreatePurchaseReturnRequest(string Reason, List<PurchaseReturnItemRequest> Items);
+public record CreatePurchaseReturnRequest(
+    string Reason,
+    List<PurchaseReturnItemRequest> Items,
+    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
+    Guid? CreatedByUserId = null);
 
 public record PurchaseReturnItemResponse(Guid Id, Guid ItemId, string Sku, string ItemName, int Quantity);