salix/modules/worker/back/methods/worker-time-control/deleteTimeEntry.js

const UserError = require('vn-loopback/util/user-error');

module.exports = Self => {
    Self.remoteMethodCtx('deleteTimeEntry', {
        description: 'Deletes a manual time entry for a worker if the user role is above the worker',
        accessType: 'READ',
        accepts: [{
            arg: 'id',
            type: 'number',
            required: true,
            description: 'The time entry id',
            http: {source: 'path'}
        }],
        returns: {
            type: 'boolean',
            root: true
        },
        http: {
            path: `/:id/deleteTimeEntry`,
            verb: 'POST'
        }
    });

    Self.deleteTimeEntry = async(ctx, id, options) => {
        const currentUserId = ctx.req.accessToken.userId;
        const models = Self.app.models;

        let myOptions = {};

        if (typeof options == 'object')
            Object.assign(myOptions, options);

        const targetTimeEntry = await Self.findById(id, null, myOptions);
        const isSubordinate = await models.Worker.isSubordinate(ctx, targetTimeEntry.userFk, myOptions);
        const isTeamBoss = await models.Account.hasRole(currentUserId, 'teamBoss', myOptions);
        const isHimself = currentUserId == targetTimeEntry.userFk;

        if (isSubordinate === false || (isSubordinate && isHimself && !isTeamBoss))
            throw new UserError(`You don't have enough privileges`);

        return Self.rawSql('CALL vn.workerTimeControl_remove(?, ?)', [
            targetTimeEntry.userFk, targetTimeEntry.timed], myOptions);
    };
};