fix and update

apps/sso-core/src/domain/media.service.ts

@@ -251,7 +251,7 @@ export class MediaService {
   }
 
   async getChatMediaAccessUrl(requesterId: string, roomId: string, storageKey: string, fileName?: string) {
-    await this.assertChatMember(roomId, requesterId);
+    await this.assertChatMemberOrModerator(roomId, requesterId);
     if (!storageKey.startsWith(`chat/${roomId}/`)) {
       throw new BadRequestException('Некорректный ключ медиафайла');
     }
@@ -379,6 +379,27 @@ export class MediaService {
     }
   }
 
+  private async assertChatMemberOrModerator(roomId: string, userId: string) {
+    const member = await this.prisma.chatRoomMember.findFirst({ where: { roomId, userId } });
+    if (member) {
+      return;
+    }
+
+    const user = await this.prisma.user.findUnique({ where: { id: userId } });
+    if (!user) {
+      throw new ForbiddenException('Нет доступа к чату');
+    }
+    const access = await this.access.getUserAccess(userId, user.isSuperAdmin);
+    if (!access.canModerateChats) {
+      throw new ForbiddenException('Нет доступа к чату');
+    }
+
+    const room = await this.prisma.chatRoom.findUnique({ where: { id: roomId } });
+    if (!room || room.isE2E || room.type === 'E2E' || room.type === 'BOT') {
+      throw new ForbiddenException('Этот чат недоступен для модерации');
+    }
+  }
+
   private async publishUserAvatarUpdated(userId: string) {
     const memberships = await this.prisma.familyMember.findMany({
       where: { userId },