feat(purchase

internal/validator/purchase_order_validator.go

@@ -193,6 +193,21 @@ func validatePurchaseTeamSelection(scope *string, categoryID *uuid.UUID, allowCl
 	return nil, ""
 }
 
+// validatePurchaseTeamFilter accepts the values the team picker hands back: Pusat,
+// no team at all, or the id of the parent category a purchase is charged to.
+func validatePurchaseTeamFilter(team string) (error, string) {
+	switch team {
+	case constants.PurchaseTeamScopeCentral, constants.PurchaseTeamNone:
+		return nil, ""
+	}
+
+	if categoryID, err := uuid.Parse(team); err != nil || categoryID == uuid.Nil {
+		return errors.New("team must be one of: central, none, or a category id"), constants.MalformedFieldErrorCode
+	}
+
+	return nil, ""
+}
+
 func (v *PurchaseOrderValidatorImpl) ValidateListPurchaseOrdersRequest(req *contract.ListPurchaseOrdersRequest) (error, string) {
 	if req == nil {
 		return errors.New("request body is required"), constants.MissingFieldErrorCode
@@ -213,6 +228,16 @@ func (v *PurchaseOrderValidatorImpl) ValidateListPurchaseOrdersRequest(req *cont
 		}
 	}
 
+	if req.Team != "" {
+		if req.TeamScope != "" || req.TeamCategoryID != nil {
+			return errors.New("team cannot be combined with team_scope or team_category_id"), constants.MalformedFieldErrorCode
+		}
+
+		if err, code := validatePurchaseTeamFilter(req.Team); err != nil {
+			return err, code
+		}
+	}
+
 	if req.TeamScope != "" {
 		validScopes := []string{constants.PurchaseTeamScopeCategory, constants.PurchaseTeamScopeCentral}
 		if !contains(validScopes, req.TeamScope) {