feat(auth): gate and regate freight API controllers

Gates the previously open support-agent, procurement, compliance,
facilities, list-users and trade-access controllers, separates customer
from staff routes across bookings, contracts, companies, billing,
warehouses, files and train scheduling, and moves billing, overview,
reports and the settings controllers onto their own keys instead of the
blanket admin key. Drops the demo-permissions module and the untested
notification test route.

apps/edr-freight-api/src/modules/companies/companies.controller.ts

@@ -11,7 +11,6 @@ import {
   HttpCode,
   HttpStatus,
   UseInterceptors,
-  UseGuards,
   UploadedFiles,
   BadRequestException,
   NotFoundException,
@@ -20,8 +19,7 @@ import { AnyFilesInterceptor } from "@nestjs/platform-express";
 import { ApiOperation, ApiTags, ApiConsumes } from "@nestjs/swagger";
 import { CurrentUser } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
-import { JwtGuard } from "@tria-plc/api-common/modules/auth/services/jwt.guard";
-import { BookingStaff } from "../../common/booking-guards";
+import { BookingStaff, MixedAudience, PortalCustomer } from "../../common/booking-guards";
 import {
   assertFreightPermission,
   hasFreightPermission,
@@ -118,6 +116,7 @@ export class CompaniesController {
   }
 
   @Get("getInfo")
+  @PortalCustomer()
   @ApiOperation({ summary: "Get company info for the current user" })
   async getInfo(
     @CurrentUser() user: CurrentIamUser,
@@ -131,6 +130,7 @@ export class CompaniesController {
   }
 
   @Get("profile")
+  @PortalCustomer()
   @ApiOperation({ summary: "Get flattened profile for the settings page" })
   async getProfile(
     @CurrentUser() user: CurrentIamUser,
@@ -146,6 +146,7 @@ export class CompaniesController {
   }
 
   @Get("profile/change-request")
+  @PortalCustomer()
   @ApiOperation({
     summary: "Current user's open profile change request (pending/rejected)",
   })
@@ -161,6 +162,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles/:profileId/reapply")
+  @PortalCustomer()
   @ApiOperation({
     summary: "Resubmit a rejected operational role for approval (→ pending)",
   })
@@ -176,6 +178,7 @@ export class CompaniesController {
   }
 
   @Get("dashboard")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Get portal dashboard KPIs (delivered, spend, freight volume) for the current user",
@@ -191,6 +194,7 @@ export class CompaniesController {
   }
 
   @Post("fetch-etrade-info")
+  @PortalCustomer()
   @ApiOperation({ summary: "Fetch company info from eTrade by TIN" })
   async fetchETradeInfo(
     @CurrentUser() user: CurrentIamUser,
@@ -211,6 +215,7 @@ export class CompaniesController {
   }
 
   @Patch("profile")
+  @PortalCustomer()
   @ApiOperation({ summary: "Update profile (flattened settings page)" })
   async updateProfile(
     @CurrentUser() user: CurrentIamUser,
@@ -220,6 +225,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Add operational profile(s) (importer/exporter/forwarder) to the current user's company",
@@ -236,6 +242,7 @@ export class CompaniesController {
   }
 
   @Post("onboarding/start")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Begin onboarding: create a draft company + profile + role(s) so later steps can save incrementally",
@@ -261,6 +268,7 @@ export class CompaniesController {
   }
 
   @Post("company-profile")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Create a single operational profile for the current user's company. The role starts pending and does not become the active mode",
@@ -278,6 +286,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles/:profileId/license")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -298,6 +307,7 @@ export class CompaniesController {
   }
 
   @Post("company-profiles/:profileId/license/:fileId/replace")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -324,6 +334,7 @@ export class CompaniesController {
   }
 
   @Delete("company-profiles/:profileId/license/:fileId")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Remove a business-license file (staged for review on an approved company).",
@@ -341,6 +352,7 @@ export class CompaniesController {
   }
 
   @Get("company-profiles/:profileId/license")
+  @PortalCustomer()
   @ApiOperation({
     summary: "List business-license documents (with review state) for a profile",
   })
@@ -352,6 +364,7 @@ export class CompaniesController {
   }
 
   @Get("poa-delegation")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "List the Power of Attorney delegation letter (with review state) for the current user's company",
@@ -363,6 +376,7 @@ export class CompaniesController {
   }
 
   @Post("poa-delegation")
+  @PortalCustomer()
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({
@@ -383,6 +397,7 @@ export class CompaniesController {
   }
 
   @Delete("poa-delegation/:fileId")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Remove the Power of Attorney delegation letter (staged for review on an approved company).",
@@ -395,6 +410,7 @@ export class CompaniesController {
   }
 
   @Post("identity/fayda/complete")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Bind a completed Fayda verification to the company's owner or Power of Attorney. " +
@@ -409,6 +425,7 @@ export class CompaniesController {
   }
 
   @Post("identity/gm/same-as-owner")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Declare the General Manager is the company's owner, copying the owner's verified identity across. " +
@@ -421,6 +438,7 @@ export class CompaniesController {
   }
 
   @Delete("identity/gm")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Clear the General Manager's identity — the \"same as owner\" declaration or a verification, and the details either wrote. " +
@@ -433,6 +451,7 @@ export class CompaniesController {
   }
 
   @Delete("identity/fayda/poa")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Remove the company's Power of Attorney — the verified identity, its details and the delegation paper together. " +
@@ -445,6 +464,7 @@ export class CompaniesController {
   }
 
   @Patch("onboarding-step")
+  @PortalCustomer()
   @ApiOperation({ summary: "Persist the user's current onboarding wizard step" })
   @HttpCode(HttpStatus.NO_CONTENT)
   async setOnboardingStep(
@@ -455,6 +475,7 @@ export class CompaniesController {
   }
 
   @Get("onboarding/requirements")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "What the current user's company still needs to finish onboarding (server-driven documents + outstanding items)",
@@ -466,6 +487,7 @@ export class CompaniesController {
   }
 
   @Post("onboarding/complete")
+  @PortalCustomer()
   @ApiOperation({ summary: "Mark the current user's onboarding as complete" })
   async completeOnboarding(
     @CurrentUser() user: CurrentIamUser,
@@ -477,6 +499,7 @@ export class CompaniesController {
 
   // Used by portal
   @Post("create")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Create a company with its associated external profile (onboarding)",
@@ -591,7 +614,11 @@ export class CompaniesController {
    * permission still needs the applicant's documents.
    */
   @Get(":companyId/documents")
-  @UseGuards(JwtGuard)
+  @MixedAudience([
+    FREIGHT_PERMS.customers.view,
+    FREIGHT_PERMS.contracts.view,
+    FREIGHT_PERMS.bookings.view,
+  ])
   @ApiOperation({ summary: "List documents uploaded for a company" })
   async listDocuments(
     @Param("companyId", ParseUUIDPipe) companyId: string,
@@ -661,6 +688,7 @@ export class CompaniesController {
   }
 
   @Post(":companyId/documents")
+  @MixedAudience(FREIGHT_PERMS.customers.update)
   @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes("multipart/form-data")
   @ApiOperation({ summary: "Upload documents for a company (onboarding)" })