implement freight permissions for trains, wagons, and routes

apps/edr-freight-api/src/modules/trains/train-builder.controller.ts

@@ -15,6 +15,7 @@ import {
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
 import { FleetManage, FleetView } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { AssignTrainWagonsDto } from './dto/assign-train-wagons.dto';
 import { BuildTrainDto } from './dto/build-train.dto';
 import { ListBuiltTrainsQueryDto } from './dto/list-built-trains-query.dto';
@@ -27,12 +28,12 @@ import { TrainBuilderService } from './train-builder.service';
 @ApiTags('train-builder')
 @ApiBearerAuth()
 @Controller('train-builder')
-@FleetView()
+@FleetView(FREIGHT_PERMS.trains.view)
 export class TrainBuilderController {
   constructor(private readonly trainBuilderService: TrainBuilderService) {}
 
   @Post()
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.create)
   @ApiOperation({ summary: 'Build a train: code + yard + 2+ locomotives (+ optional wagons)' })
   build(@Body() dto: BuildTrainDto) {
     return this.trainBuilderService.buildTrain(dto);
@@ -60,7 +61,7 @@ export class TrainBuilderController {
   }
 
   @Put(':id/locomotives')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.update)
   @ApiOperation({ summary: 'Replace the locomotive set (minimum 2, same yard)' })
   setLocomotives(
     @Param('id', ParseUUIDPipe) id: string,
@@ -70,7 +71,7 @@ export class TrainBuilderController {
   }
 
   @Patch(':id/details')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.update)
   @ApiOperation({
     summary: "Edit the train's name and fixed import/export run numbers",
   })
@@ -82,7 +83,7 @@ export class TrainBuilderController {
   }
 
   @Patch(':id/yard')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.update)
   @ApiOperation({
     summary: 'Relocate the train — its locomotives and wagons move to the new yard with it',
   })
@@ -91,14 +92,14 @@ export class TrainBuilderController {
   }
 
   @Post(':id/wagons')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.assignWagons)
   @ApiOperation({ summary: "Append AVAILABLE wagons from the train's yard to the consist" })
   assignWagons(@Param('id', ParseUUIDPipe) id: string, @Body() dto: AssignTrainWagonsDto) {
     return this.trainBuilderService.assignWagons(id, dto);
   }
 
   @Delete(':id/wagons/:wagonId')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.assignWagons)
   @ApiOperation({ summary: 'Detach one wagon from the consist' })
   removeWagon(
     @Param('id', ParseUUIDPipe) id: string,
@@ -108,7 +109,7 @@ export class TrainBuilderController {
   }
 
   @Post(':id/wagons/:wagonId/maintenance')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.assignWagons)
   @ApiOperation({ summary: 'Detach one wagon and move it to MAINTENANCE status' })
   sendWagonToMaintenance(
     @Param('id', ParseUUIDPipe) id: string,
@@ -118,14 +119,14 @@ export class TrainBuilderController {
   }
 
   @Post(':id/reorder-wagons')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.assignWagons)
   @ApiOperation({ summary: 'Persist a drag-reorder of the full consist' })
   reorderWagons(@Param('id', ParseUUIDPipe) id: string, @Body() dto: ReorderTrainWagonsDto) {
     return this.trainBuilderService.reorderWagons(id, dto);
   }
 
   @Post(':id/deactivate')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.update)
   @ApiOperation({
     summary: 'Deactivate the train (park it) — only allowed with no active schedule',
   })
@@ -134,14 +135,14 @@ export class TrainBuilderController {
   }
 
   @Post(':id/activate')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.update)
   @ApiOperation({ summary: 'Reactivate a deactivated train back to AVAILABLE' })
   activate(@Param('id', ParseUUIDPipe) id: string) {
     return this.trainBuilderService.activate(id);
   }
 
   @Delete(':id')
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.delete)
   @HttpCode(HttpStatus.NO_CONTENT)
   @ApiOperation({ summary: 'Disband the train (release wagons and locomotives)' })
   disband(@Param('id', ParseUUIDPipe) id: string) {

apps/edr-freight-api/src/modules/trains/trains.controller.ts

@@ -12,18 +12,19 @@ import {
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
 
 import { FleetManage, FleetView } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { CreateTrainDto } from "./dto/create-train.dto";
 import { UpdateTrainDto } from "./dto/update-train.dto";
 import { TrainsService } from "./trains.service";
 
 @ApiTags("trains")
 @Controller("trains")
-@FleetView()
+@FleetView(FREIGHT_PERMS.trains.view)
 export class TrainsController {
   constructor(private readonly trainsService: TrainsService) {}
 
   @Post()
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.create)
   @ApiOperation({ summary: "Register a new train" })
   create(@Body() dto: CreateTrainDto) {
     return this.trainsService.create(dto);
@@ -42,14 +43,14 @@ export class TrainsController {
   }
 
   @Patch(":id")
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.update)
   @ApiOperation({ summary: "Update a train" })
   update(@Param("id", ParseUUIDPipe) id: string, @Body() dto: UpdateTrainDto) {
     return this.trainsService.update(id, dto);
   }
 
   @Delete(":id")
-  @FleetManage()
+  @FleetManage(FREIGHT_PERMS.trains.delete)
   @ApiOperation({ summary: "Delete a train" })
   remove(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainsService.remove(id);