changes

apps/edr-freight-api/src/modules/contracts/contract-transition.service.ts

@@ -20,8 +20,13 @@ import { MinioService } from '../minio/minio.service';
 import { FileRecord } from '../files/entities/file.entity';
 import {
   assertCanApproveContractStep,
+  assertFreightPermission,
   canEditContractStep,
 } from '../../common/freight-permission.util';
+import {
+  FREIGHT_PERMS,
+  forFreightType,
+} from '../../seed/freight-permissions.registry';
 import { ContractDocumentHistoryService } from './contract-document-history.service';
 import { ApprovalRulesService } from '../rule-engine/services/approval-rules.service';
 import { CargoTypesService } from '../rule-engine/services/cargo-types.service';
@@ -239,8 +244,15 @@ export class ContractTransitionService {
     actorId: string,
     validityDays: number,
     documentSnapshot?: ContractDocumentSnapshotInput | null,
+    user?: TCurrentUser | null,
   ): Promise<Contract> {
     const contract = await this.contractsService.findById(contractId);
+    // The route guard passes on either arm; the contract's freight type decides
+    // which one is actually required (accept bulk ≠ accept container).
+    assertFreightPermission(
+      user,
+      forFreightType(FREIGHT_PERMS.contracts.staffAccept, contract.freightType),
+    );
     assertContractStatus(contract, ['SUBMITTED']);
 
     if (!Number.isInteger(validityDays) || validityDays < 1) {
@@ -535,8 +547,13 @@ export class ContractTransitionService {
     contractId: string,
     note: string,
     actorId: string,
+    user?: TCurrentUser | null,
   ): Promise<Contract> {
     const contract = await this.contractsService.findById(contractId);
+    assertFreightPermission(
+      user,
+      forFreightType(FREIGHT_PERMS.contracts.requestChanges, contract.freightType),
+    );
     assertContractStatus(contract, ['SUBMITTED']);
 
     await this.contractsRepository.createReviewNote(
@@ -554,8 +571,17 @@ export class ContractTransitionService {
     return updated;
   }
 
-  async reject(contractId: string, reason: string, actorId: string): Promise<Contract> {
+  async reject(
+    contractId: string,
+    reason: string,
+    actorId: string,
+    user?: TCurrentUser | null,
+  ): Promise<Contract> {
     const contract = await this.contractsService.findById(contractId);
+    assertFreightPermission(
+      user,
+      forFreightType(FREIGHT_PERMS.contracts.reject, contract.freightType),
+    );
     assertContractStatus(contract, ['SUBMITTED', 'PENDING_APPROVAL']);
 
     await this.contractsRepository.createReviewNote(