enhance service filtering and dashboard functionality with company profile support

apps/edr-freight-api/src/modules/bookings/bookings.controller.ts

@@ -148,15 +148,10 @@ export class BookingsController {
         },
       };
     }
-    // Scope to the active operational profile (importer/exporter) when one
-    // resolves; otherwise fall back to company-level scoping.
-    const companyProfileId =
-      await this.bookingsService.resolveActiveCompanyProfileId(userId);
-    return this.bookingsService.findAll(
-      filter,
-      companyId,
-      companyProfileId ?? undefined,
-    );
+    // Company-wide by default; the optional filter.companyProfileId (per-page
+    // service filter) narrows within the company. The company guard always
+    // applies, so a customer can only ever see their own company's bookings.
+    return this.bookingsService.findAll(filter, companyId);
   }
 
   @Get('by-company/:companyId/customer-view')

apps/edr-freight-api/src/modules/bookings/bookings.service.ts

@@ -656,10 +656,11 @@ export class BookingsService {
       assignedToSchedule: filter.assignedToSchedule,
       // A forced company scope (portal/customer) overrides any caller-provided
       // companyId so a customer can only ever see their own company's bookings.
-      // When an active profile resolves, scope to it; otherwise fall back to the
-      // company so nothing breaks for not-yet-onboarded customers.
-      companyId: forceCompanyProfileId ? undefined : forceCompanyId ?? filter.companyId,
-      companyProfileId: forceCompanyProfileId,
+      // The company guard always applies; the optional companyProfileId filter
+      // (from the per-page service filter) narrows WITHIN the company — the repo
+      // ANDs both, so cross-company access is impossible.
+      companyId: forceCompanyId ?? filter.companyId,
+      companyProfileId: forceCompanyProfileId ?? filter.companyProfileId,
       contractType: filter.contractType,
       serviceTypeId: filter.serviceTypeId,
       cargoTypeId: filter.cargoTypeId,
@@ -694,18 +695,15 @@ export class BookingsService {
     filter: FilterBookingDto,
   ): Promise<PaginatedBookings> {
     const { company } = await this.companiesService.getCompanyInfoByUserId(userId);
-    // Scope to the active operational profile when one resolves; fall back to
-    // company-level so not-yet-onboarded customers still see their payables.
-    const companyProfileId =
-      await this.companiesService.resolveActiveCompanyProfileId(userId);
 
     return this.bookingsRepository.findAllPaginated({
       page: filter.page ?? 1,
       pageSize: filter.pageSize ?? 20,
       statuses: BookingsService.PAYABLE_STATUSES,
       excludePaymentStatus: 'PAID',
-      companyId: companyProfileId ? undefined : company.id,
-      companyProfileId: companyProfileId ?? undefined,
+      // Company-wide: payables span all of the customer's services.
+      companyId: company.id,
+      companyProfileId: filter.companyProfileId,
       sortBy: filter.sortBy,
       sortOrder: filter.sortOrder,
     });

apps/edr-freight-api/src/modules/bookings/dto/filter-booking.dto.ts

@@ -38,6 +38,15 @@ export class FilterBookingDto {
   @IsUUID()
   companyId?: string;
 
+  @ApiPropertyOptional({
+    format: 'uuid',
+    description:
+      'Narrow to a single operational profile (importer/exporter/freight_forwarder) within the company.',
+  })
+  @IsOptional()
+  @IsUUID()
+  companyProfileId?: string;
+
   @ApiPropertyOptional()
   @IsOptional()
   contractType?: string;