Intercity load unload with grn ,Warehouse , fleet , and allocation endpoints permission

apps/edr-freight-api/src/modules/warehouses/warehouse-inspection.controller.ts

@@ -20,8 +20,13 @@ import { WarehouseInspectionService } from './warehouse-inspection.service';
 
 @ApiTags('warehouse-inspection')
 @ApiBearerAuth()
+// Baseline read: inspection reports are opened from inventory screens too —
+// either view permission grants reads; writes stack their own per route.
 @Controller()
-@BookingStaff(FREIGHT_PERMS.warehouseInspectionReports.view)
+@BookingStaff([
+  FREIGHT_PERMS.warehouseInspectionReports.view,
+  FREIGHT_PERMS.warehouseInventory.view,
+])
 export class WarehouseInspectionController {
   constructor(private readonly inspectionService: WarehouseInspectionService) {}
 

apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.controller.ts

@@ -5,7 +5,7 @@ import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
 import { actorLabel } from './current-actor.util';
-import { BookingStaff } from '../../common/booking-guards';
+import { BookingStaff, StaffReference } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { BulkReceiveDto } from './dto/bulk-receive.dto';
 import { BulkInspectDto } from './dto/bulk-inspect.dto';
@@ -456,6 +456,7 @@ export class WarehouseInventoryController {
   }
 
   @Get(':id/handover-document')
+  @StaffReference()
   @ApiOperation({ summary: 'View import goods handover document PDF' })
   async handoverDocument(@Param('id', ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.inventoryService.handoverDocument(id);
@@ -466,6 +467,7 @@ export class WarehouseInventoryController {
   }
 
   @Post('bookings/:bookingId/approve-delivery')
+  @StaffReference()
   @ApiOperation({ summary: "Approve delivery — customer records their full name (signature optional)" })
   approveDeliveryForBooking(
     @Param('bookingId', ParseUUIDPipe) bookingId: string,
@@ -481,12 +483,14 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/handovers')
+  @StaffReference()
   @ApiOperation({ summary: 'Handover records for a booking (per-booking or per-truck)' })
   bookingHandovers(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.handoverService.list(bookingId);
   }
 
   @Post('handovers/:handoverId/sign')
+  @StaffReference()
   @ApiOperation({ summary: 'Customer signs one handover (EDR last-mile: one signature per truck)' })
   signHandover(
     @Param('handoverId', ParseUUIDPipe) handoverId: string,
@@ -502,12 +506,14 @@ export class WarehouseInventoryController {
   }
 
   @Post('bookings/:bookingId/request-handover-signature')
+  @StaffReference()
   @ApiOperation({ summary: 'Ask the customer to sign the handover (creates one if none, then notifies)' })
   requestHandoverSignature(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.handoverService.requestSignature(bookingId);
   }
 
   @Get('bookings/:bookingId/grn-document')
+  @StaffReference()
   @ApiOperation({ summary: 'View GRN PDF for a booking (customer portal)' })
   async bookingGrnDocument(@Param('bookingId', ParseUUIDPipe) bookingId: string, @Res() res: Response) {
     const { filename, buffer } = await this.inventoryService.grnDocumentForBooking(bookingId);
@@ -518,6 +524,7 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/release-document')
+  @StaffReference()
   @ApiOperation({ summary: 'View gate-clearance / release-order PDF for a booking (customer portal)' })
   async bookingReleaseDocument(@Param('bookingId', ParseUUIDPipe) bookingId: string, @Res() res: Response) {
     const { filename, buffer } = await this.inventoryService.releaseDocumentForBooking(bookingId);
@@ -528,6 +535,7 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/handover-document')
+  @StaffReference()
   @ApiOperation({ summary: 'View import goods handover document PDF (resolved by booking; ?handoverId= for the per-truck variant)' })
   async bookingHandoverDocument(
     @Param('bookingId', ParseUUIDPipe) bookingId: string,
@@ -545,18 +553,21 @@ export class WarehouseInventoryController {
   }
 
   @Get('bookings/:bookingId/container-items')
+  @StaffReference()
   @ApiOperation({ summary: 'Per-container/bulk items of a booking with lifecycle stage + refs' })
   containerItems(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.inventoryService.containerItems(bookingId);
   }
 
   @Get('bookings/:bookingId/container-weights')
+  @StaffReference()
   @ApiOperation({ summary: "A booking's containers + VGM cargo weight (tonnes) for exit weighing" })
   containerWeights(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.inventoryService.bookingContainerWeights(bookingId);
   }
 
   @Get('bookings/:bookingId/location')
+  @StaffReference()
   @ApiOperation({ summary: "Warehouse location of a booking's inventory (customer portal)" })
   bookingLocation(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
     return this.inventoryService.bookingLocation(bookingId);

apps/edr-freight-api/src/modules/warehouses/warehouse-invoice.controller.ts

@@ -5,7 +5,7 @@ import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
 import { actorLabel } from './current-actor.util';
-import { BookingStaff } from '../../common/booking-guards';
+import { BookingStaff, StaffReference } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { PayInvoiceDto as GatewayPayInvoiceDto } from '../billing/dto/pay-invoice.dto';
 import { GenerateInvoiceDto, PayInvoiceBodyDto } from './dto/invoice.dto';
@@ -43,6 +43,7 @@ export class WarehouseInvoiceController {
   }
 
   @Get('bookings/:id/warehouse-fee-invoices')
+  @StaffReference()
   @ApiOperation({ summary: 'List warehouse fee invoices for a booking' })
   listForBooking(@Param('id', ParseUUIDPipe) id: string) {
     return this.invoiceService.listForBooking(id);
@@ -70,12 +71,14 @@ export class WarehouseInvoiceController {
   }
 
   @Get('warehouse-fee-invoices/:id')
+  @StaffReference()
   @ApiOperation({ summary: 'Get a warehouse fee invoice with items + payment history' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.invoiceService.findById(id);
   }
 
   @Get('warehouse-fee-invoices/:id/document')
+  @StaffReference()
   @ApiOperation({ summary: 'Download sealed warehouse fee invoice PDF' })
   async document(@Param('id', ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.invoiceService.document(id);
@@ -86,6 +89,7 @@ export class WarehouseInvoiceController {
   }
 
   @Get('warehouse-fee-invoices/:id/receipt')
+  @StaffReference()
   @ApiOperation({ summary: 'Download sealed warehouse fee payment receipt PDF' })
   async receipt(@Param('id', ParseUUIDPipe) id: string, @Res() res: Response) {
     const { filename, buffer } = await this.invoiceService.receipt(id);
@@ -110,6 +114,7 @@ export class WarehouseInvoiceController {
   }
 
   @Post('warehouse-fee-invoices/:id/pay-online')
+  @StaffReference()
   @ApiOperation({ summary: 'Initiate Telebirr/Waafi payment for a warehouse fee invoice' })
   payOnline(@Param('id', ParseUUIDPipe) id: string, @Body() dto: GatewayPayInvoiceDto) {
     return this.invoiceService.initiatePayment(id, dto);

apps/edr-freight-api/src/modules/warehouses/warehouse-yards.controller.ts

@@ -1,7 +1,7 @@
 import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
-import { BookingStaff, StaffReference } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateWarehouseZoneDto } from './dto/create-warehouse-zone.dto';
 import { UpdateWarehouseYardDto } from './dto/update-warehouse-yard.dto';
@@ -10,8 +10,8 @@ import { WarehouseZonesService } from './warehouse-zones.service';
 
 @ApiTags('warehouse-yards')
 @ApiBearerAuth()
-// No class-level guard: the two reference GETs are open to any signed-in
-// staff (StaffReference), every other route carries its own permission.
+// No class-level guard: every route carries its own permission (reads accept
+// yard-view OR inventory-view so inventory flows can populate yard pickers).
 @Controller('warehouse-yards')
 export class WarehouseYardsController {
   constructor(
@@ -20,14 +20,14 @@ export class WarehouseYardsController {
   ) {}
 
   @Get()
-  @StaffReference()
+  @BookingStaff([FREIGHT_PERMS.warehouseYards.view, FREIGHT_PERMS.warehouseInventory.view])
   @ApiOperation({ summary: 'List all warehouse yards' })
   findAll() {
     return this.yardsService.findAll();
   }
 
   @Get(':id')
-  @StaffReference()
+  @BookingStaff([FREIGHT_PERMS.warehouseYards.view, FREIGHT_PERMS.warehouseInventory.view])
   @ApiOperation({ summary: 'Get warehouse yard by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.yardsService.findById(id);

apps/edr-freight-api/src/modules/warehouses/warehouse-zones.controller.ts

@@ -8,8 +8,11 @@ import { WarehouseZonesService } from './warehouse-zones.service';
 
 @ApiTags('warehouse-zones')
 @ApiBearerAuth()
+// Baseline read: zone reference data also serves inventory flows (allocation,
+// receive/move pickers) — either view permission grants reads; writes stack
+// their specific permission per route.
 @Controller('warehouse-zones')
-@BookingStaff(FREIGHT_PERMS.warehouseZones.view)
+@BookingStaff([FREIGHT_PERMS.warehouseZones.view, FREIGHT_PERMS.warehouseInventory.view])
 export class WarehouseZonesController {
   constructor(private readonly zonesService: WarehouseZonesService) {}
 

apps/edr-freight-api/src/modules/warehouses/warehouses.controller.ts

@@ -13,8 +13,15 @@ import { WarehousesService } from './warehouses.service';
 
 @ApiTags('warehouses')
 @ApiBearerAuth()
+// Baseline read: warehouse reference data is consumed by inventory/dashboard
+// flows too, so any of the three view permissions grants reads. Writes stack
+// their specific create/update permission per route on top.
 @Controller('warehouses')
-@BookingStaff(FREIGHT_PERMS.warehouses.view)
+@BookingStaff([
+  FREIGHT_PERMS.warehouses.view,
+  FREIGHT_PERMS.warehouseInventory.view,
+  FREIGHT_PERMS.warehouseDashboard.view,
+])
 export class WarehousesController {
   constructor(
     private readonly warehousesService: WarehousesService,