Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-09-09 10:58:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(group-booking): draft schedules, coach-scoped seating, mixed classes

Browse Source
This commit is contained in:
Abubeker Yasin
2026-09-08 16:07:46 +03:00
parent b08fc85aaf
commit 3fb019fd07
28 changed files with 1068 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
apps/edr-passenger-api/src/modules/search/group-search.controller.ts Normal file
View File

@@ -0,0 +1,53 @@
import { Body, Controller, Post } from '@nestjs/common';
import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth } from '@nestjs/swagger';
import { SearchService } from './search.service';
import { SearchTripsDto } from './search.dto';
import { PassengerWrite } from '../../common/passenger-guards';
import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
/**
* The staff group-booking search channel.
*
* Deliberately a SEPARATE controller from `SearchController` rather than another route on it.
* `SearchController` carries a class-level `@IsPublic()`, and `JwtGuard` resolves that key with
* `getAllAndOverride([handler, class])` — a handler with no key of its own inherits the class's
* `true` and stays public. Worse, `JwtGuard` returns early for a public route and never
* populates `request.user`, so an in-handler permission check there is not merely awkward, it is
* impossible: there is no user to check.
*
* Splitting the controller is what makes the guard real. The channel is therefore decided by
* which route the caller can reach, not by a field they send — which matters because this
* channel exposes unpublished DRAFT schedules.
*/
@ApiTags('Search')
@Controller('search')
export class GroupSearchController {
constructor(private service: SearchService) {}
@Post('group')
@PassengerWrite(PASSENGER_PERMS.bookings.create, PASSENGER_PERMS.bookings.manage)
@ApiBearerAuth('IAM-auth')
@ApiOperation({
summary: 'Search trips as staff for a group booking — includes unpublished DRAFT trips',
description: `Same request body and response shape as the public \`POST /search\`, but run on the staff channel.
The staff channel is a strict **superset** of the public one:
| Schedule state | Public \`POST /search\` | This route |
| --- | --- | --- |
| \`DRAFT\` (not yet published) | hidden | **visible** |
| \`SCHEDULED\`/\`BOARDING\`/\`EN_ROUTE\`, ordinary | visible | visible |
| \`SCHEDULED\`/\`BOARDING\`/\`EN_ROUTE\`, \`isGroupBookingOnly\` | hidden | **visible** |
| \`CANCELLED\`/\`ARRIVED\`/\`DELAYED\` | hidden | hidden |
| \`isPackageOnly\` | hidden | hidden |
So a group can be booked onto an ordinary scheduled service, onto a trip reserved for groups, or onto a draft trip that has not gone on sale yet — all through the same seat inventory as normal booking.
Replaces the old \`channel: 'GROUP_BOOKING'\` body field on \`POST /search\`, which was unguarded.`,
})
@ApiResponse({ status: 200, description: 'Matching schedules, including DRAFT and group-reserved ones' })
@ApiResponse({ status: 403, description: 'Caller lacks bookings:create / bookings:manage' })
searchTripsForGroup(@Body() dto: SearchTripsDto) {
return this.service.searchTrips(dto, true);
}
}