fix issue

apps/edr-freight-api/src/modules/interchange-documents/interchange-documents.controller.ts

@@ -1,6 +1,8 @@
 import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post, Query } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { GenerateFromScheduleDto } from './dto/generate-from-schedule.dto';
 import { InterchangeDocumentQueryDto } from './dto/interchange-document-query.dto';
 import {
@@ -12,6 +14,8 @@ import { InterchangeDocumentsService } from './interchange-documents.service';
 @ApiTags('interchange-documents')
 @ApiBearerAuth()
 @Controller('interchange-documents')
+// Class-level view guard; each write route adds its own manage permission below.
+@BookingStaff(FREIGHT_PERMS.interchangeDocuments.view)
 export class InterchangeDocumentsController {
   constructor(private readonly service: InterchangeDocumentsService) {}
 
@@ -28,12 +32,14 @@ export class InterchangeDocumentsController {
   }
 
   @Post('generate-from-schedule')
+  @BookingStaff(FREIGHT_PERMS.interchangeDocuments.generate)
   @ApiOperation({ summary: 'Generate interchange document from a train schedule handover' })
   generateFromSchedule(@Body() dto: GenerateFromScheduleDto) {
     return this.service.generateFromSchedule(dto);
   }
 
   @Patch(':id/acknowledge')
+  @BookingStaff(FREIGHT_PERMS.interchangeDocuments.acknowledge)
   @ApiOperation({ summary: 'Acknowledge an interchange document' })
   acknowledge(
     @Param('id', ParseUUIDPipe) id: string,
@@ -43,12 +49,14 @@ export class InterchangeDocumentsController {
   }
 
   @Patch(':id/dispute')
+  @BookingStaff(FREIGHT_PERMS.interchangeDocuments.dispute)
   @ApiOperation({ summary: 'Dispute an interchange document' })
   dispute(@Param('id', ParseUUIDPipe) id: string, @Body() dto: DisputeInterchangeDocumentDto) {
     return this.service.dispute(id, dto);
   }
 
   @Patch(':id/cancel')
+  @BookingStaff(FREIGHT_PERMS.interchangeDocuments.cancel)
   @ApiOperation({ summary: 'Cancel a draft/generated interchange document' })
   cancel(@Param('id', ParseUUIDPipe) id: string) {
     return this.service.cancel(id);

apps/edr-freight-api/src/modules/interchange-documents/interchange-documents.service.ts

@@ -184,8 +184,13 @@ export class InterchangeDocumentsService {
     dto: AcknowledgeInterchangeDocumentDto,
   ): Promise<InterchangeDocument> {
     const document = await this.findOne(id);
-    if (document.status === 'CANCELLED') {
-      throw new BadRequestException('Cancelled interchange document cannot be acknowledged');
+    // Only a freshly GENERATED document can be acknowledged. Rejecting DISPUTED
+    // (as well as CANCELLED / already-ACKNOWLEDGED) stops an acknowledge from
+    // silently overriding a raised dispute.
+    if (document.status !== 'GENERATED') {
+      throw new BadRequestException(
+        `Interchange document in ${document.status} status cannot be acknowledged (must be GENERATED)`,
+      );
     }
     await this.dataSource.getRepository(InterchangeDocument).update(id, {
       status: 'ACKNOWLEDGED',
@@ -197,7 +202,14 @@ export class InterchangeDocumentsService {
   }
 
   async dispute(id: string, dto: DisputeInterchangeDocumentDto): Promise<InterchangeDocument> {
-    await this.findOne(id);
+    const document = await this.findOne(id);
+    // A dispute can only be raised on a live handover — a GENERATED or already
+    // ACKNOWLEDGED document. CANCELLED and already-DISPUTED are terminal here.
+    if (!['GENERATED', 'ACKNOWLEDGED'].includes(document.status)) {
+      throw new BadRequestException(
+        `Interchange document in ${document.status} status cannot be disputed (must be GENERATED or ACKNOWLEDGED)`,
+      );
+    }
     await this.dataSource.getRepository(InterchangeDocument).update(id, {
       status: 'DISPUTED',
       remarks: dto.remarks,
@@ -273,7 +285,10 @@ export class InterchangeDocumentsService {
                NULL::uuid AS "cargoId",
                a.booking_cargo_type AS "cargoType",
                a.cargo_free_text AS "cargoDescription",
-               COALESCE(bc.total_vgm_tons, c.max_gross_weight, a.cargo_total_weight_vgm) AS "weight",
+               -- Item weight is normalized to TONS. total_vgm_tons and
+               -- cargo_total_weight_vgm are already tons; containers.max_gross_weight
+               -- is kilograms, so convert it (kg -> tons).
+               COALESCE(bc.total_vgm_tons, c.max_gross_weight / 1000.0 /* kg->tons */, a.cargo_total_weight_vgm) AS "weight",
                COALESCE(bc.quantity, 1) AS "quantity",
                COALESCE(bc.quantity, 1) AS "packageCount",
                a.wagon_number AS "wagonNumber",
@@ -322,7 +337,9 @@ export class InterchangeDocumentsService {
                cg.id AS "cargoId",
                COALESCE(cgt.cargo_type_name, a.booking_cargo_type) AS "cargoType",
                COALESCE(cg.description, a.cargo_free_text) AS "cargoDescription",
-               COALESCE(cg.weight, a.cargo_total_weight_vgm) AS "weight",
+               -- Normalized to TONS: cargoes.weight is kilograms (convert), while
+               -- cargo_total_weight_vgm is already tons.
+               COALESCE(cg.weight / 1000.0 /* kg->tons */, a.cargo_total_weight_vgm) AS "weight",
                cg.quantity AS "quantity",
                cg.quantity AS "packageCount",
                a.wagon_number AS "wagonNumber",