From 50b842b002b780209d4f1383bc03a6abdfbeadac Mon Sep 17 00:00:00 2001 From: Nathnael Date: Fri, 7 Aug 2026 07:47:44 +0000 Subject: [PATCH] fix(auth): make contract template reads staff-only The comment claimed reads were open to authenticated staff, but no guard enforced it, so customers could list templates and render previews. The backoffice Templates tab is the only consumer. --- .../contract-templates.controller.ts | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts b/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts index 67f6ededc..6cba17f61 100644 --- a/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts +++ b/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts @@ -26,16 +26,26 @@ import { export class ContractTemplatesController { constructor(private readonly service: ContractTemplatesService) {} - // Reads stay open to authenticated staff (the backoffice Templates tab); + // Reads are staff-only (the backoffice Templates tab is the only consumer); // writes are admin-guarded like other freight configuration resources. @Get() + @BookingStaff([ + FREIGHT_PERMS.settings.contractTemplates.view, + FREIGHT_PERMS.settings.contractTemplates.manage, + FREIGHT_PERMS.admin, + ]) @ApiOperation({ summary: "List the six contract document templates" }) list() { return this.service.list(); } @Get(":code") + @BookingStaff([ + FREIGHT_PERMS.settings.contractTemplates.view, + FREIGHT_PERMS.settings.contractTemplates.manage, + FREIGHT_PERMS.admin, + ]) @ApiOperation({ summary: "Get one contract template by code" }) getByCode(@Param("code") code: string) { return this.service.getByCode(code); @@ -49,6 +59,11 @@ export class ContractTemplatesController { } @Post(":code/preview") + @BookingStaff([ + FREIGHT_PERMS.settings.contractTemplates.view, + FREIGHT_PERMS.settings.contractTemplates.manage, + FREIGHT_PERMS.admin, + ]) @ApiOperation({ summary: "Render an HTML preview of the template against mock contract data", })