Add fleet management and admin permissions, and update controllers to enforce new permissions

apps/edr-freight-api/src/modules/wagons/wagons.controller.ts

@@ -10,6 +10,7 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import { FleetManage, FleetView } from '../../common/booking-guards';
 import { CreateWagonDto } from './dto/create-wagon.dto';
 import { ListWagonsQueryDto } from './dto/list-wagons-query.dto';
 import { UpdateWagonDto } from './dto/update-wagon.dto';
@@ -19,10 +20,12 @@ import { WagonsService } from './wagons.service';
 
 @ApiTags('wagons')
 @Controller('wagons')
+@FleetView()
 export class WagonsController {
   constructor(private readonly wagonsService: WagonsService) {}
 
   @Post()
+  @FleetManage()
   @ApiOperation({ summary: 'Create a new wagon' })
   create(@Body() dto: CreateWagonDto) {
     return this.wagonsService.create(dto);
@@ -41,24 +44,28 @@ export class WagonsController {
   }
 
   @Patch(':id')
+  @FleetManage()
   @ApiOperation({ summary: 'Update a wagon' })
   update(@Param('id', ParseUUIDPipe) id: string, @Body() dto: UpdateWagonDto) {
     return this.wagonsService.update(id, dto);
   }
 
   @Delete(':id')
+  @FleetManage()
   @ApiOperation({ summary: 'Delete a wagon' })
   remove(@Param('id', ParseUUIDPipe) id: string) {
     return this.wagonsService.remove(id);
   }
 
   @Post(':id/assign-train')
+  @FleetManage()
   @ApiOperation({ summary: 'Assign wagon to a train' })
   assignToTrain(@Param('id', ParseUUIDPipe) id: string, @Body() dto: AssignWagonToTrainDto) {
     return this.wagonsService.assignToTrain(id, dto);
   }
 
   @Post(':id/unassign-train')
+  @FleetManage()
   @ApiOperation({ summary: 'Unassign wagon from train' })
   unassignFromTrain(@Param('id', ParseUUIDPipe) id: string) {
     return this.wagonsService.unassignFromTrain(id);
@@ -67,10 +74,12 @@ export class WagonsController {
 
 // Separate controller for train‑specific reorder (registered in module)
 @Controller('trains/:trainId/reorder-wagons')
+@FleetView()
 export class TrainWagonsReorderController {
   constructor(private readonly wagonsService: WagonsService) {}
 
   @Post()
+  @FleetManage()
   @ApiOperation({ summary: 'Reorder wagons of a train' })
   reorder(@Param('trainId', ParseUUIDPipe) trainId: string, @Body() dto: ReorderWagonsDto) {
     return this.wagonsService.reorderWagons(trainId, dto);