Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-30 07:38:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(warehouse): guard warehouse/inventory/fee endpoints with RBAC permissions

Browse Source 
Apply JwtGuard + FreightPermissionGuard (via @BookingStaff) to 83 staff
endpoints across the 8 warehouse controllers, using existing
edr_freight_app:warehouse* permissions: warehouses/yards/zones,
inventory receive/move/load/unload/dispatch/gate-pass/release/deliver/inspect
(incl. import & export queues), allocation + fee rules (demurrage/storage/
double-handling), accrual dashboard + acknowledge, and fee invoices.

Customer-portal endpoints (booking-scoped documents, approve-delivery,
portal fee-invoice view/document/receipt/pay-online) are intentionally left
unguarded — they need a customer-ownership guard, not staff permissions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Hagernesh
2026-07-14 12:52:49 +00:00
parent a367306565
commit 65f6015c5e
8 changed files with 99 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/edr-freight-api/src/modules/warehouses/warehouse-invoice.controller.ts
View File

@@ -2,6 +2,8 @@ import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post, Query, Res }
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
import type { Response } from 'express';
import { BookingStaff } from '../../common/booking-guards';
import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
import { PayInvoiceDto as GatewayPayInvoiceDto } from '../billing/dto/pay-invoice.dto';
import { GenerateInvoiceDto, PayInvoiceBodyDto } from './dto/invoice.dto';
import { WarehouseInvoiceService } from './warehouse-invoice.service';
@@ -13,12 +15,14 @@ export class WarehouseInvoiceController {
constructor(private readonly invoiceService: WarehouseInvoiceService) {}
@Post('warehouse-inventory/:id/generate-fee-invoice')
@BookingStaff(FREIGHT_PERMS.warehouseFeeInvoices.generate)
@ApiOperation({ summary: 'Generate a warehouse fee invoice from Batch 5 fee calculation' })
generate(@Param('id', ParseUUIDPipe) id: string, @Body() dto: GenerateInvoiceDto) {
return this.invoiceService.generateForInventory(id, dto);
}
@Post('last-mile/:id/generate-truck-detention-invoice')
@BookingStaff(FREIGHT_PERMS.warehouseFeeInvoices.generate)
@ApiOperation({ summary: 'Generate a truck-detention invoice for a last-mile leg (per truck per day)' })
generateTruckDetention(
@Param('id', ParseUUIDPipe) id: string,
@@ -28,6 +32,7 @@ export class WarehouseInvoiceController {
}
@Get('warehouse-inventory/:id/fee-invoices')
@BookingStaff(FREIGHT_PERMS.warehouseFeeInvoices.view)
@ApiOperation({ summary: 'List fee invoices for an inventory item' })
listForInventory(@Param('id', ParseUUIDPipe) id: string) {
return this.invoiceService.listForInventory(id);
@@ -40,6 +45,7 @@ export class WarehouseInvoiceController {
}
@Get('warehouse-fee-invoices')
@BookingStaff(FREIGHT_PERMS.warehouseFeeInvoices.view)
@ApiOperation({ summary: 'List / filter warehouse fee invoices' })
findAll(
@Query('status') status?: string,
@@ -86,12 +92,14 @@ export class WarehouseInvoiceController {
}
@Patch('warehouse-fee-invoices/:id/cancel')
@BookingStaff(FREIGHT_PERMS.warehouseFeeInvoices.cancel)
@ApiOperation({ summary: 'Cancel a warehouse fee invoice' })
cancel(@Param('id', ParseUUIDPipe) id: string) {
return this.invoiceService.cancel(id);
}
@Post('warehouse-fee-invoices/:id/pay')
@BookingStaff(FREIGHT_PERMS.warehouseFeeInvoices.pay)
@ApiOperation({ summary: 'Record a payment against a warehouse fee invoice' })
pay(@Param('id', ParseUUIDPipe) id: string, @Body() dto: PayInvoiceBodyDto) {
return this.invoiceService.pay(id, dto);