add permissions and fix issues

apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.controller.ts

@@ -1,23 +1,18 @@
-import {
-  Body,
-  Controller,
-  Delete,
-  Get,
-  Param,
-  ParseUUIDPipe,
-  Patch,
-  Post,
-  Query,
-  Res,
-} from "@nestjs/common";
-import { CurrentUser } from "@edr/api-common";
 import { ApiBearerAuth, ApiOperation, ApiTags } from "@nestjs/swagger";
 import type { Response } from "express";
 import type { AuthUserPayload } from "../../common/resolve-auth-user-id";
 import { resolveAuthUserId } from "../../common/resolve-auth-user-id";
 
 import {
-  TrainSchedulingManage,
+  Body, Controller, Delete, Get, Param, ParseUUIDPipe, Patch, Post, Query, Res,
+} from "@nestjs/common";
+import { CurrentUser } from "@edr/api-common";
+import {
+  TrainSchedulingCancel,
+  TrainSchedulingCreate,
+  TrainSchedulingReschedule,
+  TrainSchedulingRulesManage,
+  TrainSchedulingUpdate,
   TrainSchedulingView,
 } from "../../common/booking-guards";
 import { AcceptIntercityBookingsDto } from "./dto/accept-intercity-bookings.dto";
@@ -114,7 +109,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("global-rules")
-  @TrainSchedulingManage()
+  @TrainSchedulingRulesManage()
   @ApiOperation({ summary: "Update global train scheduling rules (singleton)" })
   updateGlobalRules(@Body() dto: UpdateTrainSchedulingGlobalRulesDto) {
     return this.trainSchedulingService.updateTrainSchedulingGlobalRules(dto);
@@ -181,7 +176,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/adjust-consist")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Permanently trim free wagons off / couple yard wagons onto the schedule's built train (weight & length limits incl. tolerance enforced, every change logged)",
@@ -283,21 +278,21 @@ export class TrainSchedulingController {
   }
 
   @Post("container/schedules")
-  @TrainSchedulingManage()
+  @TrainSchedulingCreate()
   @ApiOperation({ summary: "Create a container train schedule" })
   createContainerTrainSchedule(@Body() dto: CreateContainerTrainScheduleDto) {
     return this.trainSchedulingService.createContainerTrainSchedule(dto);
   }
 
   @Post("bulk/schedules")
-  @TrainSchedulingManage()
+  @TrainSchedulingCreate()
   @ApiOperation({ summary: "Create a bulk train schedule" })
   createBulkTrainSchedule(@Body() dto: CreateContainerTrainScheduleDto) {
     return this.trainSchedulingService.createContainerTrainSchedule(dto);
   }
 
   @Post("schedules/:id/assign-bookings")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Assign bookings to a train schedule (mixed-capable)",
   })
@@ -309,7 +304,7 @@ export class TrainSchedulingController {
   }
 
   @Post("container/schedules/:id/assign-bookings")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Assign container bookings to a train schedule" })
   assignContainerBookings(
     @Param("id", ParseUUIDPipe) id: string,
@@ -323,7 +318,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bulk/schedules/:id/assign-bookings")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Assign bulk bookings to a train schedule" })
   assignBulkBookings(
     @Param("id", ParseUUIDPipe) id: string,
@@ -337,7 +332,7 @@ export class TrainSchedulingController {
   }
 
   @Delete("schedules/:id/bookings/:bookingId")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Unassign a booking from a train schedule" })
   unassignBooking(
     @Param("id", ParseUUIDPipe) id: string,
@@ -352,7 +347,7 @@ export class TrainSchedulingController {
   }
 
   @Delete("schedules/:id/wagons/:trainSetWagonId")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Remove an empty wagon slot from a train" })
   removeWagonSlot(
     @Param("id", ParseUUIDPipe) id: string,
@@ -365,7 +360,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("schedules/:id/container-items/:itemId")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Update a container number on a wagon slot" })
   updateContainerItem(
     @Param("id", ParseUUIDPipe) id: string,
@@ -376,7 +371,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/wagons/:wagonId/move-load")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Move a wagon's whole load to another wagon (empty → move/repin, loaded → swap loads)",
@@ -397,7 +392,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/assign-unassigned-booking")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Assign one linked unallocated booking to wagons (preserves existing assignments)",
@@ -429,7 +424,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("schedules/:id/import-loading-status")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Mark import bookings loaded/unloaded on this schedule (tracking only, does not affect dispatch)",
@@ -442,7 +437,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("schedules/:id/loading-status")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Mark bookings loaded/unloaded on this schedule (any direction, pre-dispatch only)",
@@ -455,21 +450,21 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/pin-wagons")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Pin physical wagons to train set slots" })
   pinWagons(@Param("id", ParseUUIDPipe) id: string, @Body() dto: PinWagonsDto) {
     return this.trainSchedulingService.pinWagons(id, dto);
   }
 
   @Post("schedules/:id/finalize")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Finalize a draft train schedule" })
   finalizeSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.finalizeSchedule(id);
   }
 
   @Post("schedules/:id/dispatch")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Dispatch a scheduled train" })
   dispatchSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.dispatchSchedule(id);
@@ -496,7 +491,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/intercity/accept")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Accept intercity bookings onto this train (opens their pay window; capacity re-checked per booking)",
@@ -519,7 +514,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/bookings/:bookingId/load")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Confirm a booking's cargo loaded at its origin yard (any direction; train must be at that yard)",
@@ -532,7 +527,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/bookings/:bookingId/unload")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Confirm a booking's cargo unloaded at its destination yard — per-booking arrival, may precede the train's final arrival",
@@ -545,7 +540,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/intercity/:bookingId/load")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Confirm intercity cargo loaded (train must be at the booking's origin yard)",
   })
@@ -557,7 +552,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/intercity/:bookingId/unload")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Confirm intercity cargo unloaded at the booking's destination yard (completes the booking)",
@@ -577,7 +572,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/import-djibouti/documents")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Upload/check an import Djibouti-side document" })
   uploadImportDjiboutiDocument(
     @Param("id", ParseUUIDPipe) id: string,
@@ -587,7 +582,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/import-djibouti/gatepass-granted")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Mark import Djibouti gatepass permission granted" })
   grantImportDjiboutiGatepass(
     @Param("id", ParseUUIDPipe) id: string,
@@ -597,7 +592,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/import-djibouti/ready-for-loading")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Mark import train ready for loading at Djibouti" })
   markImportReadyForLoading(
     @Param("id", ParseUUIDPipe) id: string,
@@ -607,7 +602,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/import-djibouti/loaded-on-train")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Confirm import cargo loaded on train at Djibouti" })
   confirmImportLoadedOnTrain(
     @Param("id", ParseUUIDPipe) id: string,
@@ -617,7 +612,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/confirm-loading")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Confirm cargo loaded on the train (any direction; unblocks import-Djibouti dispatch)",
@@ -630,7 +625,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/import-djibouti/depart")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Depart loaded import train from Djibouti" })
   departImportFromDjibouti(
     @Param("id", ParseUUIDPipe) id: string,
@@ -640,7 +635,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/import-djibouti/load-list")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Generate import load list / marshalling document summary" })
   generateImportLoadList(
     @Param("id", ParseUUIDPipe) id: string,
@@ -680,7 +675,7 @@ export class TrainSchedulingController {
   // ---- batch / booking-window staff actions ----
 
   @Post("schedules/:id/run-batch")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Manually run the batch fill for a schedule" })
   async runBatch(@Param("id", ParseUUIDPipe) id: string) {
     await this.bookingBatchService.fillSchedule(id);
@@ -688,7 +683,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/run-allocation")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Run wagon-level allocation for all eligible linked bookings",
   })
@@ -697,7 +692,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("schedules/:id/booking-window")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({ summary: "Open or close a schedule booking window" })
   async setBookingWindow(
     @Param("id", ParseUUIDPipe) id: string,
@@ -711,7 +706,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("schedules/:id/window-rule")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Override the booking-window rule for one schedule (open/close hour, duration, doc-review, payment, lead days) — only before the window opens",
@@ -725,7 +720,7 @@ export class TrainSchedulingController {
   }
 
   @Patch("schedules/:id/schedule-date")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Reschedule a train's departure date — only before the booking window opens, and only if the new date still leaves room for the booking lead window",
@@ -739,7 +734,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/maintenance")
-  @TrainSchedulingManage()
+  @TrainSchedulingReschedule()
   @ApiOperation({
     summary:
       "Maintenance reschedule: move the train to a new departure with every allocated booking aboard — links, wagons and window settings unchanged",
@@ -753,7 +748,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/doc-review-complete")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Staff finished document review early — run the batch/payment phase now (applies to the whole route-day group)",
@@ -764,7 +759,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/mark-paid")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Staff: mark a reserved booking paid and allocate it now",
   })
@@ -774,7 +769,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/expire")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Staff: expire a reservation and free its capacity",
   })
@@ -784,7 +779,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/move-schedule")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Re-point a booking to another OPEN same-route schedule",
   })
@@ -806,7 +801,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/checkpoints")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary: "Log the train passing a station (final station triggers arrival)",
   })
@@ -818,7 +813,7 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/arrive")
-  @TrainSchedulingManage()
+  @TrainSchedulingUpdate()
   @ApiOperation({
     summary:
       "Mark a dispatched train arrived (move assets to destination yard, free assets)",
@@ -856,14 +851,14 @@ export class TrainSchedulingController {
   }
 
   @Post("container/schedules/:id/cancel")
-  @TrainSchedulingManage()
+  @TrainSchedulingCancel()
   @ApiOperation({ summary: "Cancel container train schedule" })
   cancelTrainSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.cancelTrainSchedule(id);
   }
 
   @Post('bulk/schedules/:id/cancel')
-  @TrainSchedulingManage()
+  @TrainSchedulingCancel()
   @ApiOperation({ summary: "Cancel bulk train schedule" })
   cancelBulkTrainSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.cancelTrainSchedule(id);