Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-09-08 17:08:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: ( permissions ) enforce specific permission keys across API and backoffice

Browse Source
This commit is contained in:
Abubeker Yasin
2026-09-04 15:44:28 +03:00
parent 7c7f5a7a70
commit 7a61ebcb27
69 changed files with 1061 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts
View File

@@ -1,7 +1,7 @@
import { Body, Controller, Get, Param, Post, Query, Req, UseGuards, Delete, Patch, SetMetadata } from '@nestjs/common';
import { ApiTags, ApiOperation, ApiBearerAuth, ApiBody, ApiQuery } from '@nestjs/swagger';
import { TicketsService } from './tickets.service';
import { PassengerStaff, PassengerAdmin } from '../../common/passenger-guards';
import { PassengerStaff, PassengerDelete, PassengerWrite } from '../../common/passenger-guards';
import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
import { resolveActingUser } from '../../common/acting-user';
@@ -118,7 +118,7 @@ export class TicketsController {
}
@Post('scan-board/:qrCodeOrRef')
@PassengerStaff(PASSENGER_PERMS.tickets.manage)
@PassengerWrite(PASSENGER_PERMS.tickets.board, PASSENGER_PERMS.tickets.manage)
@ApiBearerAuth('IAM-auth')
@ApiOperation({
summary: 'Scan QR code or booking ref and automatically board ticket',
@@ -146,7 +146,7 @@ export class TicketsController {
}
@Post(':bookingRef/validate')
@PassengerStaff(PASSENGER_PERMS.tickets.manage)
@PassengerStaff([PASSENGER_PERMS.tickets.board, PASSENGER_PERMS.tickets.edit, PASSENGER_PERMS.tickets.manage, PASSENGER_PERMS.admin])
@ApiBearerAuth('IAM-auth')
@ApiOperation({
summary: 'Validate ticket at gate with audit logging',
@@ -194,7 +194,7 @@ export class TicketsController {
}
@Post('validate/offline')
@PassengerStaff(PASSENGER_PERMS.tickets.manage)
@PassengerStaff([PASSENGER_PERMS.tickets.board, PASSENGER_PERMS.tickets.edit, PASSENGER_PERMS.tickets.manage, PASSENGER_PERMS.admin])
@ApiBearerAuth('IAM-auth')
@ApiOperation({
summary: 'Batch import offline validations',
@@ -226,7 +226,7 @@ export class TicketsController {
}
@Delete(':id')
@PassengerAdmin()
@PassengerDelete(PASSENGER_PERMS.tickets.delete)
@ApiBearerAuth('IAM-auth')
@ApiOperation({
summary: 'Delete ticket (admin only)',
@@ -237,7 +237,7 @@ export class TicketsController {
}
@Patch(':id/restore')
@PassengerStaff(PASSENGER_PERMS.tickets.manage)
@PassengerWrite(PASSENGER_PERMS.tickets.edit, PASSENGER_PERMS.tickets.manage)
@ApiBearerAuth('IAM-auth')
@ApiOperation({ summary: 'Restore a cancelled ticket by resetting its status to ACTIVE' })
restore(@Param('id') id: string) {