enhance user management and booking features with permissions and real-time updates

apps/edr-freight-api/src/modules/bookings/bookings.controller.ts

@@ -15,11 +15,13 @@ import {
   UnauthorizedException,
   UploadedFile,
   UploadedFiles,
+  UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
-import { BookingStaff } from '../../common/booking-guards';
+import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { BookingStaff, BookingView } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { AnyFilesInterceptor, FileInterceptor } from '@nestjs/platform-express';
 import {
@@ -195,6 +197,7 @@ export class BookingsController {
   }
 
   @Get("by-company/:companyId/customer-view")
+  @BookingView()
   @ApiOperation({
     summary: "List bookings for a company (customer-view shape, backoffice)",
   })
@@ -205,6 +208,7 @@ export class BookingsController {
   }
 
   @Get("list-summary")
+  @BookingView()
   @ApiOperation({ summary: "Booking list metrics and tab counts (backoffice)" })
   @ApiOkResponse({ type: BookingListSummaryDto })
   findListSummary(@Query() filter: FilterBookingDto) {
@@ -226,6 +230,7 @@ export class BookingsController {
   }
 
   @Get("queues/:queue")
+  @BookingView()
   @ApiOperation({
     summary: "List bookings for a dashboard queue",
     description: "Queues: intake, approval, signatures, marketing, finance",
@@ -956,12 +961,18 @@ export class BookingsController {
   }
 
   @Post(":id/contract/sign")
+  @UseGuards(JwtGuard)
   @ApiOperation({ summary: "Apply digital signature (customer or staff)" })
   async signContract(
     @Param("id", ParseUUIDPipe) id: string,
     @Body() dto: SignContractDto,
+    @CurrentUser() user: TCurrentUser,
     @Request() req: { user?: { id?: string; sub?: string }; ip?: string },
   ) {
+    // Staff signature needs the sign permission; customer signs their own booking.
+    if (dto.role !== "CUSTOMER") {
+      assertFreightPermission(user, FREIGHT_PERMS.bookings.signStaff);
+    }
     const userId = req.user?.id ?? req.user?.sub;
     const booking = await this.contractService.signContract(id, dto, {
       signerUserId: userId,