enhance user management and booking features with permissions and real-time updates

apps/edr-freight-api/src/modules/contracts/contracts.controller.ts

@@ -13,10 +13,12 @@ import {
   UnauthorizedException,
   UploadedFiles,
   UploadedFile,
+  UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { CurrentUser } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
+import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 import { AnyFilesInterceptor, FileInterceptor } from '@nestjs/platform-express';
 import type { Response } from 'express';
 import {
@@ -242,6 +244,7 @@ export class ContractsController {
   }
 
   @Get('list-summary')
+  @BookingStaff([FREIGHT_PERMS.bookings.view, FREIGHT_PERMS.contracts.view])
   @ApiOperation({ summary: 'Contract list metrics and status counts (backoffice)' })
   @ApiOkResponse({ type: ContractListSummaryDto })
   findListSummary(@Query() filter: FilterContractDto) {
@@ -449,14 +452,25 @@ export class ContractsController {
   }
 
   @Post(':id/contract/sign')
+  @UseGuards(JwtGuard)
   @ApiOperation({ summary: 'Apply digital signature (customer or staff/director/ceo)' })
   signContract(
     @Param('id', ParseUUIDPipe) id: string,
     @Body() dto: SignContractDto,
-    @CurrentUser() user: AuthUserPayload,
+    @CurrentUser() user: TCurrentUser,
   ) {
+    // Each staff signing role maps to the permission that step already requires;
+    // customers sign their own contract with no permission key.
+    const signRolePermission: Record<string, string> = {
+      STAFF: FREIGHT_PERMS.contracts.signStaff,
+      DIRECTOR: FREIGHT_PERMS.contracts.approveDirector,
+      CEO: FREIGHT_PERMS.contracts.approveCeo,
+    };
+    if (dto.role !== 'CUSTOMER') {
+      assertFreightPermission(user, signRolePermission[dto.role]);
+    }
     return this.transitionService.sign(id, dto, {
-      signerUserId: user?.id ?? user?.sub,
+      signerUserId: user?.id,
     });
   }