contrat nad booking modification

apps/edr-freight-api/src/modules/contracts/contracts.controller.ts

@@ -32,6 +32,7 @@ import {
 } from '@nestjs/swagger';
 
 import { BookingStaff } from '../../common/booking-guards';
+import { ContractDocumentHistoryService } from './contract-document-history.service';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import {
   assertFreightPermission,
@@ -60,7 +61,6 @@ import { ContractListSummaryDto } from './dto/contract-list-summary.dto';
 import { AcceptContractDto } from './dto/accept-contract.dto';
 import { UpdateContractDocumentDto } from './dto/contract-document.dto';
 import {
-  ApproveStepDto,
   RejectContractDto,
   RejectStepDto,
   RequestChangesDto,
@@ -90,6 +90,7 @@ import {
 @ApiBearerAuth()
 export class ContractsController {
   constructor(
+    private readonly documentHistory: ContractDocumentHistoryService,
     private readonly contractsService: ContractsService,
     private readonly pricingService: ContractPricingService,
     private readonly transitionService: ContractTransitionService,
@@ -352,8 +353,22 @@ export class ContractsController {
     summary:
       'Editable contract-document draft (this contract\'s snapshot, or the live template) for the accept/edit dialog',
   })
-  getContractDocumentDraft(@Param('id', ParseUUIDPipe) id: string) {
-    return this.transitionService.getContractDocumentDraft(id);
+  getContractDocumentDraft(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    // Editability depends on WHO is asking — only the approver whose turn it is
+    // may edit — so the caller is part of the draft lookup.
+    return this.transitionService.getContractDocumentDraft(id, user);
+  }
+
+  @Get(':id/document/revisions')
+  @BookingStaff(FREIGHT_PERMS.contracts.view)
+  @ApiOperation({
+    summary: 'Audit trail of edits to this contract\'s document (newest first)',
+  })
+  getContractDocumentRevisions(@Param('id', ParseUUIDPipe) id: string) {
+    return this.documentHistory.list(id);
   }
 
   @Put(':id/document/articles')
@@ -365,8 +380,14 @@ export class ContractsController {
   updateContractDocument(
     @Param('id', ParseUUIDPipe) id: string,
     @Body() dto: UpdateContractDocumentDto,
+    @CurrentUser() user: TCurrentUser,
   ) {
-    return this.transitionService.updateContractDocument(id, dto);
+    return this.transitionService.updateContractDocument(
+      id,
+      dto,
+      user,
+      resolveAuthUserId(user),
+    );
   }
 
   @Post(':id/staff/request-changes')
@@ -396,23 +417,20 @@ export class ContractsController {
   }
 
   @Post(':id/approval-steps/:stepId/approve')
-  @BookingStaff([
-    FREIGHT_PERMS.contracts.approveLineStaff,
-    FREIGHT_PERMS.contracts.approveDirector,
-    FREIGHT_PERMS.contracts.approveCeo,
-  ])
+  @BookingStaff(FREIGHT_PERMS.contracts.view)
   @ApiOperation({ summary: 'Approve one approval step in sequence' })
   approveStep(
     @Param('id', ParseUUIDPipe) id: string,
     @Param('stepId', ParseUUIDPipe) stepId: string,
-    @Body() dto: ApproveStepDto,
     @CurrentUser() user: TCurrentUser,
   ) {
+    // Whether this caller may approve depends on the step's own required role
+    // (an IAM position type), so the service resolves the step and authorizes
+    // against it — the client never declares its own role.
     return this.transitionService.approveStep(
       id,
       stepId,
       resolveAuthUserId(user),
-      dto.requiredRole,
       user,
     );
   }