Implement user-based booking access control and enhance booking filtering options

apps/edr-freight-api/src/modules/bookings/bookings.controller.ts

@@ -11,6 +11,7 @@ import {
   Query,
   Request,
   Res,
+  UnauthorizedException,
   UploadedFiles,
   UseInterceptors,
 } from '@nestjs/common';
@@ -117,8 +118,22 @@ export class BookingsController {
 
   @Get()
   @ApiOperation({ summary: 'List freight bookings (paginated)' })
-  findAll(@Query() filter: FilterBookingDto) {
-    return this.bookingsService.findAll(filter);
+  async findAll(
+    @Query() filter: FilterBookingDto,
+    @CurrentUser() user: TCurrentUser,
+  ) {
+    // Staff (backoffice) see every booking. Customers (portal) are always
+    // force-scoped to their own company, regardless of any companyId they pass.
+    if (hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+      return this.bookingsService.findAll(filter);
+    }
+    const userId = user?.id;
+    if (!userId) throw new UnauthorizedException('Authentication required');
+    const companyId =
+      await this.bookingsService.resolveCustomerCompanyId(userId);
+    // No linked company yet → no bookings to show (avoids leaking all bookings).
+    if (!companyId) return { items: [], total: 0 };
+    return this.bookingsService.findAll(filter, companyId);
   }
 
   @Get('list-summary')
@@ -166,15 +181,35 @@ export class BookingsController {
 
   @Get('by-reference/:reference')
   @ApiOperation({ summary: 'Get booking by reference' })
-  async findByReference(@Param('reference') reference: string) {
+  async findByReference(
+    @Param('reference') reference: string,
+    @CurrentUser() user: TCurrentUser,
+  ) {
     const booking = await this.bookingsService.findByReference(reference);
+    // Staff see any booking; customers only their own company's.
+    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+      await this.bookingsService.assertCustomerCanAccessBooking(
+        user?.id,
+        booking,
+      );
+    }
     return this.transitionService.enrichBookingResponse(booking);
   }
 
   @Get(':id')
   @ApiOperation({ summary: 'Get booking by ID' })
-  async findOne(@Param('id', ParseUUIDPipe) id: string) {
+  async findOne(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: TCurrentUser,
+  ) {
     const booking = await this.bookingsService.findById(id);
+    // Staff see any booking; customers only their own company's.
+    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+      await this.bookingsService.assertCustomerCanAccessBooking(
+        user?.id,
+        booking,
+      );
+    }
     return this.transitionService.enrichBookingResponse(booking);
   }
 

apps/edr-freight-api/src/modules/bookings/bookings.service.ts

@@ -1,6 +1,7 @@
 import {
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
@@ -575,6 +576,7 @@ export class BookingsService {
   /** Return a paginated list of bookings matching the filter. */
   async findAll(
     filter: FilterBookingDto,
+    forceCompanyId?: string,
   ): Promise<{ items: Booking[]; total: number }> {
     const page = filter.page ?? 1;
     const pageSize = filter.pageSize ?? 20;
@@ -587,7 +589,9 @@ export class BookingsService {
       ...statusFilter,
       ...schedulingStatusFilter,
       assignedToSchedule: filter.assignedToSchedule,
-      companyId: filter.companyId,
+      // A forced company scope (portal/customer) overrides any caller-provided
+      // companyId so a customer can only ever see their own company's bookings.
+      companyId: forceCompanyId ?? filter.companyId,
       contractType: filter.contractType,
       serviceTypeId: filter.serviceTypeId,
       cargoTypeId: filter.cargoTypeId,
@@ -631,6 +635,40 @@ export class BookingsService {
     });
   }
 
+  /**
+   * Resolve the company a customer user belongs to, for scoping their own
+   * bookings. Returns null when no profile/company is linked yet.
+   */
+  async resolveCustomerCompanyId(userId: string): Promise<string | null> {
+    try {
+      const { company } =
+        await this.companiesService.getCompanyInfoByUserId(userId);
+      return company?.id ?? null;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Authorize a customer's access to a single booking. Staff are scoped at the
+   * controller (they pass `isStaff`); for a customer, the booking must belong
+   * to the company the authenticated user is linked to — otherwise it is hidden
+   * behind a NotFound so booking IDs can't be probed.
+   */
+  async assertCustomerCanAccessBooking(
+    userId: string | undefined,
+    booking: Booking,
+  ): Promise<void> {
+    if (!userId) {
+      throw new ForbiddenException('Authentication required');
+    }
+    const companyId = await this.resolveCustomerCompanyId(userId);
+    if (!companyId || booking.companyId !== companyId) {
+      // Don't reveal that the booking exists for another company.
+      throw new NotFoundException(`Booking ${booking.id} not found`);
+    }
+  }
+
   /** Aggregate metrics and tab counts for the backoffice booking list. */
   async getListSummary(filter: FilterBookingDto): Promise<BookingListSummaryDto> {
     const page = filter.page ?? 1;