booking flow,summtion, approval, contract, mock payemnt and integration to back office, and also add permissions

apps/edr-freight-api/src/modules/bookings/bookings.controller.ts

@@ -3,7 +3,6 @@ import {
   Controller,
   Delete,
   Get,
-  Header,
   HttpCode,
   Param,
   ParseUUIDPipe,
@@ -12,13 +11,13 @@ import {
   Query,
   Request,
   Res,
-  StreamableFile,
   UploadedFiles,
-  UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { CurrentUser } from '@edr/api-common';
-import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { AnyFilesInterceptor } from '@nestjs/platform-express';
 import {
   ApiBearerAuth,
@@ -31,13 +30,13 @@ import {
 import type { Response } from 'express';
 
 import { BookingContractService } from './booking-contract.service';
-import { BookingPaymentService } from './booking-payment.service';
 import { BookingPricingService } from './booking-pricing.service';
 import { BookingTransitionService } from './booking-transition.service';
 import { BookingReferenceDataService } from './booking-reference-data.service';
 import { BookingsService } from './bookings.service';
 import { BookingReferenceDataDto } from './dto/booking-reference-data.dto';
 import { CreateBookingDto } from './dto/create-booking.dto';
+import { BookingListSummaryDto } from './dto/booking-list-summary.dto';
 import { FilterBookingDto } from './dto/filter-booking.dto';
 import { GeneratePriceResponseDto } from './dto/generate-price-response.dto';
 import {
@@ -65,7 +64,6 @@ export class BookingsController {
     private readonly pricingService: BookingPricingService,
     private readonly transitionService: BookingTransitionService,
     private readonly contractService: BookingContractService,
-    private readonly paymentService: BookingPaymentService,
   ) {}
 
   @Post()
@@ -104,6 +102,13 @@ export class BookingsController {
     return this.bookingsService.findAll(filter);
   }
 
+  @Get('list-summary')
+  @ApiOperation({ summary: 'Booking list metrics and tab counts (backoffice)' })
+  @ApiOkResponse({ type: BookingListSummaryDto })
+  findListSummary(@Query() filter: FilterBookingDto) {
+    return this.bookingsService.getListSummary(filter);
+  }
+
   @Get('queues/:queue')
   @ApiOperation({
     summary: 'List bookings for a dashboard queue',
@@ -162,7 +167,7 @@ export class BookingsController {
   }
 
   @Post(':id/staff/request-changes')
-  @UseGuards(JwtGuard)
+  @BookingStaff(FREIGHT_PERMS.bookings.requestChanges)
   @ApiOperation({ summary: 'Staff return booking for customer updates' })
   async requestChanges(
     @Param('id', ParseUUIDPipe) id: string,
@@ -178,7 +183,7 @@ export class BookingsController {
   }
 
   @Post(':id/staff/accept')
-  @UseGuards(JwtGuard)
+  @BookingStaff(FREIGHT_PERMS.bookings.staffAccept)
   @ApiOperation({ summary: 'Staff accept intake → start approval chain' })
   async acceptIntake(
     @Param('id', ParseUUIDPipe) id: string,
@@ -192,7 +197,7 @@ export class BookingsController {
   }
 
   @Post(':id/staff/reject')
-  @UseGuards(JwtGuard)
+  @BookingStaff(FREIGHT_PERMS.bookings.reject)
   @ApiOperation({ summary: 'Staff final reject' })
   async staffReject(
     @Param('id', ParseUUIDPipe) id: string,
@@ -208,25 +213,30 @@ export class BookingsController {
   }
 
   @Post(':id/approval-steps/:stepId/approve')
-  @UseGuards(JwtGuard)
+  @BookingStaff([
+    FREIGHT_PERMS.bookings.approveLineStaff,
+    FREIGHT_PERMS.bookings.approveDirector,
+    FREIGHT_PERMS.bookings.approveCeo,
+  ])
   @ApiOperation({ summary: 'Approve one approval step in sequence' })
   async approveStep(
     @Param('id', ParseUUIDPipe) id: string,
     @Param('stepId', ParseUUIDPipe) stepId: string,
     @Body() dto: ApproveStepDto,
-    @CurrentUser() user: AuthUserPayload,
+    @CurrentUser() user: TCurrentUser,
   ) {
     const booking = await this.transitionService.approveStep(
       id,
       stepId,
       resolveAuthUserId(user),
       dto.requiredRole,
+      user,
     );
     return this.transitionService.enrichBookingResponse(booking);
   }
 
   @Post(':id/approval-steps/:stepId/reject')
-  @UseGuards(JwtGuard)
+  @BookingStaff(FREIGHT_PERMS.bookings.rejectApproval)
   @ApiOperation({ summary: 'Reject at approval step' })
   async rejectStep(
     @Param('id', ParseUUIDPipe) id: string,
@@ -244,7 +254,7 @@ export class BookingsController {
   }
 
   @Post(':id/contract/generate')
-  @UseGuards(JwtGuard)
+  @BookingStaff(FREIGHT_PERMS.bookings.generateContract)
   @ApiOperation({ summary: 'Generate contract PDF from template' })
   async generateContract(@Param('id', ParseUUIDPipe) id: string) {
     const booking = await this.contractService.generateContract(id);
@@ -262,22 +272,23 @@ export class BookingsController {
   @ApiOperation({ summary: 'Download contract PDF' })
   async downloadContractDocument(
     @Param('id', ParseUUIDPipe) id: string,
-    @Res({ passthrough: true }) res: Response,
-  ) {
+    @Res() res: Response,
+  ): Promise<void> {
     const { stream, record } = await this.contractService.streamContract(id);
-    res.set({
-      'Content-Type': record.mimeType ?? 'application/pdf',
-      'Content-Disposition': `attachment; filename="${record.name}"`,
-    });
-    return new StreamableFile(stream);
+    res.setHeader('Content-Type', record.mimeType ?? 'application/pdf');
+    res.setHeader(
+      'Content-Disposition',
+      `attachment; filename="${record.name}"`,
+    );
+    stream.pipe(res);
   }
 
   @Get(':id/contract')
   @ApiOperation({ summary: 'Download contract file (alias)' })
   async downloadContract(
     @Param('id', ParseUUIDPipe) id: string,
-    @Res({ passthrough: true }) res: Response,
-  ) {
+    @Res() res: Response,
+  ): Promise<void> {
     return this.downloadContractDocument(id, res);
   }
 
@@ -326,7 +337,7 @@ export class BookingsController {
   }
 
   @Post(':id/marketing/approve')
-  @UseGuards(JwtGuard)
+  @BookingStaff(FREIGHT_PERMS.bookings.signStaff)
   @ApiOperation({
     summary: 'Staff contract signature and fully execute (use contract/sign STAFF preferred)',
   })
@@ -347,47 +358,8 @@ export class BookingsController {
     return this.transitionService.enrichBookingResponse(booking);
   }
 
-  @Post(':id/payment/pnr')
-  @ApiOperation({ summary: 'Generate PNR code (ETB)' })
-  async generatePnr(@Param('id', ParseUUIDPipe) id: string) {
-    const booking = await this.paymentService.generatePnr(id);
-    return this.transitionService.enrichBookingResponse(booking);
-  }
-
-  @Post(':id/payment/proof')
-  @UseInterceptors(AnyFilesInterceptor())
-  @ApiConsumes('multipart/form-data')
-  @ApiOperation({ summary: 'Upload USD payment proof' })
-  async submitPaymentProof(
-    @Param('id', ParseUUIDPipe) id: string,
-    @UploadedFiles() files: Express.Multer.File[],
-  ) {
-    const file = files?.[0];
-    const booking = await this.paymentService.submitPaymentProof(id, file);
-    return this.transitionService.enrichBookingResponse(booking);
-  }
-
-  @Get(':id/payment/request-letter')
-  @ApiOperation({ summary: 'Download payment request letter (USD stub)' })
-  @Header('Content-Type', 'text/plain')
-  async paymentRequestLetter(
-    @Param('id', ParseUUIDPipe) id: string,
-    @Res({ passthrough: true }) res: Response,
-  ) {
-    const { buffer, filename } =
-      await this.paymentService.getPaymentRequestLetter(id);
-    res.set('Content-Disposition', `attachment; filename="${filename}"`);
-    return new StreamableFile(buffer);
-  }
-
-  @Post(':id/payment/verify')
-  @ApiOperation({ summary: 'Finance verify USD payment' })
-  async verifyPayment(@Param('id', ParseUUIDPipe) id: string) {
-    const booking = await this.paymentService.verifyPayment(id);
-    return this.transitionService.enrichBookingResponse(booking);
-  }
-
   @Post(':id/operations/start-transit')
+  @BookingStaff(FREIGHT_PERMS.bookings.operations)
   @ApiOperation({ summary: 'Mark in transit' })
   async startTransit(@Param('id', ParseUUIDPipe) id: string) {
     const booking = await this.transitionService.startTransit(id);
@@ -395,6 +367,7 @@ export class BookingsController {
   }
 
   @Post(':id/operations/complete')
+  @BookingStaff(FREIGHT_PERMS.bookings.operations)
   @ApiOperation({ summary: 'Mark completed' })
   async complete(@Param('id', ParseUUIDPipe) id: string) {
     const booking = await this.transitionService.complete(id);
@@ -402,6 +375,7 @@ export class BookingsController {
   }
 
   @Post(':id/cancel')
+  @BookingStaff(FREIGHT_PERMS.bookings.cancel)
   @ApiOperation({ summary: 'Cancel booking' })
   async cancel(
     @Param('id', ParseUUIDPipe) id: string,