feat(user-management): implement staff reference permissions for various controllers and update sidebar permissions

2026-08-27 16:40:56 +00:00 · 2026-07-21 23:25:43 +00:00
parent 835c9e111c
commit d25612c2f0
10 changed files with 66 additions and 21 deletions
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/cargo-types.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/cargo-types.controller.ts
@@ -3,7 +3,8 @@ import {
  Param, ParseUUIDPipe, Patch, Post, Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineManage } from '../../../common/rule-engine-guards';
+import { StaffReference } from '../../../common/booking-guards';
 import { CreateCargoTypeDto } from '../dto/create-cargo-type.dto';
 import { ListCargoTypesQueryDto } from '../dto/list-rule-engine-query.dto';
 import { MoveOrderDto } from '../dto/move-order.dto';
@@ -18,7 +19,7 @@ export class CargoTypesController {
  constructor(private readonly service: CargoTypesService) {}

  @Get()
-  @RuleEngineView('cargo-types')
+  @StaffReference()
  @ApiOperation({ summary: 'List cargo types' })
  findAll(@Query() query: ListCargoTypesQueryDto) {
    return this.service.findAll(query);
@@ -41,7 +42,7 @@ export class CargoTypesController {
  }

  @Get(':id')
-  @RuleEngineView('cargo-types')
+  @StaffReference()
  @ApiOperation({ summary: 'Get a cargo type by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/container-types.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/container-types.controller.ts
@@ -3,7 +3,8 @@ import {
  Param, ParseUUIDPipe, Patch, Post, Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineManage } from '../../../common/rule-engine-guards';
+import { StaffReference } from '../../../common/booking-guards';
 import { CreateContainerTypeDto } from '../dto/create-container-type.dto';
 import { ListContainerTypesQueryDto } from '../dto/list-rule-engine-query.dto';
 import { MoveOrderDto } from '../dto/move-order.dto';
@@ -18,7 +19,7 @@ export class ContainerTypesController {
  constructor(private readonly service: ContainerTypesService) {}

  @Get()
-  @RuleEngineView('container-types')
+  @StaffReference()
  @ApiOperation({ summary: 'List container types' })
  findAll(@Query() query: ListContainerTypesQueryDto) {
    return this.service.findAll(query);
@@ -41,7 +42,7 @@ export class ContainerTypesController {
  }

  @Get(':id')
-  @RuleEngineView('container-types')
+  @StaffReference()
  @ApiOperation({ summary: 'Get a container type by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/service-types.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/service-types.controller.ts
@@ -2,7 +2,8 @@ import {
  Body, Controller, Delete, Get, HttpCode, HttpStatus,
  Param, ParseUUIDPipe, Patch, Post, Query,
 } from '@nestjs/common';
-import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineManage } from '../../../common/rule-engine-guards';
+import { StaffReference } from '../../../common/booking-guards';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { CreateServiceTypeDto } from '../dto/create-service-type.dto';
 import { ListServiceTypesQueryDto } from '../dto/list-rule-engine-query.dto';
@@ -18,7 +19,7 @@ export class ServiceTypesController {
  constructor(private readonly service: ServiceTypesService) {}

  @Get()
-  @RuleEngineView('service-types')
+  @StaffReference()
  @ApiOperation({ summary: 'List service types' })
  findAll(@Query() query: ListServiceTypesQueryDto) {
    return this.service.findAll(query);
@@ -41,7 +42,7 @@ export class ServiceTypesController {
  }

  @Get(':id')
-  @RuleEngineView('service-types')
+  @StaffReference()
  @ApiOperation({ summary: 'Get a service type by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/shipping-lines.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/shipping-lines.controller.ts
@@ -2,7 +2,8 @@ import {
  Body, Controller, Delete, Get, HttpCode, HttpStatus,
  Param, ParseUUIDPipe, Patch, Post, Query,
 } from '@nestjs/common';
-import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineManage } from '../../../common/rule-engine-guards';
+import { StaffReference } from '../../../common/booking-guards';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { CreateShippingLineDto } from '../dto/create-shipping-line.dto';
 import { ListRuleEngineQueryDto } from '../dto/list-rule-engine-query.dto';
@@ -16,14 +17,14 @@ export class ShippingLinesController {
  constructor(private readonly service: ShippingLinesService) {}

  @Get()
-  @RuleEngineView('shipping-lines')
+  @StaffReference()
  @ApiOperation({ summary: 'List shipping lines' })
  findAll(@Query() query: ListRuleEngineQueryDto) {
    return this.service.findAll(query);
  }

  @Get(':id')
-  @RuleEngineView('shipping-lines')
+  @StaffReference()
  @ApiOperation({ summary: 'Get a shipping line by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/yard-distances.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/yard-distances.controller.ts
@@ -12,7 +12,8 @@ import {
  Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineManage } from '../../../common/rule-engine-guards';
+import { StaffReference } from '../../../common/booking-guards';
 import { CreateYardDistanceDto } from '../dto/create-yard-distance.dto';
 import { ListYardDistancesQueryDto } from '../dto/list-rule-engine-query.dto';
 import { UpdateYardDistanceDto } from '../dto/update-yard-distance.dto';
@@ -25,14 +26,14 @@ export class YardDistancesController {
  constructor(private readonly service: YardDistancesService) {}

  @Get()
-  @RuleEngineView('yard-distances')
+  @StaffReference()
  @ApiOperation({ summary: 'List yard distances' })
  findAll(@Query() query: ListYardDistancesQueryDto) {
    return this.service.findAll(query);
  }

  @Get(':id')
-  @RuleEngineView('yard-distances')
+  @StaffReference()
  @ApiOperation({ summary: 'Get a yard distance by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
--- a/apps/edr-freight-api/src/modules/rule-engine/controllers/yards.controller.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/controllers/yards.controller.ts
@@ -2,7 +2,8 @@ import {
  Body, Controller, Delete, Get, HttpCode, HttpStatus,
  Param, ParseUUIDPipe, Patch, Post, Query,
 } from '@nestjs/common';
-import { RuleEngineManage, RuleEngineView } from '../../../common/rule-engine-guards';
+import { RuleEngineManage } from '../../../common/rule-engine-guards';
+import { StaffReference } from '../../../common/booking-guards';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { CreateYardDto } from '../dto/create-yard.dto';
 import { ListYardsQueryDto } from '../dto/list-rule-engine-query.dto';
@@ -18,7 +19,9 @@ export class YardsController {
  constructor(private readonly service: YardsService) {}

  @Get()
-  @RuleEngineView('yards')
+  // Reference read: every staff form/search needs the yard list (origin /
+  // destination pickers), so login is the only requirement.
+  @StaffReference()
  @ApiOperation({ summary: 'List yards' })
  findAll(@Query() query: ListYardsQueryDto) {
    return this.service.findAll(query);
@@ -41,7 +44,7 @@ export class YardsController {
  }

  @Get(':id')
-  @RuleEngineView('yards')
+  @StaffReference()
  @ApiOperation({ summary: 'Get a yard by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
--- a/apps/edr-freight-api/src/modules/warehouses/warehouse-yards.controller.ts
+++ b/apps/edr-freight-api/src/modules/warehouses/warehouse-yards.controller.ts
@@ -1,7 +1,7 @@
 import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';

-import { BookingStaff } from '../../common/booking-guards';
+import { BookingStaff, StaffReference } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateWarehouseZoneDto } from './dto/create-warehouse-zone.dto';
 import { UpdateWarehouseYardDto } from './dto/update-warehouse-yard.dto';
@@ -10,8 +10,9 @@ import { WarehouseZonesService } from './warehouse-zones.service';

@ApiTags('warehouse-yards')
@ApiBearerAuth()
+// No class-level guard: the two reference GETs are open to any signed-in
+// staff (StaffReference), every other route carries its own permission.
@Controller('warehouse-yards')
-@BookingStaff(FREIGHT_PERMS.warehouseYards.view)
 export class WarehouseYardsController {
  constructor(
    private readonly yardsService: WarehouseYardsService,
@@ -19,12 +20,14 @@ export class WarehouseYardsController {
  ) {}

  @Get()
+  @StaffReference()
  @ApiOperation({ summary: 'List all warehouse yards' })
  findAll() {
    return this.yardsService.findAll();
  }

  @Get(':id')
+  @StaffReference()
  @ApiOperation({ summary: 'Get warehouse yard by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.yardsService.findById(id);