Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-09-08 15:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): regate payment, booking and wagon reads

Browse Source 
Payment summary/all moved off bookings:view onto payments:view, the
booking list now requires bookings:view for staff instead of accepting
any employee, and wagon reads require wagons:view or fleet:view rather
than bare authentication.
This commit is contained in:
Nathnael
2026-08-07 07:41:00 +00:00
parent 47ea54df1b
commit d4917bc6ec
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
View File

@@ -212,7 +212,7 @@ export class BookingsController {
} }
@Get() @Get()
@MixedAudience([]) @MixedAudience(FREIGHT_PERMS.bookings.view)
@ApiOperation({ summary: "List freight bookings (paginated)" }) @ApiOperation({ summary: "List freight bookings (paginated)" })
async findAll( async findAll(
@Query() filter: FilterBookingDto, @Query() filter: FilterBookingDto,

6
apps/edr-freight-api/src/modules/payment/payment.controller.ts
View File

@@ -18,7 +18,7 @@ import {
import { Response } from "express"; import { Response } from "express";
import { CurrentUser, Public } from "@edr/api-common"; import { CurrentUser, Public } from "@edr/api-common";
import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type"; import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
import { BookingStaff, BookingView, MixedAudience, PortalCustomer } from "../../common/booking-guards"; import { BookingStaff, MixedAudience, PortalCustomer } from "../../common/booking-guards";
import { UserTradeAccessService } from "../user-trade-access/user-trade-access.service"; import { UserTradeAccessService } from "../user-trade-access/user-trade-access.service";
import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry"; import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
import { PaymentService } from "./payment.service"; import { PaymentService } from "./payment.service";
@@ -43,14 +43,14 @@ export class PaymentController {
} }
@Get("summary") @Get("summary")
@BookingView() @BookingStaff(FREIGHT_PERMS.payments.view)
@ApiOperation({ summary: "Payment count/amount summary for dashboard cards" }) @ApiOperation({ summary: "Payment count/amount summary for dashboard cards" })
getSummary() { getSummary() {
return this.paymentService.getSummary(); return this.paymentService.getSummary();
} }
@Get("all") @Get("all")
@BookingView() @BookingStaff(FREIGHT_PERMS.payments.view)
@ApiOperation({ summary: "Get all payments with filters (view-only, any staff)" }) @ApiOperation({ summary: "Get all payments with filters (view-only, any staff)" })
@ApiQuery({ name: "search", required: false }) @ApiQuery({ name: "search", required: false })
@ApiQuery({ name: "status", required: false }) @ApiQuery({ name: "status", required: false })

8
apps/edr-freight-api/src/modules/wagons/wagons.controller.ts
View File

@@ -17,7 +17,7 @@ import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/curre
import { import {
BookingStaff, BookingStaff,
FleetManage, FleetManage,
StaffReference, FleetView,
} from '../../common/booking-guards'; } from '../../common/booking-guards';
import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry'; import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
import { CreateWagonDto } from './dto/create-wagon.dto'; import { CreateWagonDto } from './dto/create-wagon.dto';
@@ -44,7 +44,7 @@ export class WagonsController {
} }
@Get() @Get()
@StaffReference() @FleetView(FREIGHT_PERMS.wagons.view)
@ApiOperation({ @ApiOperation({
summary: 'List wagons, paginated ({items, meta}) — 10 per page by default', summary: 'List wagons, paginated ({items, meta}) — 10 per page by default',
}) })
@@ -53,14 +53,14 @@ export class WagonsController {
} }
@Get(':id') @Get(':id')
@StaffReference() @FleetView(FREIGHT_PERMS.wagons.view)
@ApiOperation({ summary: 'Get a wagon by ID' }) @ApiOperation({ summary: 'Get a wagon by ID' })
findOne(@Param('id', ParseUUIDPipe) id: string) { findOne(@Param('id', ParseUUIDPipe) id: string) {
return this.wagonsService.findById(id); return this.wagonsService.findById(id);
} }
@Get(':id/movements') @Get(':id/movements')
@StaffReference() @FleetView(FREIGHT_PERMS.wagons.view)
@ApiOperation({ @ApiOperation({
summary: "Wagon movement ledger (loaded legs, empty repositions, manual moves), newest first", summary: "Wagon movement ledger (loaded legs, empty repositions, manual moves), newest first",
}) })