Merge pull request #891 from Tria-plc/freight_feature/usermanagement

feat(user-management): implement staff reference permissions for vari…

apps/edr-freight-api/src/modules/warehouses/warehouse-yards.controller.ts

@@ -1,7 +1,7 @@
 import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
-import { BookingStaff } from '../../common/booking-guards';
+import { BookingStaff, StaffReference } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateWarehouseZoneDto } from './dto/create-warehouse-zone.dto';
 import { UpdateWarehouseYardDto } from './dto/update-warehouse-yard.dto';
@@ -10,8 +10,9 @@ import { WarehouseZonesService } from './warehouse-zones.service';
 
 @ApiTags('warehouse-yards')
 @ApiBearerAuth()
+// No class-level guard: the two reference GETs are open to any signed-in
+// staff (StaffReference), every other route carries its own permission.
 @Controller('warehouse-yards')
-@BookingStaff(FREIGHT_PERMS.warehouseYards.view)
 export class WarehouseYardsController {
   constructor(
     private readonly yardsService: WarehouseYardsService,
@@ -19,12 +20,14 @@ export class WarehouseYardsController {
   ) {}
 
   @Get()
+  @StaffReference()
   @ApiOperation({ summary: 'List all warehouse yards' })
   findAll() {
     return this.yardsService.findAll();
   }
 
   @Get(':id')
+  @StaffReference()
   @ApiOperation({ summary: 'Get warehouse yard by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.yardsService.findById(id);