per-user trade-direction access scope

apps/edr-freight-api/src/modules/overview/overview.controller.ts

@@ -5,6 +5,8 @@ import {
   ApiOperation,
   ApiTags,
 } from '@nestjs/swagger';
+import { CurrentUser } from '@edr/api-common';
+import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
 import { BookingView } from '../../common/booking-guards';
 import { OverviewQueryDto } from './dto/overview-query.dto';
@@ -18,43 +20,79 @@ import {
   OverviewStaffTabDto,
 } from './dto/overview-tab-response.dto';
 import { OverviewService } from './overview.service';
+import { UserTradeAccessService } from '../user-trade-access/user-trade-access.service';
 
 @ApiTags('Overview')
 @ApiBearerAuth()
 @Controller('overview')
 export class OverviewController {
-  constructor(private readonly overviewService: OverviewService) {}
+  constructor(
+    private readonly overviewService: OverviewService,
+    private readonly userTradeAccessService: UserTradeAccessService,
+  ) {}
 
   @Get()
   @BookingView()
   @ApiOperation({ summary: 'Aggregated dashboard summary for backoffice overview' })
   @ApiOkResponse({ type: OverviewResponseDto })
-  getDashboard(@Query() query: OverviewQueryDto): Promise<OverviewResponseDto> {
-    return this.overviewService.getDashboard(query.range ?? '30d');
+  async getDashboard(
+    @Query() query: OverviewQueryDto,
+    @CurrentUser() user: TCurrentUser,
+  ): Promise<OverviewResponseDto> {
+    const allowed =
+      await this.userTradeAccessService.resolveAllowedDirections(user);
+    return this.overviewService.getDashboard(
+      query.range ?? '30d',
+      allowed ?? undefined,
+    );
   }
 
   @Get('bookings')
   @BookingView()
   @ApiOperation({ summary: 'Bookings tab metrics and charts' })
   @ApiOkResponse({ type: OverviewBookingsTabDto })
-  getBookingsTab(@Query() query: OverviewQueryDto): Promise<OverviewBookingsTabDto> {
-    return this.overviewService.getBookingsTab(query.range ?? '30d');
+  async getBookingsTab(
+    @Query() query: OverviewQueryDto,
+    @CurrentUser() user: TCurrentUser,
+  ): Promise<OverviewBookingsTabDto> {
+    const allowed =
+      await this.userTradeAccessService.resolveAllowedDirections(user);
+    return this.overviewService.getBookingsTab(
+      query.range ?? '30d',
+      allowed ?? undefined,
+    );
   }
 
   @Get('contracts')
   @BookingView()
   @ApiOperation({ summary: 'Contracts tab metrics and charts' })
   @ApiOkResponse({ type: OverviewContractsTabDto })
-  getContractsTab(@Query() query: OverviewQueryDto): Promise<OverviewContractsTabDto> {
-    return this.overviewService.getContractsTab(query.range ?? '30d');
+  async getContractsTab(
+    @Query() query: OverviewQueryDto,
+    @CurrentUser() user: TCurrentUser,
+  ): Promise<OverviewContractsTabDto> {
+    const allowed =
+      await this.userTradeAccessService.resolveAllowedDirections(user);
+    return this.overviewService.getContractsTab(
+      query.range ?? '30d',
+      allowed ?? undefined,
+    );
   }
 
   @Get('billing')
   @BookingView()
   @ApiOperation({ summary: 'Billing tab metrics and charts' })
   @ApiOkResponse({ type: OverviewBillingTabDto })
-  getBillingTab(@Query() query: OverviewQueryDto): Promise<OverviewBillingTabDto> {
-    return this.overviewService.getBillingTab(query.range ?? '30d');
+  async getBillingTab(
+    @Query() query: OverviewQueryDto,
+    @CurrentUser() user: TCurrentUser,
+  ): Promise<OverviewBillingTabDto> {
+    const allowed =
+      await this.userTradeAccessService.resolveAllowedDirections(user);
+    return this.overviewService.getBillingTab(
+      query.range ?? '30d',
+      allowed ?? undefined,
+    );
   }
 
   @Get('operations')
@@ -69,8 +107,16 @@ export class OverviewController {
   @BookingView()
   @ApiOperation({ summary: 'Customers tab metrics and charts' })
   @ApiOkResponse({ type: OverviewCustomersTabDto })
-  getCustomersTab(@Query() query: OverviewQueryDto): Promise<OverviewCustomersTabDto> {
-    return this.overviewService.getCustomersTab(query.range ?? '30d');
+  async getCustomersTab(
+    @Query() query: OverviewQueryDto,
+    @CurrentUser() user: TCurrentUser,
+  ): Promise<OverviewCustomersTabDto> {
+    const allowed =
+      await this.userTradeAccessService.resolveAllowedDirections(user);
+    return this.overviewService.getCustomersTab(
+      query.range ?? '30d',
+      allowed ?? undefined,
+    );
   }
 
   @Get('staff')