per-user trade-direction access scope

apps/edr-freight-api/src/modules/payment/payment.controller.ts

@@ -15,8 +15,10 @@ import {
     ApiProduces,
 } from "@nestjs/swagger";
 import { Response } from "express";
-import { Public } from "@edr/api-common";
+import { CurrentUser, Public } from "@edr/api-common";
+import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
 import { BookingStaff, BookingView } from "../../common/booking-guards";
+import { UserTradeAccessService } from "../user-trade-access/user-trade-access.service";
 import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { PaymentService } from "./payment.service";
 import { IntentStatusDto } from "./payments.dto";
@@ -24,7 +26,10 @@ import { IntentStatusDto } from "./payments.dto";
 @ApiTags("Payment")
 @Controller("payments")
 export class PaymentController {
-    constructor(private readonly paymentService: PaymentService) { }
+    constructor(
+        private readonly paymentService: PaymentService,
+        private readonly userTradeAccessService: UserTradeAccessService,
+    ) { }
 
     // Customer-detail payments tab — same one-of rule as the bookings tab.
     @Get("by-company/:companyId/customer-view")
@@ -52,18 +57,23 @@ export class PaymentController {
     @ApiQuery({ name: "page", required: false })
     @ApiQuery({ name: "pageSize", required: false })
     async getAll(
+        @CurrentUser() user: TCurrentUser,
         @Query("search") search?: string,
         @Query("status") status?: string,
         @Query("method") method?: string,
         @Query("page") page?: string,
         @Query("pageSize") pageSize?: string,
     ) {
+        // Per-user trade-direction scope, applied via the booking in ref_id.
+        const allowed =
+            await this.userTradeAccessService.resolveAllowedDirections(user);
         return this.paymentService.getAll({
             search,
             status,
             method,
             page: page ? parseInt(page) : 1,
             pageSize: pageSize ? parseInt(pageSize) : 10,
+            tradeDirections: allowed ?? undefined,
         });
     }