mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-27 23:40:56 +00:00
0114673120
Gates the previously open support-agent, procurement, compliance, facilities, list-users and trade-access controllers, separates customer from staff routes across bookings, contracts, companies, billing, warehouses, files and train scheduling, and moves billing, overview, reports and the settings controllers onto their own keys instead of the blanket admin key. Drops the demo-permissions module and the untested notification test route.
71 lines
2.1 KiB
TypeScript
71 lines
2.1 KiB
TypeScript
import {
|
|
Body,
|
|
Controller,
|
|
ForbiddenException,
|
|
Get,
|
|
Param,
|
|
ParseUUIDPipe,
|
|
Put,
|
|
} from '@nestjs/common';
|
|
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
|
|
import { CurrentUser } from '@edr/api-common';
|
|
import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
|
|
|
|
import { BookingStaff, StaffReference } from '../../common/booking-guards';
|
|
import { isFreightApprovalAdmin } from '../../common/freight-permission.util';
|
|
import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
|
|
import { UpsertUserTradeAccessDto } from './dto/upsert-user-trade-access.dto';
|
|
import { UserTradeAccessService } from './user-trade-access.service';
|
|
|
|
@ApiTags('user-trade-access')
|
|
@Controller('user-trade-access')
|
|
@StaffReference()
|
|
@ApiBearerAuth()
|
|
export class UserTradeAccessController {
|
|
constructor(private readonly service: UserTradeAccessService) {}
|
|
|
|
@Get()
|
|
@BookingStaff(FREIGHT_PERMS.tradeAccess.view)
|
|
@ApiOperation({ summary: 'List every configured user trade-direction scope' })
|
|
list(@CurrentUser() user: TCurrentUser) {
|
|
this.assertAdmin(user);
|
|
return this.service.listConfigs();
|
|
}
|
|
|
|
@Get('me')
|
|
@ApiOperation({ summary: "Current user's effective trade-direction scope" })
|
|
async me(@CurrentUser() user: TCurrentUser) {
|
|
const allowed = await this.service.resolveAllowedDirections(user);
|
|
return {
|
|
restricted: allowed !== null,
|
|
directions: allowed ?? ['IMPORT', 'EXPORT', 'DOMESTIC'],
|
|
};
|
|
}
|
|
|
|
@Put(':userId')
|
|
@BookingStaff(FREIGHT_PERMS.tradeAccess.manage)
|
|
@ApiOperation({
|
|
summary: 'Set the trade directions a backoffice user may see',
|
|
})
|
|
upsert(
|
|
@Param('userId', ParseUUIDPipe) userId: string,
|
|
@Body() dto: UpsertUserTradeAccessDto,
|
|
@CurrentUser() user: TCurrentUser,
|
|
) {
|
|
this.assertAdmin(user);
|
|
return this.service.upsert(
|
|
userId,
|
|
dto.directions,
|
|
(user as { id?: string } | null)?.id ?? null,
|
|
);
|
|
}
|
|
|
|
private assertAdmin(user: TCurrentUser) {
|
|
if (!isFreightApprovalAdmin(user)) {
|
|
throw new ForbiddenException(
|
|
'Only super or organization admins can manage trade-direction access',
|
|
);
|
|
}
|
|
}
|
|
}
|