edr-platform/apps/edr-freight-api/src/modules/wagons/wagons.controller.ts

import {
  Body,
  Controller,
  Delete,
  Get,
  HttpCode,
  HttpStatus,
  Param,
  ParseUUIDPipe,
  Patch,
  Post,
  Query,
} from '@nestjs/common';
import { ApiOperation, ApiTags } from '@nestjs/swagger';
import { CurrentUser } from '@edr/api-common';
import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
import {
  BookingStaff,
  FleetManage,
  FleetView,
} from '../../common/booking-guards';
import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
import { CreateWagonDto } from './dto/create-wagon.dto';
import { ListWagonsQueryDto } from './dto/list-wagons-query.dto';
import { UpdateWagonDto } from './dto/update-wagon.dto';
import { AssignWagonToTrainDto } from './dto/assign-wagon-to-train.dto';
import { BulkTransferWagonsDto } from './dto/bulk-transfer-wagons.dto';
import { BulkSetWagonStatusDto } from './dto/bulk-set-wagon-status.dto';
import { WagonsService } from './wagons.service';
import { WagonHistoryQueryDto } from '../wagon-history/dto/wagon-history-query.dto';
import { WagonHistoryService } from '../wagon-history/wagon-history.service';

@ApiTags('wagons')
// No class-level guard: reads (list, by-id, movements) are login-only reference
// data — any staff can fetch wagon data for a cross-flow view without the
// fleet:view that drives the Fleet sidebar. Every mutation has its @FleetManage().
@Controller('wagons')
export class WagonsController {
  constructor(
    private readonly wagonsService: WagonsService,
    private readonly wagonHistory: WagonHistoryService,
  ) {}

  @Post()
  @FleetManage(FREIGHT_PERMS.wagons.create)
  @ApiOperation({ summary: 'Create a new wagon' })
  create(@Body() dto: CreateWagonDto, @CurrentUser() user: TCurrentUser) {
    return this.wagonsService.create(dto, user?.id);
  }

  @Get()
  @FleetView(FREIGHT_PERMS.wagons.view)
  @ApiOperation({
    summary: 'List wagons, paginated ({items, meta}) — 10 per page by default',
  })
  findAll(@Query() query: ListWagonsQueryDto) {
    return this.wagonsService.findAll(query);
  }

  @Get(':id')
  @FleetView(FREIGHT_PERMS.wagons.view)
  @ApiOperation({ summary: 'Get a wagon by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.wagonsService.findById(id);
  }

  @Get(':id/movements')
  @FleetView(FREIGHT_PERMS.wagons.view)
  @ApiOperation({
    summary: "Wagon movement ledger (loaded legs, empty repositions, manual moves), newest first",
  })
  listMovements(@Param('id', ParseUUIDPipe) id: string) {
    return this.wagonsService.listMovements(id);
  }

  @Get(':id/history')
  @FleetView(FREIGHT_PERMS.wagons.view)
  @ApiOperation({
    summary:
      'Unified wagon history — yard moves, coupling, schedule pins/dispatch, status flips, cargo, lifecycle — newest first, keyset-paginated (`cursor`)',
  })
  history(@Param('id', ParseUUIDPipe) id: string, @Query() query: WagonHistoryQueryDto) {
    // No existence check on purpose: a deleted or purged wagon keeps its history.
    return this.wagonHistory.list(id, query);
  }

  @Patch(':id')
  @FleetManage(FREIGHT_PERMS.wagons.update)
  @ApiOperation({ summary: 'Update a wagon' })
  update(
    @Param('id', ParseUUIDPipe) id: string,
    @Body() dto: UpdateWagonDto,
    @CurrentUser() user: TCurrentUser,
  ) {
    return this.wagonsService.update(id, dto, user?.id);
  }

  // Declared before @Delete(':id') so "permanent" is never captured as an id.
  // BookingStaff, not FleetManage: the latter also accepts the coarse
  // fleet:manage key, which would hand an irreversible purge to everyone who
  // can edit the fleet. This action requires its own grant, nothing else.
  @Delete(':id/permanent')
  @BookingStaff(FREIGHT_PERMS.wagons.hardDelete)
  @HttpCode(HttpStatus.NO_CONTENT)
  @ApiOperation({
    summary:
      'Permanently delete a wagon (irreversible; refused if it has movements, containers or train-set slots)',
  })
  purge(@Param('id', ParseUUIDPipe) id: string, @CurrentUser() user: TCurrentUser) {
    return this.wagonsService.purge(id, user?.id);
  }

  @Delete(':id')
  @FleetManage(FREIGHT_PERMS.wagons.delete)
  @ApiOperation({ summary: 'Delete a wagon' })
  remove(@Param('id', ParseUUIDPipe) id: string, @CurrentUser() user: TCurrentUser) {
    return this.wagonsService.remove(id, user?.id);
  }

  @Post(':id/assign-train')
  @FleetManage(FREIGHT_PERMS.trains.assignWagons)
  @ApiOperation({ summary: 'Assign wagon to a train' })
  assignToTrain(
    @Param('id', ParseUUIDPipe) id: string,
    @Body() dto: AssignWagonToTrainDto,
    @CurrentUser() user: TCurrentUser,
  ) {
    return this.wagonsService.assignToTrain(id, dto, user?.id);
  }

  @Post(':id/unassign-train')
  @FleetManage(FREIGHT_PERMS.trains.assignWagons)
  @ApiOperation({ summary: 'Unassign wagon from train' })
  unassignFromTrain(@Param('id', ParseUUIDPipe) id: string, @CurrentUser() user: TCurrentUser) {
    return this.wagonsService.unassignFromTrain(id, user?.id);
  }

  @Post('bulk-transfer')
  @FleetManage(FREIGHT_PERMS.wagons.update)
  @ApiOperation({ summary: 'Transfer multiple wagons to a destination yard' })
  bulkTransfer(@Body() dto: BulkTransferWagonsDto, @CurrentUser() user: TCurrentUser) {
    return this.wagonsService.bulkTransfer(dto, user?.id);
  }

  @Post('bulk-status')
  // One-of: the dedicated maintenance⇄availability key, full wagon edit, or
  // the legacy coarse fleet:manage — operations/OCC hold statusToggle only.
  @BookingStaff([
    FREIGHT_PERMS.wagons.statusToggle,
    FREIGHT_PERMS.wagons.update,
    FREIGHT_PERMS.fleet.manage,
  ])
  @ApiOperation({ summary: 'Set the status of multiple wagons (audited in wagon_status_logs)' })
  bulkSetStatus(@Body() dto: BulkSetWagonStatusDto, @CurrentUser() user: TCurrentUser) {
    return this.wagonsService.bulkSetStatus(dto, user?.id);
  }

  @Get(':id/status-history')
  @FleetView(FREIGHT_PERMS.wagons.view)
  @ApiOperation({ summary: 'Status-flip history of a wagon (maintenance ⇄ availability audit)' })
  statusHistory(@Param('id', ParseUUIDPipe) id: string) {
    return this.wagonsService.statusHistory(id);
  }
}