edr-platform/apps/edr-freight-api/src/modules/rule-engine/controllers/rates.controller.ts

import {
  Body, Controller, Delete, Get, HttpCode, HttpStatus,
  Param, ParseUUIDPipe, Patch, Post, Query,
} from '@nestjs/common';
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
import { CurrentUser } from '@edr/api-common';
import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
import { RuleEngineCreate, RuleEngineDelete, RuleEngineUpdate, RuleEngineView } from '../../../common/rule-engine-guards';
import { isSuperAdmin } from '../../../common/freight-permission.util';
import { CreateRateDto } from '../dto/create-rate.dto';
import { ListRatesQueryDto } from '../dto/list-rule-engine-query.dto';
import {
  type AuthUserPayload,
  resolveAuthUserId,
} from '../../../common/resolve-auth-user-id';
import { UpdateRateDto } from '../dto/update-rate.dto';
import { RatesService } from '../services/rates.service';

@ApiTags('rates')
@Controller('rates')
@ApiBearerAuth()
export class RatesController {
  constructor(private readonly service: RatesService) {}

  @Get()
  @RuleEngineView('rates')
  @ApiOperation({ summary: 'List rates' })
  findAll(@Query() query: ListRatesQueryDto) {
    return this.service.findAll(query);
  }

  @Get('live')
  @RuleEngineView('rates')
  @ApiOperation({ summary: 'List all LIVE rates effective now' })
  findLive() {
    return this.service.findLiveRates();
  }

  @Get(':id')
  @RuleEngineView('rates')
  @ApiOperation({ summary: 'Get a rate by ID' })
  findOne(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.findById(id);
  }

  @Post()
  @RuleEngineCreate('rates')
  @ApiOperation({ summary: 'Create a rate (DRAFT)' })
  create(
    @Body() dto: CreateRateDto,
    @CurrentUser() user: AuthUserPayload,
  ) {
    return this.service.create(dto, resolveAuthUserId(user));
  }

  @Patch(':id')
  @RuleEngineUpdate('rates')
  @ApiOperation({ summary: 'Update a DRAFT rate' })
  update(@Param('id', ParseUUIDPipe) id: string, @Body() dto: UpdateRateDto) {
    return this.service.update(id, dto);
  }

  @Post(':id/submit')
  @RuleEngineUpdate('rates')
  @ApiOperation({ summary: 'Submit rate for CEO approval' })
  submit(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.submitForApproval(id);
  }

  @Post(':id/approve')
  @RuleEngineUpdate('rates')
  @ApiOperation({ summary: 'CEO approves a rate' })
  approve(
    @Param('id', ParseUUIDPipe) id: string,
    @CurrentUser() user: TCurrentUser,
  ) {
    // Super admins have full backoffice authority — they may approve a rate
    // they proposed; everyone else is held to separation of duties.
    return this.service.approve(id, resolveAuthUserId(user), isSuperAdmin(user));
  }

  @Delete(':id')
  @RuleEngineDelete('rates')
  @HttpCode(HttpStatus.NO_CONTENT)
  @ApiOperation({ summary: 'Soft-delete a rate' })
  remove(@Param('id', ParseUUIDPipe) id: string) {
    return this.service.remove(id);
  }
}