edr-platform/apps/edr-freight-api/src/common/rule-engine-guards.ts

import { applyDecorators, UseGuards } from '@nestjs/common';
import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';

import { FreightPermissionGuard } from './freight-permission.guard';
import {
  FREIGHT_PERMS,
  type RuleEngineApprovableSlug,
  type RuleEngineResourceSlug,
} from '../seed/freight-permissions.registry';

export const RuleEngineView = (slug: RuleEngineResourceSlug) =>
  applyDecorators(
    UseGuards(JwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.view(slug)])),
  );

// Granular CRUD replaces the retired coarse RuleEngineManage. Each write
// endpoint carries the specific action it performs — create on POST-new,
// update on PATCH / reorder / move-order, delete on DELETE.
export const RuleEngineCreate = (slug: RuleEngineResourceSlug) =>
  applyDecorators(
    UseGuards(JwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.create(slug)])),
  );

export const RuleEngineUpdate = (slug: RuleEngineResourceSlug) =>
  applyDecorators(
    UseGuards(JwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.update(slug)])),
  );

export const RuleEngineDelete = (slug: RuleEngineResourceSlug) =>
  applyDecorators(
    UseGuards(JwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.delete(slug)])),
  );

/**
 * Deciding a filed change — a step above `manage`, which only lets a staff
 * member propose one. Super admins pass any freight permission check, so
 * approvals work before the permission is granted to a director role.
 */
export const RuleEngineApprove = (slug: RuleEngineApprovableSlug) =>
  applyDecorators(
    UseGuards(JwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.approve(slug)])),
  );