mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-26 18:42:49 +00:00
01ea05f013
IAM lets an employee hold several positions, but the vendored JwtGuard collapses employee.positions[] down to a single employee.position and drops the rest. Non-delegate secondary positions vanished entirely, so staff on two posts resolved to one post's permissions and every check on the other rejected them. FreightJwtGuard re-attaches the full list from the same session snapshot the parent guard already read, so nothing extra is fetched per request beyond a cached session lookup. employee.position is left untouched, keeping audit logging and delegation unaffected. collectPermissionKeys and collectPositionTypeKeys now union across every position, and /me returns them all. Verified against a real two-position user (djibouti-gl-director + djibouti-gl-chief) on the local dev database: /me positions 1 -> 2 /me permissionKeys 17 -> 28 GET /api/interchange-documents 403 -> 200 GET /api/trains 403 -> 200 11 permissions recovered, none lost. Six single-position users return byte-identical payloads before and after.
43 lines
1.7 KiB
TypeScript
43 lines
1.7 KiB
TypeScript
import { applyDecorators, UseGuards } from '@nestjs/common';
|
|
import { FreightJwtGuard } from './freight-jwt.guard';
|
|
|
|
import { FreightPermissionGuard } from './freight-permission.guard';
|
|
import {
|
|
FREIGHT_PERMS,
|
|
type RuleEngineApprovableSlug,
|
|
type RuleEngineResourceSlug,
|
|
} from '../seed/freight-permissions.registry';
|
|
|
|
export const RuleEngineView = (slug: RuleEngineResourceSlug) =>
|
|
applyDecorators(
|
|
UseGuards(FreightJwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.view(slug)])),
|
|
);
|
|
|
|
// Granular CRUD replaces the retired coarse RuleEngineManage. Each write
|
|
// endpoint carries the specific action it performs — create on POST-new,
|
|
// update on PATCH / reorder / move-order, delete on DELETE.
|
|
export const RuleEngineCreate = (slug: RuleEngineResourceSlug) =>
|
|
applyDecorators(
|
|
UseGuards(FreightJwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.create(slug)])),
|
|
);
|
|
|
|
export const RuleEngineUpdate = (slug: RuleEngineResourceSlug) =>
|
|
applyDecorators(
|
|
UseGuards(FreightJwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.update(slug)])),
|
|
);
|
|
|
|
export const RuleEngineDelete = (slug: RuleEngineResourceSlug) =>
|
|
applyDecorators(
|
|
UseGuards(FreightJwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.delete(slug)])),
|
|
);
|
|
|
|
/**
|
|
* Deciding a filed change — a step above `manage`, which only lets a staff
|
|
* member propose one. Super admins pass any freight permission check, so
|
|
* approvals work before the permission is granted to a director role.
|
|
*/
|
|
export const RuleEngineApprove = (slug: RuleEngineApprovableSlug) =>
|
|
applyDecorators(
|
|
UseGuards(FreightJwtGuard, FreightPermissionGuard([FREIGHT_PERMS.ruleEngine.approve(slug)])),
|
|
);
|