Files
edr-platform/apps/edr-freight-api/src/modules/dropdown-settings/dropdown-settings.controller.ts
Nathnael 0114673120 feat(auth): gate and regate freight API controllers
Gates the previously open support-agent, procurement, compliance,
facilities, list-users and trade-access controllers, separates customer
from staff routes across bookings, contracts, companies, billing,
warehouses, files and train scheduling, and moves billing, overview,
reports and the settings controllers onto their own keys instead of the
blanket admin key. Drops the demo-permissions module and the untested
notification test route.
2026-08-07 07:32:25 +00:00

126 lines
4.1 KiB
TypeScript

import {
Body,
Controller,
Delete,
Get,
HttpCode,
HttpStatus,
Param,
ParseUUIDPipe,
Patch,
Post,
Put,
Query,
} from "@nestjs/common";
import { ApiOperation, ApiTags } from "@nestjs/swagger";
import { BookingStaff } from "../../common/booking-guards";
import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
import { CreateDropdownOptionDto } from "./dto/create-dropdown-option.dto";
import { CreateDropdownSettingDto } from "./dto/create-dropdown-setting.dto";
import { ListDropdownSettingsQueryDto } from "./dto/list-dropdown-settings-query.dto";
import { UpdateDropdownOptionDto } from "./dto/update-dropdown-option.dto";
import { UpdateDropdownSettingDto } from "./dto/update-dropdown-setting.dto";
import { DropdownSettingsService } from "./dropdown-settings.service";
@ApiTags("dropdown-settings")
@Controller("dropdown-settings")
export class DropdownSettingsController {
constructor(private readonly service: DropdownSettingsService) {}
// Reads stay open: the customer portal fetches these to render dynamic
// dropdowns (by-code). Only writes are admin-guarded.
@Get()
@ApiOperation({ summary: "List all dropdown settings" })
list() {
return this.service.list();
}
// Must be declared before @Get(":id") so "paged" isn't captured as an id.
@Get("paged")
@ApiOperation({
summary: "Paged admin listing of dropdown settings (server-side search)",
})
listPaged(@Query() query: ListDropdownSettingsQueryDto) {
return this.service.listPaged(query);
}
@Get(":id")
@ApiOperation({ summary: "Get a dropdown setting by ID" })
getById(@Param("id", ParseUUIDPipe) id: string) {
return this.service.getById(id);
}
@Get("by-code/:code")
@ApiOperation({ summary: "Get a dropdown setting by its stable code" })
getByCode(@Param("code") code: string) {
return this.service.getByCode(code);
}
@Post()
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Create a new dropdown setting" })
create(@Body() dto: CreateDropdownSettingDto) {
return this.service.create(dto);
}
@Patch(":id")
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Update a dropdown setting's metadata" })
update(
@Param("id", ParseUUIDPipe) id: string,
@Body() dto: UpdateDropdownSettingDto,
) {
return this.service.update(id, dto);
}
@Delete(":id")
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Soft-delete a dropdown setting" })
@HttpCode(HttpStatus.NO_CONTENT)
remove(@Param("id", ParseUUIDPipe) id: string) {
return this.service.remove(id);
}
/* ------------------------- option routes ------------------------- */
@Put(":id/options")
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Replace the full option list for a setting" })
replaceOptions(
@Param("id", ParseUUIDPipe) id: string,
@Body() options: CreateDropdownOptionDto[],
) {
return this.service.replaceOptions(id, options);
}
@Post(":id/options")
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Append a single option to a setting" })
addOption(
@Param("id", ParseUUIDPipe) id: string,
@Body() dto: CreateDropdownOptionDto,
) {
return this.service.addOption(id, dto);
}
@Patch("options/:optionId")
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Update a single option" })
updateOption(
@Param("optionId", ParseUUIDPipe) optionId: string,
@Body() dto: UpdateDropdownOptionDto,
) {
return this.service.updateOption(optionId, dto);
}
@Delete("options/:optionId")
@BookingStaff([FREIGHT_PERMS.settings.dropdown.manage, FREIGHT_PERMS.admin])
@ApiOperation({ summary: "Soft-delete a single option" })
@HttpCode(HttpStatus.NO_CONTENT)
removeOption(@Param("optionId", ParseUUIDPipe) optionId: string) {
return this.service.removeOption(optionId);
}
}