Files
edr-platform/apps/edr-freight-api/src/modules/warehouses/warehouse-loadings.controller.ts
Hagernesh 65f6015c5e feat(warehouse): guard warehouse/inventory/fee endpoints with RBAC permissions
Apply JwtGuard + FreightPermissionGuard (via @BookingStaff) to 83 staff
endpoints across the 8 warehouse controllers, using existing
edr_freight_app:warehouse* permissions: warehouses/yards/zones,
inventory receive/move/load/unload/dispatch/gate-pass/release/deliver/inspect
(incl. import & export queues), allocation + fee rules (demurrage/storage/
double-handling), accrual dashboard + acknowledge, and fee invoices.

Customer-portal endpoints (booking-scoped documents, approve-delivery,
portal fee-invoice view/document/receipt/pay-online) are intentionally left
unguarded — they need a customer-ownership guard, not staff permissions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-14 12:54:41 +00:00

21 lines
830 B
TypeScript

import { Controller, Get, Query } from '@nestjs/common';
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
import { BookingStaff } from '../../common/booking-guards';
import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
import { WarehouseInventoryService } from './warehouse-inventory.service';
@ApiTags('warehouse-loadings')
@ApiBearerAuth()
@Controller('warehouse-loadings')
@BookingStaff(FREIGHT_PERMS.warehouseInventory.view)
export class WarehouseLoadingsController {
constructor(private readonly inventoryService: WarehouseInventoryService) {}
@Get()
@ApiOperation({ summary: 'List wagon loading records' })
findAll(@Query('bookingId') bookingId?: string, @Query('wagonId') wagonId?: string) {
return this.inventoryService.findLoadings({ bookingId, wagonId });
}
}