From 918d774cad644f049594cb76c2be088ba8073c5d Mon Sep 17 00:00:00 2001
From: morteza-mortezai <mrtz.mrtzi.1989@gmail.com>
Date: Sun, 1 Feb 2026 12:41:50 +0330
Subject: [PATCH] payment permission

---
 .../payment/controllers/payment.controller.ts | 57 ++++++++++---------
 1 file changed, 29 insertions(+), 28 deletions(-)

diff --git a/src/modules/payment/controllers/payment.controller.ts b/src/modules/payment/controllers/payment.controller.ts
index 49a759f..0121c68 100644
--- a/src/modules/payment/controllers/payment.controller.ts
+++ b/src/modules/payment/controllers/payment.controller.ts
@@ -17,79 +17,80 @@ import { PayOrderDto } from '../dto/pay-order.dto';
 import { FindPaymentsDto } from '../dto/find-payments.dto';
 import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { AdminId } from 'src/common/decorators/admin-id.decorator';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
 
 @ApiTags('payment')
+@ApiBearerAuth()
 @Controller()
 export class PaymentController {
   constructor(
-    private readonly paymentsService: PaymentService,
+    private readonly paymentService: PaymentService,
   ) { }
 
 
-  @Post('public/payments/pay-order/:orderId')
+  @Post('public/payments/order/:id/pay')
   @UseGuards(AuthGuard)
-  @ApiBearerAuth()
   @ApiOperation({ summary: 'Pay for an order' })
-  payAnOrder(@Param('orderId') orderId: string, @Body() dto: PayOrderDto) {
-    return this.paymentsService.payOrder(orderId, dto);
+  payAnOrder(@Param('id') orderId: string, @Body() dto: PayOrderDto) {
+    return this.paymentService.payOrder(orderId, dto);
   }
 
-  @Post('public/payments/:token/verify/online')
+  @Post('public/payments/online/:token/verify')
   @UseGuards(AuthGuard)
-  @ApiBearerAuth()
   @ApiOperation({ summary: 'Verify online payment' })
   verifyOnlinePayment(@Param('paymentId') token: string) {
-    return this.paymentsService.verifyOnlinePayment(token);
+    return this.paymentService.verifyOnlinePayment(token);
   }
 
-  @ApiBearerAuth()
+
   @Get('public/payments')
   @ApiOperation({ summary: 'get all payments as user' })
   findAllByUser(@UserId() userId: string, @Query() dto: FindPaymentsDto) {
-    return this.paymentsService.findAllByUser(dto, userId);
+    return this.paymentService.findAllByUser(dto, userId);
   }
 
   /*=============== Admin =============== */
 
-  @Post('admin/payments/pay-order/:orderId')
+  @Post('admin/payments/order/:id/pay')
   @UseGuards(AdminAuthGuard)
-  @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiOperation({ summary: 'Pay for an order as Admin' })
   payOrderAsAdmin(@Param('orderId') orderId: string, @AdminId() adminId: string, @Body() dto: PayOrderDto) {
-    return this.paymentsService.payOrder(orderId, dto, adminId);
+    return this.paymentService.payOrder(orderId, dto, adminId);
   }
 
-  @Post('admin/payments/:token/verify/online')
+  @Post('admin/payments/online/:token/verify')
   @UseGuards(AdminAuthGuard)
-  @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiOperation({ summary: 'Verify online payment as admin' })
   verifyOnlinePaymentAsAdmin(@Param('paymentId') token: string) {
-    return this.paymentsService.verifyOnlinePayment(token);
+    return this.paymentService.verifyOnlinePayment(token);
   }
 
-  @Post('admin/payments/:paymentId/verify/cash')
-  @UseGuards(AuthGuard)
-  @ApiBearerAuth()
+  @Post('admin/payments/:paymentId/cash/verify')
+  @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiOperation({ summary: 'Verify cash payment' })
   confirmPayment(@Param('paymentId') paymentId: string) {
-    return this.paymentsService.confirmCashPayment(paymentId);
+    return this.paymentService.confirmCashPayment(paymentId);
   }
 
-  @Delete('admin/payments/:paymentId/verify/cash')
-  @UseGuards(AuthGuard)
-  @ApiBearerAuth()
+  @Delete('admin/payments/:paymentId/cash/deny')
+  @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiOperation({ summary: 'Deny cash payment' })
   denyPayment(@Param('paymentId') paymentId: string) {
-    return this.paymentsService.denyCashPayment(paymentId);
+    return this.paymentService.denyCashPayment(paymentId);
   }
 
-  // @UseGuards(AdminAuthGuard)
-  // @Permissions(Permission.MANAGE_PAYMENTS)
-  @ApiBearerAuth()
+
   @Get('admin/payments')
+  @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiOperation({ summary: 'get all payments as admin' })
   findAllPayments(@Body() dto: FindPaymentsDto) {
-    return this.paymentsService.findAll(dto);
+    return this.paymentService.findAll(dto);
   }
 
 }