permission

src/modules/order/controllers/order.controller.ts

@@ -15,6 +15,8 @@ import { UpdateOrderAsAdminDto } from '../dto/update-order.dto';
 import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { CreatePrintFormDto } from '../dto/create-print-form.dto';
 import { FindOrderItemsDto } from '../dto/find-order-items.dto';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { PermissionEnum } from 'src/common/enums/permission.enum';
 
 @ApiTags('orders')
 @ApiBearerAuth()
@@ -94,6 +96,7 @@ export class OrderController {
 
   @Post('admin/orders')
   @UseGuards(AdminAuthGuard)
+  @Permissions(PermissionEnum.CREATE_ORDER)
   @ApiOperation({ summary: 'create order ' })
   createOrderAsAdmin(@AdminId() adminId: string, @Body() body: CreateOrderAsAdminDto) {
     return this.orderService.createOrderAsAdmin(adminId, body);
@@ -101,17 +104,18 @@ export class OrderController {
 
   @Get('admin/orders/request')
   @UseGuards(AdminAuthGuard)
+  @Permissions(PermissionEnum.VIEW_All_REQUEST_ORDERS)
   @ApiOperation({ summary: 'Get all order requests with pagination and filters' })
   findOrderRequestAsAdmin(@Query() dto: FindOrdersDto) {
     return this.orderService.findOrderRequestsAsAdmin(dto);
   }
 
-
+  // this route permission is handled inside service
   @Get('admin/orders/invoiced')
   @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Get all invoiced orders with pagination and filters' })
-  findInvoicedOrdersAsAdmin(@Query() dto: FindOrdersDto) {
-    return this.orderService.findOrderRequestsAsAdmin(dto);
+  findInvoicedOrdersAsAdmin(@Query() dto: FindOrdersDto, @AdminId() adminId: string) {
+    return this.orderService.findInvoicedOrdersAsAdmin(adminId, dto);
   }
 
   @Get('admin/orders/:id')
@@ -123,6 +127,7 @@ export class OrderController {
 
   @Get('admin/orders/item/print')
   @UseGuards(AdminAuthGuard)
+  @Permissions(PermissionEnum.VIEW_All_ORDERS)
   @ApiOperation({ summary: 'get print orders' })
   getPrintOrders(@Body() dto: FindOrderItemsDto) {
     return this.orderService.findPrintOrderItemsAsAdmin(dto);
@@ -135,19 +140,6 @@ export class OrderController {
     return this.orderService.findOrderItemOrFailByItemId(+itemId);
   }
 
-  @Get('admin/orders/item/:id/print')
-  @UseGuards(AdminAuthGuard)
-  @ApiOperation({ summary: 'create order item print' })
-  createOrderItemPrint(@Param('id') itemId: string) {
-    // return this.orderService.findOrderItemOrFailByItemId(+itemId);
-  }
-  // @Patch('admin/orders/:orderId')
-  // @UseGuards(AdminAuthGuard)
-  // @ApiOperation({ summary: 'Update Order ' })
-  // updateOrder(@Param('orderId') orderId: string, @Body() dto: UpdateOrderAsAdminDto) {
-  //   return this.orderService.updateOrderAsAdmin(orderId, dto);
-  // }
-
   @Patch('admin/orders/:orderId')
   @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Update Order ' })
@@ -157,6 +149,7 @@ export class OrderController {
 
   @Patch('admin/orders/:id/item/:itemId/print')
   @UseGuards(AdminAuthGuard)
+  @Permissions(PermissionEnum.CREATE_ORDER_PRINT)
   @ApiOperation({ summary: 'Create Print form for order item' })
   createPrintForm(@Param('id') id: string, @Param('itemId') itemId: string, @Body() dto: CreatePrintFormDto) {
     return this.orderService.createPrintForm(id, +itemId, dto);

src/modules/order/listeners/order.listeners.ts

@@ -2,7 +2,7 @@ import { Injectable, Logger } from '@nestjs/common';
 import { OnEvent } from '@nestjs/event-emitter';
 import { AdminRepository } from 'src/modules/admin/repositories/admin.repository';
 import { OrderCreatedEvent, OrderStatusChangedEvent } from '../events/order.events';
-import { Permission } from 'src/common/enums/permission.enum';
+import { PermissionEnum } from 'src/common/enums/permission.enum';
 import { NotifEvent } from 'src/modules/notification/interfaces/notification.interface';
 import { NotificationService } from 'src/modules/notification/services/notification.service';
 import { ConfigService } from '@nestjs/config';

src/modules/order/providers/order.service.ts

@@ -30,8 +30,9 @@ import { AdminService } from 'src/modules/admin/providers/admin.service';
 import { OrderItem } from '../entities/order-item.entity';
 import { UpdateOrderAsAdminDto } from '../dto/update-order.dto';
 import { CreatePrintFormDto } from '../dto/create-print-form.dto';
-import { Product } from 'src/modules/product/entities/product.entity';
 import { FindOrderItemsDto } from '../dto/find-order-items.dto';
+import { PermissionService } from 'src/modules/roles/providers/permissions.service';
+import { PermissionEnum } from 'src/common/enums/permission.enum';
 
 
 @Injectable()
@@ -51,6 +52,7 @@ export class OrderService {
     private readonly eventEmitter: EventEmitter2,
     private readonly adminRepository: AdminRepository,
     private readonly paymentRepository: PaymentRepository,
+    private readonly permissionService: PermissionService,
   ) { }
 
   async createOrderAsAdmin(adminId: string, dto: CreateOrderAsAdminDto) {
@@ -83,6 +85,7 @@ export class OrderService {
     // return updateOrder
   }
 
+  //TODO : clean
   async updateOrderAsAdmin2(orderId: string, dto: UpdateOrderAsAdminDto) {
     const order = await this.findOrderOrFail(orderId)
 
@@ -291,8 +294,23 @@ export class OrderService {
     return orders
   }
 
-  async findInvoicedOrdersAsAdmin(dto: FindOrdersDto) {
-    const orders = await this.orderRepository.findAllPaginated({ ...dto, isInvoiced: true, })
+  async findInvoicedOrdersAsAdmin(adminId: string, dto: FindOrdersDto) {
+    const canSeeAll = await this.adminService.hasPermission(adminId, PermissionEnum.VIEW_All_INVOICED_ORDERS)
+
+    let canSeeAsigned = false
+
+    if (!canSeeAll) {
+      canSeeAsigned = await this.adminService.hasPermission(adminId, PermissionEnum.VIEW_MY_ASSIGNED_INVOICED_REQUESTS)
+    }
+
+    if (!canSeeAsigned && !canSeeAll) {
+      throw new BadRequestException("You dont have Permission")
+    }
+
+    let designerId = canSeeAll ? undefined : adminId
+
+    const orders = await this.orderRepository.findAllPaginated({ ...dto, isInvoiced: true, designerId })
+
     return orders
   }
 

src/modules/order/repositories/order.repository.ts

@@ -10,6 +10,7 @@ import { FindOrdersDto } from '../dto/find-orders.dto';
 class FindOrdersOpts extends FindOrdersDto {
   userId?: string;
   isInvoiced?: boolean;
+  designerId?: string
 };
 
 @Injectable()
@@ -29,7 +30,8 @@ export class OrderRepository extends EntityRepository<Order> {
       userId,
       from,
       to,
-      isInvoiced
+      isInvoiced,
+      designerId
     } = opts;
 
     const offset = (page - 1) * limit;
@@ -60,11 +62,14 @@ export class OrderRepository extends EntityRepository<Order> {
     if (isInvoiced != undefined) {
       if (isInvoiced == true) {
         where.invoicedAt = { $not: null }
-      }else{
+      } else {
         where.invoicedAt = null
       }
     }
 
+    if (designerId) {
+      where.items = { $some: { designer: { id: designerId } } }
+    }
     // Filter by date range
     if (from || to) {
       where.createdAt = {};