order

src/app.module.ts

@@ -31,9 +31,9 @@ import { cacheConfig } from './config/cache.config';
     ConfigModule.forRoot({ isGlobal: true, cache: true }),
     CacheModule.registerAsync(cacheConfig()),
     MikroOrmModule.forRootAsync(dataBaseConfig),
+    AuthModule,
     UserModule,
     UtilsModule,
-    AuthModule,
     UploaderModule,
     AdminModule,
     ThrottlerModule.forRoot([

src/common/decorators/admin-perms.decorator.ts

@@ -0,0 +1,18 @@
+import { createParamDecorator, type ExecutionContext } from '@nestjs/common';
+import type { Request } from 'express';
+
+/**
+ * Decorator to extract userId from the authenticated request.
+ * Must be used after AdminAuthGuard or AuthGuard that sets request.userId.
+ *
+ * @example
+ * @Get('/profile')
+ * @UseGuards(AdminAuthGuard)
+ * getProfile(@UserId() userId: string) {
+ *   return this.userService.findById(userId);
+ * }
+ */
+export const AdminPerms = createParamDecorator((data: unknown, ctx: ExecutionContext): string[] => {
+  const request = ctx.switchToHttp().getRequest<Request & { permissions?: string[] }>();
+  return request.permissions || [];
+});

src/common/enums/permission.enum.ts

@@ -1,5 +1,7 @@
 export enum PermissionEnum {
 
+  DASHBOARD = 'dashboard',
+
   MANAGE_PRODUCTS = 'manage_products',
   MANAGE_CATEGORIES = 'manage_categories',
 
@@ -60,6 +62,7 @@ export enum PermissionEnum {
 
 
 export const PermissionTitles: Record<PermissionEnum, string> = {
+  [PermissionEnum.DASHBOARD]: 'مشاهده داشبورد',
   [PermissionEnum.MANAGE_PRODUCTS]: 'مدیریت محصولات',
   [PermissionEnum.MANAGE_CATEGORIES]: 'مدیریت دسته‌بندی‌ها',
 

src/modules/admin/controllers/admin.controller.ts

@@ -9,6 +9,7 @@ import { AdminId } from 'src/common/decorators/admin-id.decorator';
 import { Admin } from '../entities/admin.entity';
 import { PermissionEnum } from 'src/common/enums/permission.enum';
 import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { AdminPerms } from 'src/common/decorators/admin-perms.decorator';
 
 @Controller()
 @ApiTags('admin')
@@ -20,7 +21,7 @@ export class AdminController {
   @Post('admin/admin')
   @Permissions(PermissionEnum.MANAGE_ADMINS)
   @ApiOperation({ summary: 'Create a new admin' })
-  async create(@Body() dto: CreateAdminDto,) {
+  async create(@Body() dto: CreateAdminDto) {
     const admin = await this.adminService.create(dto);
     return admin;
   }
@@ -40,55 +41,55 @@ export class AdminController {
 
   @Get('admin/admins/me')
   @ApiOperation({ summary: 'Get current authenticated admin profile' })
-  async getMe(@AdminId() adminId: string,) {
+  async getMe(@AdminId() adminId: string) {
-    const admin = await this.adminService.findById(adminId,);
+    const admin = await this.adminService.findById(adminId);
     return admin;
   }
 
   @Patch('admin/admins/me')
   @ApiOperation({ summary: 'Update current authenticated admin profile' })
-  updateMe(@AdminId() adminId: string, @Body() dto: UpdateAdminMeDto,): Promise<Admin> {
+  updateMe(@AdminId() adminId: string, @Body() dto: UpdateAdminMeDto): Promise<Admin> {
     return this.adminService.updateMe(adminId, dto);
   }
 
-  @Get('admin/dashboard/counts')
+  @Get('admin/menu/counts')
-  @ApiOperation({ summary: 'Get dashboard entity counts for admin panel' })
+  @ApiOperation({ summary: 'Get metrics for admin panel' })
-  getDashboardCounts() {
+  getDashboardCounts(@AdminId() adminId: string, @AdminPerms() permissions: string[]) {
-    return this.adminService.getDashboardCounts();
+    return this.adminService.getDashboardCounts(adminId, permissions);
   }
 
   @Get('admin/home/stats')
+  @Permissions(PermissionEnum.DASHBOARD)
   @ApiOperation({ summary: 'Get home page stats for admin panel' })
   getHomeStats() {
     return this.adminService.getHomeStats();
   }
 
   @Get('admin/home/weekly-orders')
+  @Permissions(PermissionEnum.DASHBOARD)
   @ApiOperation({ summary: 'Get weekly order counts for admin home page chart' })
   getWeeklyOrders() {
     return this.adminService.getWeeklyOrders();
   }
 
-
   @Patch('admin/admins/:adminId')
   @Permissions(PermissionEnum.MANAGE_ADMINS)
   @ApiOperation({ summary: 'Update an admin' })
-  update(@Param('adminId') adminId: string, @Body() dto: UpdateAdminDto,): Promise<Admin> {
+  update(@Param('adminId') adminId: string, @Body() dto: UpdateAdminDto): Promise<Admin> {
     return this.adminService.update(adminId, dto);
   }
 
   @Get('admin/admins/:adminId')
   @Permissions(PermissionEnum.MANAGE_ADMINS)
   @ApiOperation({ summary: 'Get an admin by ID' })
-  getById(@Param('adminId') adminId: string,): Promise<Admin | null> {
+  getById(@Param('adminId') adminId: string): Promise<Admin | null> {
-    return this.adminService.findById(adminId,);
+    return this.adminService.findById(adminId);
   }
 
   @Delete('admin/admins/:adminId')
   @Permissions(PermissionEnum.MANAGE_ADMINS)
   @ApiOperation({ summary: 'Delete an admin by ID' })
-  deleteById(@Param('adminId') adminId: string,): Promise<void> {
+  deleteById(@Param('adminId') adminId: string): Promise<void> {
-    return this.adminService.softDelete(adminId,);
+    return this.adminService.softDelete(adminId);
   }
-
 }

src/modules/admin/providers/admin.service.ts

@@ -149,27 +149,22 @@ export class AdminService {
     return admins
   }
  
-  async ownedPermissions(adminId: string, permissionNames: PermissionEnum[]): Promise<PermissionEnum[]> {
-    if (permissionNames.length === 0) return []
 
-    const admin = await this.adminRepository.findOne(
+  async getDashboardCounts(adminId: string, permissions: string[]) {
-      { id: adminId },
-      { populate: ['role', 'role.permissions'] },
-    )
  
-    if (!admin?.role?.permissions) return []
+    const canViewAnyOrder = permissions.includes(PermissionEnum.VIEW_ORDERS);
+    const canViewAssignedOrder = permissions.includes(PermissionEnum.VIEW_ASSIGNED_ORDERS);
 
-    const adminPermissionNames = new Set(
+    const ordersCountPromise = canViewAnyOrder
-      admin.role.permissions.getItems().map((p) => p.name),
+      ? this.em.count(Order)
-    )
+      : canViewAssignedOrder
-    return permissionNames.filter((name) => adminPermissionNames.has(name))
+        ? this.em.count(Order, { designers: { designer: { id: adminId } } })
-  }
+        : Promise.resolve(0);
 
-  async getDashboardCounts() {
     const [requestsCount, invoicesCount, ordersCount, paymentsCount] = await Promise.all([
       this.em.count(Request),
-      this.em.count(Invoice),
+      this.em.count(Invoice, { status: { $nin: [InvoiceConfirmStatusEnum.ARCHIVED] } }),
-      this.em.count(Order),
+      ordersCountPromise,
       this.em.count(Payment),
     ]);
 

src/modules/auth/auth.module.ts

@@ -1,4 +1,4 @@
-import { Module, forwardRef } from '@nestjs/common';
+import { Global, Module, forwardRef } from '@nestjs/common';
 import { AuthService } from './services/auth.service';
 import { AuthController } from './controllers/auth.controller';
 import { UtilsModule } from '../util/utils.module';
@@ -13,6 +13,7 @@ import { RefreshToken } from './entities/refresh-token.entity';
 import { NotificationsModule } from '../notification/notifications.module';
 import { OtpService } from './services/otp.service';
 
+@Global()
 @Module({
   imports: [
     UtilsModule,
@@ -38,6 +39,6 @@ import { OtpService } from './services/otp.service';
   ],
   controllers: [AuthController],
   providers: [AuthService, TokensService, AdminAuthGuard, OtpService],
-  exports: [AdminAuthGuard],
+  exports: [AdminAuthGuard, AuthService],
 })
 export class AuthModule { }

src/modules/auth/guards/adminAuth.guard.ts

@@ -13,10 +13,11 @@ import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import { IAdminTokenPayload } from '../interfaces/IToken-payload';
 import { PERMISSIONS_KEY } from '../../../common/decorators/permissions.decorator';
-import { PermissionService } from 'src/modules/roles/providers/permissions.service';
+import { AuthService } from '../services/auth.service';
 
 export interface AdminAuthRequest extends Request {
   adminId: string;
+  permissions: string[];
 }
 
 @Injectable()
@@ -28,7 +29,7 @@ export class AdminAuthGuard implements CanActivate {
     private readonly jwtService: JwtService,
     @Inject(ConfigService)
     private readonly configService: ConfigService,
-    private readonly permissionsService: PermissionService,
+    private readonly authService: AuthService,
     private readonly reflector: Reflector,
   ) { }
 
@@ -61,34 +62,25 @@ export class AdminAuthGuard implements CanActivate {
 
       request['adminId'] = payload.adminId;
 
+      const adminPermissions = await this.authService.getAdminPermissionsFromCache(payload.adminId);
+      request['permissions'] = adminPermissions;
 
       // check if the user has the required permissions
       const requiredPermissions =
         this.reflector.getAllAndOverride<string[]>(PERMISSIONS_KEY, [context.getHandler(), context.getClass()]) ?? [];
 
-      if (!requiredPermissions || requiredPermissions.length === 0) {
+      if (requiredPermissions.length > 0) {
-        return true;
+        const hasPermission = requiredPermissions.every(p => adminPermissions.includes(p));
+
+        if (!hasPermission) {
+          this.logger.warn('Insufficient permissions', {
+            adminId: payload.adminId,
+            required: requiredPermissions,
+            has: hasPermission,
+          });
+          throw new ForbiddenException('You are not authorized to access this resource');
+        }
       }
-      //TODO : admin permissions must get it from cache
-      // const adminPermission = (await this.permissionsService.getAdminPermissions(payload.adminId))
-
-      // if (!adminPermission || !Array.isArray(adminPermission)) {
-      //   this.logger.error('No permissions found', { adminId: payload.adminId });
-      //   throw new ForbiddenException('No permissions found');
-      // }
-
-      // const adminPermissionNames = adminPermission.map(p => p.name)
-
-      // const hasPermission = requiredPermissions.every(p => adminPermissionNames.includes(p));
-
-      // if (!hasPermission) {
-      //   this.logger.warn('Insufficient permissions', {
-      //     adminId: payload.adminId,
-      //     required: requiredPermissions,
-      //     has: adminPermission,
-      //   });
-      //   throw new ForbiddenException('You are not authorized to access this resource');
-      // }
 
       return true;
     } catch (err) {

src/modules/auth/services/auth.service.ts

@@ -10,10 +10,12 @@ import { AdminLoginTransformer } from '../transformers/admin-login.transformer';
 import { UserLoginTransformer } from '../transformers/user-login.transformer';
 import { OtpService } from './otp.service';
 import { normalizePhoneToLocal } from 'src/modules/util/phone.util';
+import { CacheService } from 'src/modules/util/cache.service';
+import { PermissionService } from 'src/modules/roles/providers/permissions.service';
 
 @Injectable()
 export class AuthService {
-  readonly ADMIN_PERMISSIONS_KEY = 'admin-perms';
+  readonly ADMIN_PERMISSIONS_EXPIRATION_TIME = 1800;
 
   constructor(
     private readonly smsService: SmsService,
@@ -21,6 +23,8 @@ export class AuthService {
     private readonly tokensService: TokensService,
     private readonly adminRepository: AdminRepository,
     private readonly otpService: OtpService,
+    private readonly cacheService: CacheService,
+    private readonly permissionService: PermissionService,
   ) {
 
   }
@@ -82,6 +86,10 @@ export class AuthService {
 
     const tokens = await this.tokensService.generateAccessAndRefreshToken(admin.id, true);
 
+    const permissionNames = admin.role.permissions.map(p => p.name);
+
+
+
     const adminResponse = await AdminLoginTransformer.transform(admin);
 
     return { tokens, admin: adminResponse };
@@ -103,4 +111,30 @@ export class AuthService {
     }
   }
 
+  async setAdminPermissionsInCache(adminId: string, permissionNames: string[]) {
+    await this.cacheService.set(
+      this.getAdminPermissionsCacheKey(adminId),
+      JSON.stringify(permissionNames),
+      this.ADMIN_PERMISSIONS_EXPIRATION_TIME,
+    );
+    return { success: true };
+  }
+
+  async getAdminPermissionsFromCache(adminId: string): Promise<string[]> {
+    const cacheKey = this.getAdminPermissionsCacheKey(adminId);
+    const cached = await this.cacheService.get<string>(cacheKey);
+
+    if (cached !== undefined) {
+      return JSON.parse(cached) as string[];
+    }
+
+    const permissions = await this.permissionService.getAdminPermissionsName(adminId);
+    await this.setAdminPermissionsInCache(adminId, permissions);
+
+    return permissions;
+  }
+
+  private getAdminPermissionsCacheKey(adminId: string): string {
+    return `admin:${adminId}:permissions`;
+  }
 }

src/modules/order/controllers/order.controller.ts

@@ -7,6 +7,7 @@ import { FindOrdersDto } from '../dto/find-orders.dto';
 import { CreateOrderAsAdminDto } from '../dto/create-order.dto';
 import { UpdateOrderAsAdminDto } from '../dto/update-order.dto';
 import { AdminId } from 'src/common/decorators/admin-id.decorator';
+import { AdminPerms } from 'src/common/decorators/admin-perms.decorator';
 import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { Permissions } from 'src/common/decorators/permissions.decorator';
 import { PermissionEnum } from 'src/common/enums/permission.enum';
@@ -55,17 +56,24 @@ export class OrderController {
   // Permission handled inside service
   @Get('admin/orders')
   @UseGuards(AdminAuthGuard)
-  // @Permissions(PermissionEnum.VIEW_ORDERS)
   @ApiOperation({ summary: 'Get all orders with pagination and filters' })
-  findAllAsAdmin(@Query() dto: FindOrdersDto, @AdminId() adminId: string) {
+  findAllAsAdmin(
-    return this.orderService.findOrdersAsAdmin(adminId, dto);
+    @Query() dto: FindOrdersDto,
+    @AdminId() adminId: string,
+    @AdminPerms() permissions: string[],
+  ) {
+    return this.orderService.findOrdersAsAdmin(adminId, permissions, dto);
   }
 
   @Get('admin/orders/tab-counts')
   @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Get order tab counts for admin order list' })
-  getAdminOrderTabCounts(@Query() dto: FindOrdersDto, @AdminId() adminId: string) {
+  getAdminOrderTabCounts(
-    return this.orderService.getAdminOrderTabCounts(adminId, dto);
+    @Query() dto: FindOrdersDto,
+    @AdminId() adminId: string,
+    @AdminPerms() permissions: string[],
+  ) {
+    return this.orderService.getAdminOrderTabCounts(adminId, permissions, dto);
   }
 
   @Get('admin/orders/:id')
@@ -106,8 +114,13 @@ export class OrderController {
   @Post('admin/orders/:orderId/status')
   @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Assign Order Designer ' })
-  updateStatus(@Param('orderId') orderId: string,@AdminId()adminId:string, @Body() dto: UpdateStatusDto) {
+  updateStatus(
-    return this.orderService.updateStatus(orderId,adminId, dto);
+    @Param('orderId') orderId: string,
+    @AdminId() adminId: string,
+    @AdminPerms() permissions: string[],
+    @Body() dto: UpdateStatusDto,
+  ) {
+    return this.orderService.updateStatus(orderId, adminId, permissions, dto);
   }
 
 

src/modules/order/providers/order.service.ts

@@ -158,10 +158,11 @@ export class OrderService {
     })
   }
 
-  async findOrdersAsAdmin(adminId: string, dto: FindOrdersDto): Promise<PaginatedResult<Order>> {
+  async findOrdersAsAdmin(
-    const permissions = await this.adminService.ownedPermissions(adminId,
+    adminId: string,
-      [PermissionEnum.VIEW_ORDERS, PermissionEnum.VIEW_ASSIGNED_ORDERS])
+    permissions: string[],
-
+    dto: FindOrdersDto,
+  ): Promise<PaginatedResult<Order>> {
     if (permissions.includes(PermissionEnum.VIEW_ORDERS)) {
 
       return this.orderRepository.findAllPaginated(dto)
@@ -179,12 +180,11 @@ export class OrderService {
     }
   }
 
-  async getAdminOrderTabCounts(adminId: string, dto: FindOrdersDto): Promise<AdminOrderTabCounts> {
+  async getAdminOrderTabCounts(
-    const permissions = await this.adminService.ownedPermissions(adminId, [
+    adminId: string,
-      PermissionEnum.VIEW_ORDERS,
+    permissions: string[],
-      PermissionEnum.VIEW_ASSIGNED_ORDERS,
+    dto: FindOrdersDto,
-    ]);
+  ): Promise<AdminOrderTabCounts> {
-
     const canViewAnyOrder = permissions.includes(PermissionEnum.VIEW_ORDERS);
     const canViewAssignedOrder = permissions.includes(PermissionEnum.VIEW_ASSIGNED_ORDERS);
 
@@ -300,18 +300,12 @@ export class OrderService {
 
 
 
-  async updateStatus(orderId: string, adminId: string, dto: UpdateStatusDto): Promise<Order> {
+  async updateStatus(
-    const statusPermissions = [
+    orderId: string,
-      PermissionEnum.CHANGE_ORDER_STATUS_FROM_ANY_TO_ANY,
+    adminId: string,
-      PermissionEnum.CHANGE_ORDER_STATUS_TO_CANCELLED,
+    permissions: string[],
-      PermissionEnum.CHANGE_ORDER_STATUS_IN_PROGRESS,
+    dto: UpdateStatusDto,
-      PermissionEnum.CHANGE_ORDER_STATUS_FROM_IN_PROGRESS_TO_FINISHED,
+  ): Promise<Order> {
-      PermissionEnum.CHANGE_ORDER_STATUS_FROM_FINISHED_TO_INVOICED,
-    ];
-
-    const permissions = await this.adminService.ownedPermissions(adminId,
-      [PermissionEnum.VIEW_ORDERS, PermissionEnum.VIEW_ASSIGNED_ORDERS, ...statusPermissions]);
-
     const canViewAnyOrder = permissions.includes(PermissionEnum.VIEW_ORDERS);
     const canViewAssignedOrder = permissions.includes(PermissionEnum.VIEW_ASSIGNED_ORDERS);
 

src/modules/product/controllers/product.controller.ts

@@ -50,6 +50,7 @@ export class ProductController {
   @ApiQuery({ name: 'orderBy', required: false, type: String })
   @ApiQuery({ name: 'order', required: false, enum: ['asc', 'desc'] })
   @ApiQuery({ name: 'isActive', required: false, type: Boolean })
+  @ApiQuery({ name: 'parentId', required: false, type: String, description: 'Parent category id, or "null" for roots' })
   async findAllCategories(@Query() dto: FindCategoriesDto) {
     const result = await this.categoryService.findAll(dto);
     return result;

src/modules/product/dto/find-categories.dto.ts

@@ -36,4 +36,12 @@ export class FindCategoriesDto {
   @Type(() => Boolean)
   @ApiPropertyOptional({ example: true })
   isActive?: boolean;
+
+  @IsOptional()
+  @IsString()
+  @ApiPropertyOptional({
+    description: 'Filter by parent category id. Use "null" for root categories only.',
+    example: 'null',
+  })
+  parentId?: string;
 }

src/modules/product/repositories/category.repository.ts

@@ -11,6 +11,7 @@ type FindCategoriesOpts = {
   orderBy?: string;
   order?: 'asc' | 'desc';
   isActive?: boolean;
+  parentId?: string;
 };
 
 export type CategoryTreeNode = {
@@ -73,7 +74,7 @@ export class CategoryRepository extends EntityRepository<Category> {
   }
 
   async findAllPaginated(opts: FindCategoriesOpts = {}): Promise<PaginatedResult<Category>> {
-    const { page = 1, limit = 10, search, orderBy = 'createdAt', order = 'desc', isActive } = opts;
+    const { page = 1, limit = 10, search, orderBy = 'order', order = 'asc', isActive, parentId } = opts;
 
     const offset = (page - 1) * limit;
 
@@ -83,6 +84,12 @@ export class CategoryRepository extends EntityRepository<Category> {
       where.isActive = isActive;
     }
 
+    if (parentId === 'null') {
+      where.parent = null;
+    } else if (parentId) {
+      where.parent = parentId;
+    }
+
     if (search) {
       where.$or = [
         { title: { $ilike: `%${search}%` } },
@@ -91,7 +98,7 @@ export class CategoryRepository extends EntityRepository<Category> {
 
     const allCategories = await this.find(where, {
       orderBy: { [orderBy]: order.toLowerCase() as 'asc' | 'desc' },
-      populate: ['parent'],
+      populate: ['parent', 'children'],
     });
 
     const total = allCategories.length;

src/modules/product/repositories/product.repository.ts

@@ -21,7 +21,7 @@ export class ProductRepository extends EntityRepository<Product> {
   }
 
   async findAllPaginated(opts: FindproductsOpts = {}): Promise<PaginatedResult<Product>> {
-    const { page = 1, limit = 10, search, orderBy = 'createdAt', order = 'desc', categoryId, isActive } = opts;
+    const { page = 1, limit = 10, search, orderBy = 'order', order = 'asc', categoryId, isActive } = opts;
 
     const offset = (page - 1) * limit;
 

src/modules/user/controllers/users.controller.ts

@@ -39,9 +39,9 @@ export class UsersController {
     return user;
   }
 
-  @Get('public/dashboard/counts')
+  @Get('public/menu/counts')
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: 'Get dashboard entity counts for user panel' })
+  @ApiOperation({ summary: 'Get metrics for user panel' })
   getDashboardCounts(@UserId() userId: string) {
     return this.userService.getDashboardCounts(userId);
   }

src/modules/user/providers/user.service.ts

@@ -13,6 +13,7 @@ import { Request } from 'src/modules/request/entities/request.entity';
 import { Invoice } from 'src/modules/invoice/entities/invoice.entity';
 import { Order } from 'src/modules/order/entities/order.entity';
 import { Payment } from 'src/modules/payment/entities/payment.entity';
+import { InvoiceConfirmStatusEnum } from 'src/modules/invoice/enum/invoice-confirm-status.enum';
 
 @Injectable()
 export class UserService {
@@ -125,7 +126,7 @@ export class UserService {
   async getDashboardCounts(userId: string) {
     const [requestsCount, invoicesCount, ordersCount, paymentsCount] = await Promise.all([
       this.em.count(Request, { user: { id: userId } }),
-      this.em.count(Invoice, { user: { id: userId } }),
+      this.em.count(Invoice, { user: { id: userId }, status: { $nin: [InvoiceConfirmStatusEnum.ARCHIVED] } }),
       this.em.count(Order, { user: { id: userId } }),
       this.em.count(Payment, { invoice: { user: { id: userId } } }),
     ]);

src/seeders/data/admins.data.ts

@@ -13,13 +13,13 @@ export const adminsData: AdminData[] = [
     roleName: 'admin',
 
   },
-  {
+  // {
-    phone: '09121724095',
+  //   phone: '09121724095',
-    firstName: 'آقای',
+  //   firstName: 'آقای',
-    lastName: 'نواعتقاد',
+  //   lastName: 'نواعتقاد',
-    roleName:  'admin',
+  //   roleName:  'admin',
 
-  },
+  // },
   // {
   //   phone: '09185290775',
   //   firstName: 'حمید',