permissions

src/modules/restaurants/controllers/restaurants.controller.ts

@@ -16,6 +16,8 @@ import {
 import { RestId } from 'src/common/decorators';
 import { API_HEADER_SLUG } from 'src/common/constants';
 import { SuperAdminAuthGuard } from 'src/modules/auth/guards/superAdminAuth.guard';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
 
 @ApiTags('restaurants')
 @Controller()
@@ -34,6 +36,7 @@ export class RestaurantsController {
   /** Admin Endpoints */
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @Post('admin/restaurants')
   @ApiOperation({ summary: 'Create a new restaurant' })
   @ApiBody({ type: CreateRestaurantDto })
@@ -44,7 +47,7 @@ export class RestaurantsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
-  @ApiBearerAuth('admin/restaurants')
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @ApiOperation({ summary: 'Get restaurant by ID from request' })
   @Get('admin/restaurants/my-restaurant')
   async findOne(@RestId() restId: string) {
@@ -53,6 +56,7 @@ export class RestaurantsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @ApiOperation({ summary: 'Update a restaurant' })
   @ApiBody({ type: UpdateRestaurantDto })
   @Patch('admin/restaurants/my-restaurant')
@@ -62,6 +66,7 @@ export class RestaurantsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @ApiOperation({ summary: 'Delete a restaurant' })
   @Delete('admin/restaurants/:id')
   remove(@Param('id') id: string) {

src/modules/restaurants/controllers/schedule.controller.ts

@@ -18,30 +18,29 @@ import { FindSchedulesDto } from '../dto/find-schedules.dto';
 import { Schedule } from '../entities/schedule.entity';
 import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { RestId } from 'src/common/decorators/rest-id.decorator';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
+import { API_HEADER_SLUG } from 'src/common/constants';
 
 @ApiTags('schedules')
 @Controller()
 export class ScheduleController {
-  constructor(private readonly scheduleService: ScheduleService) {}
+  constructor(private readonly scheduleService: ScheduleService) { }
 
   @Get('public/schedules/restaurant/:slug')
   @ApiOperation({ summary: 'Get schedule of a restaurant by slug' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
+  @ApiHeader(API_HEADER_SLUG)
   @ApiParam({ name: 'slug', description: 'Restaurant Slug' })
   @ApiOkResponse({ description: 'Today schedule of the restaurant', type: Schedule })
   async getTodaySchedules(@Param('slug') slug: string): Promise<Schedule[]> {
     return this.scheduleService.findScheduleBySlug(slug);
   }
 
+  /********************  Admin Routes **********************/
+
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Post('admin/schedules')
   @ApiOperation({ summary: 'Create a new schedule' })
   @ApiBody({ type: CreateScheduleDto })
@@ -52,6 +51,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Get('admin/schedules')
   @ApiOperation({ summary: 'Get all schedules' })
   @ApiQuery({
@@ -70,6 +70,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Get('admin/schedules/:id')
   @ApiOperation({ summary: 'Get a schedule by ID' })
   @ApiParam({ name: 'id', description: 'Schedule ID' })
@@ -81,6 +82,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Patch('admin/schedules/:id')
   @ApiOperation({ summary: 'Update a schedule' })
   @ApiParam({ name: 'id', description: 'Schedule ID' })
@@ -93,6 +95,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Delete('admin/schedules/:id')
   @ApiOperation({ summary: 'Delete a schedule' })
   @ApiParam({ name: 'id', description: 'Schedule ID' })