morteza/dmenu-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

set permissions

Browse Source
This commit is contained in:
morteza-mortezai
2025-12-23 14:39:29 +03:30
parent 98f973958d
commit 5accc89c00
8 changed files with 58 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/modules/inventory/inventory.controller.ts
+6 -5
View File
@@ -6,15 +6,18 @@ import { ApiTags, ApiOperation, ApiBody, ApiParam, ApiBearerAuth } from '@nestjs
import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
import { RestId } from 'src/common/decorators';
import { Inventory } from './entities/inventory.entity';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { Permission } from 'src/common/enums/permission.enum';
@ApiTags('inventory')
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@Permissions(Permission.MANAGE_FOODS)
@Controller()
export class InventoryController {
constructor(private readonly inventoryService: InventoryService) {}
constructor(private readonly inventoryService: InventoryService) { }
@Patch('admin/inventory/food/:foodId/stock')
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@ApiOperation({ summary: 'Set available and total stock for a food item' })
@ApiParam({ name: 'foodId', description: 'Food ID' })
@ApiBody({ type: SetStockDto })
@@ -27,8 +30,6 @@ export class InventoryController {
}
@Post('admin/inventory/foods/stock/bulk')
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@ApiOperation({ summary: 'Bulk set available and total stock for multiple food items' })
@ApiBody({ type: BulkSetStockDto })
bulkSetStockForFoods(@RestId() restaurantId: string, @Body() bulkSetStockDto: BulkSetStockDto): Promise<Inventory[]> {
src/modules/orders/controllers/orders.controller.ts
+7
View File
@@ -9,6 +9,8 @@ import { FindOrdersDto } from '../dto/find-orders.dto';
import { OrderStatus } from '../interface/order.interface';
import { API_HEADER_SLUG } from 'src/common/constants/index';
import { UpdateOrderStatusDto } from '../dto/update-order-status.dto';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { Permission } from 'src/common/enums/permission.enum';
@ApiTags('orders')
@ApiBearerAuth()
@@ -63,6 +65,7 @@ export class OrdersController {
/******************** Admin Routes **********************/
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_ORDERS)
@Get('admin/orders')
@ApiOperation({ summary: 'Get all orders with pagination and filters' })
findAllAdmin(@RestId() restId: string, @Query() dto: FindOrdersDto) {
@@ -70,6 +73,7 @@ export class OrdersController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_ORDERS)
@ApiOperation({ summary: 'Get an order By id for User' })
@ApiParam({ name: 'orderId', description: 'Order ID' })
@Get('admin/orders/:orderId')
@@ -78,6 +82,7 @@ export class OrdersController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_ORDERS)
@Patch('admin/orders/:orderId/:status')
@ApiOperation({ summary: 'Update an order status' })
@ApiParam({ name: 'orderId', description: 'Order ID' })
@@ -97,6 +102,7 @@ export class OrdersController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_ORDERS)
@ApiOperation({ summary: 'Get Stats for report page' })
@Get('admin/orders/stats')
findStats(@RestId() restId: string) {
@@ -104,6 +110,7 @@ export class OrdersController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_ORDERS)
@ApiOperation({ summary: 'Get food sales pie chart data for last month' })
@ApiHeader(API_HEADER_SLUG)
@Get('admin/orders/food-sales-pie-chart')
src/modules/pager/controllers/pager.controller.ts
+10 -9
View File
@@ -11,11 +11,14 @@ import { AdminAuthGuard } from '../../auth/guards/adminAuth.guard';
import { AdminId } from 'src/common/decorators/admin-id.decorator';
import { UpdatePagerStatusDto } from '../dto/update-pager.dto';
import { PagerMessage } from 'src/common/enums/message.enum';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { Permission } from 'src/common/enums/permission.enum';
import { API_HEADER_SLUG } from 'src/common/constants';
@ApiTags('pager')
@Controller()
export class PagerController {
constructor(private readonly pagerService: PagerService) {}
constructor(private readonly pagerService: PagerService) { }
@UseGuards(OptionalAuthGuard)
@Post('public/pager')
@@ -55,17 +58,11 @@ export class PagerController {
});
}
@UseGuards(OptionalAuthGuard)
@Get('public/pager')
@ApiOperation({ summary: 'Get all pager requests for the current session' })
@ApiHeader({
name: 'X-Slug',
required: true,
schema: {
type: 'string',
default: 'zhivan',
},
})
@ApiHeader(API_HEADER_SLUG)
@ApiHeader({ name: 'Authorization', required: false, description: 'Bearer token (optional authentication)' })
async findAll(@Req() request: FastifyRequest) {
const cookieId = request.cookies['pagerId'] || undefined;
@@ -75,7 +72,10 @@ export class PagerController {
return this.pagerService.findAll(cookieId);
}
/******************** Admin Routes **********************/
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAGER)
@ApiBearerAuth()
@Get('admin/pager')
@ApiOperation({ summary: 'Get all pager requests for the restaurant' })
@@ -84,6 +84,7 @@ export class PagerController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAGER)
@ApiBearerAuth()
@Patch('admin/pager/:pagerId/status')
@ApiParam({ name: 'pagerId', required: true, type: String })
src/modules/payments/controllers/payments.controller.ts
+9
View File
@@ -18,6 +18,8 @@ import { PaymentChartDto } from '../dto/payment-chart.dto';
import { RestId, UserId } from 'src/common/decorators';
import { AuthGuard } from 'src/modules/auth/guards/auth.guard';
import { API_HEADER_SLUG } from 'src/common/constants';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { Permission } from 'src/common/enums/permission.enum';
@ApiTags('payments')
@Controller()
@@ -67,6 +69,7 @@ export class PaymentsController {
/** admin routes */
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Get('admin/payments/methods')
@ApiOperation({ summary: 'Get restaurant all payment methods' })
@@ -75,6 +78,7 @@ export class PaymentsController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Post('admin/payments/methods')
@ApiOperation({ summary: 'Create a new restaurant payment method' })
@@ -84,6 +88,7 @@ export class PaymentsController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Get('admin/payments/methods/:paymentMethodId')
@ApiOperation({ summary: 'Get restaurant payment method by ID' })
@@ -93,6 +98,7 @@ export class PaymentsController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Patch('admin/payments/methods/:paymentMethodId')
@ApiOperation({ summary: 'Update a restaurant payment method' })
@@ -106,6 +112,7 @@ export class PaymentsController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Delete('admin/payments/methods/:paymentMethodId')
@ApiOperation({ summary: 'Delete a restaurant payment method' })
@@ -115,6 +122,7 @@ export class PaymentsController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Post('admin/payments/verify-cash-method/:paymentId')
@ApiOperation({ summary: 'Verify cash payment ' })
@@ -124,6 +132,7 @@ export class PaymentsController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_PAYMENTS)
@ApiBearerAuth()
@Get('admin/payments/chart')
@ApiOperation({ summary: 'Get payment chart data with date and period filters' })
src/modules/restaurants/controllers/restaurants.controller.ts
-9
View File
@@ -51,15 +51,6 @@ export class RestaurantsController {
return await this.restaurantsService.findOne(restId);
}
// @UseGuards(AdminAuthGuard)
// @ApiBearerAuth()
// @ApiOperation({ summary: 'Update a restaurant' })
// @ApiBody({ type: UpdateRestaurantDto })
// @Patch('admin/restaurants/:id')
// update(@Param('id') id: string, @Body() updateRestaurantDto: UpdateRestaurantDto) {
// return this.restaurantsService.update(id, updateRestaurantDto);
// }
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@ApiOperation({ summary: 'Update a restaurant' })
src/modules/review/controllers/review.controller.ts
+16 -42
View File
@@ -20,6 +20,9 @@ import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
import { UserId } from 'src/common/decorators/user-id.decorator';
import { RestId } from 'src/common/decorators/rest-id.decorator';
import { ReviewStatus } from '../enums/review-status.enum';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { Permission } from 'src/common/enums/permission.enum';
import { API_HEADER_SLUG } from 'src/common/constants';
@ApiTags('review')
@Controller()
@@ -30,14 +33,7 @@ export class ReviewController {
@ApiBearerAuth()
@Post('public/reviews')
@ApiOperation({ summary: 'Create a new review and rating' })
@ApiHeader({
name: 'X-Slug',
required: true,
schema: {
type: 'string',
default: 'zhivan',
},
})
@ApiHeader(API_HEADER_SLUG)
@ApiCreatedResponse({ description: 'The review has been successfully created.' })
@ApiBody({ type: CreateReviewDto })
create(@Body() createReviewDto: CreateReviewDto, @UserId() userId: string) {
@@ -46,14 +42,7 @@ export class ReviewController {
@Get('public/reviews/:foodId')
@ApiOperation({ summary: 'Get all reviews of food by id(public - only approved)' })
@ApiHeader({
name: 'X-Slug',
required: true,
schema: {
type: 'string',
default: 'zhivan',
},
})
@ApiHeader(API_HEADER_SLUG)
@ApiOkResponse({ description: 'List of approved reviews' })
@ApiParam({ name: 'foodId', required: true, type: String })
@ApiQuery({ name: 'page', required: false, type: Number })
@@ -67,16 +56,8 @@ export class ReviewController {
@Get('public/reviews/restuarant/:restuarantSlug')
@ApiOperation({ summary: 'Get all reviews of restuarant by slug(public - only approved)' })
@ApiHeader({
name: 'X-Slug',
required: true,
schema: {
type: 'string',
default: 'zhivan',
},
})
@ApiOkResponse({ description: 'List of approved reviews' })
@ApiParam({ name: 'restuarantSlug', required: true, type: String })
@ApiHeader(API_HEADER_SLUG)
@ApiParam({ name: 'restuarantSlug', required: true, type: String })
@ApiQuery({ name: 'page', required: false, type: Number })
@ApiQuery({ name: 'limit', required: false, type: Number })
@ApiQuery({ name: 'orderBy', required: false, type: String })
@@ -99,14 +80,7 @@ export class ReviewController {
@ApiBearerAuth()
@Patch('public/reviews/:reviewId')
@ApiOperation({ summary: 'Update a review (own reviews only)' })
@ApiHeader({
name: 'X-Slug',
required: true,
schema: {
type: 'string',
default: 'zhivan',
},
})
@ApiHeader(API_HEADER_SLUG)
@ApiParam({ name: 'reviewId', required: true })
@ApiBody({ type: UpdateReviewDto })
@ApiOkResponse({ description: 'The updated review' })
@@ -118,21 +92,17 @@ export class ReviewController {
@ApiBearerAuth()
@Delete('public/reviews/:id')
@ApiOperation({ summary: 'Delete a review (own reviews only)' })
@ApiHeader({
name: 'X-Slug',
required: true,
schema: {
type: 'string',
default: 'zhivan',
},
})
@ApiHeader(API_HEADER_SLUG)
@ApiParam({ name: 'id', required: true })
remove(@Param('id') id: string, @UserId() userId: string) {
return this.reviewService.remove(id, userId, false);
}
/******************** Admin Routes **********************/
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@Permissions(Permission.MANAGE_REVIEWS)
@Get('admin/reviews')
@ApiOperation({ summary: 'Get all reviews (admin - including unapproved)' })
@ApiOkResponse({ description: 'List of all reviews' })
@@ -149,6 +119,7 @@ export class ReviewController {
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@Permissions(Permission.MANAGE_REVIEWS)
@Patch('admin/reviews/:id')
@ApiOperation({ summary: 'Update a review (admin - can change approval status)' })
@ApiParam({ name: 'id', required: true })
@@ -159,6 +130,7 @@ export class ReviewController {
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@Permissions(Permission.MANAGE_REVIEWS)
@Get('admin/reviews/:id')
@ApiOperation({ summary: 'review detail' })
@ApiParam({ name: 'id', required: true })
@@ -168,6 +140,7 @@ export class ReviewController {
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@Permissions(Permission.MANAGE_REVIEWS)
@Patch('admin/reviews/:id/status')
@ApiOperation({ summary: 'Change review status (pending, approved, rejected)' })
@ApiParam({ name: 'id', required: true })
@@ -181,6 +154,7 @@ export class ReviewController {
}
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_REVIEWS)
@ApiBearerAuth()
@Delete('admin/reviews/:id')
@ApiOperation({ summary: 'Delete a review (admin)' })
src/modules/roles/controllers/roles.controller.ts
+3
View File
@@ -8,8 +8,11 @@ import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { RestId } from 'src/common/decorators';
import { AdminId } from 'src/common/decorators/admin-id.decorator';
import { Permission } from 'src/common/enums/permission.enum';
@UseGuards(AdminAuthGuard)
@Permissions(Permission.MANAGE_ROLES)
@ApiBearerAuth()
@ApiTags('roles')
@Controller('admin/roles')
src/modules/users/controllers/users.controller.ts
+7 -4
View File
@@ -11,11 +11,13 @@ import { FindUsersDto } from '../dto/find-user.dto';
import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
import { API_HEADER_SLUG } from 'src/common/constants/index';
import { UserSuccessMessage } from 'src/common/enums/message.enum';
import { Permissions } from 'src/common/decorators/permissions.decorator';
import { Permission } from 'src/common/enums/permission.enum';
@ApiTags('User')
@Controller()
export class UsersController {
constructor(private readonly userService: UserService) {}
constructor(private readonly userService: UserService) { }
@UseGuards(AuthGuard)
@ApiBearerAuth()
@@ -134,12 +136,13 @@ export class UsersController {
};
}
/******************** Admin Routes **********************/
@UseGuards(AdminAuthGuard)
@ApiBearerAuth()
@Permissions(Permission.MANAGE_USERS)
@ApiOperation({ summary: 'Get paginated list of restuarant users with filters' })
@ApiOkResponse({ description: 'Paginated list of users' })
@Get('admin/users')
@Get('admin/users')
async findAllRestaurantUsers(
@Query(new ValidationPipe({ transform: true, whitelist: true }))
query: FindUsersDto,