From 5accc89c003437dec43075fea8e7923d9d19774f Mon Sep 17 00:00:00 2001 From: morteza-mortezai Date: Tue, 23 Dec 2025 14:39:29 +0330 Subject: [PATCH] set permissions --- src/modules/inventory/inventory.controller.ts | 11 ++-- .../orders/controllers/orders.controller.ts | 7 +++ .../pager/controllers/pager.controller.ts | 19 +++--- .../controllers/payments.controller.ts | 9 +++ .../controllers/restaurants.controller.ts | 9 --- .../review/controllers/review.controller.ts | 58 +++++-------------- .../roles/controllers/roles.controller.ts | 3 + .../users/controllers/users.controller.ts | 11 ++-- 8 files changed, 58 insertions(+), 69 deletions(-) diff --git a/src/modules/inventory/inventory.controller.ts b/src/modules/inventory/inventory.controller.ts index 39e332d..9a71e3c 100644 --- a/src/modules/inventory/inventory.controller.ts +++ b/src/modules/inventory/inventory.controller.ts @@ -6,15 +6,18 @@ import { ApiTags, ApiOperation, ApiBody, ApiParam, ApiBearerAuth } from '@nestjs import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard'; import { RestId } from 'src/common/decorators'; import { Inventory } from './entities/inventory.entity'; +import { Permissions } from 'src/common/decorators/permissions.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; @ApiTags('inventory') +@UseGuards(AdminAuthGuard) +@ApiBearerAuth() +@Permissions(Permission.MANAGE_FOODS) @Controller() export class InventoryController { - constructor(private readonly inventoryService: InventoryService) {} + constructor(private readonly inventoryService: InventoryService) { } @Patch('admin/inventory/food/:foodId/stock') - @UseGuards(AdminAuthGuard) - @ApiBearerAuth() @ApiOperation({ summary: 'Set available and total stock for a food item' }) @ApiParam({ name: 'foodId', description: 'Food ID' }) @ApiBody({ type: SetStockDto }) @@ -27,8 +30,6 @@ export class InventoryController { } @Post('admin/inventory/foods/stock/bulk') - @UseGuards(AdminAuthGuard) - @ApiBearerAuth() @ApiOperation({ summary: 'Bulk set available and total stock for multiple food items' }) @ApiBody({ type: BulkSetStockDto }) bulkSetStockForFoods(@RestId() restaurantId: string, @Body() bulkSetStockDto: BulkSetStockDto): Promise { diff --git a/src/modules/orders/controllers/orders.controller.ts b/src/modules/orders/controllers/orders.controller.ts index 9140795..b10eb46 100644 --- a/src/modules/orders/controllers/orders.controller.ts +++ b/src/modules/orders/controllers/orders.controller.ts @@ -9,6 +9,8 @@ import { FindOrdersDto } from '../dto/find-orders.dto'; import { OrderStatus } from '../interface/order.interface'; import { API_HEADER_SLUG } from 'src/common/constants/index'; import { UpdateOrderStatusDto } from '../dto/update-order-status.dto'; +import { Permissions } from 'src/common/decorators/permissions.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; @ApiTags('orders') @ApiBearerAuth() @@ -63,6 +65,7 @@ export class OrdersController { /******************** Admin Routes **********************/ @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_ORDERS) @Get('admin/orders') @ApiOperation({ summary: 'Get all orders with pagination and filters' }) findAllAdmin(@RestId() restId: string, @Query() dto: FindOrdersDto) { @@ -70,6 +73,7 @@ export class OrdersController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_ORDERS) @ApiOperation({ summary: 'Get an order By id for User' }) @ApiParam({ name: 'orderId', description: 'Order ID' }) @Get('admin/orders/:orderId') @@ -78,6 +82,7 @@ export class OrdersController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_ORDERS) @Patch('admin/orders/:orderId/:status') @ApiOperation({ summary: 'Update an order status' }) @ApiParam({ name: 'orderId', description: 'Order ID' }) @@ -97,6 +102,7 @@ export class OrdersController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_ORDERS) @ApiOperation({ summary: 'Get Stats for report page' }) @Get('admin/orders/stats') findStats(@RestId() restId: string) { @@ -104,6 +110,7 @@ export class OrdersController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_ORDERS) @ApiOperation({ summary: 'Get food sales pie chart data for last month' }) @ApiHeader(API_HEADER_SLUG) @Get('admin/orders/food-sales-pie-chart') diff --git a/src/modules/pager/controllers/pager.controller.ts b/src/modules/pager/controllers/pager.controller.ts index 6d2c7c9..c5a10e9 100644 --- a/src/modules/pager/controllers/pager.controller.ts +++ b/src/modules/pager/controllers/pager.controller.ts @@ -11,11 +11,14 @@ import { AdminAuthGuard } from '../../auth/guards/adminAuth.guard'; import { AdminId } from 'src/common/decorators/admin-id.decorator'; import { UpdatePagerStatusDto } from '../dto/update-pager.dto'; import { PagerMessage } from 'src/common/enums/message.enum'; +import { Permissions } from 'src/common/decorators/permissions.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; +import { API_HEADER_SLUG } from 'src/common/constants'; @ApiTags('pager') @Controller() export class PagerController { - constructor(private readonly pagerService: PagerService) {} + constructor(private readonly pagerService: PagerService) { } @UseGuards(OptionalAuthGuard) @Post('public/pager') @@ -55,17 +58,11 @@ export class PagerController { }); } + @UseGuards(OptionalAuthGuard) @Get('public/pager') @ApiOperation({ summary: 'Get all pager requests for the current session' }) - @ApiHeader({ - name: 'X-Slug', - required: true, - schema: { - type: 'string', - default: 'zhivan', - }, - }) + @ApiHeader(API_HEADER_SLUG) @ApiHeader({ name: 'Authorization', required: false, description: 'Bearer token (optional authentication)' }) async findAll(@Req() request: FastifyRequest) { const cookieId = request.cookies['pagerId'] || undefined; @@ -75,7 +72,10 @@ export class PagerController { return this.pagerService.findAll(cookieId); } + /******************** Admin Routes **********************/ + @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAGER) @ApiBearerAuth() @Get('admin/pager') @ApiOperation({ summary: 'Get all pager requests for the restaurant' }) @@ -84,6 +84,7 @@ export class PagerController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAGER) @ApiBearerAuth() @Patch('admin/pager/:pagerId/status') @ApiParam({ name: 'pagerId', required: true, type: String }) diff --git a/src/modules/payments/controllers/payments.controller.ts b/src/modules/payments/controllers/payments.controller.ts index 51fa4a0..e2f6abf 100644 --- a/src/modules/payments/controllers/payments.controller.ts +++ b/src/modules/payments/controllers/payments.controller.ts @@ -18,6 +18,8 @@ import { PaymentChartDto } from '../dto/payment-chart.dto'; import { RestId, UserId } from 'src/common/decorators'; import { AuthGuard } from 'src/modules/auth/guards/auth.guard'; import { API_HEADER_SLUG } from 'src/common/constants'; +import { Permissions } from 'src/common/decorators/permissions.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; @ApiTags('payments') @Controller() @@ -67,6 +69,7 @@ export class PaymentsController { /** admin routes */ @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Get('admin/payments/methods') @ApiOperation({ summary: 'Get restaurant all payment methods' }) @@ -75,6 +78,7 @@ export class PaymentsController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Post('admin/payments/methods') @ApiOperation({ summary: 'Create a new restaurant payment method' }) @@ -84,6 +88,7 @@ export class PaymentsController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Get('admin/payments/methods/:paymentMethodId') @ApiOperation({ summary: 'Get restaurant payment method by ID' }) @@ -93,6 +98,7 @@ export class PaymentsController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Patch('admin/payments/methods/:paymentMethodId') @ApiOperation({ summary: 'Update a restaurant payment method' }) @@ -106,6 +112,7 @@ export class PaymentsController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Delete('admin/payments/methods/:paymentMethodId') @ApiOperation({ summary: 'Delete a restaurant payment method' }) @@ -115,6 +122,7 @@ export class PaymentsController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Post('admin/payments/verify-cash-method/:paymentId') @ApiOperation({ summary: 'Verify cash payment ' }) @@ -124,6 +132,7 @@ export class PaymentsController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_PAYMENTS) @ApiBearerAuth() @Get('admin/payments/chart') @ApiOperation({ summary: 'Get payment chart data with date and period filters' }) diff --git a/src/modules/restaurants/controllers/restaurants.controller.ts b/src/modules/restaurants/controllers/restaurants.controller.ts index 3ccd722..7752a13 100644 --- a/src/modules/restaurants/controllers/restaurants.controller.ts +++ b/src/modules/restaurants/controllers/restaurants.controller.ts @@ -51,15 +51,6 @@ export class RestaurantsController { return await this.restaurantsService.findOne(restId); } - // @UseGuards(AdminAuthGuard) - // @ApiBearerAuth() - // @ApiOperation({ summary: 'Update a restaurant' }) - // @ApiBody({ type: UpdateRestaurantDto }) - // @Patch('admin/restaurants/:id') - // update(@Param('id') id: string, @Body() updateRestaurantDto: UpdateRestaurantDto) { - // return this.restaurantsService.update(id, updateRestaurantDto); - // } - @UseGuards(AdminAuthGuard) @ApiBearerAuth() @ApiOperation({ summary: 'Update a restaurant' }) diff --git a/src/modules/review/controllers/review.controller.ts b/src/modules/review/controllers/review.controller.ts index e76b9de..36ad8fc 100644 --- a/src/modules/review/controllers/review.controller.ts +++ b/src/modules/review/controllers/review.controller.ts @@ -20,6 +20,9 @@ import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard'; import { UserId } from 'src/common/decorators/user-id.decorator'; import { RestId } from 'src/common/decorators/rest-id.decorator'; import { ReviewStatus } from '../enums/review-status.enum'; +import { Permissions } from 'src/common/decorators/permissions.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; +import { API_HEADER_SLUG } from 'src/common/constants'; @ApiTags('review') @Controller() @@ -30,14 +33,7 @@ export class ReviewController { @ApiBearerAuth() @Post('public/reviews') @ApiOperation({ summary: 'Create a new review and rating' }) - @ApiHeader({ - name: 'X-Slug', - required: true, - schema: { - type: 'string', - default: 'zhivan', - }, - }) + @ApiHeader(API_HEADER_SLUG) @ApiCreatedResponse({ description: 'The review has been successfully created.' }) @ApiBody({ type: CreateReviewDto }) create(@Body() createReviewDto: CreateReviewDto, @UserId() userId: string) { @@ -46,14 +42,7 @@ export class ReviewController { @Get('public/reviews/:foodId') @ApiOperation({ summary: 'Get all reviews of food by id(public - only approved)' }) - @ApiHeader({ - name: 'X-Slug', - required: true, - schema: { - type: 'string', - default: 'zhivan', - }, - }) + @ApiHeader(API_HEADER_SLUG) @ApiOkResponse({ description: 'List of approved reviews' }) @ApiParam({ name: 'foodId', required: true, type: String }) @ApiQuery({ name: 'page', required: false, type: Number }) @@ -67,16 +56,8 @@ export class ReviewController { @Get('public/reviews/restuarant/:restuarantSlug') @ApiOperation({ summary: 'Get all reviews of restuarant by slug(public - only approved)' }) - @ApiHeader({ - name: 'X-Slug', - required: true, - schema: { - type: 'string', - default: 'zhivan', - }, - }) - @ApiOkResponse({ description: 'List of approved reviews' }) - @ApiParam({ name: 'restuarantSlug', required: true, type: String }) + @ApiHeader(API_HEADER_SLUG) + @ApiParam({ name: 'restuarantSlug', required: true, type: String }) @ApiQuery({ name: 'page', required: false, type: Number }) @ApiQuery({ name: 'limit', required: false, type: Number }) @ApiQuery({ name: 'orderBy', required: false, type: String }) @@ -99,14 +80,7 @@ export class ReviewController { @ApiBearerAuth() @Patch('public/reviews/:reviewId') @ApiOperation({ summary: 'Update a review (own reviews only)' }) - @ApiHeader({ - name: 'X-Slug', - required: true, - schema: { - type: 'string', - default: 'zhivan', - }, - }) + @ApiHeader(API_HEADER_SLUG) @ApiParam({ name: 'reviewId', required: true }) @ApiBody({ type: UpdateReviewDto }) @ApiOkResponse({ description: 'The updated review' }) @@ -118,21 +92,17 @@ export class ReviewController { @ApiBearerAuth() @Delete('public/reviews/:id') @ApiOperation({ summary: 'Delete a review (own reviews only)' }) - @ApiHeader({ - name: 'X-Slug', - required: true, - schema: { - type: 'string', - default: 'zhivan', - }, - }) + @ApiHeader(API_HEADER_SLUG) @ApiParam({ name: 'id', required: true }) remove(@Param('id') id: string, @UserId() userId: string) { return this.reviewService.remove(id, userId, false); } + /******************** Admin Routes **********************/ + @UseGuards(AdminAuthGuard) @ApiBearerAuth() + @Permissions(Permission.MANAGE_REVIEWS) @Get('admin/reviews') @ApiOperation({ summary: 'Get all reviews (admin - including unapproved)' }) @ApiOkResponse({ description: 'List of all reviews' }) @@ -149,6 +119,7 @@ export class ReviewController { @UseGuards(AdminAuthGuard) @ApiBearerAuth() + @Permissions(Permission.MANAGE_REVIEWS) @Patch('admin/reviews/:id') @ApiOperation({ summary: 'Update a review (admin - can change approval status)' }) @ApiParam({ name: 'id', required: true }) @@ -159,6 +130,7 @@ export class ReviewController { @UseGuards(AdminAuthGuard) @ApiBearerAuth() + @Permissions(Permission.MANAGE_REVIEWS) @Get('admin/reviews/:id') @ApiOperation({ summary: 'review detail' }) @ApiParam({ name: 'id', required: true }) @@ -168,6 +140,7 @@ export class ReviewController { @UseGuards(AdminAuthGuard) @ApiBearerAuth() + @Permissions(Permission.MANAGE_REVIEWS) @Patch('admin/reviews/:id/status') @ApiOperation({ summary: 'Change review status (pending, approved, rejected)' }) @ApiParam({ name: 'id', required: true }) @@ -181,6 +154,7 @@ export class ReviewController { } @UseGuards(AdminAuthGuard) + @Permissions(Permission.MANAGE_REVIEWS) @ApiBearerAuth() @Delete('admin/reviews/:id') @ApiOperation({ summary: 'Delete a review (admin)' }) diff --git a/src/modules/roles/controllers/roles.controller.ts b/src/modules/roles/controllers/roles.controller.ts index 0dc6c4c..cd4a083 100644 --- a/src/modules/roles/controllers/roles.controller.ts +++ b/src/modules/roles/controllers/roles.controller.ts @@ -8,8 +8,11 @@ import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard'; import { Permissions } from 'src/common/decorators/permissions.decorator'; import { RestId } from 'src/common/decorators'; import { AdminId } from 'src/common/decorators/admin-id.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; + @UseGuards(AdminAuthGuard) +@Permissions(Permission.MANAGE_ROLES) @ApiBearerAuth() @ApiTags('roles') @Controller('admin/roles') diff --git a/src/modules/users/controllers/users.controller.ts b/src/modules/users/controllers/users.controller.ts index 57c0d7f..b08a58a 100644 --- a/src/modules/users/controllers/users.controller.ts +++ b/src/modules/users/controllers/users.controller.ts @@ -11,11 +11,13 @@ import { FindUsersDto } from '../dto/find-user.dto'; import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard'; import { API_HEADER_SLUG } from 'src/common/constants/index'; import { UserSuccessMessage } from 'src/common/enums/message.enum'; +import { Permissions } from 'src/common/decorators/permissions.decorator'; +import { Permission } from 'src/common/enums/permission.enum'; @ApiTags('User') @Controller() export class UsersController { - constructor(private readonly userService: UserService) {} + constructor(private readonly userService: UserService) { } @UseGuards(AuthGuard) @ApiBearerAuth() @@ -134,12 +136,13 @@ export class UsersController { }; } - + /******************** Admin Routes **********************/ + @UseGuards(AdminAuthGuard) @ApiBearerAuth() + @Permissions(Permission.MANAGE_USERS) @ApiOperation({ summary: 'Get paginated list of restuarant users with filters' }) - @ApiOkResponse({ description: 'Paginated list of users' }) - @Get('admin/users') + @Get('admin/users') async findAllRestaurantUsers( @Query(new ValidationPipe({ transform: true, whitelist: true })) query: FindUsersDto,