set permissions

src/modules/orders/controllers/orders.controller.ts

@@ -9,6 +9,8 @@ import { FindOrdersDto } from '../dto/find-orders.dto';
 import { OrderStatus } from '../interface/order.interface';
 import { API_HEADER_SLUG } from 'src/common/constants/index';
 import { UpdateOrderStatusDto } from '../dto/update-order-status.dto';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
 
 @ApiTags('orders')
 @ApiBearerAuth()
@@ -63,6 +65,7 @@ export class OrdersController {
 
   /********************  Admin Routes **********************/
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_ORDERS)
   @Get('admin/orders')
   @ApiOperation({ summary: 'Get all orders with pagination and filters' })
   findAllAdmin(@RestId() restId: string, @Query() dto: FindOrdersDto) {
@@ -70,6 +73,7 @@ export class OrdersController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_ORDERS)
   @ApiOperation({ summary: 'Get an order By id for User' })
   @ApiParam({ name: 'orderId', description: 'Order ID' })
   @Get('admin/orders/:orderId')
@@ -78,6 +82,7 @@ export class OrdersController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_ORDERS)
   @Patch('admin/orders/:orderId/:status')
   @ApiOperation({ summary: 'Update an order status' })
   @ApiParam({ name: 'orderId', description: 'Order ID' })
@@ -97,6 +102,7 @@ export class OrdersController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_ORDERS)
   @ApiOperation({ summary: 'Get Stats for report page' })
   @Get('admin/orders/stats')
   findStats(@RestId() restId: string) {
@@ -104,6 +110,7 @@ export class OrdersController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_ORDERS)
   @ApiOperation({ summary: 'Get food sales pie chart data for last month' })
   @ApiHeader(API_HEADER_SLUG)
   @Get('admin/orders/food-sales-pie-chart')