set permissions

src/modules/payments/controllers/payments.controller.ts

@@ -18,6 +18,8 @@ import { PaymentChartDto } from '../dto/payment-chart.dto';
 import { RestId, UserId } from 'src/common/decorators';
 import { AuthGuard } from 'src/modules/auth/guards/auth.guard';
 import { API_HEADER_SLUG } from 'src/common/constants';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
 
 @ApiTags('payments')
 @Controller()
@@ -67,6 +69,7 @@ export class PaymentsController {
 
   /** admin routes */
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Get('admin/payments/methods')
   @ApiOperation({ summary: 'Get restaurant all payment methods' })
@@ -75,6 +78,7 @@ export class PaymentsController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Post('admin/payments/methods')
   @ApiOperation({ summary: 'Create a new restaurant payment method' })
@@ -84,6 +88,7 @@ export class PaymentsController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Get('admin/payments/methods/:paymentMethodId')
   @ApiOperation({ summary: 'Get restaurant payment method by ID' })
@@ -93,6 +98,7 @@ export class PaymentsController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Patch('admin/payments/methods/:paymentMethodId')
   @ApiOperation({ summary: 'Update a restaurant payment method' })
@@ -106,6 +112,7 @@ export class PaymentsController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Delete('admin/payments/methods/:paymentMethodId')
   @ApiOperation({ summary: 'Delete a restaurant payment method' })
@@ -115,6 +122,7 @@ export class PaymentsController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Post('admin/payments/verify-cash-method/:paymentId')
   @ApiOperation({ summary: 'Verify cash payment ' })
@@ -124,6 +132,7 @@ export class PaymentsController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_PAYMENTS)
   @ApiBearerAuth()
   @Get('admin/payments/chart')
   @ApiOperation({ summary: 'Get payment chart data with date and period filters' })