set permissions

src/modules/review/controllers/review.controller.ts

@@ -20,6 +20,9 @@ import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { UserId } from 'src/common/decorators/user-id.decorator';
 import { RestId } from 'src/common/decorators/rest-id.decorator';
 import { ReviewStatus } from '../enums/review-status.enum';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
+import { API_HEADER_SLUG } from 'src/common/constants';
 
 @ApiTags('review')
 @Controller()
@@ -30,14 +33,7 @@ export class ReviewController {
   @ApiBearerAuth()
   @Post('public/reviews')
   @ApiOperation({ summary: 'Create a new review and rating' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
+  @ApiHeader(API_HEADER_SLUG)
   @ApiCreatedResponse({ description: 'The review has been successfully created.' })
   @ApiBody({ type: CreateReviewDto })
   create(@Body() createReviewDto: CreateReviewDto, @UserId() userId: string) {
@@ -46,14 +42,7 @@ export class ReviewController {
 
   @Get('public/reviews/:foodId')
   @ApiOperation({ summary: 'Get all reviews of food by id(public - only approved)' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
+  @ApiHeader(API_HEADER_SLUG)
   @ApiOkResponse({ description: 'List of approved reviews' })
   @ApiParam({ name: 'foodId', required: true, type: String })
   @ApiQuery({ name: 'page', required: false, type: Number })
@@ -67,16 +56,8 @@ export class ReviewController {
 
   @Get('public/reviews/restuarant/:restuarantSlug')
   @ApiOperation({ summary: 'Get all reviews of restuarant by slug(public - only approved)' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
-  @ApiOkResponse({ description: 'List of approved reviews' })
-  @ApiParam({ name: 'restuarantSlug', required: true, type: String })
+  @ApiHeader(API_HEADER_SLUG)
+   @ApiParam({ name: 'restuarantSlug', required: true, type: String })
   @ApiQuery({ name: 'page', required: false, type: Number })
   @ApiQuery({ name: 'limit', required: false, type: Number })
   @ApiQuery({ name: 'orderBy', required: false, type: String })
@@ -99,14 +80,7 @@ export class ReviewController {
   @ApiBearerAuth()
   @Patch('public/reviews/:reviewId')
   @ApiOperation({ summary: 'Update a review (own reviews only)' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
+  @ApiHeader(API_HEADER_SLUG)
   @ApiParam({ name: 'reviewId', required: true })
   @ApiBody({ type: UpdateReviewDto })
   @ApiOkResponse({ description: 'The updated review' })
@@ -118,21 +92,17 @@ export class ReviewController {
   @ApiBearerAuth()
   @Delete('public/reviews/:id')
   @ApiOperation({ summary: 'Delete a review (own reviews only)' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
+  @ApiHeader(API_HEADER_SLUG)
   @ApiParam({ name: 'id', required: true })
   remove(@Param('id') id: string, @UserId() userId: string) {
     return this.reviewService.remove(id, userId, false);
   }
 
+  /********************  Admin Routes **********************/
+
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_REVIEWS)
   @Get('admin/reviews')
   @ApiOperation({ summary: 'Get all reviews (admin - including unapproved)' })
   @ApiOkResponse({ description: 'List of all reviews' })
@@ -149,6 +119,7 @@ export class ReviewController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_REVIEWS)
   @Patch('admin/reviews/:id')
   @ApiOperation({ summary: 'Update a review (admin - can change approval status)' })
   @ApiParam({ name: 'id', required: true })
@@ -159,6 +130,7 @@ export class ReviewController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_REVIEWS)
   @Get('admin/reviews/:id')
   @ApiOperation({ summary: 'review detail' })
   @ApiParam({ name: 'id', required: true })
@@ -168,6 +140,7 @@ export class ReviewController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_REVIEWS)
   @Patch('admin/reviews/:id/status')
   @ApiOperation({ summary: 'Change review status (pending, approved, rejected)' })
   @ApiParam({ name: 'id', required: true })
@@ -181,6 +154,7 @@ export class ReviewController {
   }
 
   @UseGuards(AdminAuthGuard)
+  @Permissions(Permission.MANAGE_REVIEWS)
   @ApiBearerAuth()
   @Delete('admin/reviews/:id')
   @ApiOperation({ summary: 'Delete a review (admin)' })