set perms

src/modules/foods/controllers/category.controller.ts

@@ -16,11 +16,13 @@ import {
 import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { UseGuards } from '@nestjs/common';
 import { RestId } from 'src/common/decorators';
+import { Permission } from 'src/common/enums/permission.enum';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
 
 @ApiTags('category')
 @Controller()
 export class CategoryController {
-  constructor(private readonly categoryService: CategoryService) {}
+  constructor(private readonly categoryService: CategoryService) { }
 
   @Get('public/categories/restaurant/:slug')
   @ApiOperation({ summary: 'Get all categories by restaurant slug' })
@@ -38,31 +40,31 @@ export class CategoryController {
     return this.categoryService.findAllByRestaurant(slug);
   }
 
+  /*** Admin ***/
+
   @ApiOperation({ summary: 'Create category' })
-  @ApiCreatedResponse({ description: 'Category created', type: CreateCategoryDto })
   @ApiBody({ type: CreateCategoryDto })
+  @Permissions(Permission.MANAGE_CATEGORIES)
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
   @Post('admin/categories')
   create(@Body() dto: CreateCategoryDto, @RestId() restId: string) {
     return this.categoryService.create(restId, dto);
   }
-
+  @Permissions(Permission.MANAGE_CATEGORIES)
   @ApiOperation({ summary: 'my restaurant categories' })
-  @ApiOkResponse({ description: 'List of categories' })
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
-  @Get('admin/categories')
+  @Get('admin/categories') 
   findAll(@RestId() restId: string) {
     return this.categoryService.findAllByRestaurantId(restId);
-  }
+  } 
 
+  @Permissions(Permission.MANAGE_CATEGORIES)
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
   @Get('admin/categories/:id')
   @ApiOperation({ summary: 'Get category' })
-  @ApiOkResponse({ description: 'Category detail', type: CreateCategoryDto })
-  @ApiNotFoundResponse({ description: 'Category not found' })
   @ApiParam({ name: 'id', required: true, type: String })
   findOne(@Param('id') id: string, @RestId() restId: string) {
     return this.categoryService.findOne(restId, id);
@@ -70,17 +72,18 @@ export class CategoryController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_CATEGORIES)
   @Patch('admin/categories/:id')
   @ApiOperation({ summary: 'Update category' })
   @ApiParam({ name: 'id' })
   @ApiBody({ type: UpdateCategoryDto })
-  @ApiOkResponse({ description: 'Updated category', type: UpdateCategoryDto })
   update(@Param('id') id: string, @Body() dto: UpdateCategoryDto, @RestId() restId: string) {
     return this.categoryService.update(restId, id, dto);
   }
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_CATEGORIES)
   @Delete('admin/categories/:id')
   @ApiOperation({ summary: 'Delete category' })
   @ApiParam({ name: 'id' })
@@ -89,11 +92,4 @@ export class CategoryController {
     return this.categoryService.remove(restId, id);
   }
 
-  // @Get('restaurant/:restId')
-  // @ApiOperation({ summary: 'Restaurant categories for user' })
-  // @ApiOkResponse({ description: 'List of categories' })
-  // @ApiParam({ name: 'restId', required: true, type: String })
-  // findAllForRestaurant(@Param('restId') restId: string) {
-  //   return this.categoryService.findRestaurantCategories(restId);
-  // }
 }

src/modules/foods/controllers/food.controller.ts

@@ -20,6 +20,8 @@ import { RestId, UserId } from 'src/common/decorators';
 import { AuthGuard } from 'src/modules/auth/guards/auth.guard';
 import { OptionalAuthGuard } from 'src/modules/auth/guards/optinalAuth.guard';
 import { API_HEADER_SLUG } from 'src/common/constants';
+import { Permission } from 'src/common/enums/permission.enum';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
 
 @ApiTags('foods')
 @Controller()
@@ -30,7 +32,6 @@ export class FoodController {
   @ApiOperation({ summary: 'Get all foods by restaurant slug' })
   @ApiHeader(API_HEADER_SLUG)
   @ApiParam({ name: 'slug', required: true, description: 'Restaurant Slug' })
-  @ApiOkResponse({ description: 'List of all foods for the restaurant' })
   findAllByRestaurant(@Param('slug') slug: string) {
     return this.foodsService.findByWeekDateAndMealType(slug);
   }
@@ -68,9 +69,9 @@ export class FoodController {
   /* ---------------------------------- Admin ---------------------------------- */
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_FOODS)
   @Post('admin/foods')
   @ApiOperation({ summary: 'Create a new food' })
-  @ApiCreatedResponse({ description: 'The food has been successfully created.', type: CreateFoodDto })
   @ApiBody({ type: CreateFoodDto })
   create(@Body() createFoodDto: CreateFoodDto, @RestId() restId: string) {
     return this.foodsService.create(restId, createFoodDto);
@@ -78,9 +79,9 @@ export class FoodController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_FOODS)
   @Get('admin/foods')
   @ApiOperation({ summary: 'Get a paginated list of foods' })
-  @ApiOkResponse({ description: 'Paginated list of foods' })
   @ApiQuery({ name: 'page', required: false, type: Number })
   @ApiQuery({ name: 'limit', required: false, type: Number })
   @ApiQuery({ name: 'search', required: false, type: String })
@@ -95,27 +96,27 @@ export class FoodController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_FOODS)
   @Get('admin/foods/:id')
   @ApiOperation({ summary: 'Get a food by id' })
   @ApiParam({ name: 'id', required: true })
-  @ApiOkResponse({ description: 'The food', type: CreateFoodDto })
-  @ApiNotFoundResponse({ description: 'Food not found' })
   findById(@Param('id') id: string, @RestId() restId: string) {
     return this.foodsService.findAdminById(restId, id);
   }
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_FOODS)
   @Patch('admin/foods/:id')
   @ApiOperation({ summary: 'Update a food' })
   @ApiParam({ name: 'id', required: true })
   @ApiBody({ type: UpdateFoodDto })
-  @ApiOkResponse({ description: 'The updated food', type: UpdateFoodDto })
   update(@Param('id') id: string, @Body() updateFoodDto: UpdateFoodDto, @RestId() restId: string) {
     return this.foodsService.update(restId, id, updateFoodDto);
   }
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_FOODS)
   @Delete('admin/foods/:id')
   @ApiOperation({ summary: 'Delete (soft) a food' })
   @ApiParam({ name: 'id', required: true })