add auth roles and guards 050220

src/modules/businesses/businesses.controller.ts

@@ -7,8 +7,15 @@ import {
   Patch,
   Post,
   Query,
+  UseGuards,
 } from '@nestjs/common';
 import { BusinessEntity } from '../../entities/business.entity';
+import { UserRole } from '../../entities/user.entity';
+import { AuthUser } from '../auth/auth.types';
+import { CurrentUser } from '../auth/decorators/current-user.decorator';
+import { Roles } from '../auth/decorators/roles.decorator';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { RolesGuard } from '../auth/guards/roles.guard';
 import { BusinessesService } from './businesses.service';
 import { CreateBusinessDto } from './dto/create-business.dto';
 import { UpdateBusinessDto } from './dto/update-business.dto';
@@ -37,19 +44,26 @@ export class BusinessesController {
   }
 
   @Post()
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.ADMIN)
   create(@Body() payload: CreateBusinessDto): Promise<BusinessEntity> {
     return this.service.create(payload);
   }
 
   @Patch(':id')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.ADMIN, UserRole.BUSINESS_OWNER)
   update(
     @Param('id') id: string,
     @Body() payload: UpdateBusinessDto,
+    @CurrentUser() user: AuthUser,
   ): Promise<BusinessEntity> {
-    return this.service.update(id, payload);
+    return this.service.update(id, payload, user);
   }
 
   @Delete(':id')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.ADMIN)
   async remove(@Param('id') id: string): Promise<{ success: true }> {
     await this.service.remove(id);
     return { success: true };

src/modules/businesses/businesses.service.ts

@@ -1,5 +1,6 @@
 import {
   ConflictException,
+  ForbiddenException,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
@@ -7,6 +8,8 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { BusinessCategoryEntity } from '../../entities/business-category.entity';
 import { BusinessEntity } from '../../entities/business.entity';
+import { UserRole } from '../../entities/user.entity';
+import { AuthUser } from '../auth/auth.types';
 import { CreateBusinessDto } from './dto/create-business.dto';
 import { UpdateBusinessDto } from './dto/update-business.dto';
 
@@ -80,8 +83,13 @@ export class BusinessesService {
     return this.repo.save(entity);
   }
 
-  async update(id: string, payload: UpdateBusinessDto): Promise<BusinessEntity> {
+  async update(
+    id: string,
+    payload: UpdateBusinessDto,
+    actor?: AuthUser,
+  ): Promise<BusinessEntity> {
     const business = await this.findOne(id);
+    this.assertCanUpdateBusiness(business, payload, actor);
 
     if (payload.slug && payload.slug !== business.slug) {
       const slugTaken = await this.repo.findOne({ where: { slug: payload.slug } });
@@ -111,4 +119,31 @@ export class BusinessesService {
       throw new NotFoundException('Business category not found');
     }
   }
+
+  private assertCanUpdateBusiness(
+    business: BusinessEntity,
+    payload: UpdateBusinessDto,
+    actor?: AuthUser,
+  ): void {
+    if (!actor || actor.role === UserRole.ADMIN) {
+      return;
+    }
+
+    if (
+      actor.role !== UserRole.BUSINESS_OWNER ||
+      business.ownerId !== actor.id
+    ) {
+      throw new ForbiddenException('You can only manage your own business');
+    }
+
+    if (
+      payload.ownerId !== undefined ||
+      payload.categoryId !== undefined ||
+      payload.isActive !== undefined
+    ) {
+      throw new ForbiddenException(
+        'Only the super admin can change owner, category, or active status',
+      );
+    }
+  }
 }