56 lines
2.0 KiB
TypeScript
56 lines
2.0 KiB
TypeScript
|
import { Body, Controller, Get, Param, Post } from '@nestjs/common';
|
||
|
|
import { LedgerService } from './ledger.service';
|
||
|
|
import { PostGoldRepaymentDto } from './dto/post-gold-repayment.dto';
|
||
|
|
import { PostRialRepaymentDto } from './dto/post-rial-repayment.dto';
|
||
|
|
import { RequirePermission } from '../auth/guards';
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Ledger operations — admin only.
|
||
|
|
*
|
||
|
|
* These were `@Public()` until the security hotfix. That was faithful to the
|
||
|
|
* reference, where the whole admin route file is unauthenticated (the
|
||
|
|
* `auth:api` group wrapper is commented out at henza_server/routes/admin.php:12
|
||
|
|
* and :272), but it contradicted decision D1 in docs/parity/DECISIONS.md, which
|
||
|
|
* confirms the target keeps its stricter auth. Four of these five routes WRITE
|
||
|
|
* to the ledger, so an anonymous caller could reconcile a balance or post and
|
||
|
|
* confirm a repayment.
|
||
|
|
*
|
||
|
|
* Rids follow the legacy vocabulary: reading a balance is a wallet read,
|
||
|
|
* repayments are financial documents, and confirming an entry is the existing
|
||
|
|
* document-confirm permission.
|
||
|
|
*/
|
||
|
|
@Controller('accounting')
|
||
|
|
export class AccountingController {
|
||
|
|
constructor(private readonly ledger: LedgerService) {}
|
||
|
|
|
||
|
|
@Get('customers/:customerId/balance')
|
||
|
|
@RequirePermission('wallet.list')
|
||
|
|
getBalance(@Param('customerId') customerId: string) {
|
||
|
|
return this.ledger.getBalance(customerId);
|
||
|
|
}
|
||
|
|
|
||
|
|
@Post('customers/:customerId/reconcile')
|
||
|
|
@RequirePermission('wallet.charge')
|
||
|
|
reconcile(@Param('customerId') customerId: string) {
|
||
|
|
return this.ledger.reconcileBalance(customerId);
|
||
|
|
}
|
||
|
|
|
||
|
|
@Post('repayments/gold')
|
||
|
|
@RequirePermission('document.create')
|
||
|
|
postGoldRepayment(@Body() dto: PostGoldRepaymentDto) {
|
||
|
|
return this.ledger.postGoldRepayment(dto);
|
||
|
|
}
|
||
|
|
|
||
|
|
@Post('repayments/rial')
|
||
|
|
@RequirePermission('document.create')
|
||
|
|
postRialRepayment(@Body() dto: PostRialRepaymentDto) {
|
||
|
|
return this.ledger.postRialRepayment(dto);
|
||
|
|
}
|
||
|
|
|
||
|
|
@Post('entries/:entryId/confirm')
|
||
|
|
@RequirePermission('document.list.confirm')
|
||
|
|
confirmEntry(@Param('entryId') entryId: string) {
|
||
|
|
return this.ledger.confirmEntry(entryId);
|
||
|
|
}
|
||
|
|
}
|