hedena_gold/apps/api/src/modules/orders/orders.controller.ts

import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
import { OrdersService } from './orders.service';
import { CreateOrderDto } from './dto/create-order.dto';
import { UpdateOrderStatusDto } from './dto/update-order-status.dto';
import { Public, RequirePermission } from '../auth/guards';

/**
 * Customer-facing order routes.
 *
 * POST / and GET /:id stay `@Public()` for now: the target has no customer
 * session yet, so the customer id travels in the request body. The reference
 * derived it from the `api-customer` guard instead
 * (henza_server ApiMobileController.php:533 reads `auth()->id()`), which is what
 * stage 2 of the security hotfix restores. Tracked as SEC-02 / B1-B2 in
 * docs/parity/ISSUES.md.
 *
 * PATCH /:id/status was public too, which was worse in kind: it let an
 * anonymous caller move any order's status AND attribute the change to any
 * admin via the DTO's actorAdminUserId. It is an admin operation in the
 * reference, it had no caller in this repo (the admin panel posts to
 * admin/orders/status instead), so it is now behind the order-status rid.
 */
@Controller('orders')
export class OrdersController {
  constructor(private readonly orders: OrdersService) {}

  @Public()
  @Post()
  create(@Body() dto: CreateOrderDto) {
    return this.orders.createOrder(dto);
  }

  @Public()
  @Get(':id')
  get(@Param('id') id: string) {
    return this.orders.getById(id);
  }

  @Patch(':id/status')
  @RequirePermission('order.list.sts.submit')
  updateStatus(@Param('id') id: string, @Body() dto: UpdateOrderStatusDto) {
    return this.orders.updateStatus(id, dto.status, dto.actorAdminUserId, dto.note);
  }
}