Initial commit: Hedena Gold monorepo.

First commit of the Hedena Gold product (separate from gold-bank): branding, package names, and deploy defaults aligned to the new brand; legacy Henza trees stay local-only via .gitignore.
2026-10-15 17:19:10 +03:30
commit ea86636027
1121 changed files with 401065 additions and 0 deletions
@@ -0,0 +1,55 @@
+import { Body, Controller, Get, Param, Post } from '@nestjs/common';
+import { LedgerService } from './ledger.service';
+import { PostGoldRepaymentDto } from './dto/post-gold-repayment.dto';
+import { PostRialRepaymentDto } from './dto/post-rial-repayment.dto';
+import { RequirePermission } from '../auth/guards';
+
+/**
+ * Ledger operations — admin only.
+ *
+ * These were `@Public()` until the security hotfix. That was faithful to the
+ * reference, where the whole admin route file is unauthenticated (the
+ * `auth:api` group wrapper is commented out at henza_server/routes/admin.php:12
+ * and :272), but it contradicted decision D1 in docs/parity/DECISIONS.md, which
+ * confirms the target keeps its stricter auth. Four of these five routes WRITE
+ * to the ledger, so an anonymous caller could reconcile a balance or post and
+ * confirm a repayment.
+ *
+ * Rids follow the legacy vocabulary: reading a balance is a wallet read,
+ * repayments are financial documents, and confirming an entry is the existing
+ * document-confirm permission.
+ */
+@Controller('accounting')
+export class AccountingController {
+  constructor(private readonly ledger: LedgerService) {}
+
+  @Get('customers/:customerId/balance')
+  @RequirePermission('wallet.list')
+  getBalance(@Param('customerId') customerId: string) {
+    return this.ledger.getBalance(customerId);
+  }
+
+  @Post('customers/:customerId/reconcile')
+  @RequirePermission('wallet.charge')
+  reconcile(@Param('customerId') customerId: string) {
+    return this.ledger.reconcileBalance(customerId);
+  }
+
+  @Post('repayments/gold')
+  @RequirePermission('document.create')
+  postGoldRepayment(@Body() dto: PostGoldRepaymentDto) {
+    return this.ledger.postGoldRepayment(dto);
+  }
+
+  @Post('repayments/rial')
+  @RequirePermission('document.create')
+  postRialRepayment(@Body() dto: PostRialRepaymentDto) {
+    return this.ledger.postRialRepayment(dto);
+  }
+
+  @Post('entries/:entryId/confirm')
+  @RequirePermission('document.list.confirm')
+  confirmEntry(@Param('entryId') entryId: string) {
+    return this.ledger.confirmEntry(entryId);
+  }
+}