update admin

apps/api/src/modules/sales-agent/sales-agent.controller.ts

@@ -0,0 +1,43 @@
+import { Body, Controller, Get, HttpCode, Post, Query } from '@nestjs/common';
+import { SalesAgentService } from './sales-agent.service';
+import { CurrentAdmin } from '../auth/guards';
+import type { AuthenticatedAdmin } from '../auth/jwt.strategy';
+
+/**
+ * The sales expert's own routes in the customer apps.
+ *
+ * Deliberately NOT part of CustomersModule: CustomersController is @Public() at
+ * the CLASS level, which would defeat a route-level guard here. This controller
+ * carries no @Public() at all, so the globally-registered JwtAuthGuard applies to
+ * every route below and the caller is always a real, token-authenticated
+ * AdminUser.
+ *
+ * Note these are NOT @RequirePermission()-gated. The rids in UserType 86
+ * («کارشناس فروش») describe what an agent may do in the ADMIN PANEL; these
+ * routes are the customer-app surface and are scoped by identity instead — the
+ * service checks `role === 'SALES_EXPERT'` and every query is filtered to the
+ * caller's own id, never to an id taken from the request.
+ */
+@Controller('sales-agent')
+export class SalesAgentController {
+  constructor(private readonly salesAgent: SalesAgentService) {}
+
+  @Get('me')
+  me(@CurrentAdmin() admin: AuthenticatedAdmin) {
+    return this.salesAgent.me(admin);
+  }
+
+  @Get('my-customers')
+  myCustomers(@CurrentAdmin() admin: AuthenticatedAdmin, @Query('search') search?: string) {
+    return this.salesAgent.myCustomers(admin, search);
+  }
+
+  @Post('verify-acting-as')
+  @HttpCode(200)
+  verifyActingAs(
+    @CurrentAdmin() admin: AuthenticatedAdmin,
+    @Body() body: { customerId: string },
+  ) {
+    return this.salesAgent.verifyActingAs(admin, body.customerId);
+  }
+}