44 lines
1.6 KiB
TypeScript
44 lines
1.6 KiB
TypeScript
import { Body, Controller, Get, HttpCode, Post, Query } from '@nestjs/common';
|
|
import { SalesAgentService } from './sales-agent.service';
|
|
import { CurrentAdmin } from '../auth/guards';
|
|
import type { AuthenticatedAdmin } from '../auth/jwt.strategy';
|
|
|
|
/**
|
|
* The sales expert's own routes in the customer apps.
|
|
*
|
|
* Deliberately NOT part of CustomersModule: CustomersController is @Public() at
|
|
* the CLASS level, which would defeat a route-level guard here. This controller
|
|
* carries no @Public() at all, so the globally-registered JwtAuthGuard applies to
|
|
* every route below and the caller is always a real, token-authenticated
|
|
* AdminUser.
|
|
*
|
|
* Note these are NOT @RequirePermission()-gated. The rids in UserType 86
|
|
* («کارشناس فروش») describe what an agent may do in the ADMIN PANEL; these
|
|
* routes are the customer-app surface and are scoped by identity instead — the
|
|
* service checks `role === 'SALES_EXPERT'` and every query is filtered to the
|
|
* caller's own id, never to an id taken from the request.
|
|
*/
|
|
@Controller('sales-agent')
|
|
export class SalesAgentController {
|
|
constructor(private readonly salesAgent: SalesAgentService) {}
|
|
|
|
@Get('me')
|
|
me(@CurrentAdmin() admin: AuthenticatedAdmin) {
|
|
return this.salesAgent.me(admin);
|
|
}
|
|
|
|
@Get('my-customers')
|
|
myCustomers(@CurrentAdmin() admin: AuthenticatedAdmin, @Query('search') search?: string) {
|
|
return this.salesAgent.myCustomers(admin, search);
|
|
}
|
|
|
|
@Post('verify-acting-as')
|
|
@HttpCode(200)
|
|
verifyActingAs(
|
|
@CurrentAdmin() admin: AuthenticatedAdmin,
|
|
@Body() body: { customerId: string },
|
|
) {
|
|
return this.salesAgent.verifyActingAs(admin, body.customerId);
|
|
}
|
|
}
|