tehran_tala/apps/api/src/modules/admin-orders/admin-orders.controller.ts

import { Body, Controller, Get, HttpCode, Param, Post } from '@nestjs/common';
import { AdminOrdersService } from './admin-orders.service';
import { TableQueryDto } from '../admin-table/table-query.dto';
import { UpdateOrderStatusDto } from './update-status.dto';
import { CurrentAdmin, RequirePermission } from '../auth/guards';
import type { AuthenticatedAdmin } from '../auth/jwt.strategy';

/**
 * Legacy endpoints (henza_server routes/admin.php):
 *   POST single-order      -> the single-sale order grid
 *   GET  order/{id}        -> order detail + status timeline
 *
 * Each route is gated by the same rid the legacy router used in `meta.role`,
 * so the API enforces what the menu already hides.
 */
@Controller('admin/orders')
export class AdminOrdersController {
  constructor(private readonly orders: AdminOrdersService) {}

  /** Legacy POST single-order. POST, not GET, because XTable posts its filters. */
  @Post('list')
  @HttpCode(200)
  @RequirePermission('order.list')
  list(@Body() query: TableQueryDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
    /**
     * Branch scoping, ported from legacy AdminController::getSingleOrders:
     *
     *   if (!is_null(auth()->user()->branch_id)) {
     *       $records->where('branch_id', auth()->user()->branch_id);
     *   }
     *
     * i.e. ANY user carrying a branch_id sees only that branch. Faithful to legacy.
     *
     * Consequence worth knowing: the seed gives head-office admins a home branch,
     * so under this rule they see only that branch's orders. That is legacy's real
     * behaviour, not a defect introduced here — head office was expected to have a
     * null branch_id. Recorded in docs/ADMIN-PORT-PLAN.md.
     */
    return this.orders.list(query, admin.branchId ?? undefined);
  }

  /** Legacy POST major/order/table — the wholesale grid. */
  @Post('wholesale/list')
  @HttpCode(200)
  @RequirePermission('order.omde')
  listWholesale(@Body() query: TableQueryDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
    return this.orders.listWholesale(query, admin.branchId ?? undefined);
  }

  /** Legacy POST order-tamin — orders that reached the sourcing stage. */
  @Post('tamin/list')
  @HttpCode(200)
  @RequirePermission('order.tamin')
  listTamin(@Body() query: TableQueryDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
    return this.orders.listTamin(query, admin.branchId ?? undefined);
  }

  /** Legacy POST delete-order. */
  @Post('delete')
  @HttpCode(200)
  @RequirePermission('order.omde')
  remove(@Body() body: { id: string }) {
    return this.orders.remove(body.id);
  }

  /** Legacy POST /order from the admin order builder (views/order/create.vue). */
  @Post('create')
  @HttpCode(200)
  @RequirePermission('order.create')
  createFromAdmin(
    @Body()
    body: {
      customer_id: string;
      order_items: { vid: string; qty: number; percent?: number; discount?: number }[];
      sts?: number | string;
      note?: string;
    },
    @CurrentAdmin() admin: AuthenticatedAdmin,
  ) {
    return this.orders.createFromAdmin(body, admin.id);
  }

  /** Legacy GET order/type. */
  @Get('type-options')
  @RequirePermission('order.create')
  typeOptions() {
    return this.orders.typeOptions();
  }

  @Get('status-options')
  @RequirePermission('order.list')
  statusOptions() {
    return this.orders.statusOptions();
  }

  /** Legacy POST single/order-sts/edit. */
  @Post('status')
  @HttpCode(200)
  @RequirePermission('order.list')
  setStatus(@Body() dto: UpdateOrderStatusDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
    return this.orders.setStatus(dto, admin.id);
  }

  @Get(':id')
  @RequirePermission('order.list')
  findOne(@Param('id') id: string) {
    return this.orders.findOne(id);
  }
}