olsch01
43b10869f0
Introduces a capability layer on top of existing roles that controls feature visibility and access. Capabilities follow an area.feature.action taxonomy (~35 capabilities) with sensible defaults per role. Tenant admins can customize via grant/revoke overrides stored in org settings JSONB. Key changes: - Add vice_president role to DB schema - Backend: capability constants, resolution logic, CapabilityGuard (global), @RequireCapability decorator on all 16 tenant controllers - Frontend: permission hooks (useCanEdit, useHasCapability), CapabilityGate component, sidebar filtering by capability, all 17 pages migrated from useIsReadOnly to capability-based checks - New admin UI: /settings/permissions matrix page for per-tenant role customization with grant/revoke delta model - GET /organizations/my-capabilities endpoint for capability refresh - Validation of permissionOverrides in settings updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
53 lines
1.8 KiB
TypeScript
53 lines
1.8 KiB
TypeScript
import { Controller, Get, Post, Put, Body, Param, Res, UseGuards } from '@nestjs/common';
|
|
import { ApiTags, ApiBearerAuth } from '@nestjs/swagger';
|
|
import { Response } from 'express';
|
|
import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
|
|
import { RequireCapability } from '../../common/decorators/capability.decorator';
|
|
import { ProjectsService } from './projects.service';
|
|
|
|
@ApiTags('projects')
|
|
@Controller('projects')
|
|
@ApiBearerAuth()
|
|
@UseGuards(JwtAuthGuard)
|
|
export class ProjectsController {
|
|
constructor(private service: ProjectsService) {}
|
|
|
|
@Get()
|
|
@RequireCapability('planning.projects.view')
|
|
findAll() { return this.service.findAll(); }
|
|
|
|
@Get('export')
|
|
@RequireCapability('planning.projects.view')
|
|
async exportCSV(@Res() res: Response) {
|
|
const csv = await this.service.exportCSV();
|
|
res.set({ 'Content-Type': 'text/csv', 'Content-Disposition': 'attachment; filename="projects.csv"' });
|
|
res.send(csv);
|
|
}
|
|
|
|
@Get('planning')
|
|
@RequireCapability('planning.projects.view')
|
|
findForPlanning() { return this.service.findForPlanning(); }
|
|
|
|
@Get(':id')
|
|
@RequireCapability('planning.projects.view')
|
|
findOne(@Param('id') id: string) { return this.service.findOne(id); }
|
|
|
|
@Post('import')
|
|
@RequireCapability('planning.projects.edit')
|
|
importCSV(@Body() rows: any[]) { return this.service.importCSV(rows); }
|
|
|
|
@Post()
|
|
@RequireCapability('planning.projects.edit')
|
|
create(@Body() dto: any) { return this.service.create(dto); }
|
|
|
|
@Put(':id')
|
|
@RequireCapability('planning.projects.edit')
|
|
update(@Param('id') id: string, @Body() dto: any) { return this.service.update(id, dto); }
|
|
|
|
@Put(':id/planned-date')
|
|
@RequireCapability('planning.projects.edit')
|
|
updatePlannedDate(@Param('id') id: string, @Body() dto: { planned_date: string }) {
|
|
return this.service.updatePlannedDate(id, dto.planned_date);
|
|
}
|
|
}
|