7a5ea75b50
CI/CD / CI · API (dotnet build + test) (push) Successful in 40s
CI/CD / CI · Admin API (dotnet build) (push) Successful in 30s
CI/CD / CI · Dashboard (tsc) (push) Successful in 1m9s
CI/CD / CI · Admin Web (tsc) (push) Successful in 37s
CI/CD / CI · Website (tsc) (push) Successful in 45s
CI/CD / CI · Koja (tsc) (push) Has been cancelled
CI/CD / Deploy · all services (push) Has been cancelled
Closes the gap where the custom-role matrix was defined but unenforced — most write endpoints only checked café membership, so the API would accept writes a role's UI hid. Adds EnsurePermission(...) to all mutating/sensitive endpoints across 32 controllers, mapped to the granular catalog: - menu/inventory/coupons/customers/expenses/reservations/taxes/branches → CRUD perms - tables/queue/kitchen-stations/print-settings → manage perms - orders → ProcessOrders / EditOrder / VoidOrder / UpdateOrderStatus / HandlePayments, payment corrections → ManageFinancials - HR → CreateStaff / ManageSchedules / ReviewLeave / View+ManageSalaries / ManageStaffCredentials (self-service clock-in/leave preserved) - reports → ViewReports, export → ExportReports, audit → ViewAuditLog - billing → ManageBilling, sms → SendSms/ManageSmsSettings, reviews → ManageReviews, discover/public profile → ManageDiscoverProfile, café settings → ManageCafeSettings, custom roles → ManageRoles Removes legacy [Authorize(Roles=...)] attributes that would have overridden the permission model (orders, branch-menu, pos-device, print). Manual discount/comp have no backend endpoint yet (discounts come from coupons) — gated on the POS UI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.8 KiB
C#
73 lines
2.8 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Meezi.API.Models.Discover;
|
|
using Meezi.API.Services;
|
|
using Meezi.Core.Authorization;
|
|
using Meezi.Core.Enums;
|
|
using Meezi.Core.Interfaces;
|
|
using Meezi.Infrastructure.Data;
|
|
using Meezi.Infrastructure.Discover;
|
|
using Meezi.Infrastructure.Services.Platform;
|
|
using Meezi.Shared;
|
|
using Microsoft.EntityFrameworkCore;
|
|
|
|
namespace Meezi.API.Controllers;
|
|
|
|
[Authorize]
|
|
[Route("api/cafes/{cafeId}/discover-profile")]
|
|
public class CafeDiscoverProfileController : CafeApiControllerBase
|
|
{
|
|
private readonly AppDbContext _db;
|
|
|
|
public CafeDiscoverProfileController(AppDbContext db) => _db = db;
|
|
|
|
[HttpGet]
|
|
public async Task<IActionResult> Get(string cafeId, ITenantContext tenant, CancellationToken ct)
|
|
{
|
|
if (EnsureCafeAccess(cafeId, tenant) is { } denied)
|
|
return denied;
|
|
|
|
var cafe = await _db.Cafes.AsNoTracking()
|
|
.FirstOrDefaultAsync(c => c.Id == cafeId, cancellationToken: ct);
|
|
if (cafe is null)
|
|
return NotFound(new ApiResponse<object>(false, null, new ApiError("NOT_FOUND", "Cafe not found.")));
|
|
|
|
var profile = CafeDiscoverProfileSerializer.Deserialize(cafe.DiscoverProfileJson);
|
|
return Ok(new ApiResponse<CafeDiscoverProfileDto>(true, CafeDiscoverProfileMapping.ToDto(profile)));
|
|
}
|
|
|
|
[HttpPut]
|
|
public async Task<IActionResult> Put(
|
|
string cafeId,
|
|
[FromBody] UpsertCafeDiscoverProfileRequest request,
|
|
ITenantContext tenant,
|
|
IPlatformCatalogService catalog,
|
|
CancellationToken ct)
|
|
{
|
|
if (EnsureCafeAccess(cafeId, tenant) is { } denied)
|
|
return denied;
|
|
if (EnsurePermission(tenant, Permission.ManageDiscoverProfile) is { } permDenied) return permDenied;
|
|
|
|
var planTier = tenant.PlanTier ?? PlanTier.Free;
|
|
if (!await catalog.IsFeatureEnabledForCafeAsync(cafeId, planTier, "discover_profile", ct))
|
|
{
|
|
return StatusCode(
|
|
StatusCodes.Status403Forbidden,
|
|
new ApiResponse<object>(
|
|
false,
|
|
null,
|
|
new ApiError("PLAN_FEATURE_DISABLED", "Discover profile is not included in your plan. Upgrade to enable it.")));
|
|
}
|
|
|
|
var cafe = await _db.Cafes.FirstOrDefaultAsync(c => c.Id == cafeId, cancellationToken: ct);
|
|
if (cafe is null)
|
|
return NotFound(new ApiResponse<object>(false, null, new ApiError("NOT_FOUND", "Cafe not found.")));
|
|
|
|
var profile = CafeDiscoverProfileMapping.FromRequest(request);
|
|
cafe.DiscoverProfileJson = CafeDiscoverProfileSerializer.Serialize(profile);
|
|
await _db.SaveChangesAsync(ct);
|
|
|
|
return Ok(new ApiResponse<CafeDiscoverProfileDto>(true, CafeDiscoverProfileMapping.ToDto(profile)));
|
|
}
|
|
}
|