Nick.Rosenloecher/ApiCore
1
0 Fork 0
Code Issues 22 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: RBAC Phase 2a - Bienenvolk-Kern auf @RequirePermission umgestellt

Browse Source 
Apiaries, Colonies, Queens, Inspections (+ ColonyInspections),
Tasks, TaskTemplates: @Roles(...) durch @RequirePermission(...) ersetzt.
Schliesst dabei die bisher ungeschuetzten GET-Routen (jeder eingeloggte
Nutzer konnte lesen, unabhaengig von seiner Rolle) mit :read-Rechten.
TaskTemplatesController verliert seinen klassenweiten @Roles-Blanket
zugunsten pro-Route-Rechten (gleiche effektive Berechtigung: nur
ADMIN/BEEKEEPER, jetzt ueber task-templates:* statt Rollen-Liste).

Verifiziert: tsc, lint, e2e (apiaries/colonies/queens/inspections/
tasks/task-templates, 29/29 gruen).

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Nick SzaunigandClaude Sonnet 5 committed 2026-08-26 06:57:04 +02:00
1 parent 139ea6fdd7
commit f4b174ec56
7 files changed
+52 -38
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ApiCore-Backend/src/colonies/colonies.controller.ts
+12 -9
View File
@@ -8,8 +8,8 @@ import {
Query,
} from '@nestjs/common';
import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
import { ColonyStatus, LegacyRole as Role } from '../../generated/prisma';
import { Roles } from '../auth/decorators/roles.decorator';
import { ColonyStatus } from '../../generated/prisma';
import { RequirePermission } from '../auth/decorators/require-permission.decorator';
import { CurrentUser } from '../auth/decorators/current-user.decorator';
import type { AuthenticatedUser } from '../auth/types/authenticated-user';
import { CreateColonyDto } from './dto/create-colony.dto';
@@ -25,6 +25,7 @@ import { ColoniesService } from './colonies.service';
export class ColoniesController {
constructor(private readonly coloniesService: ColoniesService) {}
@RequirePermission('colonies:read')
@Get()
findAll(
@Query('status') status?: ColonyStatus,
@@ -33,17 +34,19 @@ export class ColoniesController {
return this.coloniesService.findAll({ status, apiaryId });
}
@RequirePermission('colonies:read')
@Get(':id')
findOne(@Param('id') id: string) {
return this.coloniesService.findById(id);
}
@RequirePermission('colonies:read')
@Get(':id/history')
getHistory(@Param('id') id: string) {
return this.coloniesService.getHistory(id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:create')
@Post()
create(
@Body() dto: CreateColonyDto,
@@ -52,7 +55,7 @@ export class ColoniesController {
return this.coloniesService.create(dto, actor.id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:update')
@Patch(':id')
update(
@Param('id') id: string,
@@ -62,7 +65,7 @@ export class ColoniesController {
return this.coloniesService.update(id, dto, actor.id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:manage-lifecycle')
@Post(':id/move')
move(
@Param('id') id: string,
@@ -72,7 +75,7 @@ export class ColoniesController {
return this.coloniesService.move(id, dto, actor.id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:manage-lifecycle')
@Post(':id/split')
split(
@Param('id') id: string,
@@ -82,7 +85,7 @@ export class ColoniesController {
return this.coloniesService.split(id, dto, actor.id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:manage-lifecycle')
@Post(':id/merge')
merge(
@Param('id') id: string,
@@ -92,13 +95,13 @@ export class ColoniesController {
return this.coloniesService.merge(id, dto, actor.id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:manage-lifecycle')
@Post(':id/dissolve')
dissolve(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
return this.coloniesService.dissolve(id, actor.id);
}
@Roles(Role.ADMIN, Role.BEEKEEPER)
@RequirePermission('colonies:deactivate')
@Post(':id/reactivate')
reactivate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
return this.coloniesService.reactivate(id, actor.id);