cab8d690ab
Apply RLS context at task service boundaries, harden orchestrator/web integration and session startup behavior, re-enable targeted frontend tests, and lock vulnerable transitive dependencies so QA and security gates pass cleanly.
110 lines
2.9 KiB
TypeScript
110 lines
2.9 KiB
TypeScript
import {
|
|
Controller,
|
|
Get,
|
|
Post,
|
|
Patch,
|
|
Delete,
|
|
Body,
|
|
Param,
|
|
Query,
|
|
UseGuards,
|
|
} from "@nestjs/common";
|
|
import { TasksService } from "./tasks.service";
|
|
import { CreateTaskDto, UpdateTaskDto, QueryTasksDto } from "./dto";
|
|
import { AuthGuard } from "../auth/guards/auth.guard";
|
|
import { WorkspaceGuard, PermissionGuard } from "../common/guards";
|
|
import { Workspace, Permission, RequirePermission } from "../common/decorators";
|
|
import { CurrentUser } from "../auth/decorators/current-user.decorator";
|
|
import type { AuthenticatedUser } from "../common/types/user.types";
|
|
|
|
/**
|
|
* Controller for task endpoints
|
|
* All endpoints require authentication and workspace context
|
|
*
|
|
* Guards are applied in order:
|
|
* 1. AuthGuard - Verifies user authentication
|
|
* 2. WorkspaceGuard - Validates workspace access and sets RLS context
|
|
* 3. PermissionGuard - Checks role-based permissions
|
|
*/
|
|
@Controller("tasks")
|
|
@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
|
|
export class TasksController {
|
|
constructor(private readonly tasksService: TasksService) {}
|
|
|
|
/**
|
|
* POST /api/tasks
|
|
* Create a new task
|
|
* Requires: MEMBER role or higher
|
|
*/
|
|
@Post()
|
|
@RequirePermission(Permission.WORKSPACE_MEMBER)
|
|
async create(
|
|
@Body() createTaskDto: CreateTaskDto,
|
|
@Workspace() workspaceId: string,
|
|
@CurrentUser() user: AuthenticatedUser
|
|
) {
|
|
return this.tasksService.create(workspaceId, user.id, createTaskDto);
|
|
}
|
|
|
|
/**
|
|
* GET /api/tasks
|
|
* Get paginated tasks with optional filters
|
|
* Requires: Any workspace member (including GUEST)
|
|
*/
|
|
@Get()
|
|
@RequirePermission(Permission.WORKSPACE_ANY)
|
|
async findAll(
|
|
@Query() query: QueryTasksDto,
|
|
@Workspace() workspaceId: string,
|
|
@CurrentUser() user: AuthenticatedUser
|
|
) {
|
|
return this.tasksService.findAll(Object.assign({}, query, { workspaceId }), user.id);
|
|
}
|
|
|
|
/**
|
|
* GET /api/tasks/:id
|
|
* Get a single task by ID
|
|
* Requires: Any workspace member
|
|
*/
|
|
@Get(":id")
|
|
@RequirePermission(Permission.WORKSPACE_ANY)
|
|
async findOne(
|
|
@Param("id") id: string,
|
|
@Workspace() workspaceId: string,
|
|
@CurrentUser() user: AuthenticatedUser
|
|
) {
|
|
return this.tasksService.findOne(id, workspaceId, user.id);
|
|
}
|
|
|
|
/**
|
|
* PATCH /api/tasks/:id
|
|
* Update a task
|
|
* Requires: MEMBER role or higher
|
|
*/
|
|
@Patch(":id")
|
|
@RequirePermission(Permission.WORKSPACE_MEMBER)
|
|
async update(
|
|
@Param("id") id: string,
|
|
@Body() updateTaskDto: UpdateTaskDto,
|
|
@Workspace() workspaceId: string,
|
|
@CurrentUser() user: AuthenticatedUser
|
|
) {
|
|
return this.tasksService.update(id, workspaceId, user.id, updateTaskDto);
|
|
}
|
|
|
|
/**
|
|
* DELETE /api/tasks/:id
|
|
* Delete a task
|
|
* Requires: ADMIN role or higher
|
|
*/
|
|
@Delete(":id")
|
|
@RequirePermission(Permission.WORKSPACE_ADMIN)
|
|
async remove(
|
|
@Param("id") id: string,
|
|
@Workspace() workspaceId: string,
|
|
@CurrentUser() user: AuthenticatedUser
|
|
) {
|
|
return this.tasksService.remove(id, workspaceId, user.id);
|
|
}
|
|
}
|