feat: secure penalty catalog management

myteamwallet_backend/src/penalty/penalty.controller.ts

@@ -1,45 +1,62 @@
 import {
   Body,
   Controller,
+  Delete,
   Get,
+  HttpCode,
+  HttpStatus,
   Param,
+  ParseIntPipe,
+  Patch,
   Post,
-  Req,
+  Request,
   UseGuards,
 } from '@nestjs/common';
 import { AuthGuard } from '@nestjs/passport';
 import { ApiBearerAuth } from '@nestjs/swagger';
-import { Roles } from 'src/roles/roles.decorator';
-import { RolesGuard } from 'src/roles/roles.guard';
 import { CreatePenaltyDTO } from './dto/create-penalty.dto';
+import { UpdatePenaltyDTO } from './dto/update-penalty.dto';
 import { PenaltyService } from './penalty.service';
 
+type AuthenticatedRequest = { user: { id: number } };
+
 @ApiBearerAuth()
-@Controller({
-  path: 'penalty',
-  version: '1',
-})
+@UseGuards(AuthGuard('jwt'))
+@Controller({ path: 'penalty', version: '1' })
 export class PenaltyController {
-  constructor(private service: PenaltyService) {}
+  constructor(private readonly service: PenaltyService) {}
 
-  @Roles([])
-  @Get()
-  getIt(@Req() req: any) {
-    const userId = req.user?.id;
-    return this.service.getAll(userId);
+  @Get(':teamId')
+  getTeamPenalties(
+    @Request() request: AuthenticatedRequest,
+    @Param('teamId', ParseIntPipe) teamId: number,
+  ) {
+    return this.service.getTeamPenalties(request.user.id, teamId);
   }
 
-  @Roles([])
-  @UseGuards(AuthGuard('jwt'), RolesGuard)
-  @Get(':id')
-  getTeams(@Param('id') teamId: string) {
-    return this.service.getTeamPenalties(teamId);
-  }
-
-  @UseGuards(AuthGuard('jwt'), RolesGuard)
   @Post()
-  createPenalty(@Req() req: any, @Body() createPenaltyDto: CreatePenaltyDTO) {
-    const userId = req.user?.id;
-    return this.service.createPenalty(createPenaltyDto, userId);
+  createPenalty(
+    @Request() request: AuthenticatedRequest,
+    @Body() dto: CreatePenaltyDTO,
+  ) {
+    return this.service.createPenalty(dto, request.user.id);
+  }
+
+  @Patch(':penaltyId')
+  updatePenalty(
+    @Request() request: AuthenticatedRequest,
+    @Param('penaltyId', ParseIntPipe) penaltyId: number,
+    @Body() dto: UpdatePenaltyDTO,
+  ) {
+    return this.service.updatePenalty(penaltyId, dto, request.user.id);
+  }
+
+  @Delete(':penaltyId')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  async deletePenalty(
+    @Request() request: AuthenticatedRequest,
+    @Param('penaltyId', ParseIntPipe) penaltyId: number,
+  ): Promise<void> {
+    await this.service.deletePenalty(penaltyId, request.user.id);
   }
 }