feat: enforce trip membership and role authorization

backend/apps/api/src/trips/trips.controller.ts

@@ -6,22 +6,33 @@ import {
   Param,
   Patch,
   Post,
+  Put,
   UseGuards,
 } from '@nestjs/common';
 import { OidcAuthGuard } from '../../../../libs/auth/src';
 import type { AuthenticatedUser } from '../../../../libs/auth/src';
-import { TripsService } from '../../../../libs/trips/src';
+import {
+  TripMembershipGuard,
+  TripRoles,
+  TripSettingsService,
+  TripsService,
+} from '../../../../libs/trips/src';
 import type {
   CreateTripDto,
   Trip,
+  TripSettings,
   UpdateTripDto,
+  UpdateTripSettingsDto,
 } from '../../../../libs/trips/src';
 import { CurrentUser } from '../auth/current-user.decorator';
 
 @Controller('trips')
 @UseGuards(OidcAuthGuard)
 export class TripsController {
-  constructor(private readonly tripsService: TripsService) {}
+  constructor(
+    private readonly tripsService: TripsService,
+    private readonly tripSettingsService: TripSettingsService,
+  ) {}
 
   @Get()
   list(@CurrentUser() currentUser: AuthenticatedUser): Promise<Trip[]> {
@@ -37,11 +48,14 @@ export class TripsController {
   }
 
   @Get(':tripId')
+  @UseGuards(TripMembershipGuard)
   getOne(@Param('tripId') tripId: string): Promise<Trip> {
     return this.tripsService.getTrip(tripId);
   }
 
   @Patch(':tripId')
+  @UseGuards(TripMembershipGuard)
+  @TripRoles('OWNER')
   update(
     @Param('tripId') tripId: string,
     @Body() dto: UpdateTripDto,
@@ -50,7 +64,25 @@ export class TripsController {
   }
 
   @Delete(':tripId')
+  @UseGuards(TripMembershipGuard)
+  @TripRoles('OWNER')
   remove(@Param('tripId') tripId: string): Promise<void> {
     return this.tripsService.deleteTrip(tripId);
   }
+
+  @Get(':tripId/settings')
+  @UseGuards(TripMembershipGuard)
+  getSettings(@Param('tripId') tripId: string): Promise<TripSettings> {
+    return this.tripSettingsService.getSettings(tripId);
+  }
+
+  @Put(':tripId/settings')
+  @UseGuards(TripMembershipGuard)
+  @TripRoles('OWNER')
+  replaceSettings(
+    @Param('tripId') tripId: string,
+    @Body() dto: UpdateTripSettingsDto,
+  ): Promise<TripSettings> {
+    return this.tripSettingsService.replaceSettings(tripId, dto);
+  }
 }