feature: a minimal implementation of staff management is done.

backend/src/modules/staff/staff.controller.ts

@@ -0,0 +1,62 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Req,
+  UseGuards,
+} from '@nestjs/common';
+import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { InviteStaffDto } from './dto/invite-staff.dto';
+import { UpdateStaffMemberDto } from './dto/update-staff-member.dto';
+import { StaffService } from './staff.service';
+
+@ApiTags('staff')
+@ApiBearerAuth('JWT-auth')
+@UseGuards(JwtAuthGuard)
+@Controller('staff')
+export class StaffController {
+  constructor(private readonly staffService: StaffService) {}
+
+  @Get()
+  @ApiOperation({ summary: 'List organization members (requires TAB_STAFF_READ or owner)' })
+  list(@Req() req: { user: { id: string; organizationId?: string } }) {
+    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
+    return this.staffService.list(req.user.id, organizationId);
+  }
+
+  @Post('invite')
+  @ApiOperation({ summary: 'Invite staff (requires TAB_STAFF_EDIT or owner)' })
+  invite(
+    @Req() req: { user: { id: string; organizationId?: string } },
+    @Body() dto: InviteStaffDto,
+  ) {
+    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
+    return this.staffService.invite(req.user.id, organizationId, dto);
+  }
+
+  @Patch('members/:membershipId')
+  @ApiOperation({ summary: 'Update staff member name and/or permissions' })
+  updateMember(
+    @Req() req: { user: { id: string; organizationId?: string } },
+    @Param('membershipId') membershipId: string,
+    @Body() dto: UpdateStaffMemberDto,
+  ) {
+    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
+    return this.staffService.updateMember(req.user.id, organizationId, membershipId, dto);
+  }
+
+  @Delete('members/:membershipId')
+  @ApiOperation({ summary: 'Remove staff member from organization' })
+  removeMember(
+    @Req() req: { user: { id: string; organizationId?: string } },
+    @Param('membershipId') membershipId: string,
+  ) {
+    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
+    return this.staffService.removeMember(req.user.id, organizationId, membershipId);
+  }
+}