feat(ato): Add AtoCreationGuard to restrict ATO creation for CAOC and…

apps/pac-shield-api/src/app/ato/ato.controller.ts

@@ -16,6 +16,7 @@ import { CreateATORequestDto } from './dto/create-ato-request.dto';
 import { UpdateATORequestDto } from './dto/update-ato-request.dto';
 import { ATOLine } from '../generated/aTOLine/aTOLine.entity';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { AtoCreationGuard } from '../auth/ato-creation.guard';
 import { AircraftInstance } from '@prisma/client';
 import { GetAtoQueryDto } from './dto/get-ato-query.dto';
 
@@ -73,6 +74,7 @@ export class AtoController {
    * @example POST /ato
    */
   @Post()
+  @UseGuards(AtoCreationGuard)
   async createFlightPlan(
     @Body() createAtoRequestDto: CreateATORequestDto,
     @Request() req: any

apps/pac-shield-api/src/app/ato/ato.module.ts

@@ -2,6 +2,7 @@ import { Module, forwardRef } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { AtoController } from './ato.controller';
 import { AtoService } from './ato.service';
+import { AtoCreationGuard } from '../auth/ato-creation.guard';
 import { PrismaModule } from '../../prisma/prisma.module';
 import { GameModule } from '../../game/game.module';
 import { AuthModule } from '../../auth/auth.module';
@@ -20,7 +21,7 @@ import { AuthModule } from '../../auth/auth.module';
     }),
   ],
   controllers: [AtoController],
-  providers: [AtoService],
+  providers: [AtoService, AtoCreationGuard],
   exports: [AtoService],
 })
 export class AtoModule {}

apps/pac-shield-api/src/app/auth/ato-creation.guard.ts

@@ -0,0 +1,50 @@
+import { Injectable, CanActivate, ExecutionContext, ForbiddenException, NotFoundException } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { PlayerRole } from '@prisma/client';
+
+/**
+ * Guard that prevents CAOC and CSpOC team members from creating Air Tasking Orders (ATOs).
+ * - Allows Game Masters to bypass the restriction
+ * - Blocks players whose team.type === 'CAOC' or 'CSPOC'
+ * - Allows all other team types to create ATOs
+ */
+@Injectable()
+export class AtoCreationGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user;
+
+    const candidate = user?.sub ?? user?.playerId;
+    if (candidate == null) {
+      throw new ForbiddenException('Authentication required to create Air Tasking Orders');
+    }
+
+    // Resolve player by numeric id (preferred) or by sessionId as a fallback
+    const candidateStr = String(candidate);
+    const isNumericId = /^\d+$/.test(candidateStr);
+    const player = await this.prisma.player.findUnique({
+      where: isNumericId ? { id: Number(candidateStr) } : { sessionId: candidateStr },
+      include: { team: true }
+    });
+
+    if (!player) {
+      throw new NotFoundException('Player not found');
+    }
+
+    // Allow GMs to create ATOs for any team
+    if (player.role === PlayerRole.GM) {
+      return true;
+    }
+
+    // Block CAOC and CSPOC team members
+    if (player.team?.type === 'CSPOC' || player.team?.type === 'CAOC') {
+      throw new ForbiddenException(
+        'CAOC and CSpOC team members cannot create Air Tasking Orders'
+      );
+    }
+
+    return true;
+  }
+}

apps/pac-shield/src/app/features/game/dialogs/aircraft-request/aircraft-request-dialog.component.ts

@@ -1,3 +1,8 @@
+/**
+ * @deprecated This dialog is no longer used in the MOB workflow.
+ * CAOC now distributes aircraft directly without MOB requests.
+ * Kept for potential future use or reference.
+ */
 import { Component, OnInit, OnDestroy, inject } from '@angular/core';
 import { CommonModule } from '@angular/common';
 import { ReactiveFormsModule, FormBuilder, FormGroup, Validators } from '@angular/forms';