From 2690c4f7df73eaa06999766915e15a9880745e1e Mon Sep 17 00:00:00 2001
From: Charles Pizzato <311327716+modernitconsultants@users.noreply.github.com>
Date: Thu, 13 Aug 2026 10:49:30 +1000
Subject: [PATCH] feat(ical): allow revenue_manager to list, read and sync
 feeds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every iCal route required admin. A scheduler that keeps import feeds fresh
(hourly cron pulling OTA calendar exports) then has to hold admin
credentials permanently — the broadest role in the realm for the most
routine job in the system.

This widens exactly three routes to revenue_manager: feed list, feed read,
feed sync. Create, update, delete and rotate-token stay admin-only — a
scheduler needs to trigger and observe, not manage.
---
 apps/api/src/modules/ical/ical.controller.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/api/src/modules/ical/ical.controller.ts b/apps/api/src/modules/ical/ical.controller.ts
index 0bb1df82..ee5657ca 100644
--- a/apps/api/src/modules/ical/ical.controller.ts
+++ b/apps/api/src/modules/ical/ical.controller.ts
@@ -53,14 +53,14 @@ export class IcalController {
   }
 
   @Get('feeds')
-  @Roles('admin')
+  @Roles('admin', 'revenue_manager')
   @ApiOperation({ summary: 'List iCal feeds for a property' })
   listFeeds(@Query() dto: ListIcalFeedsDto) {
     return this.icalService.list(dto);
   }
 
   @Get('feeds/:id')
-  @Roles('admin')
+  @Roles('admin', 'revenue_manager')
   @ApiOperation({ summary: 'Get an iCal feed' })
   @ApiQuery({ name: 'propertyId', required: true })
   getFeed(
@@ -94,7 +94,7 @@ export class IcalController {
   }
 
   @Post('feeds/:id/sync')
-  @Roles('admin')
+  @Roles('admin', 'revenue_manager')
   @ApiOperation({ summary: 'Fetch an import feed and replace its busy blocks' })
   @ApiQuery({ name: 'propertyId', required: true })
   syncFeed(