Put it all together
The service and the guard are done. Write the controller that exposes them: the right routes and status codes, parsed and validated params, a filter that rejects nonsense, and guards exactly where they belong.
Plan the routes
Before typing, list each route with its method, input, guard and success status. This table is effectively your API contract, and it makes the controller almost mechanical to write. It also shows at a glance which routes are public and which need staff — exactly the kind of thing a reviewer will check.
- GET /orders?status= — public; 400 for an unknown status; 200.
- GET /orders/:id — public; ParseIntPipe; 404 if missing.
- POST /orders — StaffGuard; body is a CreateOrderDto; 201.
- PATCH /orders/:id/advance — StaffGuard (kitchen); @HttpCode(200).
Apply the guard per method with @UseGuards(StaffGuard). Putting it on the class would lock customers out of reading orders.