From 1a218769787b31339a1a385188c7e8d1d23a5529 Mon Sep 17 00:00:00 2001 From: michaelschal <35957947-michaelschal@users.noreply.replit.com> Date: Thu, 21 Aug 2025 11:03:41 +0000 Subject: [PATCH] Grant director access to all orders and refine manager order visibility Update route logic to include 'directeur' role for admin-like access and adjust manager role to display orders from all accessible groups, while enforcing explicit store selection for employees. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 0ec86cdf-a5be-4b0e-84a3-07b926f5cc80 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/0ec86cdf-a5be-4b0e-84a3-07b926f5cc80/PHXoZau --- server/routes.ts | 84 ++++++++++++++++++++++++++++++------------------ 1 file changed, 52 insertions(+), 32 deletions(-) diff --git a/server/routes.ts b/server/routes.ts index 39d4889..0cbd284 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -339,15 +339,15 @@ export async function registerRoutes(app: Express): Promise { console.log('Orders API called with:', { startDate, endDate, storeId, userRole: user.role }); - if (user.role === 'admin') { + if (user.role === 'admin' || user.role === 'directeur') { let groupIds: number[] | undefined; - // If admin selected a specific store, filter by it + // If admin/directeur selected a specific store, filter by it if (storeId) { groupIds = [parseInt(storeId as string)]; - console.log('🔍 Admin orders filtering by store:', { storeId, groupIds }); + console.log('🔍 Admin/Directeur orders filtering by store:', { storeId, groupIds, role: user.role }); } else { - console.log('🔍 Admin orders - showing all stores'); + console.log('🔍 Admin/Directeur orders - showing all stores', { role: user.role }); } // Only filter by date if both startDate and endDate are provided @@ -359,7 +359,7 @@ export async function registerRoutes(app: Express): Promise { orders = await storage.getOrders(groupIds); } } else { - // For all non-admin roles (manager, employee, directeur), filter by their assigned groups + // For manager and employee roles, filter by their assigned groups const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; let groupIds: number[] | undefined; @@ -384,14 +384,24 @@ export async function registerRoutes(app: Express): Promise { return res.json([]); } } else { - // IMPORTANT FIX: For directeur/manager roles, when no specific store is selected, - // return empty result to force explicit store selection - console.log('🔍 Non-admin orders - no store selection, returning empty:', { - userId: user.id, - role: user.role, - userGroups: userGroupIds - }); - return res.json([]); + // For manager role, when no specific store is selected, show orders from all their assigned groups + if (user.role === 'manager') { + groupIds = userGroupIds.length > 0 ? userGroupIds : undefined; + console.log('🔍 Manager orders - showing all accessible stores:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds, + groupIds + }); + } else { + // For employee role, require explicit store selection + console.log('🔍 Employee orders - no store selection, returning empty:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds + }); + return res.json([]); + } } // Only filter by date if both startDate and endDate are provided @@ -425,8 +435,8 @@ export async function registerRoutes(app: Express): Promise { return res.status(404).json({ message: "Order not found" }); } - // Check if user has access to this order (only admin can access all orders) - if (user.role !== 'admin') { + // Check if user has access to this order (admin and directeur can access all orders) + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(order.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -527,7 +537,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to edit orders" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(order.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -562,7 +572,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to delete orders" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(order.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -652,15 +662,15 @@ export async function registerRoutes(app: Express): Promise { console.log('Deliveries API called with:', { startDate, endDate, storeId, withBL, userRole: user.role }); - if (user.role === 'admin') { + if (user.role === 'admin' || user.role === 'directeur') { let groupIds: number[] | undefined; - // If admin selected a specific store, filter by it + // If admin/directeur selected a specific store, filter by it if (storeId) { groupIds = [parseInt(storeId as string)]; - console.log('🔍 Admin deliveries filtering by store:', { storeId, groupIds }); + console.log('🔍 Admin/Directeur deliveries filtering by store:', { storeId, groupIds, role: user.role }); } else { - console.log('🔍 Admin deliveries - showing all stores'); + console.log('🔍 Admin/Directeur deliveries - showing all stores', { role: user.role }); } // Only filter by date if both startDate and endDate are provided @@ -672,7 +682,7 @@ export async function registerRoutes(app: Express): Promise { deliveries = await storage.getDeliveries(groupIds); } } else { - // For non-admin users (managers, employees, directeurs), filter by their assigned groups + // For manager and employee roles, filter by their assigned groups const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; let groupIds: number[] | undefined; @@ -697,14 +707,24 @@ export async function registerRoutes(app: Express): Promise { return res.json([]); } } else { - // IMPORTANT FIX: For directeur/manager roles, when no specific store is selected, - // return empty result to force explicit store selection - console.log('🔍 Non-admin deliveries - no store selection, returning empty:', { - userId: user.id, - role: user.role, - userGroups: userGroupIds - }); - return res.json([]); + // For manager role, when no specific store is selected, show deliveries from all their assigned groups + if (user.role === 'manager') { + groupIds = userGroupIds.length > 0 ? userGroupIds : undefined; + console.log('🔍 Manager deliveries - showing all accessible stores:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds, + groupIds + }); + } else { + // For employee role, require explicit store selection + console.log('🔍 Employee deliveries - no store selection, returning empty:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds + }); + return res.json([]); + } } // Only filter by date if both startDate and endDate are provided @@ -777,7 +797,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to edit deliveries" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(delivery.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -943,7 +963,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to delete deliveries" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(delivery.groupId)) { return res.status(403).json({ message: "Access denied" });