From 2028f761f39b1e8790dcf0e74b9cd3ba4e5c61fb Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Mon, 18 Aug 2025 10:19:01 +0000
Subject: [PATCH] Limit SAV ticket creation to administrative roles

Adjust SAV ticket creation permissions on both frontend and backend to restrict the 'employee' role, allowing only 'admin', 'directeur', and 'manager' roles to create tickets.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: f9197b9b-a5b3-4469-a27d-930a9e9ee736
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/f9197b9b-a5b3-4469-a27d-930a9e9ee736/i2gFnxm
---
 client/src/pages/SavTickets.tsx | 3 ++-
 server/routes.ts                | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/src/pages/SavTickets.tsx b/client/src/pages/SavTickets.tsx
index 45bf45e..d1799b2 100644
--- a/client/src/pages/SavTickets.tsx
+++ b/client/src/pages/SavTickets.tsx
@@ -259,6 +259,7 @@ export default function SavTickets() {
 
   // Check permissions AFTER all hooks are called
   const canView = ['admin', 'directeur', 'manager', 'employee'].includes(user?.role || '');
+  const canCreate = ['admin', 'directeur', 'manager'].includes(user?.role || ''); // Employee can only view
   const canModify = ['admin', 'directeur', 'manager'].includes(user?.role || '');
   const canDelete = ['admin', 'directeur'].includes(user?.role || '');
 
@@ -436,7 +437,7 @@ export default function SavTickets() {
           <h1 className="text-2xl sm:text-3xl font-bold text-gray-900">Service Après-Vente</h1>
           <p className="text-gray-600 mt-1">Gestion des tickets SAV et suivi des réparations</p>
         </div>
-        {canModify && (
+        {canCreate && (
           <Dialog open={showCreateModal} onOpenChange={setShowCreateModal}>
             <DialogTrigger asChild>
               <Button className="w-full sm:w-auto">
diff --git a/server/routes.ts b/server/routes.ts
index f04ea4d..85c2289 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -2688,8 +2688,8 @@ RÉSUMÉ DU SCAN
         return res.status(404).json({ message: "User not found" });
       }
 
-      // Check permissions: admin, manager, directeur, employee can create
-      if (!['admin', 'manager', 'directeur', 'employee'].includes(user.role)) {
+      // Check permissions: admin, manager, directeur can create (employee can only view)
+      if (!['admin', 'manager', 'directeur'].includes(user.role)) {
         return res.status(403).json({ message: "Insufficient permissions to create tickets" });
       }