From 510a62915bfbabe0b2d330d225a11a995da6cdb3 Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Wed, 3 Sep 2025 08:40:25 +0000
Subject: [PATCH] Restrict director access to assigned groups only

Update route protection logic to ensure directors can only access deliveries within their assigned groups.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 28b81ac1-a55f-409c-b6a9-88ad420d8a9a
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/28b81ac1-a55f-409c-b6a9-88ad420d8a9a/6PoDWd4
---
 server/routes.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/routes.ts b/server/routes.ts
index eb6c5cf..da5aade 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -1022,7 +1022,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(403).json({ message: "Insufficient permissions" });
       }
 
-      if (user.role !== 'admin' && user.role !== 'directeur') {
+      if (user.role !== 'admin') {
         const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || [];
         if (!userGroupIds.includes(delivery.groupId)) {
           return res.status(403).json({ message: "Access denied to this group" });