Restrict employee access to orders and deliveries while fixing supplier visibility

Fixes bugs that prevented employees from viewing supplier lists and restricted their access to order and delivery creation functionalities.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: b163d4c0-de5e-4f4e-a9c0-aed4c7049718
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/b163d4c0-de5e-4f4e-a9c0-aed4c7049718/9RgkyCi

server/routes.ts

@@ -188,7 +188,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
   app.get('/api/suppliers', isAuthenticated, async (req: any, res) => {
     try {
       const user = await storage.getUser(req.user.claims ? req.user.claims.sub : req.user.id);
-      if (!user || (user.role !== 'admin' && user.role !== 'manager')) {
+      if (!user || (user.role !== 'admin' && user.role !== 'manager' && user.role !== 'directeur' && user.role !== 'employee')) {
         return res.status(403).json({ message: "Insufficient permissions" });
       }
 
@@ -237,8 +237,8 @@ export async function registerRoutes(app: Express): Promise<Server> {
       console.log('✅ User found:', { username: user.username, role: user.role });
       
       // Vérifier les permissions
-      if (user.role !== 'admin' && user.role !== 'manager') {
-        console.error('❌ Insufficient permissions:', { userRole: user.role, required: ['admin', 'manager'] });
+      if (user.role !== 'admin' && user.role !== 'manager' && user.role !== 'directeur') {
+        console.error('❌ Insufficient permissions:', { userRole: user.role, required: ['admin', 'manager', 'directeur'] });
         return res.status(403).json({ message: "Insufficient permissions" });
       }
       
@@ -279,7 +279,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
   app.put('/api/suppliers/:id', isAuthenticated, async (req: any, res) => {
     try {
       const user = await storage.getUser(req.user.claims ? req.user.claims.sub : req.user.id);
-      if (!user || (user.role !== 'admin' && user.role !== 'manager')) {
+      if (!user || (user.role !== 'admin' && user.role !== 'manager' && user.role !== 'directeur')) {
         return res.status(403).json({ message: "Insufficient permissions" });
       }
 
@@ -296,7 +296,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
   app.delete('/api/suppliers/:id', isAuthenticated, async (req: any, res) => {
     try {
       const user = await storage.getUser(req.user.claims ? req.user.claims.sub : req.user.id);
-      if (!user || (user.role !== 'admin' && user.role !== 'manager')) {
+      if (!user || (user.role !== 'admin' && user.role !== 'directeur')) {
         return res.status(403).json({ message: "Insufficient permissions" });
       }