From 01b3e8288ea863e5c3f6cf9b96b463d9f4a4e853 Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Mon, 8 Sep 2025 20:58:20 +0000
Subject: [PATCH 1/4] Restrict file uploads and status changes for managers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prevent managers from uploading files for 'Reçu' status and sending files via webhook.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869/7eY9Hl8
---
 client/src/pages/Avoirs.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/pages/Avoirs.tsx b/client/src/pages/Avoirs.tsx
index 6bf4ee4..18eac56 100644
--- a/client/src/pages/Avoirs.tsx
+++ b/client/src/pages/Avoirs.tsx
@@ -1024,8 +1024,8 @@ export default function Avoirs() {
                 </td>
                 <td className="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
                   <div className="flex items-center space-x-2">
-                    {/* Upload pour avoirs "Reçu" */}
-                    {avoir?.status === 'Reçu' && (
+                    {/* Upload pour avoirs "Reçu" - interdit aux managers */}
+                    {avoir?.status === 'Reçu' && (user as any)?.role !== 'manager' && (
                       <Button
                         variant="outline"
                         size="sm"

From ee5c1226643b20aee6b907406f77430115e00a9f Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Mon, 8 Sep 2025 20:58:58 +0000
Subject: [PATCH 2/4] Restrict managers from changing status and uploading
 files via webhooks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prevent 'manager' role users from setting 'avoir' status to 'Reçu'. Modify SelectItem visibility in Avoirs.tsx to conditionally render the 'Reçu' option based on user role.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869/7eY9Hl8
---
 client/src/pages/Avoirs.tsx | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/client/src/pages/Avoirs.tsx b/client/src/pages/Avoirs.tsx
index 18eac56..5e86732 100644
--- a/client/src/pages/Avoirs.tsx
+++ b/client/src/pages/Avoirs.tsx
@@ -446,6 +446,16 @@ export default function Avoirs() {
 
   // Handle status change
   const handleStatusChange = (avoirId: number, newStatus: string) => {
+    // Empêcher les managers de mettre le statut en "Reçu"
+    if ((user as any)?.role === 'manager' && newStatus === 'Reçu') {
+      toast({
+        title: "Accès refusé",
+        description: "Vous n'avez pas les permissions pour marquer un avoir comme reçu",
+        variant: "destructive",
+      });
+      return;
+    }
+
     const avoir = avoirs?.find(a => a?.id === avoirId);
     if (avoir && avoir.supplierId && avoir.groupId) {
       editAvoirMutation.mutate({ 
@@ -969,7 +979,9 @@ export default function Avoirs() {
                     <SelectContent>
                       <SelectItem value="En attente de demande">En attente de demande</SelectItem>
                       <SelectItem value="Demandé">Demandé</SelectItem>
-                      <SelectItem value="Reçu">Reçu</SelectItem>
+                      {(user as any)?.role !== 'manager' && (
+                        <SelectItem value="Reçu">Reçu</SelectItem>
+                      )}
                     </SelectContent>
                   </Select>
                 </td>

From 6631ece2abb8481046d40b0df39bc3908d707e4f Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Mon, 8 Sep 2025 20:59:38 +0000
Subject: [PATCH 3/4] Set default group based on user role for task creation

Adjusted the default `groupId` in the Avoirs form. If the user is an 'admin', it defaults to `1`. Otherwise, it defaults to the first `groupId` associated with the user's `userGroups`, or `0` if none are assigned. This change is implemented in `client/src/pages/Avoirs.tsx`.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869/7eY9Hl8
---
 client/src/pages/Avoirs.tsx | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/client/src/pages/Avoirs.tsx b/client/src/pages/Avoirs.tsx
index 5e86732..bf3a3a4 100644
--- a/client/src/pages/Avoirs.tsx
+++ b/client/src/pages/Avoirs.tsx
@@ -356,12 +356,24 @@ export default function Avoirs() {
     }
   });
 
+  // Calculate default group ID based on user role
+  const getDefaultGroupId = () => {
+    if ((user as any)?.role === 'admin') {
+      // Admin : groupe 1 par défaut
+      return 1;
+    } else {
+      // Utilisateurs : leur groupe assigné par défaut
+      const userGroupIds = (user as any)?.userGroups?.map((ug: any) => ug.groupId) || [];
+      return userGroupIds.length > 0 ? userGroupIds[0] : 0;
+    }
+  };
+
   // Initialize create form
   const form = useForm<AvoirFormData>({
     resolver: zodResolver(avoirSchema),
     defaultValues: {
       supplierId: 0,
-      groupId: 0,
+      groupId: getDefaultGroupId(),
       invoiceReference: "",
       amount: undefined,
       comment: "",

From 45772a4fe023eac3a38766ff531f6e948cab69bc Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Mon, 8 Sep 2025 20:59:58 +0000
Subject: [PATCH 4/4] Restrict manager webhook uploads and status updates, set
 default groups

Refactor webhook controller and role-based access control to prevent managers from uploading files and setting status to 'received'. Update modal logic to assign the default group based on user role (assigned group for managers, group 1 for admins).

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869/7eY9Hl8