Merge pull request #312 from R0m1k3/1.1

1.1

server/routes.ts

@@ -1645,6 +1645,11 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "User not found" });
       }
 
+      // Check permissions for creating tasks
+      if (!hasPermission(user.role, 'tasks', 'create')) {
+        return res.status(403).json({ message: "Permission denied: cannot create tasks" });
+      }
+
       const data = {
         ...req.body,
         createdBy: user.id,

shared/permissions.ts

@@ -80,11 +80,11 @@ const PERMISSIONS: Record<Module, Record<Role, Permission[]>> = {
     employee: ['view', 'create']
   },
 
-  // Tâches - Admin/Directeur tout, Manager view + validate, Employé view seulement
+  // Tâches - Admin/Directeur tout, Manager view + create + edit + validate, Employé view seulement
   tasks: {
     admin: ['view', 'create', 'edit', 'delete', 'validate'],
     directeur: ['view', 'create', 'edit', 'delete', 'validate'],
-    manager: ['view', 'validate'],
+    manager: ['view', 'create', 'edit', 'validate'],
     employee: ['view']
   }
 };