From 1a218769787b31339a1a385188c7e8d1d23a5529 Mon Sep 17 00:00:00 2001 From: michaelschal <35957947-michaelschal@users.noreply.replit.com> Date: Thu, 21 Aug 2025 11:03:41 +0000 Subject: [PATCH 1/2] Grant director access to all orders and refine manager order visibility Update route logic to include 'directeur' role for admin-like access and adjust manager role to display orders from all accessible groups, while enforcing explicit store selection for employees. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 0ec86cdf-a5be-4b0e-84a3-07b926f5cc80 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/0ec86cdf-a5be-4b0e-84a3-07b926f5cc80/PHXoZau --- server/routes.ts | 84 ++++++++++++++++++++++++++++++------------------ 1 file changed, 52 insertions(+), 32 deletions(-) diff --git a/server/routes.ts b/server/routes.ts index 39d4889..0cbd284 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -339,15 +339,15 @@ export async function registerRoutes(app: Express): Promise { console.log('Orders API called with:', { startDate, endDate, storeId, userRole: user.role }); - if (user.role === 'admin') { + if (user.role === 'admin' || user.role === 'directeur') { let groupIds: number[] | undefined; - // If admin selected a specific store, filter by it + // If admin/directeur selected a specific store, filter by it if (storeId) { groupIds = [parseInt(storeId as string)]; - console.log('🔍 Admin orders filtering by store:', { storeId, groupIds }); + console.log('🔍 Admin/Directeur orders filtering by store:', { storeId, groupIds, role: user.role }); } else { - console.log('🔍 Admin orders - showing all stores'); + console.log('🔍 Admin/Directeur orders - showing all stores', { role: user.role }); } // Only filter by date if both startDate and endDate are provided @@ -359,7 +359,7 @@ export async function registerRoutes(app: Express): Promise { orders = await storage.getOrders(groupIds); } } else { - // For all non-admin roles (manager, employee, directeur), filter by their assigned groups + // For manager and employee roles, filter by their assigned groups const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; let groupIds: number[] | undefined; @@ -384,14 +384,24 @@ export async function registerRoutes(app: Express): Promise { return res.json([]); } } else { - // IMPORTANT FIX: For directeur/manager roles, when no specific store is selected, - // return empty result to force explicit store selection - console.log('🔍 Non-admin orders - no store selection, returning empty:', { - userId: user.id, - role: user.role, - userGroups: userGroupIds - }); - return res.json([]); + // For manager role, when no specific store is selected, show orders from all their assigned groups + if (user.role === 'manager') { + groupIds = userGroupIds.length > 0 ? userGroupIds : undefined; + console.log('🔍 Manager orders - showing all accessible stores:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds, + groupIds + }); + } else { + // For employee role, require explicit store selection + console.log('🔍 Employee orders - no store selection, returning empty:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds + }); + return res.json([]); + } } // Only filter by date if both startDate and endDate are provided @@ -425,8 +435,8 @@ export async function registerRoutes(app: Express): Promise { return res.status(404).json({ message: "Order not found" }); } - // Check if user has access to this order (only admin can access all orders) - if (user.role !== 'admin') { + // Check if user has access to this order (admin and directeur can access all orders) + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(order.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -527,7 +537,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to edit orders" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(order.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -562,7 +572,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to delete orders" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(order.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -652,15 +662,15 @@ export async function registerRoutes(app: Express): Promise { console.log('Deliveries API called with:', { startDate, endDate, storeId, withBL, userRole: user.role }); - if (user.role === 'admin') { + if (user.role === 'admin' || user.role === 'directeur') { let groupIds: number[] | undefined; - // If admin selected a specific store, filter by it + // If admin/directeur selected a specific store, filter by it if (storeId) { groupIds = [parseInt(storeId as string)]; - console.log('🔍 Admin deliveries filtering by store:', { storeId, groupIds }); + console.log('🔍 Admin/Directeur deliveries filtering by store:', { storeId, groupIds, role: user.role }); } else { - console.log('🔍 Admin deliveries - showing all stores'); + console.log('🔍 Admin/Directeur deliveries - showing all stores', { role: user.role }); } // Only filter by date if both startDate and endDate are provided @@ -672,7 +682,7 @@ export async function registerRoutes(app: Express): Promise { deliveries = await storage.getDeliveries(groupIds); } } else { - // For non-admin users (managers, employees, directeurs), filter by their assigned groups + // For manager and employee roles, filter by their assigned groups const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; let groupIds: number[] | undefined; @@ -697,14 +707,24 @@ export async function registerRoutes(app: Express): Promise { return res.json([]); } } else { - // IMPORTANT FIX: For directeur/manager roles, when no specific store is selected, - // return empty result to force explicit store selection - console.log('🔍 Non-admin deliveries - no store selection, returning empty:', { - userId: user.id, - role: user.role, - userGroups: userGroupIds - }); - return res.json([]); + // For manager role, when no specific store is selected, show deliveries from all their assigned groups + if (user.role === 'manager') { + groupIds = userGroupIds.length > 0 ? userGroupIds : undefined; + console.log('🔍 Manager deliveries - showing all accessible stores:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds, + groupIds + }); + } else { + // For employee role, require explicit store selection + console.log('🔍 Employee deliveries - no store selection, returning empty:', { + userId: user.id, + role: user.role, + userGroups: userGroupIds + }); + return res.json([]); + } } // Only filter by date if both startDate and endDate are provided @@ -777,7 +797,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to edit deliveries" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(delivery.groupId)) { return res.status(403).json({ message: "Access denied" }); @@ -943,7 +963,7 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions to delete deliveries" }); } - if (user.role !== 'admin') { + if (user.role !== 'admin' && user.role !== 'directeur') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(delivery.groupId)) { return res.status(403).json({ message: "Access denied" }); From 172541c2b7bffcaa921708672f219dea9f79b222 Mon Sep 17 00:00:00 2001 From: michaelschal <35957947-michaelschal@users.noreply.replit.com> Date: Thu, 21 Aug 2025 11:10:06 +0000 Subject: [PATCH 2/2] Make managers see orders from their assigned store automatically Update manager role logic in routes.ts to automatically use the first assigned store for orders and deliveries, and handle cases where no stores are assigned. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 0ec86cdf-a5be-4b0e-84a3-07b926f5cc80 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/0ec86cdf-a5be-4b0e-84a3-07b926f5cc80/PHXoZau --- server/routes.ts | 48 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 32 insertions(+), 16 deletions(-) diff --git a/server/routes.ts b/server/routes.ts index 0cbd284..87fbf0b 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -384,15 +384,23 @@ export async function registerRoutes(app: Express): Promise { return res.json([]); } } else { - // For manager role, when no specific store is selected, show orders from all their assigned groups + // For manager role, automatically use their assigned store if (user.role === 'manager') { - groupIds = userGroupIds.length > 0 ? userGroupIds : undefined; - console.log('🔍 Manager orders - showing all accessible stores:', { - userId: user.id, - role: user.role, - userGroups: userGroupIds, - groupIds - }); + if (userGroupIds.length > 0) { + groupIds = [userGroupIds[0]]; // Use first assigned store automatically + console.log('🔍 Manager orders - using assigned store automatically:', { + userId: user.id, + role: user.role, + assignedStore: userGroupIds[0], + allUserGroups: userGroupIds + }); + } else { + console.log('🚫 Manager has no assigned stores:', { + userId: user.id, + role: user.role + }); + return res.json([]); + } } else { // For employee role, require explicit store selection console.log('🔍 Employee orders - no store selection, returning empty:', { @@ -707,15 +715,23 @@ export async function registerRoutes(app: Express): Promise { return res.json([]); } } else { - // For manager role, when no specific store is selected, show deliveries from all their assigned groups + // For manager role, automatically use their assigned store if (user.role === 'manager') { - groupIds = userGroupIds.length > 0 ? userGroupIds : undefined; - console.log('🔍 Manager deliveries - showing all accessible stores:', { - userId: user.id, - role: user.role, - userGroups: userGroupIds, - groupIds - }); + if (userGroupIds.length > 0) { + groupIds = [userGroupIds[0]]; // Use first assigned store automatically + console.log('🔍 Manager deliveries - using assigned store automatically:', { + userId: user.id, + role: user.role, + assignedStore: userGroupIds[0], + allUserGroups: userGroupIds + }); + } else { + console.log('🚫 Manager has no assigned stores:', { + userId: user.id, + role: user.role + }); + return res.json([]); + } } else { // For employee role, require explicit store selection console.log('🔍 Employee deliveries - no store selection, returning empty:', {