Grant employees permission to create and manage customer orders

Implement role-based access control for customer order creation, editing, and deletion, resolving permission issues for employee roles.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: b163d4c0-de5e-4f4e-a9c0-aed4c7049718
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/b163d4c0-de5e-4f4e-a9c0-aed4c7049718/2frIorO

server/routes.ts

@@ -2,7 +2,7 @@ import type { Express } from "express";
 import { createServer, type Server } from "http";
 import { storage } from "./storage";
 import { setupLocalAuth, requireAuth } from "./localAuth";
-import { requireModulePermission, requireAdmin } from "./permissions";
+import { requireModulePermission, requireAdmin, requirePermission } from "./permissions";
 import { db, pool } from "./db";
 
 console.log('🔍 Using development storage and authentication');
@@ -1928,7 +1928,7 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.post('/api/customer-orders', isAuthenticated, async (req: any, res) => {
+  app.post('/api/customer-orders', isAuthenticated, requirePermission('customer-orders', 'create'), async (req: any, res) => {
     try {
       console.log("Raw body received:", req.body);
       console.log("Body type:", typeof req.body);
@@ -1965,7 +1965,7 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.put('/api/customer-orders/:id', isAuthenticated, async (req: any, res) => {
+  app.put('/api/customer-orders/:id', isAuthenticated, requirePermission('customer-orders', 'edit'), async (req: any, res) => {
     try {
       const id = parseInt(req.params.id);
       const userId = req.user.claims ? req.user.claims.sub : req.user.id;
@@ -1996,7 +1996,7 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.delete('/api/customer-orders/:id', isAuthenticated, async (req: any, res) => {
+  app.delete('/api/customer-orders/:id', isAuthenticated, requirePermission('customer-orders', 'delete'), async (req: any, res) => {
     try {
       const id = parseInt(req.params.id);
       const userId = req.user.claims ? req.user.claims.sub : req.user.id;
@@ -2011,10 +2011,7 @@ RÉSUMÉ DU SCAN
         return res.status(404).json({ message: "Customer order not found" });
       }
 
-      // Check permissions using the shared permission system
-      if (!hasPermission(user.role, 'customer-orders', 'delete')) {
-        return res.status(403).json({ message: "Insufficient permissions to delete customer orders" });
-      }
+      // Permission already checked by middleware
 
       await storage.deleteCustomerOrder(id);
       res.status(204).send();