diff --git a/attached_assets/{29BD8749-1C84-4FD4-A3F3-A8546D5534B7}_1755005668941.png b/attached_assets/{29BD8749-1C84-4FD4-A3F3-A8546D5534B7}_1755005668941.png
new file mode 100644
index 0000000..532f2bd
Binary files /dev/null and b/attached_assets/{29BD8749-1C84-4FD4-A3F3-A8546D5534B7}_1755005668941.png differ
diff --git a/server/routes.ts b/server/routes.ts
index 6d9291e..442a43c 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -2,7 +2,7 @@ import type { Express } from "express";
 import { createServer, type Server } from "http";
 import { storage } from "./storage";
 import { setupLocalAuth, requireAuth } from "./localAuth";
-import { requireModulePermission, requireAdmin } from "./permissions";
+import { requireModulePermission, requireAdmin, requirePermission } from "./permissions";
 import { db, pool } from "./db";
 
 console.log('🔍 Using development storage and authentication');
@@ -1928,7 +1928,7 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.post('/api/customer-orders', isAuthenticated, async (req: any, res) => {
+  app.post('/api/customer-orders', isAuthenticated, requirePermission('customer-orders', 'create'), async (req: any, res) => {
     try {
       console.log("Raw body received:", req.body);
       console.log("Body type:", typeof req.body);
@@ -1965,7 +1965,7 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.put('/api/customer-orders/:id', isAuthenticated, async (req: any, res) => {
+  app.put('/api/customer-orders/:id', isAuthenticated, requirePermission('customer-orders', 'edit'), async (req: any, res) => {
     try {
       const id = parseInt(req.params.id);
       const userId = req.user.claims ? req.user.claims.sub : req.user.id;
@@ -1996,7 +1996,7 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.delete('/api/customer-orders/:id', isAuthenticated, async (req: any, res) => {
+  app.delete('/api/customer-orders/:id', isAuthenticated, requirePermission('customer-orders', 'delete'), async (req: any, res) => {
     try {
       const id = parseInt(req.params.id);
       const userId = req.user.claims ? req.user.claims.sub : req.user.id;
@@ -2011,10 +2011,7 @@ RÉSUMÉ DU SCAN
         return res.status(404).json({ message: "Customer order not found" });
       }
 
-      // Check permissions using the shared permission system
-      if (!hasPermission(user.role, 'customer-orders', 'delete')) {
-        return res.status(403).json({ message: "Insufficient permissions to delete customer orders" });
-      }
+      // Permission already checked by middleware
 
       await storage.deleteCustomerOrder(id);
       res.status(204).send();