diff --git a/attached_assets/{8C9A60B2-DD64-429F-B9FF-7B9F1598B3D8}_1756890188902.png b/attached_assets/{8C9A60B2-DD64-429F-B9FF-7B9F1598B3D8}_1756890188902.png new file mode 100644 index 0000000..094711b Binary files /dev/null and b/attached_assets/{8C9A60B2-DD64-429F-B9FF-7B9F1598B3D8}_1756890188902.png differ diff --git a/server/routes.ts b/server/routes.ts index 2d8ac6c..f853f47 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -1038,11 +1038,26 @@ export async function registerRoutes(app: Express): Promise { return res.status(403).json({ message: "Insufficient permissions" }); } + // Admin has access to all deliveries, others must be in the same group if (user.role !== 'admin') { const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || []; if (!userGroupIds.includes(delivery.groupId)) { + console.log('🚫 Access denied - User groups check:', { + userId: user.id, + userRole: user.role, + userGroupIds, + deliveryGroupId: delivery.groupId, + deliverySupplier: delivery.supplier?.name + }); return res.status(403).json({ message: "Access denied to this group" }); } + } else { + console.log('✅ Admin access granted for delivery:', { + userId: user.id, + deliveryId: delivery.id, + deliveryGroupId: delivery.groupId, + deliverySupplier: delivery.supplier?.name + }); } const { invoiceReference, blNumber, forceRefresh } = req.body;