From 61c002f8be8907463ff448b743d89707a7e527c8 Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Tue, 12 Aug 2025 13:56:48 +0000
Subject: [PATCH] Improve order and delivery management with refined user
 permissions

Update routes in server/routes.ts to implement granular role-based access control for editing, deleting, and validating orders and deliveries using the `hasPermission` function, addressing permission issues for users attempting these actions.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: b163d4c0-de5e-4f4e-a9c0-aed4c7049718
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/b163d4c0-de5e-4f4e-a9c0-aed4c7049718/KcBoGui
---
 server/routes.ts | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/server/routes.ts b/server/routes.ts
index ce0c5b4..afdea82 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -474,9 +474,13 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "Order not found" });
       }
 
-      // Check permissions
+      // Check edit permissions using the shared permission system
+      if (!hasPermission(user.role, 'orders', 'edit')) {
+        return res.status(403).json({ message: "Insufficient permissions to edit orders" });
+      }
+
       if (user.role !== 'admin') {
-        const userGroupIds = user.userGroups.map(ug => ug.groupId);
+        const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || [];
         if (!userGroupIds.includes(order.groupId)) {
           return res.status(403).json({ message: "Access denied" });
         }
@@ -505,9 +509,9 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "Order not found" });
       }
 
-      // Check permissions
-      if (user.role !== 'admin' && user.role !== 'manager') {
-        return res.status(403).json({ message: "Insufficient permissions" });
+      // Check delete permissions using the shared permission system
+      if (!hasPermission(user.role, 'orders', 'delete')) {
+        return res.status(403).json({ message: "Insufficient permissions to delete orders" });
       }
 
       if (user.role === 'manager') {
@@ -684,7 +688,11 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "Delivery not found" });
       }
 
-      // Check permissions
+      // Check edit permissions using the shared permission system
+      if (!hasPermission(user.role, 'deliveries', 'edit')) {
+        return res.status(403).json({ message: "Insufficient permissions to edit deliveries" });
+      }
+
       if (user.role !== 'admin') {
         const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || [];
         if (!userGroupIds.includes(delivery.groupId)) {
@@ -802,9 +810,9 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "Delivery not found" });
       }
 
-      // Check permissions
-      if (user.role !== 'admin' && user.role !== 'manager') {
-        return res.status(403).json({ message: "Insufficient permissions" });
+      // Check permissions using the shared permission system
+      if (!hasPermission(user.role, 'deliveries', 'delete')) {
+        return res.status(403).json({ message: "Insufficient permissions to delete deliveries" });
       }
 
       if (user.role === 'manager') {
@@ -829,8 +837,9 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "User not found" });
       }
 
-      if (user.role !== 'admin' && user.role !== 'manager') {
-        return res.status(403).json({ message: "Insufficient permissions" });
+      // Check validate permissions using the shared permission system
+      if (!hasPermission(user.role, 'deliveries', 'validate')) {
+        return res.status(403).json({ message: "Insufficient permissions to validate deliveries" });
       }
 
       const id = parseInt(req.params.id);