Michael/LogiFlow
1
0 Fork 0
mirror of https://github.com/R0m1k3/LogiFlow.git synced 2026-10-22 06:28:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #36 from R0m1k3/1.1

Browse Source 
Improve order and delivery management with refined user permissions
This commit is contained in:
LogiFlow authored and GitHub committed 2025-08-12 15:58:59 +02:00
2 parents f84e748486 61c002f8be
commit 9d37abafb6
1 file changed
+20 -11
Download Patch File Download Diff File Expand all files Collapse all files
server/routes.ts
+20 -11
View File
@@ -474,9 +474,13 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Order not found" }); return res.status(404).json({ message: "Order not found" });
} }
// Check permissions // Check edit permissions using the shared permission system
if (!hasPermission(user.role, 'orders', 'edit')) {
return res.status(403).json({ message: "Insufficient permissions to edit orders" });
}
if (user.role !== 'admin') { if (user.role !== 'admin') {
const userGroupIds = user.userGroups.map(ug => ug.groupId); const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || [];
if (!userGroupIds.includes(order.groupId)) { if (!userGroupIds.includes(order.groupId)) {
return res.status(403).json({ message: "Access denied" }); return res.status(403).json({ message: "Access denied" });
} }
@@ -505,9 +509,9 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Order not found" }); return res.status(404).json({ message: "Order not found" });
} }
// Check permissions // Check delete permissions using the shared permission system
if (user.role !== 'admin' && user.role !== 'manager') { if (!hasPermission(user.role, 'orders', 'delete')) {
return res.status(403).json({ message: "Insufficient permissions" }); return res.status(403).json({ message: "Insufficient permissions to delete orders" });
} }
if (user.role === 'manager') { if (user.role === 'manager') {
@@ -684,7 +688,11 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Delivery not found" }); return res.status(404).json({ message: "Delivery not found" });
} }
// Check permissions // Check edit permissions using the shared permission system
if (!hasPermission(user.role, 'deliveries', 'edit')) {
return res.status(403).json({ message: "Insufficient permissions to edit deliveries" });
}
if (user.role !== 'admin') { if (user.role !== 'admin') {
const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || []; const userGroupIds = (user as any).userGroups?.map((ug: any) => ug.groupId) || [];
if (!userGroupIds.includes(delivery.groupId)) { if (!userGroupIds.includes(delivery.groupId)) {
@@ -802,9 +810,9 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "Delivery not found" }); return res.status(404).json({ message: "Delivery not found" });
} }
// Check permissions // Check permissions using the shared permission system
if (user.role !== 'admin' && user.role !== 'manager') { if (!hasPermission(user.role, 'deliveries', 'delete')) {
return res.status(403).json({ message: "Insufficient permissions" }); return res.status(403).json({ message: "Insufficient permissions to delete deliveries" });
} }
if (user.role === 'manager') { if (user.role === 'manager') {
@@ -829,8 +837,9 @@ export async function registerRoutes(app: Express): Promise<Server> {
return res.status(404).json({ message: "User not found" }); return res.status(404).json({ message: "User not found" });
} }
if (user.role !== 'admin' && user.role !== 'manager') { // Check validate permissions using the shared permission system
return res.status(403).json({ message: "Insufficient permissions" }); if (!hasPermission(user.role, 'deliveries', 'validate')) {
return res.status(403).json({ message: "Insufficient permissions to validate deliveries" });
} }
const id = parseInt(req.params.id); const id = parseInt(req.params.id);