From d9c4e091af86a2a505d91fa9e4cc0fa6a8e96f39 Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Thu, 14 Aug 2025 09:15:33 +0000
Subject: [PATCH] Improve access control for the SAV tickets module

Adjust permission checks in the SAV tickets page to ensure correct access control logic and prevent potential rendering issues.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 31f9bd88-0285-4787-81b3-31ceeea5a08b
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/31f9bd88-0285-4787-81b3-31ceeea5a08b/BuVhk7G
---
 client/src/pages/SavTickets.tsx | 53 ++++++++++++++++-----------------
 1 file changed, 26 insertions(+), 27 deletions(-)

diff --git a/client/src/pages/SavTickets.tsx b/client/src/pages/SavTickets.tsx
index dac8bac..a394eae 100644
--- a/client/src/pages/SavTickets.tsx
+++ b/client/src/pages/SavTickets.tsx
@@ -8,7 +8,6 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/com
 import { useAuthUnified } from "@/hooks/useAuthUnified";
 import { useToast } from "@/hooks/use-toast";
 import { apiRequest } from "@/lib/queryClient";
-import { usePermissions } from "@shared/permissions";
 import { 
   Plus, 
   Search, 
@@ -49,38 +48,12 @@ export default function SavTickets() {
   const { user } = useAuthUnified();
   const { toast } = useToast();
   const queryClient = useQueryClient();
-  const permissions = usePermissions(user?.role);
   
   const [searchTerm, setSearchTerm] = useState("");
   const [statusFilter, setStatusFilter] = useState("all");
   const [priorityFilter, setPriorityFilter] = useState("all");
   const [supplierFilter, setSupplierFilter] = useState("all");
 
-  // Redirection pour les employés sans permission
-  const canView = ['admin', 'directeur', 'manager', 'employee'].includes(user?.role || '');
-  const canModify = ['admin', 'directeur', 'manager'].includes(user?.role || '');
-  const canDelete = ['admin', 'directeur'].includes(user?.role || '');
-
-  if (!canView) {
-    return (
-      <div className="p-4 sm:p-6">
-        <div className="bg-orange-50 border-l-4 border-orange-400 p-4 rounded-r-lg">
-          <div className="flex">
-            <div className="flex-shrink-0">
-              <Wrench className="h-5 w-5 text-orange-400" />
-            </div>
-            <div className="ml-3">
-              <p className="text-sm text-orange-700">
-                <strong>Accès restreint</strong><br />
-                Vous n'avez pas les permissions nécessaires pour accéder au module SAV.
-              </p>
-            </div>
-          </div>
-        </div>
-      </div>
-    );
-  }
-
   // Build query parameters
   const queryParams = new URLSearchParams();
   if (statusFilter !== 'all') queryParams.append('status', statusFilter);
@@ -110,6 +83,32 @@ export default function SavTickets() {
     staleTime: 1000 * 60 * 2, // 2 minutes
   });
 
+  // Check permissions AFTER all hooks are called
+  const canView = ['admin', 'directeur', 'manager', 'employee'].includes(user?.role || '');
+  const canModify = ['admin', 'directeur', 'manager'].includes(user?.role || '');
+  const canDelete = ['admin', 'directeur'].includes(user?.role || '');
+
+  // Handle permission check without early return
+  if (!canView) {
+    return (
+      <div className="p-4 sm:p-6">
+        <div className="bg-orange-50 border-l-4 border-orange-400 p-4 rounded-r-lg">
+          <div className="flex">
+            <div className="flex-shrink-0">
+              <Wrench className="h-5 w-5 text-orange-400" />
+            </div>
+            <div className="ml-3">
+              <p className="text-sm text-orange-700">
+                <strong>Accès restreint</strong><br />
+                Vous n'avez pas les permissions nécessaires pour accéder au module SAV.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   // Filter tickets by search term
   const filteredTickets = ticketsData.filter(ticket => {
     if (!searchTerm) return true;