diff --git a/attached_assets/{15FA3613-084B-4C65-9137-D8D3FF33CD34}_1755006743271.png b/attached_assets/{15FA3613-084B-4C65-9137-D8D3FF33CD34}_1755006743271.png
new file mode 100644
index 0000000..f84c90a
Binary files /dev/null and b/attached_assets/{15FA3613-084B-4C65-9137-D8D3FF33CD34}_1755006743271.png differ
diff --git a/attached_assets/{41E896A3-9301-4C3E-AB6A-195D11ECE3F0}_1755006693645.png b/attached_assets/{41E896A3-9301-4C3E-AB6A-195D11ECE3F0}_1755006693645.png
new file mode 100644
index 0000000..30ba41b
Binary files /dev/null and b/attached_assets/{41E896A3-9301-4C3E-AB6A-195D11ECE3F0}_1755006693645.png differ
diff --git a/attached_assets/{DFCCD614-BF99-4F78-845B-737CFC16AF4D}_1755006833150.png b/attached_assets/{DFCCD614-BF99-4F78-845B-737CFC16AF4D}_1755006833150.png
new file mode 100644
index 0000000..24ca636
Binary files /dev/null and b/attached_assets/{DFCCD614-BF99-4F78-845B-737CFC16AF4D}_1755006833150.png differ
diff --git a/server/routes.ts b/server/routes.ts
index a03a2cd..ce0c5b4 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -1940,12 +1940,17 @@ RÉSUMÉ DU SCAN
         return res.status(404).json({ message: "User not found" });
       }
 
+      // Check permissions for customer-orders create
+      if (!hasPermission(user.role, 'customer-orders', 'create')) {
+        return res.status(403).json({ message: "Insufficient permissions to create customer orders" });
+      }
+
       const data = insertCustomerOrderSchema.parse(req.body);
       console.log("Parsed data:", data);
       
       // Check if user has access to the specified group
       if (user.role !== 'admin') {
-        const userGroupIds = user.userGroups.map(ug => ug.groupId);
+        const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || [];
         if (!userGroupIds.includes(data.groupId)) {
           return res.status(403).json({ message: "Access denied to this group" });
         }
@@ -1980,8 +1985,13 @@ RÉSUMÉ DU SCAN
         return res.status(404).json({ message: "Customer order not found" });
       }
 
+      // Check edit permissions
+      if (!hasPermission(user.role, 'customer-orders', 'edit')) {
+        return res.status(403).json({ message: "Insufficient permissions to edit customer orders" });
+      }
+
       if (user.role !== 'admin') {
-        const userGroupIds = user.userGroups.map(ug => ug.groupId);
+        const userGroupIds = user.userGroups?.map((ug: any) => ug.groupId) || [];
         if (!userGroupIds.includes(existingOrder.groupId)) {
           return res.status(403).json({ message: "Access denied" });
         }
diff --git a/shared/schema.ts b/shared/schema.ts
index b30661f..f9ae687 100644
--- a/shared/schema.ts
+++ b/shared/schema.ts
@@ -500,9 +500,6 @@ export type Task = typeof tasks.$inferSelect;
 export type InsertTask = z.infer<typeof insertTaskSchema>;
 
 // Complex types with relations
-export type UserWithGroups = User & {
-  groups: Group[];
-};
 
 export type OrderWithRelations = Order & {
   supplier: Supplier;