From 0bd5ee8ee8553cd4bc0d0e18b99a8b39b802c978 Mon Sep 17 00:00:00 2001 From: consultoria-as Date: Fri, 3 Jul 2026 08:10:22 +0000 Subject: [PATCH] fix(permissions): honor module permissions for cashier/counter in sidebar and page guard --- pos/static/js/app-init.js | 32 +++++--------- pos/static/js/sidebar.js | 58 +++++++++++-------------- pos/templates/accounting.html | 4 +- pos/templates/catalog.html | 4 +- pos/templates/config.html | 4 +- pos/templates/customers.html | 4 +- pos/templates/dashboard.html | 4 +- pos/templates/diagrams.html | 4 +- pos/templates/fleet.html | 4 +- pos/templates/inventory.html | 4 +- pos/templates/invoicing.html | 4 +- pos/templates/marketplace_external.html | 4 +- pos/templates/pos.html | 2 +- pos/templates/quotations.html | 4 +- pos/templates/remission_notes.html | 4 +- pos/templates/reports.html | 4 +- pos/templates/supplier_catalog.html | 4 +- pos/templates/whatsapp.html | 4 +- pos/templates/workshop.html | 4 +- 19 files changed, 69 insertions(+), 87 deletions(-) diff --git a/pos/static/js/app-init.js b/pos/static/js/app-init.js index 644dba0..3badc33 100644 --- a/pos/static/js/app-init.js +++ b/pos/static/js/app-init.js @@ -186,22 +186,24 @@ function isPageAllowed(pagePath, userRole, userPerms) { if (userRole === 'owner' || userRole === 'admin') return true; - // Workshop/mechanic accounts always see Taller; extra modules depend on permissions. - if (userRole === 'workshop' || userRole === 'mechanic') { - var allowed = ['/pos/workshop']; + // Restricted roles (workshop/mechanic/counter/cashier) see modules based on permissions. + if (['workshop', 'mechanic', 'counter', 'cashier'].indexOf(userRole) !== -1) { + var allowed = []; + if (userRole === 'workshop' || userRole === 'mechanic') { + allowed = ['/pos/workshop']; + } var permMap = { - 'customers.view': '/pos/customers', - 'inventory.view': '/pos/inventory', - 'catalog.view': '/pos/catalog', 'pos.sell': '/pos/sale', 'pos.view': '/pos/sale', + 'catalog.view': '/pos/catalog', + 'inventory.view': '/pos/inventory', + 'customers.view': '/pos/customers', + 'workshop.view': '/pos/workshop', 'pos.remission': '/pos/remission-notes', 'invoicing.view': '/pos/invoicing', 'quotations.view': '/pos/quotations', 'accounting.view': '/pos/accounting', 'reports.view': '/pos/reports', - 'config.view': '/pos/config', - 'config.edit': '/pos/config', 'dashboard.view': '/pos/dashboard' }; for (var p in permMap) { @@ -212,20 +214,6 @@ return allowed.indexOf(pagePath) !== -1; } - // Counter: fixed module set. Dashboard only if explicitly granted. - if (userRole === 'counter') { - var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/reports']; - if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard'); - return allowed.indexOf(pagePath) !== -1; - } - - // Cashier: fixed module set. Dashboard only if explicitly granted. - if (userRole === 'cashier') { - var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/invoicing','/pos/reports']; - if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard'); - return allowed.indexOf(pagePath) !== -1; - } - // Always allow login/logout pages so users can sign out without hitting the guard. if (pagePath === '/pos/login' || pagePath === '/pos/logout') return true; diff --git a/pos/static/js/sidebar.js b/pos/static/js/sidebar.js index d34af9d..393eff0 100644 --- a/pos/static/js/sidebar.js +++ b/pos/static/js/sidebar.js @@ -37,43 +37,37 @@ window.renderSidebar = function(modulesOverride) { } // Role-based section filtering. Owner/admin bypasses; other roles get - // only the sections relevant to their job. + // only the sections allowed by their permissions. function itemAllowed(id) { if (role === 'owner' || role === 'admin') return true; + + var base = []; if (role === 'workshop' || role === 'mechanic') { - // Taller siempre visible; el resto depende de los permisos asignados. - var allowed = ['workshop']; - var permMap = { - 'customers.view': 'customers', - 'inventory.view': 'inventory', - 'catalog.view': 'catalog', - 'pos.sell': 'pos', - 'pos.view': 'pos', - 'pos.remission': 'remission_notes', - 'invoicing.view': 'invoicing', - 'quotations.view': 'quotations', - 'accounting.view': 'accounting', - 'reports.view': 'reports', - 'dashboard.view': 'dashboard' - }; - for (var p in permMap) { - if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) { - allowed.push(permMap[p]); - } + base = ['workshop']; + } + + var permMap = { + 'pos.sell': 'pos', + 'pos.view': 'pos', + 'catalog.view': 'catalog', + 'inventory.view': 'inventory', + 'customers.view': 'customers', + 'workshop.view': 'workshop', + 'pos.remission': 'remission_notes', + 'invoicing.view': 'invoicing', + 'quotations.view': 'quotations', + 'accounting.view': 'accounting', + 'reports.view': 'reports', + 'dashboard.view': 'dashboard' + }; + + var allowed = base.slice(); + for (var p in permMap) { + if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) { + allowed.push(permMap[p]); } - return allowed.indexOf(id) !== -1; } - if (role === 'counter') { - var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','reports']; - if (hasPerm('dashboard.view')) allowed.push('dashboard'); - return allowed.indexOf(id) !== -1; - } - if (role === 'cashier') { - var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','invoicing','reports']; - if (hasPerm('dashboard.view')) allowed.push('dashboard'); - return allowed.indexOf(id) !== -1; - } - return true; + return allowed.indexOf(id) !== -1; } var navSections = [ diff --git a/pos/templates/accounting.html b/pos/templates/accounting.html index e2f293e..4c2d145 100644 --- a/pos/templates/accounting.html +++ b/pos/templates/accounting.html @@ -493,10 +493,10 @@ - + - + diff --git a/pos/templates/catalog.html b/pos/templates/catalog.html index 913a2c9..b3f2715 100644 --- a/pos/templates/catalog.html +++ b/pos/templates/catalog.html @@ -316,10 +316,10 @@ - + - + diff --git a/pos/templates/config.html b/pos/templates/config.html index 0cf6284..3574d1d 100644 --- a/pos/templates/config.html +++ b/pos/templates/config.html @@ -1033,10 +1033,10 @@ - + - + diff --git a/pos/templates/customers.html b/pos/templates/customers.html index 13e687c..43262c2 100644 --- a/pos/templates/customers.html +++ b/pos/templates/customers.html @@ -651,10 +651,10 @@ - + - + diff --git a/pos/templates/dashboard.html b/pos/templates/dashboard.html index b90da34..f166886 100644 --- a/pos/templates/dashboard.html +++ b/pos/templates/dashboard.html @@ -606,10 +606,10 @@ - + - + diff --git a/pos/templates/diagrams.html b/pos/templates/diagrams.html index 45acbe9..c8d864a 100644 --- a/pos/templates/diagrams.html +++ b/pos/templates/diagrams.html @@ -150,10 +150,10 @@ - + - + diff --git a/pos/templates/fleet.html b/pos/templates/fleet.html index 71064b4..616eb1d 100644 --- a/pos/templates/fleet.html +++ b/pos/templates/fleet.html @@ -303,10 +303,10 @@ - + - + diff --git a/pos/templates/inventory.html b/pos/templates/inventory.html index cd01121..1df831a 100644 --- a/pos/templates/inventory.html +++ b/pos/templates/inventory.html @@ -1062,10 +1062,10 @@ - + - + diff --git a/pos/templates/invoicing.html b/pos/templates/invoicing.html index e33c5e2..0d8446e 100644 --- a/pos/templates/invoicing.html +++ b/pos/templates/invoicing.html @@ -1064,10 +1064,10 @@ - + - + diff --git a/pos/templates/marketplace_external.html b/pos/templates/marketplace_external.html index a11ef52..cef7973 100644 --- a/pos/templates/marketplace_external.html +++ b/pos/templates/marketplace_external.html @@ -343,10 +343,10 @@ - + - + diff --git a/pos/templates/pos.html b/pos/templates/pos.html index 8b185de..428ef59 100644 --- a/pos/templates/pos.html +++ b/pos/templates/pos.html @@ -729,7 +729,7 @@ - + diff --git a/pos/templates/quotations.html b/pos/templates/quotations.html index c19df5e..8d4e28d 100644 --- a/pos/templates/quotations.html +++ b/pos/templates/quotations.html @@ -15,9 +15,9 @@ - + - +

Cotizaciones

diff --git a/pos/templates/remission_notes.html b/pos/templates/remission_notes.html index d63c6d7..bd272fb 100644 --- a/pos/templates/remission_notes.html +++ b/pos/templates/remission_notes.html @@ -227,8 +227,8 @@
- - + + - + - + diff --git a/pos/templates/supplier_catalog.html b/pos/templates/supplier_catalog.html index 6e6b61b..f5ff07f 100644 --- a/pos/templates/supplier_catalog.html +++ b/pos/templates/supplier_catalog.html @@ -126,8 +126,8 @@ - - + + diff --git a/pos/templates/whatsapp.html b/pos/templates/whatsapp.html index a7e3f26..ff925ae 100644 --- a/pos/templates/whatsapp.html +++ b/pos/templates/whatsapp.html @@ -132,11 +132,11 @@ function posLogout(){localStorage.removeItem('pos_token');window.location.href=' - + - + diff --git a/pos/templates/workshop.html b/pos/templates/workshop.html index 44d1534..cbd350e 100644 --- a/pos/templates/workshop.html +++ b/pos/templates/workshop.html @@ -494,10 +494,10 @@ - + - +