consultoria-as/Autoparts-DB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permissions): honor module permissions for cashier/counter in sidebar and page guard
Some checks failed
CI / lint-and-test (3.11) (push) Has been cancelled
Details
CI / lint-and-test (3.13) (push) Has been cancelled
Details

Browse Source
This commit is contained in:
consultoria-as
2026-07-03 08:10:22 +00:00
parent e270e848d7
commit 0bd5ee8ee8
19 changed files with 69 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
pos/static/js/app-init.js
View File

@@ -186,22 +186,24 @@
function isPageAllowed(pagePath, userRole, userPerms) {
if (userRole === 'owner' || userRole === 'admin') return true;
// Workshop/mechanic accounts always see Taller; extra modules depend on permissions.
if (userRole === 'workshop' || userRole === 'mechanic') {
var allowed = ['/pos/workshop'];
// Restricted roles (workshop/mechanic/counter/cashier) see modules based on permissions.
if (['workshop', 'mechanic', 'counter', 'cashier'].indexOf(userRole) !== -1) {
var allowed = [];
if (userRole === 'workshop' || userRole === 'mechanic') {
allowed = ['/pos/workshop'];
}
var permMap = {
'customers.view': '/pos/customers',
'inventory.view': '/pos/inventory',
'catalog.view': '/pos/catalog',
'pos.sell': '/pos/sale',
'pos.view': '/pos/sale',
'catalog.view': '/pos/catalog',
'inventory.view': '/pos/inventory',
'customers.view': '/pos/customers',
'workshop.view': '/pos/workshop',
'pos.remission': '/pos/remission-notes',
'invoicing.view': '/pos/invoicing',
'quotations.view': '/pos/quotations',
'accounting.view': '/pos/accounting',
'reports.view': '/pos/reports',
'config.view': '/pos/config',
'config.edit': '/pos/config',
'dashboard.view': '/pos/dashboard'
};
for (var p in permMap) {
@@ -212,20 +214,6 @@
return allowed.indexOf(pagePath) !== -1;
}
// Counter: fixed module set. Dashboard only if explicitly granted.
if (userRole === 'counter') {
var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/reports'];
if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
return allowed.indexOf(pagePath) !== -1;
}
// Cashier: fixed module set. Dashboard only if explicitly granted.
if (userRole === 'cashier') {
var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/invoicing','/pos/reports'];
if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
return allowed.indexOf(pagePath) !== -1;
}
// Always allow login/logout pages so users can sign out without hitting the guard.
if (pagePath === '/pos/login' || pagePath === '/pos/logout') return true;

58
pos/static/js/sidebar.js
View File

@@ -37,43 +37,37 @@ window.renderSidebar = function(modulesOverride) {
}
// Role-based section filtering. Owner/admin bypasses; other roles get
// only the sections relevant to their job.
// only the sections allowed by their permissions.
function itemAllowed(id) {
if (role === 'owner' || role === 'admin') return true;
var base = [];
if (role === 'workshop' || role === 'mechanic') {
// Taller siempre visible; el resto depende de los permisos asignados.
var allowed = ['workshop'];
var permMap = {
'customers.view': 'customers',
'inventory.view': 'inventory',
'catalog.view': 'catalog',
'pos.sell': 'pos',
'pos.view': 'pos',
'pos.remission': 'remission_notes',
'invoicing.view': 'invoicing',
'quotations.view': 'quotations',
'accounting.view': 'accounting',
'reports.view': 'reports',
'dashboard.view': 'dashboard'
};
for (var p in permMap) {
if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
allowed.push(permMap[p]);
}
base = ['workshop'];
}
var permMap = {
'pos.sell': 'pos',
'pos.view': 'pos',
'catalog.view': 'catalog',
'inventory.view': 'inventory',
'customers.view': 'customers',
'workshop.view': 'workshop',
'pos.remission': 'remission_notes',
'invoicing.view': 'invoicing',
'quotations.view': 'quotations',
'accounting.view': 'accounting',
'reports.view': 'reports',
'dashboard.view': 'dashboard'
};
var allowed = base.slice();
for (var p in permMap) {
if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
allowed.push(permMap[p]);
}
return allowed.indexOf(id) !== -1;
}
if (role === 'counter') {
var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','reports'];
if (hasPerm('dashboard.view')) allowed.push('dashboard');
return allowed.indexOf(id) !== -1;
}
if (role === 'cashier') {
var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','invoicing','reports'];
if (hasPerm('dashboard.view')) allowed.push('dashboard');
return allowed.indexOf(id) !== -1;
}
return true;
return allowed.indexOf(id) !== -1;
}
var navSections = [