consultoria-as/Autoparts-DB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permissions): honor module permissions for cashier/counter in sidebar and page guard
Some checks failed
CI / lint-and-test (3.11) (push) Has been cancelled
Details
CI / lint-and-test (3.13) (push) Has been cancelled
Details

Browse Source
This commit is contained in:
consultoria-as
2026-07-03 08:10:22 +00:00
parent e270e848d7
commit 0bd5ee8ee8
19 changed files with 69 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
pos/static/js/app-init.js
View File

@@ -186,22 +186,24 @@
function isPageAllowed(pagePath, userRole, userPerms) {
if (userRole === 'owner' || userRole === 'admin') return true;
// Workshop/mechanic accounts always see Taller; extra modules depend on permissions.
if (userRole === 'workshop' || userRole === 'mechanic') {
var allowed = ['/pos/workshop'];
// Restricted roles (workshop/mechanic/counter/cashier) see modules based on permissions.
if (['workshop', 'mechanic', 'counter', 'cashier'].indexOf(userRole) !== -1) {
var allowed = [];
if (userRole === 'workshop' || userRole === 'mechanic') {
allowed = ['/pos/workshop'];
}
var permMap = {
'customers.view': '/pos/customers',
'inventory.view': '/pos/inventory',
'catalog.view': '/pos/catalog',
'pos.sell': '/pos/sale',
'pos.view': '/pos/sale',
'catalog.view': '/pos/catalog',
'inventory.view': '/pos/inventory',
'customers.view': '/pos/customers',
'workshop.view': '/pos/workshop',
'pos.remission': '/pos/remission-notes',
'invoicing.view': '/pos/invoicing',
'quotations.view': '/pos/quotations',
'accounting.view': '/pos/accounting',
'reports.view': '/pos/reports',
'config.view': '/pos/config',
'config.edit': '/pos/config',
'dashboard.view': '/pos/dashboard'
};
for (var p in permMap) {
@@ -212,20 +214,6 @@
return allowed.indexOf(pagePath) !== -1;
}
// Counter: fixed module set. Dashboard only if explicitly granted.
if (userRole === 'counter') {
var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/reports'];
if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
return allowed.indexOf(pagePath) !== -1;
}
// Cashier: fixed module set. Dashboard only if explicitly granted.
if (userRole === 'cashier') {
var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/invoicing','/pos/reports'];
if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
return allowed.indexOf(pagePath) !== -1;
}
// Always allow login/logout pages so users can sign out without hitting the guard.
if (pagePath === '/pos/login' || pagePath === '/pos/logout') return true;