consultoria-as/Autoparts-DB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permissions): honor module permissions for cashier/counter in sidebar and page guard
Some checks failed
CI / lint-and-test (3.11) (push) Has been cancelled
Details
CI / lint-and-test (3.13) (push) Has been cancelled
Details

Browse Source
This commit is contained in:
consultoria-as
2026-07-03 08:10:22 +00:00
parent e270e848d7
commit 0bd5ee8ee8
19 changed files with 69 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
pos/static/js/sidebar.js
View File

@@ -37,43 +37,37 @@ window.renderSidebar = function(modulesOverride) {
}
// Role-based section filtering. Owner/admin bypasses; other roles get
// only the sections relevant to their job.
// only the sections allowed by their permissions.
function itemAllowed(id) {
if (role === 'owner' || role === 'admin') return true;
var base = [];
if (role === 'workshop' || role === 'mechanic') {
// Taller siempre visible; el resto depende de los permisos asignados.
var allowed = ['workshop'];
var permMap = {
'customers.view': 'customers',
'inventory.view': 'inventory',
'catalog.view': 'catalog',
'pos.sell': 'pos',
'pos.view': 'pos',
'pos.remission': 'remission_notes',
'invoicing.view': 'invoicing',
'quotations.view': 'quotations',
'accounting.view': 'accounting',
'reports.view': 'reports',
'dashboard.view': 'dashboard'
};
for (var p in permMap) {
if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
allowed.push(permMap[p]);
}
base = ['workshop'];
}
var permMap = {
'pos.sell': 'pos',
'pos.view': 'pos',
'catalog.view': 'catalog',
'inventory.view': 'inventory',
'customers.view': 'customers',
'workshop.view': 'workshop',
'pos.remission': 'remission_notes',
'invoicing.view': 'invoicing',
'quotations.view': 'quotations',
'accounting.view': 'accounting',
'reports.view': 'reports',
'dashboard.view': 'dashboard'
};
var allowed = base.slice();
for (var p in permMap) {
if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
allowed.push(permMap[p]);
}
return allowed.indexOf(id) !== -1;
}
if (role === 'counter') {
var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','reports'];
if (hasPerm('dashboard.view')) allowed.push('dashboard');
return allowed.indexOf(id) !== -1;
}
if (role === 'cashier') {
var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','invoicing','reports'];
if (hasPerm('dashboard.view')) allowed.push('dashboard');
return allowed.indexOf(id) !== -1;
}
return true;
return allowed.indexOf(id) !== -1;
}
var navSections = [