fix(permissions): honor module permissions for cashier/counter in sidebar and page guard

2026-07-03 08:10:22 +00:00
parent e270e848d7
commit 0bd5ee8ee8
19 changed files with 69 additions and 87 deletions
--- a/pos/static/js/app-init.js
+++ b/pos/static/js/app-init.js
@@ -186,22 +186,24 @@
    function isPageAllowed(pagePath, userRole, userPerms) {
        if (userRole === 'owner' || userRole === 'admin') return true;

-        // Workshop/mechanic accounts always see Taller; extra modules depend on permissions.
-        if (userRole === 'workshop' || userRole === 'mechanic') {
-            var allowed = ['/pos/workshop'];
+        // Restricted roles (workshop/mechanic/counter/cashier) see modules based on permissions.
+        if (['workshop', 'mechanic', 'counter', 'cashier'].indexOf(userRole) !== -1) {
+            var allowed = [];
+            if (userRole === 'workshop' || userRole === 'mechanic') {
+                allowed = ['/pos/workshop'];
+            }
            var permMap = {
-                'customers.view': '/pos/customers',
-                'inventory.view': '/pos/inventory',
-                'catalog.view': '/pos/catalog',
                'pos.sell': '/pos/sale',
                'pos.view': '/pos/sale',
+                'catalog.view': '/pos/catalog',
+                'inventory.view': '/pos/inventory',
+                'customers.view': '/pos/customers',
+                'workshop.view': '/pos/workshop',
                'pos.remission': '/pos/remission-notes',
                'invoicing.view': '/pos/invoicing',
                'quotations.view': '/pos/quotations',
                'accounting.view': '/pos/accounting',
                'reports.view': '/pos/reports',
-                'config.view': '/pos/config',
-                'config.edit': '/pos/config',
                'dashboard.view': '/pos/dashboard'
            };
            for (var p in permMap) {
@@ -212,20 +214,6 @@
            return allowed.indexOf(pagePath) !== -1;
        }

-        // Counter: fixed module set. Dashboard only if explicitly granted.
-        if (userRole === 'counter') {
-            var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/reports'];
-            if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
-            return allowed.indexOf(pagePath) !== -1;
-        }
-
-        // Cashier: fixed module set. Dashboard only if explicitly granted.
-        if (userRole === 'cashier') {
-            var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/invoicing','/pos/reports'];
-            if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
-            return allowed.indexOf(pagePath) !== -1;
-        }
-
        // Always allow login/logout pages so users can sign out without hitting the guard.
        if (pagePath === '/pos/login' || pagePath === '/pos/logout') return true;

--- a/pos/static/js/sidebar.js
+++ b/pos/static/js/sidebar.js
@@ -37,43 +37,37 @@ window.renderSidebar = function(modulesOverride) {
    }

    // Role-based section filtering. Owner/admin bypasses; other roles get
-    // only the sections relevant to their job.
+    // only the sections allowed by their permissions.
    function itemAllowed(id) {
        if (role === 'owner' || role === 'admin') return true;
+
+        var base = [];
        if (role === 'workshop' || role === 'mechanic') {
-            // Taller siempre visible; el resto depende de los permisos asignados.
-            var allowed = ['workshop'];
-            var permMap = {
-                'customers.view': 'customers',
-                'inventory.view': 'inventory',
-                'catalog.view': 'catalog',
-                'pos.sell': 'pos',
-                'pos.view': 'pos',
-                'pos.remission': 'remission_notes',
-                'invoicing.view': 'invoicing',
-                'quotations.view': 'quotations',
-                'accounting.view': 'accounting',
-                'reports.view': 'reports',
-                'dashboard.view': 'dashboard'
-            };
-            for (var p in permMap) {
-                if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
-                    allowed.push(permMap[p]);
-                }
+            base = ['workshop'];
+        }
+
+        var permMap = {
+            'pos.sell': 'pos',
+            'pos.view': 'pos',
+            'catalog.view': 'catalog',
+            'inventory.view': 'inventory',
+            'customers.view': 'customers',
+            'workshop.view': 'workshop',
+            'pos.remission': 'remission_notes',
+            'invoicing.view': 'invoicing',
+            'quotations.view': 'quotations',
+            'accounting.view': 'accounting',
+            'reports.view': 'reports',
+            'dashboard.view': 'dashboard'
+        };
+
+        var allowed = base.slice();
+        for (var p in permMap) {
+            if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
+                allowed.push(permMap[p]);
            }
-            return allowed.indexOf(id) !== -1;
        }
-        if (role === 'counter') {
-            var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','reports'];
-            if (hasPerm('dashboard.view')) allowed.push('dashboard');
-            return allowed.indexOf(id) !== -1;
-        }
-        if (role === 'cashier') {
-            var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','invoicing','reports'];
-            if (hasPerm('dashboard.view')) allowed.push('dashboard');
-            return allowed.indexOf(id) !== -1;
-        }
-        return true;
+        return allowed.indexOf(id) !== -1;
    }

    var navSections = [
--- a/pos/templates/accounting.html
+++ b/pos/templates/accounting.html
@@ -493,10 +493,10 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/accounting.v9.js?v=33" defer></script>
  <script src="/pos/static/js/sync-engine.js" defer></script>
  <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
--- a/pos/templates/catalog.html
+++ b/pos/templates/catalog.html
@@ -316,10 +316,10 @@

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
  <script src="/pos/static/js/kiosk.js" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/catalog.js?v=33" defer></script>
  <script src="/pos/static/js/offline-banner.js" defer></script>
  <script src="/pos/static/js/chat.js" defer></script>
--- a/pos/templates/config.html
+++ b/pos/templates/config.html
@@ -1033,10 +1033,10 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/kiosk.js" defer></script>
  <script src="/pos/static/js/config.js?v=41" defer></script>
  <script src="/pos/static/js/sync-engine.js" defer></script>
--- a/pos/templates/customers.html
+++ b/pos/templates/customers.html
@@ -651,10 +651,10 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/virtual-scroll.js" defer></script>
  <script src="/pos/static/js/customers.js?v=35" defer></script>
  <script src="/pos/static/js/offline-banner.js" defer></script>
--- a/pos/templates/dashboard.html
+++ b/pos/templates/dashboard.html
@@ -606,10 +606,10 @@

  <script src="/pos/static/js/chart.umd.min.js" defer></script>
  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/dashboard-stats.js?v=33" defer></script>
  <script src="/pos/static/js/dashboard.js?v=33" defer></script>
  <script src="/pos/static/js/sync-engine.js" defer></script>
--- a/pos/templates/diagrams.html
+++ b/pos/templates/diagrams.html
@@ -150,10 +150,10 @@

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
  <script src="/pos/static/js/kiosk.js" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/diagrams.js" defer></script>
  <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
  <script src="/pos/static/js/pwa-install.js" defer></script>
--- a/pos/templates/fleet.html
+++ b/pos/templates/fleet.html
@@ -303,10 +303,10 @@
 </div>

 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=7" defer></script>
+<script src="/pos/static/js/app-init.js?v=8" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
 <script src="/pos/static/js/fleet.js" defer></script>
 <script src="/pos/static/js/offline-banner.js" defer></script>
 <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
--- a/pos/templates/inventory.html
+++ b/pos/templates/inventory.html
@@ -1062,10 +1062,10 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/virtual-scroll.js?v=33" defer></script>
  <script src="/pos/static/js/inventory.js?v=38" defer></script>
  <script src="/pos/static/js/offline-banner.js" defer></script>
--- a/pos/templates/invoicing.html
+++ b/pos/templates/invoicing.html
@@ -1064,10 +1064,10 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/invoicing.js?v=33" defer></script>
  <script src="/pos/static/js/sync-engine.js" defer></script>
  <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
--- a/pos/templates/marketplace_external.html
+++ b/pos/templates/marketplace_external.html
@@ -343,10 +343,10 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/marketplace_external.js?v=33" defer></script>
  <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
 </body>
--- a/pos/templates/pos.html
+++ b/pos/templates/pos.html
@@ -729,7 +729,7 @@
  <script src="/pos/static/js/i18n.js?v=39" defer></script>
  <script src="/pos/static/js/kiosk.js" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/push.js" defer></script>
  <script src="/pos/static/js/printer.js" defer></script>
--- a/pos/templates/quotations.html
+++ b/pos/templates/quotations.html
@@ -15,9 +15,9 @@
 <body>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>

  <div class="page">
    <h1 class="page-title">Cotizaciones</h1>
--- a/pos/templates/remission_notes.html
+++ b/pos/templates/remission_notes.html
@@ -227,8 +227,8 @@
  </div>

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>

  <script>
    const token = localStorage.getItem('pos_token') || '';
--- a/pos/templates/reports.html
+++ b/pos/templates/reports.html
@@ -406,10 +406,10 @@
  <!-- End app-shell -->

  <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
  <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
  <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/reports.js?v=35" defer></script>
  <script src="/pos/static/js/sync-engine.js" defer></script>
  <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
--- a/pos/templates/supplier_catalog.html
+++ b/pos/templates/supplier_catalog.html
@@ -126,8 +126,8 @@
    </div>
  </div>

-  <script src="/pos/static/js/app-init.js?v=7" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/app-init.js?v=8" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>
  <script src="/pos/static/js/supplier_catalog.js?v=33" defer></script>
  <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
 </body>
--- a/pos/templates/whatsapp.html
+++ b/pos/templates/whatsapp.html
@@ -132,11 +132,11 @@ function posLogout(){localStorage.removeItem('pos_token');window.location.href='

 <!-- Sidebar -->
 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=7" defer></script>
+<script src="/pos/static/js/app-init.js?v=8" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/whatsapp2.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=46" defer></script>

  <script src="/pos/static/js/chat.js" defer></script>
 </body>
--- a/pos/templates/workshop.html
+++ b/pos/templates/workshop.html
@@ -494,10 +494,10 @@
 </div>

 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=7" defer></script>
+<script src="/pos/static/js/app-init.js?v=8" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-<script src="/pos/static/js/sidebar.js?v=45" defer></script>
+<script src="/pos/static/js/sidebar.js?v=46" defer></script>
 <script src="/pos/static/js/offline-banner.js" defer></script>
 <script src="/pos/static/js/workshop.js?v=57" defer></script>
 <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>