From 982315bdaf0c5b9e600df9cdb181b5833dd9d156 Mon Sep 17 00:00:00 2001
From: consultoria-as <ialcarazsalazar@consultoria-as.com>
Date: Thu, 2 Jul 2026 22:37:28 +0000
Subject: [PATCH] feat(permissions): add dashboard.view permission for
 cashier/counter/workshop

---
 pos/blueprints/config_bp.py             |  3 +++
 pos/static/js/app-init.js               | 18 ++++++++++++------
 pos/static/js/sidebar.js                | 11 ++++++++---
 pos/templates/accounting.html           |  4 ++--
 pos/templates/catalog.html              |  4 ++--
 pos/templates/config.html               |  4 ++--
 pos/templates/customers.html            |  4 ++--
 pos/templates/dashboard.html            |  4 ++--
 pos/templates/diagrams.html             |  4 ++--
 pos/templates/fleet.html                |  4 ++--
 pos/templates/inventory.html            |  4 ++--
 pos/templates/invoicing.html            |  4 ++--
 pos/templates/marketplace_external.html |  4 ++--
 pos/templates/pos.html                  |  2 +-
 pos/templates/quotations.html           |  4 ++--
 pos/templates/remission_notes.html      |  4 ++--
 pos/templates/reports.html              |  4 ++--
 pos/templates/supplier_catalog.html     |  4 ++--
 pos/templates/whatsapp.html             |  4 ++--
 pos/templates/workshop.html             |  4 ++--
 20 files changed, 56 insertions(+), 42 deletions(-)

diff --git a/pos/blueprints/config_bp.py b/pos/blueprints/config_bp.py
index ad4140f..843afe5 100644
--- a/pos/blueprints/config_bp.py
+++ b/pos/blueprints/config_bp.py
@@ -46,6 +46,9 @@ _DEFAULT_ROLE_PERMISSIONS = {
 
 
 _AVAILABLE_PERMISSIONS = [
+    {'module': 'Dashboard', 'permissions': [
+        {'key': 'dashboard.view', 'label': 'Ver Dashboard'},
+    ]},
     {'module': 'Punto de Venta', 'permissions': [
         {'key': 'pos.sell', 'label': 'Realizar ventas'},
         {'key': 'pos.view', 'label': 'Ver ventas/cotizaciones'},
diff --git a/pos/static/js/app-init.js b/pos/static/js/app-init.js
index 170afdf..644dba0 100644
--- a/pos/static/js/app-init.js
+++ b/pos/static/js/app-init.js
@@ -201,7 +201,8 @@
                 'accounting.view': '/pos/accounting',
                 'reports.view': '/pos/reports',
                 'config.view': '/pos/config',
-                'config.edit': '/pos/config'
+                'config.edit': '/pos/config',
+                'dashboard.view': '/pos/dashboard'
             };
             for (var p in permMap) {
                 if (userPerms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
@@ -211,14 +212,18 @@
             return allowed.indexOf(pagePath) !== -1;
         }
 
-        // Counter: fixed module set (no dashboard).
+        // Counter: fixed module set. Dashboard only if explicitly granted.
         if (userRole === 'counter') {
-            return ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/reports'].indexOf(pagePath) !== -1;
+            var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/reports'];
+            if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
+            return allowed.indexOf(pagePath) !== -1;
         }
 
-        // Cashier: fixed module set (no dashboard).
+        // Cashier: fixed module set. Dashboard only if explicitly granted.
         if (userRole === 'cashier') {
-            return ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/invoicing','/pos/reports'].indexOf(pagePath) !== -1;
+            var allowed = ['/pos/sale','/pos/catalog','/pos/inventory','/pos/customers','/pos/workshop','/pos/remission-notes','/pos/invoicing','/pos/reports'];
+            if (userPerms.indexOf('dashboard.view') !== -1) allowed.push('/pos/dashboard');
+            return allowed.indexOf(pagePath) !== -1;
         }
 
         // Always allow login/logout pages so users can sign out without hitting the guard.
@@ -287,8 +292,9 @@
     (function hideBackToSystemForRestrictedRoles() {
         var backBtn = document.getElementById('backToSystemBtn');
         if (!backBtn) return;
-        // owner/admin are the only roles that should see the dashboard shortcut from POS.
+        // owner/admin always see it; others only if they have dashboard.view.
         if (role === 'owner' || role === 'admin') return;
+        if ((window.POS_USER.permissions || []).indexOf('dashboard.view') !== -1) return;
         backBtn.style.display = 'none';
     })();
 
diff --git a/pos/static/js/sidebar.js b/pos/static/js/sidebar.js
index 8ce7889..d34af9d 100644
--- a/pos/static/js/sidebar.js
+++ b/pos/static/js/sidebar.js
@@ -53,7 +53,8 @@ window.renderSidebar = function(modulesOverride) {
                 'invoicing.view': 'invoicing',
                 'quotations.view': 'quotations',
                 'accounting.view': 'accounting',
-                'reports.view': 'reports'
+                'reports.view': 'reports',
+                'dashboard.view': 'dashboard'
             };
             for (var p in permMap) {
                 if (perms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
@@ -63,10 +64,14 @@ window.renderSidebar = function(modulesOverride) {
             return allowed.indexOf(id) !== -1;
         }
         if (role === 'counter') {
-            return ['pos','catalog','inventory','customers','workshop','remission_notes','reports'].indexOf(id) !== -1;
+            var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','reports'];
+            if (hasPerm('dashboard.view')) allowed.push('dashboard');
+            return allowed.indexOf(id) !== -1;
         }
         if (role === 'cashier') {
-            return ['pos','catalog','inventory','customers','workshop','remission_notes','invoicing','reports'].indexOf(id) !== -1;
+            var allowed = ['pos','catalog','inventory','customers','workshop','remission_notes','invoicing','reports'];
+            if (hasPerm('dashboard.view')) allowed.push('dashboard');
+            return allowed.indexOf(id) !== -1;
         }
         return true;
     }
diff --git a/pos/templates/accounting.html b/pos/templates/accounting.html
index 469fcf6..e2f293e 100644
--- a/pos/templates/accounting.html
+++ b/pos/templates/accounting.html
@@ -493,10 +493,10 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/accounting.v9.js?v=33" defer></script>
   <script src="/pos/static/js/sync-engine.js" defer></script>
   <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
diff --git a/pos/templates/catalog.html b/pos/templates/catalog.html
index 1e6d51a..913a2c9 100644
--- a/pos/templates/catalog.html
+++ b/pos/templates/catalog.html
@@ -316,10 +316,10 @@
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
   <script src="/pos/static/js/kiosk.js" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/catalog.js?v=33" defer></script>
   <script src="/pos/static/js/offline-banner.js" defer></script>
   <script src="/pos/static/js/chat.js" defer></script>
diff --git a/pos/templates/config.html b/pos/templates/config.html
index e50f453..943f1a0 100644
--- a/pos/templates/config.html
+++ b/pos/templates/config.html
@@ -1016,10 +1016,10 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/kiosk.js" defer></script>
   <script src="/pos/static/js/config.js?v=39" defer></script>
   <script src="/pos/static/js/sync-engine.js" defer></script>
diff --git a/pos/templates/customers.html b/pos/templates/customers.html
index 6a1bf2b..13e687c 100644
--- a/pos/templates/customers.html
+++ b/pos/templates/customers.html
@@ -651,10 +651,10 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/virtual-scroll.js" defer></script>
   <script src="/pos/static/js/customers.js?v=35" defer></script>
   <script src="/pos/static/js/offline-banner.js" defer></script>
diff --git a/pos/templates/dashboard.html b/pos/templates/dashboard.html
index 1dbf2db..b90da34 100644
--- a/pos/templates/dashboard.html
+++ b/pos/templates/dashboard.html
@@ -606,10 +606,10 @@
 
   <script src="/pos/static/js/chart.umd.min.js" defer></script>
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/dashboard-stats.js?v=33" defer></script>
   <script src="/pos/static/js/dashboard.js?v=33" defer></script>
   <script src="/pos/static/js/sync-engine.js" defer></script>
diff --git a/pos/templates/diagrams.html b/pos/templates/diagrams.html
index 4a35f11..45acbe9 100644
--- a/pos/templates/diagrams.html
+++ b/pos/templates/diagrams.html
@@ -150,10 +150,10 @@
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
   <script src="/pos/static/js/kiosk.js" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/diagrams.js" defer></script>
   <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
   <script src="/pos/static/js/pwa-install.js" defer></script>
diff --git a/pos/templates/fleet.html b/pos/templates/fleet.html
index 6bb9ddf..71064b4 100644
--- a/pos/templates/fleet.html
+++ b/pos/templates/fleet.html
@@ -303,10 +303,10 @@
 </div>
 
 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=6" defer></script>
+<script src="/pos/static/js/app-init.js?v=7" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
 <script src="/pos/static/js/fleet.js" defer></script>
 <script src="/pos/static/js/offline-banner.js" defer></script>
 <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
diff --git a/pos/templates/inventory.html b/pos/templates/inventory.html
index ea1cc84..cd01121 100644
--- a/pos/templates/inventory.html
+++ b/pos/templates/inventory.html
@@ -1062,10 +1062,10 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/virtual-scroll.js?v=33" defer></script>
   <script src="/pos/static/js/inventory.js?v=38" defer></script>
   <script src="/pos/static/js/offline-banner.js" defer></script>
diff --git a/pos/templates/invoicing.html b/pos/templates/invoicing.html
index 17da913..e33c5e2 100644
--- a/pos/templates/invoicing.html
+++ b/pos/templates/invoicing.html
@@ -1064,10 +1064,10 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/invoicing.js?v=33" defer></script>
   <script src="/pos/static/js/sync-engine.js" defer></script>
   <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
diff --git a/pos/templates/marketplace_external.html b/pos/templates/marketplace_external.html
index 4b8b94b..a11ef52 100644
--- a/pos/templates/marketplace_external.html
+++ b/pos/templates/marketplace_external.html
@@ -343,10 +343,10 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/marketplace_external.js?v=33" defer></script>
   <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
 </body>
diff --git a/pos/templates/pos.html b/pos/templates/pos.html
index 259c757..6a4c519 100644
--- a/pos/templates/pos.html
+++ b/pos/templates/pos.html
@@ -729,7 +729,7 @@
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
   <script src="/pos/static/js/kiosk.js" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/push.js" defer></script>
   <script src="/pos/static/js/printer.js" defer></script>
diff --git a/pos/templates/quotations.html b/pos/templates/quotations.html
index 45e5004..c19df5e 100644
--- a/pos/templates/quotations.html
+++ b/pos/templates/quotations.html
@@ -15,9 +15,9 @@
 <body>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
 
   <div class="page">
     <h1 class="page-title">Cotizaciones</h1>
diff --git a/pos/templates/remission_notes.html b/pos/templates/remission_notes.html
index d3a5b5c..d63c6d7 100644
--- a/pos/templates/remission_notes.html
+++ b/pos/templates/remission_notes.html
@@ -227,8 +227,8 @@
   </div>
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
 
   <script>
     const token = localStorage.getItem('pos_token') || '';
diff --git a/pos/templates/reports.html b/pos/templates/reports.html
index bfe9e73..56cabbc 100644
--- a/pos/templates/reports.html
+++ b/pos/templates/reports.html
@@ -406,10 +406,10 @@
   <!-- End app-shell -->
 
   <script src="/pos/static/js/i18n.js?v=39" defer></script>
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
   <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
   <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/reports.js?v=35" defer></script>
   <script src="/pos/static/js/sync-engine.js" defer></script>
   <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
diff --git a/pos/templates/supplier_catalog.html b/pos/templates/supplier_catalog.html
index 2286bc4..6e6b61b 100644
--- a/pos/templates/supplier_catalog.html
+++ b/pos/templates/supplier_catalog.html
@@ -126,8 +126,8 @@
     </div>
   </div>
 
-  <script src="/pos/static/js/app-init.js?v=6" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/app-init.js?v=7" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
   <script src="/pos/static/js/supplier_catalog.js?v=33" defer></script>
   <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>
 </body>
diff --git a/pos/templates/whatsapp.html b/pos/templates/whatsapp.html
index 2775915..a7e3f26 100644
--- a/pos/templates/whatsapp.html
+++ b/pos/templates/whatsapp.html
@@ -132,11 +132,11 @@ function posLogout(){localStorage.removeItem('pos_token');window.location.href='
 
 <!-- Sidebar -->
 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=6" defer></script>
+<script src="/pos/static/js/app-init.js?v=7" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/whatsapp2.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-  <script src="/pos/static/js/sidebar.js?v=44" defer></script>
+  <script src="/pos/static/js/sidebar.js?v=45" defer></script>
 
   <script src="/pos/static/js/chat.js" defer></script>
 </body>
diff --git a/pos/templates/workshop.html b/pos/templates/workshop.html
index 9633b31..2403e04 100644
--- a/pos/templates/workshop.html
+++ b/pos/templates/workshop.html
@@ -494,10 +494,10 @@
 </div>
 
 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=6" defer></script>
+<script src="/pos/static/js/app-init.js?v=7" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>
-<script src="/pos/static/js/sidebar.js?v=44" defer></script>
+<script src="/pos/static/js/sidebar.js?v=45" defer></script>
 <script src="/pos/static/js/offline-banner.js" defer></script>
 <script src="/pos/static/js/workshop.js?v=56" defer></script>
 <script>if('serviceWorker' in navigator){navigator.serviceWorker.register('/pos/sw.js',{scope:'/pos/'});}</script>