From c2db68b1842d3de8ab14af8378f502b3fe0f078e Mon Sep 17 00:00:00 2001
From: consultoria-as <ialcarazsalazar@consultoria-as.com>
Date: Tue, 30 Jun 2026 16:36:38 +0000
Subject: [PATCH] fix(roles): restringe usuarios Taller y Mecanico a solo la
 seccion de Taller y oculta precios

- sidebar.js: itemAllowed incluye mechanic junto a workshop -> solo muestra Taller
- app-init.js: redirige a /pos/workshop si el rol es workshop/mechanic
- config_bp.py: remueve customers.view y fleet.view de los permisos por defecto de workshop/mechanic
- workshop.js: hidePrices ahora tambien aplica para mechanic; oculta columnas/inputs de precio
- app-init.js/config.js: agrega etiquetas de rol para workshop y mechanic
- workshop.html: marca columnas de precio con price-col y oculta input catRate

Tests: 35 passed
---
 pos/blueprints/config_bp.py | 6 ++----
 pos/static/js/app-init.js   | 9 ++++++++-
 pos/static/js/sidebar.js    | 2 +-
 pos/static/js/workshop.js   | 8 ++++----
 pos/templates/workshop.html | 6 +++---
 5 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/pos/blueprints/config_bp.py b/pos/blueprints/config_bp.py
index 32d5109..4c7ec0c 100644
--- a/pos/blueprints/config_bp.py
+++ b/pos/blueprints/config_bp.py
@@ -237,10 +237,8 @@ def create_employee():
                         'reports.view', 'reports.financial',
                         'customers.view',
                         'fleet.view'],
-        'workshop': ['workshop.view', 'workshop.edit', 'workshop.add_items', 'customers.view',
-                     'fleet.view'],
-        'mechanic': ['workshop.view', 'workshop.edit', 'workshop.add_items', 'customers.view',
-                     'fleet.view'],
+        'workshop': ['workshop.view', 'workshop.edit', 'workshop.add_items'],
+        'mechanic': ['workshop.view', 'workshop.edit', 'workshop.add_items'],
     }
 
     for perm in role_permissions.get(data['role'], []):
diff --git a/pos/static/js/app-init.js b/pos/static/js/app-init.js
index bdae956..6dd725c 100644
--- a/pos/static/js/app-init.js
+++ b/pos/static/js/app-init.js
@@ -43,7 +43,8 @@
     var _t = typeof window.t === 'function' ? window.t : function(k) { return k; };
     var roleLabels = {
         'owner': _t('role_owner'), 'admin': _t('role_admin'), 'cashier': _t('role_cashier'),
-        'warehouse': _t('role_warehouse'), 'accountant': _t('role_accountant')
+        'warehouse': _t('role_warehouse'), 'accountant': _t('role_accountant'),
+        'workshop': 'Taller', 'mechanic': 'Mecanico'
     };
     var roleLabel = roleLabels[role] || role;
     var initials = name.split(' ').map(function(p) { return p[0]; }).join('').toUpperCase().substring(0, 2);
@@ -180,6 +181,12 @@
         permissions: payload.permissions || []
     };
 
+    // ─── Restrict workshop/mechanic users to the workshop view only ───
+    if ((role === 'workshop' || role === 'mechanic') && window.location.pathname !== '/pos/workshop') {
+        window.location.replace('/pos/workshop');
+        return;
+    }
+
     // ─── Preload enabled modules for sidebar filtering ───
     try {
         fetch('/pos/api/config/modules', {
diff --git a/pos/static/js/sidebar.js b/pos/static/js/sidebar.js
index e8c270b..8614798 100644
--- a/pos/static/js/sidebar.js
+++ b/pos/static/js/sidebar.js
@@ -41,7 +41,7 @@ window.renderSidebar = function(modulesOverride) {
     // only the sections relevant to their job.
     function itemAllowed(id) {
         if (role === 'owner' || role === 'admin') return true;
-        if (role === 'workshop') {
+        if (role === 'workshop' || role === 'mechanic') {
             return id === 'workshop';
         }
         if (role === 'cashier') {
diff --git a/pos/static/js/workshop.js b/pos/static/js/workshop.js
index 28a84cd..55a0816 100644
--- a/pos/static/js/workshop.js
+++ b/pos/static/js/workshop.js
@@ -22,7 +22,7 @@ var Workshop = (function() {
 
     var user = window.POS_USER || {};
     var role = (user.role || '').toLowerCase();
-    var hidePrices = role === 'workshop';
+    var hidePrices = role === 'workshop' || role === 'mechanic';
     var perms = user.permissions || [];
     var canEdit = role === 'owner' || role === 'admin' || perms.indexOf('workshop.edit') !== -1;
     var canSell = role === 'owner' || role === 'admin' || perms.indexOf('pos.sell') !== -1;
@@ -652,15 +652,15 @@ var Workshop = (function() {
     function renderCatalog() {
         var body = document.getElementById('catalogBody');
         if (!catalog.length) {
-            body.innerHTML = '<tr><td colspan="5" style="text-align:center;">Sin conceptos</td></tr>';
+            body.innerHTML = '<tr><td colspan="' + (hidePrices ? 3 : 5) + '" style="text-align:center;">Sin conceptos</td></tr>';
             return;
         }
         body.innerHTML = catalog.map(function(c) {
             return '<tr>' +
                 '<td>' + esc(c.name) + (c.description ? '<br><small>' + esc(c.description) + '</small>' : '') + '</td>' +
                 '<td>' + fmt(c.suggested_hours) + '</td>' +
-                '<td>' + fmtMoney(c.suggested_rate) + '</td>' +
-                '<td>' + fmtMoney(c.suggested_hours * c.suggested_rate) + '</td>' +
+                (hidePrices ? '' : '<td class="price-col">' + fmtMoney(c.suggested_rate) + '</td>' +
+                '<td class="price-col">' + fmtMoney(c.suggested_hours * c.suggested_rate) + '</td>') +
                 '<td><button class="btn btn--sm btn--ghost" onclick="Workshop.deleteCatalogItem(' + c.id + ')">Desactivar</button></td>' +
                 '</tr>';
         }).join('');
diff --git a/pos/templates/workshop.html b/pos/templates/workshop.html
index 1bb2a15..a481072 100644
--- a/pos/templates/workshop.html
+++ b/pos/templates/workshop.html
@@ -254,7 +254,7 @@
         <div class="form-field">
           <input class="form-input" id="catHours" type="number" step="0.1" placeholder="Horas" />
         </div>
-        <div class="form-field">
+        <div class="form-field price-col">
           <input class="form-input" id="catRate" type="number" step="0.01" placeholder="Precio/hora" />
         </div>
         <div class="form-field form-field--span3">
@@ -271,8 +271,8 @@
               <tr>
                 <th>Servicio</th>
                 <th>Horas</th>
-                <th>Precio/hora</th>
-                <th>Total sugerido</th>
+                <th class="price-col">Precio/hora</th>
+                <th class="price-col">Total sugerido</th>
                 <th></th>
               </tr>
             </thead>