Add freight demo data seeder and permissions management

- Introduced `DemoFreightDataSeeder` to seed demo freight data including wagons, approval rules, and staff users.
- Added `seed:freight-demo` script to `package.json` for easy execution.
- Updated permissions for operations officer and added permission checks in various components.
- Enhanced sidebar and booking actions to respect user permissions.

apps/edr-freight-web/backoffice/src/App.tsx

@@ -47,6 +47,8 @@ import TrainScheduleTrackPage from "./pages/trainScheduling/TrainScheduleTrackPa
 import TrainSchedulingGlobalRulesPage from "./pages/trainScheduling/TrainSchedulingGlobalRulesPage";
 import FleetResourcePage from "./pages/fleet/FleetResourcePage";
 import { getCategorySidebarChildren } from "./pages/ruleEngine/config/resources";
+import { FREIGHT_PERMS, hasPermission as hasFreightPermission } from "./lib/permissions";
+import { RequirePermission } from "./components/auth/RequirePermission";
 import TrainDetailPage from "./pages/trains/TrainDetailPage";
 import RoutesPage from "./pages/fleet/RoutesPage";
 
@@ -80,11 +82,13 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "Train Schedules",
         href: "/dashboard/operations/train-scheduling-v2",
         icon: <Train />,
+        permission: FREIGHT_PERMS.trainScheduling.view,
       },
       {
         label: "Batch Board",
         href: "/dashboard/operations/batch-board",
         icon: <LayoutGrid />,
+        permission: FREIGHT_PERMS.trainScheduling.view,
       },
     ],
   },
@@ -196,18 +200,25 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
   },
 ];
 
-const hasPermission = (
+/** Keep only items the user is permitted to see; drop now-empty sections. */
+const filterSidebarByPermission = (
+  sections: SidebarSection[],
   user: ReturnType<typeof useAuth>["user"],
-  key: string,
-) => {
-  if (!user) return false;
-  if (user.permissions?.some((p) => p.key === key)) return true;
+): SidebarSection[] => {
+  const itemAllowed = (item: SidebarItem): boolean => {
+    if (!item.permission) return true;
+    const keys = Array.isArray(item.permission)
+      ? item.permission
+      : [item.permission];
+    return keys.some((key) => hasFreightPermission(user, key));
+  };
 
-  return (user.employee ?? []).some((emp) =>
-    (emp.positions ?? []).some((pos) =>
-      (pos.permissions ?? []).some((p) => p.key === key),
-    ),
-  );
+  return sections
+    .map((section) => ({
+      ...section,
+      items: section.items.filter(itemAllowed),
+    }))
+    .filter((section) => section.items.length > 0);
 };
 
 const DashboardShell = () => {
@@ -217,7 +228,10 @@ const DashboardShell = () => {
 
   const demoItems: SidebarItem[] = [];
 
-  const sidebarSections = buildSidebarSections(demoItems);
+  const sidebarSections = filterSidebarByPermission(
+    buildSidebarSections(demoItems),
+    user,
+  );
   const displayName = user?.name?.en || user?.username || user?.email || "User";
 
   return (
@@ -271,22 +285,45 @@ const App = () => {
             path="operations/train-scheduling"
             element={<Navigate to="/dashboard/operations/train-scheduling-v2" replace />}
           />
-          <Route path="operations/batch-board" element={<BatchBoardPage />} />
+          <Route
+            path="operations/batch-board"
+            element={
+              <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+                <BatchBoardPage />
+              </RequirePermission>
+            }
+          />
           <Route
             path="operations/batch-board/:scheduleId"
-            element={<BatchScheduleDetailPage />}
+            element={
+              <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+                <BatchScheduleDetailPage />
+              </RequirePermission>
+            }
           />
           <Route
             path="operations/train-scheduling-v2"
-            element={<TrainScheduleV2ListPage />}
+            element={
+              <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+                <TrainScheduleV2ListPage />
+              </RequirePermission>
+            }
           />
           <Route
             path="operations/train-scheduling-v2/:scheduleId"
-            element={<TrainScheduleV2DetailPage />}
+            element={
+              <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+                <TrainScheduleV2DetailPage />
+              </RequirePermission>
+            }
           />
           <Route
             path="operations/train-scheduling-v2/:scheduleId/track"
-            element={<TrainScheduleTrackPage />}
+            element={
+              <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+                <TrainScheduleTrackPage />
+              </RequirePermission>
+            }
           />
           <Route path="routes" element={<RoutesPage />} />
           <Route path="locomotives" element={<FleetResourcePage />} />
@@ -316,7 +353,11 @@ const App = () => {
           />
           <Route
             path="configuration/train-scheduling-rules"
-            element={<TrainSchedulingGlobalRulesPage />}
+            element={
+              <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+                <TrainSchedulingGlobalRulesPage />
+              </RequirePermission>
+            }
           />
           <Route path="configuration/:resource" element={<RuleEngineResourcePage />} />
 

apps/edr-freight-web/backoffice/src/components/auth/RequirePermission.tsx

@@ -0,0 +1,30 @@
+import type { ReactNode } from "react";
+import { Navigate } from "react-router-dom";
+
+import { useAuth } from "@/auth/useAuth";
+import { hasPermission } from "@/lib/permissions";
+
+interface RequirePermissionProps {
+  /** Permission key(s); access is granted if the user has ANY of them. */
+  permission: string | string[];
+  /** Where to send users who lack the permission. */
+  redirectTo?: string;
+  children: ReactNode;
+}
+
+/**
+ * Page-level guard: renders children only when the current user holds one of
+ * the given permissions, otherwise redirects (default: overview).
+ */
+export function RequirePermission({
+  permission,
+  redirectTo = "/dashboard/overview",
+  children,
+}: RequirePermissionProps) {
+  const { user } = useAuth();
+  const keys = Array.isArray(permission) ? permission : [permission];
+  const allowed = keys.some((key) => hasPermission(user, key));
+
+  if (!allowed) return <Navigate to={redirectTo} replace />;
+  return <>{children}</>;
+}

apps/edr-freight-web/backoffice/src/components/bookings/BookingActionsToolbar.tsx

@@ -8,6 +8,8 @@ import { BookingActionsMenu } from "./BookingActionsMenu";
 import { SectionCard } from "./detail/SectionCard";
 import { toBookingListRow } from "@/features/bookings/mapBookingListRow";
 import { canAllocateBooking } from "@/features/bookings/booking-actions.config";
+import { useAuth } from "@/auth/useAuth";
+import { canManageScheduling } from "@/lib/permissions";
 import type { useBookingMutations } from "@/hooks/bookings/useBookings";
 
 type Mutations = ReturnType<typeof useBookingMutations>;
@@ -19,9 +21,11 @@ interface BookingActionsToolbarProps {
 
 /** Detail-page actions: primary toolbar + downloads. */
 export function BookingActionsToolbar({ booking, mutations }: BookingActionsToolbarProps) {
+  const { user } = useAuth();
   const row = toBookingListRow(booking);
   const { status } = booking;
   const [allocateOpen, setAllocateOpen] = useState(false);
+  const canAllocate = canManageScheduling(user);
 
   const downloadBlob = async (fn: () => Promise<Blob>, filename: string) => {
     const blob = await fn();
@@ -127,7 +131,7 @@ export function BookingActionsToolbar({ booking, mutations }: BookingActionsTool
         </SectionCard>
       )}
 
-      {canAllocateBooking(booking) ? (
+      {canAllocate && canAllocateBooking(booking) ? (
         <AllocateBookingWizard
           booking={booking}
           opened={allocateOpen}

apps/edr-freight-web/backoffice/src/components/layout/types.ts

@@ -6,6 +6,8 @@ export interface SidebarItem {
   href?: string;
   icon?: ReactNode;
   children?: SidebarItem[];
+  /** Permission key(s) required to see this item; ANY grants access. */
+  permission?: string | string[];
 }
 
 export interface SidebarSection {

apps/edr-freight-web/backoffice/src/features/bookings/booking-actions.config.ts

@@ -201,6 +201,7 @@ const ACTION_PERMISSION: Partial<Record<BookingActionId, string>> = {
   signContractStaff: FREIGHT_PERMS.bookings.signStaff,
   startTransit: FREIGHT_PERMS.bookings.operations,
   complete: FREIGHT_PERMS.bookings.operations,
+  allocateBooking: FREIGHT_PERMS.trainScheduling.manage,
   cancel: FREIGHT_PERMS.bookings.cancel,
 };
 

apps/edr-freight-web/backoffice/src/lib/permissions.ts

@@ -16,6 +16,10 @@ export const FREIGHT_PERMS = {
     operations: "edr_freight_app:bookings:operations",
     cancel: "edr_freight_app:bookings:cancel",
   },
+  trainScheduling: {
+    view: "edr_freight_app:train_scheduling:view",
+    manage: "edr_freight_app:train_scheduling:manage",
+  },
 } as const;
 
 const slugToResourceKey = (slug: RuleEngineResourceSlug): string =>
@@ -70,6 +74,14 @@ export function canAccessBookings(user: AuthUser | null | undefined): boolean {
   return hasPermission(user, FREIGHT_PERMS.bookings.view);
 }
 
+export function canViewScheduling(user: AuthUser | null | undefined): boolean {
+  return hasPermission(user, FREIGHT_PERMS.trainScheduling.view);
+}
+
+export function canManageScheduling(user: AuthUser | null | undefined): boolean {
+  return hasPermission(user, FREIGHT_PERMS.trainScheduling.manage);
+}
+
 export function ruleEngineViewKey(slug: RuleEngineResourceSlug): string {
   return `edr_freight_app:rule_engine:${slugToResourceKey(slug)}:view`;
 }