Merge pull request #1192 from Tria-plc/freight/nati-2

Freight/nati 2

apps/edr-freight-web/backoffice/src/lib/permissions.ts

@@ -659,19 +659,13 @@ export type FleetCrudResource =
   | "vehicles"
   | "drivers";
 
-/**
- * Per-resource fleet CRUD check. The legacy coarse fleet:manage key still
- * grants every action (mirrors the API's one-of guard fallback).
- */
+/** Per-resource fleet CRUD check — each resource needs its own grant. */
 export function canFleetAction(
   user: AuthUser | null | undefined,
   resource: FleetCrudResource,
   action: "create" | "update" | "delete",
 ): boolean {
-  return (
-    hasPermission(user, FREIGHT_PERMS[resource][action]) ||
-    hasPermission(user, FREIGHT_PERMS.fleet.manage)
-  );
+  return hasPermission(user, FREIGHT_PERMS[resource][action]);
 }
 
 /**