add permissions and fix issues

apps/edr-freight-web/backoffice/src/pages/contracts/ContractViewPage.tsx

@@ -20,6 +20,8 @@ import { ContractSignSuccessModal } from "@/components/contracts/ContractSignSuc
 import { ContractSignaturePad } from "@/components/bookings/ContractSignaturePad";
 import { contractsService } from "@/services/contracts.service";
 import { QUERY_KEYS } from "@/constants/QUERY_KEYS";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 
 /**
  * Staff contract preview + sign. Staff must open and read the generated
@@ -30,6 +32,7 @@ export default function ContractViewPage() {
   const navigate = useNavigate();
   const qc = useQueryClient();
   const iframeRef = useRef<HTMLIFrameElement>(null);
+  const { user } = useAuth();
 
   const [signOpen, setSignOpen] = useState(false);
   const [successOpen, setSuccessOpen] = useState(false);
@@ -116,6 +119,15 @@ export default function ContractViewPage() {
     );
   }
 
+  // Counter-signature permission is split per freight type — a bulk signer must
+  // not sign a container contract (API enforces the same on POST /contract/sign).
+  const maySign = hasPermission(
+    user,
+    FREIGHT_PERMS.contracts.signStaff[
+      data.freightType === "BULK" ? "bulk" : "container"
+    ],
+  );
+
   return (
     <Box p={{ base: "md", md: "xl" }}>
       <Box maw={920} mx="auto">
@@ -145,7 +157,7 @@ export default function ContractViewPage() {
             >
               Download PDF
             </Button>
-            {data.canSignStaff && (
+            {data.canSignStaff && maySign && (
               <Button
                 color="edr-green"
                 leftSection={<FileSignature size={16} />}

apps/edr-freight-web/backoffice/src/pages/fleet/FleetResourcePage.tsx

@@ -4,7 +4,7 @@ import { useMutation, useQuery } from "@tanstack/react-query";
 
 import { api } from "@/services/api";
 import { useAuth } from "@/auth/useAuth";
-import { canFleetAction } from "@/lib/permissions";
+import { canFleetAction, hasPermission, FREIGHT_PERMS } from "@/lib/permissions";
 import Breadcrumbs from "@/components/ui/Breadcrumbs";
 import { Inbox, Plus, Warehouse } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
@@ -43,6 +43,12 @@ const FleetResourcePage = () => {
   const canCreate = canFleetAction(user, slug, "create");
   const canUpdate = canFleetAction(user, slug, "update");
   const canDelete = canFleetAction(user, slug, "delete");
+  // Wagon transfer workspace: shown only to holders of a transfer capability
+  // (raise a request, fulfill one, or see the cross-yard history).
+  const canTransfer =
+    hasPermission(user, FREIGHT_PERMS.wagons.transferRequest) ||
+    hasPermission(user, FREIGHT_PERMS.wagons.transferFulfill) ||
+    hasPermission(user, FREIGHT_PERMS.wagons.transferHistoryAll);
 
   const { pagination, setPagination } = usePagination({ pageSize: 10 });
   const [search, setSearch] = useState("");
@@ -411,15 +417,17 @@ const FleetResourcePage = () => {
                     Yard Workspace
                   </Button>
                 ) : null}
-                <Button
-                  variant="light"
-                  color="grape"
-                  leftSection={<Inbox size={16} />}
-                  styles={{ label: { fontWeight: 500 } }}
-                  onClick={() => setTransferRequestsOpen(true)}
-                >
-                  Transfer Requests
-                </Button>
+                {canTransfer ? (
+                  <Button
+                    variant="light"
+                    color="grape"
+                    leftSection={<Inbox size={16} />}
+                    styles={{ label: { fontWeight: 500 } }}
+                    onClick={() => setTransferRequestsOpen(true)}
+                  >
+                    Transfer Requests
+                  </Button>
+                ) : null}
               </>
             ) : null}
             {canCreate ? (

apps/edr-freight-web/backoffice/src/pages/ruleEngine/CargoTypesPage.tsx

@@ -114,7 +114,9 @@ const CargoTypesPage = () => {
   const config = getRuleEngineResource(CARGO_SLUG);
 
   const canView = canAccessRuleEngineResource(user, CARGO_SLUG, "view");
-  const canManage = canAccessRuleEngineResource(user, CARGO_SLUG, "manage");
+  const canCreate = canAccessRuleEngineResource(user, CARGO_SLUG, "create");
+  const canUpdate = canAccessRuleEngineResource(user, CARGO_SLUG, "update");
+  const canDelete = canAccessRuleEngineResource(user, CARGO_SLUG, "delete");
 
   // One fetch of the whole (small) set — page-walked because the API caps
   // pageSize at 100; the tree, ancestry and each level are derived client-side
@@ -128,7 +130,7 @@ const CargoTypesPage = () => {
   const { create, update, remove } = useRuleEngineMutations(CARGO_SLUG);
 
   // Wagon-type options for the "Wagon types" picker (bulk cargo → allowed list).
-  const { data: wagonTypeOptions } = useWagonTypeOptions(canManage);
+  const { data: wagonTypeOptions } = useWagonTypeOptions(canCreate || canUpdate);
   const formFields = useMemo<FormFieldDef[]>(
     () =>
       FORM_FIELDS.map((field) =>
@@ -291,7 +293,7 @@ const CargoTypesPage = () => {
               leftSection={<Search size={16} />}
               w={240}
             />
-            {canManage && (
+            {canCreate && (
               <Button
                 color="teal"
                 leftSection={<Plus size={16} />}
@@ -335,7 +337,7 @@ const CargoTypesPage = () => {
                   ? "No cargo categories yet"
                   : `No cargo types under “${str(current?.cargoTypeName)}” yet`}
             </Text>
-            {!term && canManage && (
+            {!term && canCreate && (
               <Button
                 variant="light"
                 color="teal"
@@ -354,7 +356,8 @@ const CargoTypesPage = () => {
                 node={node}
                 childCount={(childrenOf.get(node.id) ?? []).length}
                 topBorder={i > 0}
-                canManage={canManage}
+                canUpdate={canUpdate}
+                canDelete={canDelete}
                 onOpen={() => navigate(`${BASE_PATH}/${node.id}`)}
                 onEdit={() => setFormMode({ kind: "edit", record: node })}
                 onDelete={() => setDeleteTarget(node)}
@@ -444,7 +447,8 @@ interface CargoRowProps {
   node: CargoNode;
   childCount: number;
   topBorder: boolean;
-  canManage: boolean;
+  canUpdate: boolean;
+  canDelete: boolean;
   onOpen: () => void;
   onEdit: () => void;
   onDelete: () => void;
@@ -454,7 +458,8 @@ function CargoRow({
   node,
   childCount,
   topBorder,
-  canManage,
+  canUpdate,
+  canDelete,
   onOpen,
   onEdit,
   onDelete,
@@ -529,19 +534,19 @@ function CargoRow({
       </UnstyledButton>
 
       <Group gap={4} wrap="nowrap">
-        {canManage && (
-          <>
-            <Tooltip label="Edit" withArrow>
-              <Button size="compact-sm" variant="subtle" color="gray" onClick={onEdit} px={8}>
-                <Pencil size={15} />
-              </Button>
-            </Tooltip>
-            <Tooltip label="Delete" withArrow>
-              <Button size="compact-sm" variant="subtle" color="red" onClick={onDelete} px={8}>
-                <Trash2 size={15} />
-              </Button>
-            </Tooltip>
-          </>
+        {canUpdate && (
+          <Tooltip label="Edit" withArrow>
+            <Button size="compact-sm" variant="subtle" color="gray" onClick={onEdit} px={8}>
+              <Pencil size={15} />
+            </Button>
+          </Tooltip>
+        )}
+        {canDelete && (
+          <Tooltip label="Delete" withArrow>
+            <Button size="compact-sm" variant="subtle" color="red" onClick={onDelete} px={8}>
+              <Trash2 size={15} />
+            </Button>
+          </Tooltip>
         )}
         <Tooltip label="Open" withArrow>
           <Button size="compact-sm" variant="subtle" color="teal" onClick={onOpen} px={8}>

apps/edr-freight-web/backoffice/src/pages/ruleEngine/RuleEngineResourcePage.tsx

@@ -150,9 +150,20 @@ const RuleEngineResourcePage = () => {
   const canView = Boolean(
     config && canAccessRuleEngineResource(user, config.slug, "view"),
   );
-  const canManage = Boolean(
-    config && canAccessRuleEngineResource(user, config.slug, "manage"),
+  // Per-action gates replace the retired coarse "manage": Add shows only with
+  // create, row Edit with update, row Delete with delete.
+  const canCreate = Boolean(
+    config && canAccessRuleEngineResource(user, config.slug, "create"),
   );
+  const canUpdate = Boolean(
+    config && canAccessRuleEngineResource(user, config.slug, "update"),
+  );
+  const canDelete = Boolean(
+    config && canAccessRuleEngineResource(user, config.slug, "delete"),
+  );
+  // Update-class controls (reorder, rate submit/approve, approval-rule decide)
+  // all map to the update permission — the matching endpoints now require it.
+  const canUpdateControls = canUpdate;
 
   const listParams = useMemo(
     () => ({
@@ -480,7 +491,7 @@ const RuleEngineResourcePage = () => {
       cell: ({ row }) => (
         <div onClick={(e) => e.stopPropagation()} data-stop-row-click>
           <Group gap="xs" wrap="nowrap" justify="flex-end">
-            {config.orderConfig && canManage ? (
+            {config.orderConfig && canUpdateControls ? (
               <RuleEngineOrderControls
                 record={row.original}
                 orderConfig={config.orderConfig}
@@ -493,7 +504,7 @@ const RuleEngineResourcePage = () => {
               record={row.original}
               config={config}
               layout="row"
-              readOnly={!canManage}
+              readOnly={!canUpdateControls}
               onEdit={(record) => {
                 setEditing(record);
                 setFormOpen(true);
@@ -504,8 +515,8 @@ const RuleEngineResourcePage = () => {
                   ? () => setChainOpen(true)
                   : undefined
               }
-              onSubmitRate={canManage ? (id) => submit.mutate(id) : undefined}
-              onApproveRate={canManage ? handleApproveRate : undefined}
+              onSubmitRate={canUpdateControls ? (id) => submit.mutate(id) : undefined}
+              onApproveRate={canUpdateControls ? handleApproveRate : undefined}
             />
           </Group>
         </div>
@@ -514,7 +525,7 @@ const RuleEngineResourcePage = () => {
 
     return base;
   }, [
-    canManage,
+    canUpdateControls,
     config,
     isRates,
     pendingByRateId,
@@ -642,7 +653,7 @@ const RuleEngineResourcePage = () => {
         title={config.label}
         subtitle={config.subtitle}
         action={
-          canManage && config.slug !== "container-types" ? (
+          canCreate && config.slug !== "container-types" ? (
             <Button leftSection={<Plus size={18} />} onClick={openCreate}>
               {addLabel}
             </Button>
@@ -653,7 +664,7 @@ const RuleEngineResourcePage = () => {
       {isPriorityRules ? (
         <PriorityRuleApprovalsSection
           requests={priorityWorkflow.pending.data ?? []}
-          canDecide={canManage}
+          canDecide={canUpdateControls}
           approve={priorityWorkflow.approve}
           reject={priorityWorkflow.reject}
         />
@@ -742,7 +753,7 @@ const RuleEngineResourcePage = () => {
               showSearch={Boolean(config.supportsSearch)}
               searchPlaceholder={config.searchPlaceholder}
               onManageOrder={
-                canManage && config.orderConfig
+                canUpdateControls && config.orderConfig
                   ? () => setOrderDialogOpen(true)
                   : undefined
               }
@@ -806,16 +817,16 @@ const RuleEngineResourcePage = () => {
               pageCount={pageCount}
               totalCount={totalCount}
               onPaginationChange={setPagination}
-              readOnly={!canManage}
-              onEdit={canManage ? openEdit : undefined}
-              onDelete={canManage ? setDeleteTarget : undefined}
+              readOnly={!canUpdate && !canDelete}
+              onEdit={canUpdate ? openEdit : undefined}
+              onDelete={canDelete ? setDeleteTarget : undefined}
               onViewChain={
                 config.slug === "approval-rules"
                   ? () => setChainOpen(true)
                   : undefined
               }
-              onSubmitRate={canManage ? (id) => submit.mutate(id) : undefined}
-              onApproveRate={canManage ? handleApproveRate : undefined}
+              onSubmitRate={canUpdateControls ? (id) => submit.mutate(id) : undefined}
+              onApproveRate={canUpdateControls ? handleApproveRate : undefined}
             />
           )}
         </Stack>

apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleTrackPage.tsx

@@ -1,5 +1,6 @@
 import { Link, useParams } from "react-router-dom";
 import { isAxiosError } from "axios";
+import { useState } from "react";
 import {
   ArrowLeft,
   CalendarClock,
@@ -7,9 +8,11 @@ import {
   Flag,
   MapPin,
   Navigation,
+  PackageCheck,
   Train,
 } from "lucide-react";
 import {
+  Alert,
   Badge,
   Box,
   Button,
@@ -25,7 +28,9 @@ import {
 } from "@mantine/core";
 
 import { PageContainer } from "@/components/page";
+import { LogPassYardWorkModal } from "@/components/trainScheduling/LogPassYardWorkModal";
 import { RouteCorridorTrack } from "@/components/trainScheduling/RouteCorridorTrack";
+import type { TrackStation } from "@/types/trainScheduling";
 import {
   RouteCorridor,
   StatusPill,
@@ -148,6 +153,18 @@ export default function TrainScheduleTrackPage() {
   const recordCheckpoint = useMutation(
     api.trainScheduling.recordCheckpoint.mutationOptions(),
   );
+  // Yard work drives the log-pass modal: which bookings board/alight per stop.
+  const yardWorkQuery = useQuery(
+    api.trainScheduling.yardWork.queryOptions({
+      input: { scheduleId: scheduleId ?? "" },
+      enabled: Boolean(scheduleId) && trackQuery.data?.status === "DISPATCHED",
+    }),
+  );
+  const [yardModal, setYardModal] = useState<{
+    station: TrackStation;
+    isFinal: boolean;
+    alreadyLogged: boolean;
+  } | null>(null);
 
   if (trackQuery.isLoading) {
     return (
@@ -181,8 +198,26 @@ export default function TrainScheduleTrackPage() {
   const inTransit = track.status === "DISPATCHED";
   const arrived = track.status === "ARRIVED";
 
+  // Yard work at a station: boarders not yet loaded, and loaded bookings that
+  // alight there. When either exists, logging the pass goes through the modal
+  // so the operator sees (and can act on) both lists; empty yards log directly.
+  const yardWorkFor = (station: TrackStation | undefined) =>
+    yardWorkQuery.data?.yards.find((y) => y.yardId === station?.yardId);
+  const stationHasWork = (station: TrackStation | undefined) => {
+    const yard = yardWorkFor(station);
+    return Boolean(
+      yard &&
+        (yard.toLoad.some((r) => !r.loadedAt) || yard.toUnload.some((r) => r.canUnload)),
+    );
+  };
+
   const handleLog = (sequenceNo: number) => {
+    const station = track.stations.find((s) => s.sequenceNo === sequenceNo);
     const isFinal = sequenceNo === track.stations[totalStations - 1]?.sequenceNo;
+    if (station && stationHasWork(station)) {
+      setYardModal({ station, isFinal, alreadyLogged: false });
+      return;
+    }
     recordCheckpoint.mutate(
       { id: scheduleId, payload: { sequenceNo } },
       {
@@ -203,6 +238,15 @@ export default function TrainScheduleTrackPage() {
     );
   };
 
+  // "Forgot to load" catch: while the train sits at the current station, any
+  // boarder there that is still unloaded can be loaded until the next pass.
+  const currentStationObj = track.stations.find(
+    (s) => s.sequenceNo === track.currentSequenceNo,
+  );
+  const currentYard = canLog ? yardWorkFor(currentStationObj) : undefined;
+  const forgottenBoarders =
+    currentYard?.toLoad.filter((r) => !r.loadedAt) ?? [];
+
   return (
     <PageContainer>
       <Button
@@ -416,6 +460,43 @@ export default function TrainScheduleTrackPage() {
             }
             onLogCheckpoint={handleLog}
           />
+
+          {/* Cargo the operator forgot: boarders at the CURRENT station stay
+              loadable until the next pass is logged. */}
+          {currentStationObj && forgottenBoarders.length > 0 ? (
+            <Alert
+              color="yellow"
+              variant="light"
+              radius="md"
+              icon={<PackageCheck size={16} />}
+              title={`${forgottenBoarders.length} booking${
+                forgottenBoarders.length === 1 ? "" : "s"
+              } at ${currentStationObj.label} not loaded yet`}
+            >
+              <Group justify="space-between" align="center" wrap="wrap" gap="sm">
+                <Text size="sm">
+                  The train is at {currentStationObj.label} — cargo boarding here can
+                  still be loaded before the next station is logged.
+                </Text>
+                <Button
+                  size="compact-sm"
+                  variant="light"
+                  color="yellow"
+                  onClick={() =>
+                    setYardModal({
+                      station: currentStationObj,
+                      isFinal:
+                        currentStationObj.sequenceNo ===
+                        track.stations[totalStations - 1]?.sequenceNo,
+                      alreadyLogged: true,
+                    })
+                  }
+                >
+                  Open yard work
+                </Button>
+              </Group>
+            </Alert>
+          ) : null}
         </Stack>
       </Paper>
 
@@ -505,6 +586,15 @@ export default function TrainScheduleTrackPage() {
           </Timeline>
         )}
       </Paper>
+
+      <LogPassYardWorkModal
+        opened={yardModal !== null}
+        onClose={() => setYardModal(null)}
+        scheduleId={scheduleId}
+        station={yardModal?.station ?? null}
+        isFinal={yardModal?.isFinal ?? false}
+        alreadyLogged={yardModal?.alreadyLogged ?? false}
+      />
     </PageContainer>
   );
 }

apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx

@@ -398,11 +398,8 @@ export default function TrainScheduleV2DetailPage() {
       !b.loadedAt &&
       !["IN_TRANSIT", "COMPLETED"].includes(b.status ?? ""),
   ).length;
-  // Import-Djibouti trains are HARD-blocked from dispatch until loading is
-  // confirmed in the workspace — surface it as a blocker, not just a warning.
-  const loadingBlocksDispatch =
-    schedule.requiresLoadingConfirmation === true &&
-    schedule.loadingConfirmed !== true;
+  // No loading hard-block: bookings may board mid-corridor, so loading happens
+  // per yard from the track page's log-pass flow. Everything below is advisory.
   const hasDispatchWarnings =
     unassignedCount > 0 || unloadedCount > 0 || intercityNotLoadedCount > 0;
 
@@ -1271,22 +1268,6 @@ export default function TrainScheduleV2DetailPage() {
             undone.
           </Text>
 
-          {loadingBlocksDispatch ? (
-            <Alert
-              color="red"
-              variant="light"
-              radius="md"
-              icon={<AlertTriangle size={18} />}
-              title="Loading not confirmed"
-            >
-              This import train cannot depart until loading is confirmed. Use{" "}
-              <Text span fw={700}>
-                Confirm loading
-              </Text>{" "}
-              in the Workspace tab first.
-            </Alert>
-          ) : null}
-
           {hasDispatchWarnings ? (
             <Alert
               color="orange"
@@ -1309,8 +1290,9 @@ export default function TrainScheduleV2DetailPage() {
                     <Text span fw={700}>
                       {unloadedCount}
                     </Text>{" "}
-                    wagon-assigned booking{unloadedCount === 1 ? "" : "s"} still marked
-                    unloaded
+                    wagon-assigned booking{unloadedCount === 1 ? "" : "s"} not loaded
+                    yet — mid-route boarders load from the track page when the train
+                    reaches their yard
                   </List.Item>
                 ) : null}
                 {intercityNotLoadedCount > 0 ? (
@@ -1350,7 +1332,6 @@ export default function TrainScheduleV2DetailPage() {
               color="edr-green"
               leftSection={<Send size={16} />}
               loading={dispatch.isPending}
-              disabled={loadingBlocksDispatch}
               onClick={() => void runDispatch()}
             >
               {hasDispatchWarnings ? "Dispatch anyway" : "Dispatch train"}

apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx

@@ -55,6 +55,8 @@ import { keepPreviousData, useMutation, useQuery } from "@tanstack/react-query";
 import { api } from "@/services/api";
 import { formatRouteLabel } from "@/services/routes.service";
 import { useToast } from "@/hooks/use-toast";
+import { useAuth } from "@/auth/useAuth";
+import { canCreateSchedule } from "@/lib/permissions";
 import type {
   FreightType,
   TrainScheduleListFilters,
@@ -99,6 +101,8 @@ const parseError = (error: unknown, fallback: string) => {
 export default function TrainScheduleV2ListPage() {
   const navigate = useNavigate();
   const { toast } = useToast();
+  const { user } = useAuth();
+  const canCreate = canCreateSchedule(user);
   const { viewMode, setViewMode } = useFleetViewMode("train-scheduling-v2");
   const { pagination, setPagination } = usePagination({ pageSize: 10 });
   const [search, setSearch] = useState("");
@@ -550,9 +554,11 @@ export default function TrainScheduleV2ListPage() {
         title="Train Schedules"
         subtitle="Operational train scheduling with full allocation workflow."
         action={
-          <Button leftSection={<Train size={18} />} onClick={() => setCreateOpen(true)}>
-            New schedule
-          </Button>
+          canCreate ? (
+            <Button leftSection={<Train size={18} />} onClick={() => setCreateOpen(true)}>
+              New schedule
+            </Button>
+          ) : undefined
         }
       />