From 70b1f751589fb97d457b418348315dddcbcc5102 Mon Sep 17 00:00:00 2001
From: Abubeker Yasin <dev.abubeker@gmail.com>
Date: Sat, 5 Sep 2026 09:23:22 +0300
Subject: [PATCH] fix: ( permissions) accept payments:manage for luggage
 charges

---
 .../modules/excess-baggage/excess-baggage.controller.ts  | 9 ++++++++-
 .../backoffice/src/app/excess-baggage/page.tsx           | 4 ++--
 .../backoffice/src/app/tickets/page.tsx                  | 4 ++--
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/apps/edr-passenger-api/src/modules/excess-baggage/excess-baggage.controller.ts b/apps/edr-passenger-api/src/modules/excess-baggage/excess-baggage.controller.ts
index 4e5478093..f5866c5bd 100644
--- a/apps/edr-passenger-api/src/modules/excess-baggage/excess-baggage.controller.ts
+++ b/apps/edr-passenger-api/src/modules/excess-baggage/excess-baggage.controller.ts
@@ -22,7 +22,14 @@ import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
  * included — could raise a charge.
  */
 const CanCharge = () =>
-  PassengerStaff([PASSENGER_PERMS.excessBaggage.charge, PASSENGER_PERMS.bookings.manage, PASSENGER_PERMS.admin]);
+  PassengerStaff([
+    PASSENGER_PERMS.excessBaggage.charge,
+    // Same shape as the supplementary-charge guard in payments.controller.ts: both bill a
+    // passenger and send them a pay link, so whoever manages payments can do either.
+    PASSENGER_PERMS.payments.manage,
+    PASSENGER_PERMS.bookings.manage,
+    PASSENGER_PERMS.admin,
+  ]);
 
 class UpsertBaggageAllowanceDto {
   @IsString() seatClassId: string;
diff --git a/apps/edr-passenger-web/backoffice/src/app/excess-baggage/page.tsx b/apps/edr-passenger-web/backoffice/src/app/excess-baggage/page.tsx
index 5386f8f4c..38763da7c 100644
--- a/apps/edr-passenger-web/backoffice/src/app/excess-baggage/page.tsx
+++ b/apps/edr-passenger-web/backoffice/src/app/excess-baggage/page.tsx
@@ -10,7 +10,7 @@ import Modal from '@/components/ui/Modal';
 import { excessBaggageApi, apiClient, bookingsApi } from '@/lib/api';
 import { formatDateTime, formatCurrency } from '@/lib/utils';
 import { useAuthStore } from '@/lib/auth-store';
-import { useWritePermission } from '@/lib/use-permission';
+import { useAnyPermission, useWritePermission } from '@/lib/use-permission';
 import { PermissionGuard } from '@/components/layout/PermissionGuard';
 import { PERMS } from '@/lib/permissions';
 
@@ -26,7 +26,7 @@ function ExcessBaggagePageContent() {
   const queryClient = useQueryClient();
 
   // Logging or resending a luggage charge bills the passenger and sends a pay link.
-  const canCharge = useWritePermission(PERMS.excessBaggage.charge, PERMS.bookings.manage);
+  const canCharge = useAnyPermission([PERMS.excessBaggage.charge, PERMS.payments.manage, PERMS.bookings.manage, PERMS.admin]);
   const [filters, setFilters] = useState({ status: '', bookingRef: '', dateFrom: '', dateTo: '', page: '1' });
   const [showExtraFilters, setShowExtraFilters] = useState(false);
   const user = useAuthStore((s) => s.user);
diff --git a/apps/edr-passenger-web/backoffice/src/app/tickets/page.tsx b/apps/edr-passenger-web/backoffice/src/app/tickets/page.tsx
index ed2ad79cb..df23f9ee1 100644
--- a/apps/edr-passenger-web/backoffice/src/app/tickets/page.tsx
+++ b/apps/edr-passenger-web/backoffice/src/app/tickets/page.tsx
@@ -16,7 +16,7 @@ import { formatDateTime, formatCurrency, formatDateTimeShort } from '@/lib/utils
 import { useAuthStore } from '@/lib/auth-store';
 import { PermissionGuard } from '@/components/layout/PermissionGuard';
 import { PERMS } from '@/lib/permissions';
-import { usePermission, useWritePermission, useDeletePermission } from '@/lib/use-permission';
+import { useAnyPermission, useDeletePermission, usePermission, useWritePermission } from '@/lib/use-permission';
 
 function TicketsPageContent() {
   const [filters, setFilters] = useState({ search: '', status: '', originStationId: '', destinationStationId: '', departureDate: '', arrivalDate: '', dateFrom: '', dateTo: '', coachId: '' });
@@ -76,7 +76,7 @@ function TicketsPageContent() {
   const canEditTicket = useWritePermission(PERMS.tickets.edit, PERMS.tickets.manage);
   const canDelete = useDeletePermission(PERMS.tickets.delete);
   // Logging luggage bills the passenger and sends a pay link, so it is its own grant.
-  const canLogBaggage = useWritePermission(PERMS.excessBaggage.charge, PERMS.bookings.manage);
+  const canLogBaggage = useAnyPermission([PERMS.excessBaggage.charge, PERMS.payments.manage, PERMS.bookings.manage, PERMS.admin]);
   const canBoard = useWritePermission(PERMS.tickets.board, PERMS.tickets.manage);
 
   const { data, isLoading, error } = useQuery({