user permition

apps/edr-freight-api/src/modules/drivers/drivers.controller.ts

@@ -13,7 +13,8 @@ import {
 } from '@nestjs/common';
 import { AnyFilesInterceptor } from '@nestjs/platform-express';
 import { ApiBearerAuth, ApiConsumes, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { FleetManage, FleetView } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { DriversService } from './drivers.service';
 import { CreateDriverDto } from './dto/create-driver.dto';
 import { UpdateDriverDto } from './dto/update-driver.dto';
@@ -22,7 +23,7 @@ import { FleetHistoryService } from '../fleet-history/fleet-history.service';
 @ApiTags('drivers')
 @ApiBearerAuth()
 @Controller('drivers')
-@FleetView()
+@BookingStaff(FREIGHT_PERMS.drivers.view)
 export class DriversController {
   constructor(
     private readonly driversService: DriversService,
@@ -30,7 +31,7 @@ export class DriversController {
   ) {}
 
   @Post()
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.drivers.create)
   @ApiOperation({ summary: 'Create a new driver' })
   create(@Body() createDriverDto: CreateDriverDto) {
     return this.driversService.create(createDriverDto);
@@ -69,7 +70,7 @@ export class DriversController {
   }
 
   @Post(':id/documents')
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.drivers.update)
   @ApiConsumes('multipart/form-data')
   @UseInterceptors(AnyFilesInterceptor())
   @ApiOperation({ summary: 'Upload driver documents (code driver_docs)' })
@@ -87,14 +88,14 @@ export class DriversController {
   }
 
   @Delete(':id/documents/:fileId')
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.drivers.update)
   @ApiOperation({ summary: 'Delete a driver document' })
   removeDocument(@Param('fileId', ParseUUIDPipe) fileId: string) {
     return this.driversService.removeDocument(fileId);
   }
 
   @Patch(':id')
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.drivers.update)
   @ApiOperation({ summary: 'Update a driver' })
   update(
     @Param('id', ParseUUIDPipe) id: string,
@@ -104,7 +105,7 @@ export class DriversController {
   }
 
   @Delete(':id')
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.drivers.delete)
   @ApiOperation({ summary: 'Delete a driver' })
   remove(@Param('id', ParseUUIDPipe) id: string) {
     return this.driversService.remove(id);

apps/edr-freight-api/src/modules/first-mile/first-mile.controller.ts

@@ -14,7 +14,8 @@ import {
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
-import { TrainSchedulingManage, TrainSchedulingView } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 
 import { CreateFirstMileDto } from './dto/create-first-mile.dto';
 import { UpdateFirstMileDto } from './dto/update-first-mile.dto';
@@ -27,7 +28,7 @@ import { FirstMileInvoiceService } from './first-mile-invoice.service';
 @ApiTags('first-mile')
 @ApiBearerAuth()
 @Controller('first-mile')
-@TrainSchedulingView()
+@BookingStaff(FREIGHT_PERMS.firstMile.view)
 export class FirstMileController {
   constructor(
     private readonly firstMileService: FirstMileService,
@@ -63,27 +64,28 @@ export class FirstMileController {
   }
 
   @Get('acceptitem/:id')
+  @BookingStaff(FREIGHT_PERMS.firstMile.accept)
   @ApiOperation({ summary: 'Get a first-mile accep by ID' })
   acceptItem(@Param('id', ParseUUIDPipe) id: string) {
     return this.firstMileService.acceptBooking(id);
   }
 
   @Post('accept/:reference')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.accept)
   @ApiOperation({ summary: 'Accept a paid booking and create a first-mile leg' })
   acceptBooking(@Param('reference') reference: string) {
     return this.firstMileService.acceptBookingByReference(reference);
   }
 
   @Post()
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.create)
   @ApiOperation({ summary: 'Create a first-mile leg' })
   create(@Body() dto: CreateFirstMileDto) {
     return this.firstMileService.create(dto);
   }
 
   @Patch(':id')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.update)
   @ApiOperation({ summary: 'Update a first-mile leg' })
   async update(@Param('id', ParseUUIDPipe) id: string, @Body() dto: UpdateFirstMileDto) {
     // No invoice side-effects — invoices are generated only via the explicit
@@ -92,7 +94,7 @@ export class FirstMileController {
   }
 
   @Post(':id/invoice')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.generateInvoice)
   @ApiOperation({ summary: 'Generate the first-mile delivery-fee invoice' })
   async generateInvoice(@Param('id', ParseUUIDPipe) id: string) {
     const record = await this.firstMileService.findById(id);
@@ -106,7 +108,7 @@ export class FirstMileController {
   }
 
   @Post(':id/vehicles')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.assignVehicles)
   @ApiOperation({ summary: 'Set the vehicles assigned to a first-mile pickup (multi-truck)' })
   async setVehicles(
     @Param('id', ParseUUIDPipe) id: string,
@@ -116,7 +118,7 @@ export class FirstMileController {
   }
 
   @Post(':id/distances')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.setDistances)
   @ApiOperation({ summary: 'Set per-vehicle actual distances (does not generate an invoice)' })
   async setDistances(
     @Param('id', ParseUUIDPipe) id: string,
@@ -126,7 +128,7 @@ export class FirstMileController {
   }
 
   @Delete(':id')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.firstMile.delete)
   @HttpCode(HttpStatus.NO_CONTENT)
   @ApiOperation({ summary: 'Soft-delete a first-mile leg' })
   remove(@Param('id', ParseUUIDPipe) id: string) {

apps/edr-freight-api/src/modules/fuel/fuel.controller.ts

@@ -1,26 +1,40 @@
 import { Controller, Post, Get, Body, Param, Query } from '@nestjs/common';
-import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { ApiBearerAuth, ApiTags, ApiOperation } from '@nestjs/swagger';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { FuelService } from './fuel.service';
 import { CreateFuelPurchaseDto } from './dto/create-fuel-purchase.dto';
 
+// Stats feed the Financial Reports + Fleet Dashboard pages, so their viewers may
+// read them without full fuel access.
+const FUEL_STATS_PERMS = [
+  FREIGHT_PERMS.fuel.view,
+  FREIGHT_PERMS.fleetReports.view,
+  FREIGHT_PERMS.fleetDashboard.view,
+];
+
 @ApiTags('Fuel Management')
+@ApiBearerAuth()
 @Controller('fuel')
 export class FuelController {
   constructor(private readonly fuelService: FuelService) {}
 
   @Post('purchases')
+  @BookingStaff(FREIGHT_PERMS.fuel.create)
   @ApiOperation({ summary: 'Record fuel purchase' })
   async recordFuelPurchase(@Body() dto: CreateFuelPurchaseDto) {
     return this.fuelService.recordFuelPurchase(dto);
   }
 
   @Get('purchases')
+  @BookingStaff(FREIGHT_PERMS.fuel.view)
   @ApiOperation({ summary: 'Get all fuel purchases' })
   async getAllFuelPurchases() {
     return this.fuelService.getAllFuelPurchases();
   }
 
   @Get('purchases/:vehicleId')
+  @BookingStaff(FREIGHT_PERMS.fuel.view)
   @ApiOperation({ summary: 'Get fuel purchases for vehicle' })
   async getFuelPurchases(
     @Param('vehicleId') vehicleId: string,
@@ -35,6 +49,7 @@ export class FuelController {
   }
 
   @Get('consumption/:vehicleId/:month')
+  @BookingStaff(FREIGHT_PERMS.fuel.view)
   @ApiOperation({ summary: 'Get monthly fuel consumption' })
   async getMonthlyConsumption(
     @Param('vehicleId') vehicleId: string,
@@ -44,12 +59,14 @@ export class FuelController {
   }
 
   @Get('stats')
+  @BookingStaff(FUEL_STATS_PERMS)
   @ApiOperation({ summary: 'Get fleet-wide fuel statistics' })
   async getFleetFuelStats(@Query('months') months: number = 12) {
     return this.fuelService.getFleetFuelStats(months);
   }
 
   @Get('stats/:vehicleId')
+  @BookingStaff(FUEL_STATS_PERMS)
   @ApiOperation({ summary: 'Get fuel statistics for vehicle' })
   async getVehicleFuelStats(
     @Param('vehicleId') vehicleId: string,

apps/edr-freight-api/src/modules/last-mile/last-mile.controller.ts

@@ -14,7 +14,8 @@ import {
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
-import { TrainSchedulingManage, TrainSchedulingView } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 
 import { CreateLastMileDto } from './dto/create-last-mile.dto';
 import { UpdateLastMileDto } from './dto/update-last-mile.dto';
@@ -27,7 +28,7 @@ import { LastMileInvoiceService } from './last-mile-invoice.service';
 @ApiTags('last-mile')
 @ApiBearerAuth()
 @Controller('last-mile')
-@TrainSchedulingView()
+@BookingStaff(FREIGHT_PERMS.lastMile.view)
 export class LastMileController {
   constructor(
     private readonly lastMileService: LastMileService,
@@ -63,21 +64,21 @@ export class LastMileController {
   }
 
   @Post('accept/:reference')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.accept)
   @ApiOperation({ summary: 'Accept a paid booking and create a last-mile leg' })
   acceptBooking(@Param('reference') reference: string) {
     return this.lastMileService.acceptBookingByReference(reference);
   }
 
   @Post()
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.create)
   @ApiOperation({ summary: 'Create a last-mile leg' })
   create(@Body() dto: CreateLastMileDto) {
     return this.lastMileService.create(dto);
   }
 
   @Patch(':id')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.update)
   @ApiOperation({ summary: 'Update a last-mile leg' })
   async update(@Param('id', ParseUUIDPipe) id: string, @Body() dto: UpdateLastMileDto) {
     // No invoice side-effects here — invoices are generated only via the
@@ -86,7 +87,7 @@ export class LastMileController {
   }
 
   @Delete(':id')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.delete)
   @HttpCode(HttpStatus.NO_CONTENT)
   @ApiOperation({ summary: 'Soft-delete a last-mile leg' })
   remove(@Param('id', ParseUUIDPipe) id: string) {
@@ -95,7 +96,7 @@ export class LastMileController {
 
 
   @Post(':id/vehicles')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.assignVehicles)
   @ApiOperation({ summary: 'Set the vehicles assigned to a last-mile delivery (multi-truck)' })
   async setVehicles(
     @Param('id', ParseUUIDPipe) id: string,
@@ -105,7 +106,7 @@ export class LastMileController {
   }
 
   @Post(':id/distances')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.setDistances)
   @ApiOperation({ summary: 'Set per-vehicle actual distances (does not generate an invoice)' })
   async setDistances(
     @Param('id', ParseUUIDPipe) id: string,
@@ -115,7 +116,7 @@ export class LastMileController {
   }
 
   @Post(':id/invoice')
-  @TrainSchedulingManage()
+  @BookingStaff(FREIGHT_PERMS.lastMile.generateInvoice)
   @ApiOperation({ summary: 'Generate the delivery-fee invoice for a last-mile leg' })
   async generateInvoice(@Param('id', ParseUUIDPipe) id: string) {
     const record = await this.lastMileService.findById(id);

apps/edr-freight-api/src/modules/maintenance/maintenance.controller.ts

@@ -1,5 +1,7 @@
 import { Controller, Post, Get, Patch, Delete, Body, Param, Query } from '@nestjs/common';
-import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { ApiBearerAuth, ApiTags, ApiOperation } from '@nestjs/swagger';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { MaintenanceService } from './maintenance.service';
 import { MaintenanceDepthService } from './maintenance-depth.service';
 import { CreateMaintenanceScheduleDto, CreateMaintenanceCostDto, UpdateMaintenanceScheduleDto } from './dto/create-maintenance.dto';
@@ -13,6 +15,7 @@ import {
 import { WorkOrderStatus } from './entities/work-order.entity';
 
 @ApiTags('Maintenance Management')
+@ApiBearerAuth()
 @Controller('maintenance')
 export class MaintenanceController {
   constructor(
@@ -21,42 +24,49 @@ export class MaintenanceController {
   ) {}
 
   @Post('schedules')
+  @BookingStaff(FREIGHT_PERMS.maintenance.create)
   @ApiOperation({ summary: 'Schedule maintenance' })
   async scheduleMaintenanceAsync(@Body() dto: CreateMaintenanceScheduleDto) {
     return this.maintenanceService.scheduleMaintenanceAsync(dto);
   }
 
   @Post('costs')
+  @BookingStaff(FREIGHT_PERMS.maintenance.create)
   @ApiOperation({ summary: 'Record maintenance cost' })
   async recordCost(@Body() dto: CreateMaintenanceCostDto) {
     return this.maintenanceService.recordMaintenanceCost(dto);
   }
 
   @Patch('schedules/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.update)
   @ApiOperation({ summary: 'Update maintenance schedule' })
   async updateSchedule(@Param('id') id: string, @Body() dto: UpdateMaintenanceScheduleDto) {
     return this.maintenanceService.updateMaintenanceSchedule(id, dto);
   }
 
   @Get('upcoming/:vehicleId')
+  @BookingStaff(FREIGHT_PERMS.maintenance.view)
   @ApiOperation({ summary: 'Get upcoming maintenance' })
   async getUpcoming(@Param('vehicleId') vehicleId: string) {
     return this.maintenanceService.getUpcomingMaintenance(vehicleId);
   }
 
   @Get('history/:vehicleId')
+  @BookingStaff(FREIGHT_PERMS.maintenance.view)
   @ApiOperation({ summary: 'Get maintenance history' })
   async getHistory(@Param('vehicleId') vehicleId: string) {
     return this.maintenanceService.getMaintenanceHistory(vehicleId);
   }
 
   @Get('stats')
+  @BookingStaff([FREIGHT_PERMS.maintenance.view, FREIGHT_PERMS.fleetReports.view, FREIGHT_PERMS.fleetDashboard.view])
   @ApiOperation({ summary: 'Get fleet-wide maintenance statistics' })
   async getFleetStats() {
     return this.maintenanceService.getFleetMaintenanceStats();
   }
 
   @Get('stats/:vehicleId')
+  @BookingStaff([FREIGHT_PERMS.maintenance.view, FREIGHT_PERMS.fleetReports.view, FREIGHT_PERMS.fleetDashboard.view])
   @ApiOperation({ summary: 'Get maintenance statistics' })
   async getStats(@Param('vehicleId') vehicleId: string) {
     return this.maintenanceService.getVehicleMaintenanceStats(vehicleId);
@@ -65,12 +75,14 @@ export class MaintenanceController {
   // ---- Work Orders ----
 
   @Post('work-orders')
+  @BookingStaff(FREIGHT_PERMS.maintenance.create)
   @ApiOperation({ summary: 'Create work order' })
   async createWorkOrder(@Body() dto: CreateWorkOrderDto) {
     return this.maintenanceDepthService.createWorkOrder(dto);
   }
 
   @Get('work-orders')
+  @BookingStaff(FREIGHT_PERMS.maintenance.view)
   @ApiOperation({ summary: 'List work orders' })
   async listWorkOrders(
     @Query('vehicleId') vehicleId?: string,
@@ -80,18 +92,21 @@ export class MaintenanceController {
   }
 
   @Get('work-orders/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.view)
   @ApiOperation({ summary: 'Get work order' })
   async getWorkOrder(@Param('id') id: string) {
     return this.maintenanceDepthService.findWorkOrderById(id);
   }
 
   @Patch('work-orders/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.update)
   @ApiOperation({ summary: 'Update work order' })
   async updateWorkOrder(@Param('id') id: string, @Body() dto: UpdateWorkOrderDto) {
     return this.maintenanceDepthService.updateWorkOrder(id, dto);
   }
 
   @Delete('work-orders/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.delete)
   @ApiOperation({ summary: 'Delete work order' })
   async deleteWorkOrder(@Param('id') id: string) {
     return this.maintenanceDepthService.deleteWorkOrder(id);
@@ -100,12 +115,14 @@ export class MaintenanceController {
   // ---- Parts / Tires ----
 
   @Post('parts')
+  @BookingStaff(FREIGHT_PERMS.maintenance.create)
   @ApiOperation({ summary: 'Create part' })
   async createPart(@Body() dto: CreatePartDto) {
     return this.maintenanceDepthService.createPart(dto);
   }
 
   @Get('parts')
+  @BookingStaff(FREIGHT_PERMS.maintenance.view)
   @ApiOperation({ summary: 'List parts / tire inventory' })
   async listParts(
     @Query('category') category?: string,
@@ -118,12 +135,14 @@ export class MaintenanceController {
   }
 
   @Patch('parts/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.update)
   @ApiOperation({ summary: 'Update part' })
   async updatePart(@Param('id') id: string, @Body() dto: UpdatePartDto) {
     return this.maintenanceDepthService.updatePart(id, dto);
   }
 
   @Delete('parts/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.delete)
   @ApiOperation({ summary: 'Delete part' })
   async deletePart(@Param('id') id: string) {
     return this.maintenanceDepthService.deletePart(id);
@@ -132,18 +151,21 @@ export class MaintenanceController {
   // ---- Warranties ----
 
   @Post('warranties')
+  @BookingStaff(FREIGHT_PERMS.maintenance.create)
   @ApiOperation({ summary: 'Create warranty' })
   async createWarranty(@Body() dto: CreateWarrantyDto) {
     return this.maintenanceDepthService.createWarranty(dto);
   }
 
   @Get('warranties')
+  @BookingStaff(FREIGHT_PERMS.maintenance.view)
   @ApiOperation({ summary: 'List warranties' })
   async listWarranties(@Query('vehicleId') vehicleId?: string) {
     return this.maintenanceDepthService.findWarranties({ vehicleId });
   }
 
   @Delete('warranties/:id')
+  @BookingStaff(FREIGHT_PERMS.maintenance.delete)
   @ApiOperation({ summary: 'Delete warranty' })
   async deleteWarranty(@Param('id') id: string) {
     return this.maintenanceDepthService.deleteWarranty(id);

apps/edr-freight-api/src/modules/vehicles/vehicles.controller.ts

@@ -10,7 +10,8 @@ import {
   ParseUUIDPipe,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { FleetManage, FleetView } from '../../common/booking-guards';
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { VehiclesService } from './vehicles.service';
 import { CreateVehicleDto } from './dto/create-vehicle.dto';
 import { UpdateVehicleDto } from './dto/update-vehicle.dto';
@@ -19,7 +20,7 @@ import { FleetHistoryService } from '../fleet-history/fleet-history.service';
 @ApiTags('vehicles')
 @ApiBearerAuth()
 @Controller('vehicles')
-@FleetView()
+@BookingStaff(FREIGHT_PERMS.vehicles.view)
 export class VehiclesController {
   constructor(
     private readonly vehiclesService: VehiclesService,
@@ -27,7 +28,7 @@ export class VehiclesController {
   ) {}
 
   @Post()
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.vehicles.create)
   @ApiOperation({ summary: 'Create a new vehicle' })
   create(@Body() createVehicleDto: CreateVehicleDto) {
     return this.vehiclesService.create(createVehicleDto);
@@ -68,7 +69,7 @@ export class VehiclesController {
   }
 
   @Patch(':id')
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.vehicles.update)
   @ApiOperation({ summary: 'Update a vehicle' })
   update(
     @Param('id', ParseUUIDPipe) id: string,
@@ -78,7 +79,7 @@ export class VehiclesController {
   }
 
   @Delete(':id')
-  @FleetManage()
+  @BookingStaff(FREIGHT_PERMS.vehicles.delete)
   @ApiOperation({ summary: 'Delete a vehicle' })
   remove(@Param('id', ParseUUIDPipe) id: string) {
     return this.vehiclesService.remove(id);

apps/edr-freight-web/backoffice/src/App.tsx

@@ -216,13 +216,13 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "First Mile",
         href: "/dashboard/operations/first-mile",
         icon: <Truck />,
-        permission: FREIGHT_PERMS.trainScheduling.view,
+        permission: FREIGHT_PERMS.firstMile.view,
       },
       {
         label: "Last Mile",
         href: "/dashboard/operations/last-mile",
         icon: <Truck />,
-        permission: FREIGHT_PERMS.trainScheduling.view,
+        permission: FREIGHT_PERMS.lastMile.view,
       },
     ],
   },
@@ -233,7 +233,7 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "Fleet Dashboard",
         href: "/dashboard/fleet-dashboard",
         icon: <LayoutDashboard />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.fleetDashboard.view,
       },
       {
         label: "Routes",
@@ -263,43 +263,43 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "Vehicles",
         href: "/dashboard/vehicles",
         icon: <Truck />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.vehicles.view,
       },
       {
         label: "Drivers",
         href: "/dashboard/drivers",
         icon: <Users />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.drivers.view,
       },
       {
         label: "Track Vehicles",
         href: "/dashboard/tracking",
         icon: <MapPin />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.tracking.view,
       },
       {
         label: "Fuel Purchases",
         href: "/dashboard/fuel-purchases",
         icon: <Truck />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.fuel.view,
       },
       {
         label: "Fuel Analytics",
         href: "/dashboard/fuel-stats",
         icon: <Truck />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.fuel.view,
       },
       {
         label: "Maintenance",
         href: "/dashboard/maintenance",
         icon: <Truck />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.maintenance.view,
       },
       {
         label: "Work Orders",
         href: "/dashboard/work-orders",
         icon: <SlidersHorizontal />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.maintenance.view,
       },
       {
         label: "Compliance & Alerts",
@@ -323,7 +323,7 @@ const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] => [
         label: "Financial Reports",
         href: "/dashboard/financial-reports",
         icon: <Wallet />,
-        permission: FREIGHT_PERMS.fleet.view,
+        permission: FREIGHT_PERMS.fleetReports.view,
       },
       // {
       //   label: "Containers",
@@ -896,7 +896,7 @@ const App = () => {
         <Route
           path="operations/first-mile"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+            <RequirePermission permission={FREIGHT_PERMS.firstMile.view}>
               <FirstMilePage />
             </RequirePermission>
           }
@@ -904,7 +904,7 @@ const App = () => {
         <Route
           path="operations/last-mile"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.trainScheduling.view}>
+            <RequirePermission permission={FREIGHT_PERMS.lastMile.view}>
               <LastMilePage />
             </RequirePermission>
           }
@@ -1000,7 +1000,7 @@ const App = () => {
         <Route
           path="vehicles"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.vehicles.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -1008,7 +1008,7 @@ const App = () => {
         <Route
           path="vehicles/:id"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.vehicles.view}>
               <VehicleDetailPage />
             </RequirePermission>
           }
@@ -1016,7 +1016,7 @@ const App = () => {
         <Route
           path="drivers"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.drivers.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -1024,7 +1024,7 @@ const App = () => {
         <Route
           path="drivers/:id"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.drivers.view}>
               <DriverDetailPage />
             </RequirePermission>
           }
@@ -1086,7 +1086,7 @@ const App = () => {
         <Route
           path="fuel-purchases"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.fuel.view}>
               <FuelPurchasePage />
             </RequirePermission>
           }
@@ -1094,7 +1094,7 @@ const App = () => {
         <Route
           path="fuel-stats"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.fuel.view}>
               <FuelStatsPage />
             </RequirePermission>
           }
@@ -1102,7 +1102,7 @@ const App = () => {
         <Route
           path="maintenance"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.maintenance.view}>
               <MaintenancePage />
             </RequirePermission>
           }
@@ -1110,7 +1110,7 @@ const App = () => {
         <Route
           path="financial-reports"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.fleetReports.view}>
               <FinancialReportsPage />
             </RequirePermission>
           }
@@ -1118,7 +1118,7 @@ const App = () => {
         <Route
           path="fleet-dashboard"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.fleetDashboard.view}>
               <FleetDashboard />
             </RequirePermission>
           }
@@ -1126,7 +1126,7 @@ const App = () => {
         <Route
           path="tracking"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.tracking.view}>
               <TrackingPage />
             </RequirePermission>
           }
@@ -1150,7 +1150,7 @@ const App = () => {
         <Route
           path="work-orders"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission permission={FREIGHT_PERMS.maintenance.view}>
               <WorkOrdersPage />
             </RequirePermission>
           }