Merge pull request #941 from Tria-plc/freight/feat/fixes-v1

Freight/feat/fixes v1

apps/edr-freight-web/backoffice/src/pages/customers/CustomerDetailPage.tsx

@@ -56,6 +56,8 @@ import {
   humanize,
 } from "@/components/customers";
 import { KpiStrip, PageContainer, PageHeader } from "@/components/page";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 import {
   downloadBookingFile,
   fetchViewableFile,
@@ -108,6 +110,7 @@ export default function CustomerDetailPage() {
   const { id } = useParams<{ id: string }>();
   const navigate = useNavigate();
   const { view, viewer } = useFileViewer();
+  const { user } = useAuth();
 
   const { data: company, isLoading } = useQuery(
     api.customers.getById.queryOptions({
@@ -180,6 +183,11 @@ export default function CustomerDetailPage() {
   // API's rule exactly, so no button is offered that the server would reject.
   const stillOnboarding = company ? isOnboardingDraft(company) : false;
   const canReview = company ? hasSubmittedOnboarding(company) : true;
+  // Workflow gate (above) AND authority: asking the customer to correct a
+  // document is a `customers:verify` action, so a view-only reviewer reads the
+  // documents but is not offered the request-change control.
+  const canRequestDocChange =
+    canReview && hasPermission(user, FREIGHT_PERMS.customers.verify);
 
   /** Document the reviewer is asking the customer to correct; null = closed. */
   const [changeRequestDoc, setChangeRequestDoc] =
@@ -446,7 +454,7 @@ export default function CustomerDetailPage() {
             >
               <Download size={16} />
             </ActionIcon>
-            {canReview && (
+            {canRequestDocChange && (
               <ActionIcon
                 component="button"
                 type="button"
@@ -468,7 +476,7 @@ export default function CustomerDetailPage() {
         ),
       },
     ],
-    [view, canReview],
+    [view, canRequestDocChange],
   );
 
   const paymentColumns: ColumnDef<CustomerPayment>[] = useMemo(