diff --git a/apps/edr-freight-web/backoffice/src/App.tsx b/apps/edr-freight-web/backoffice/src/App.tsx index 2dd0cbf73..255413271 100644 --- a/apps/edr-freight-web/backoffice/src/App.tsx +++ b/apps/edr-freight-web/backoffice/src/App.tsx @@ -573,9 +573,7 @@ const App = () => { + } @@ -583,12 +581,7 @@ const App = () => { + } @@ -596,9 +589,7 @@ const App = () => { + } @@ -606,9 +597,7 @@ const App = () => { + } @@ -616,9 +605,7 @@ const App = () => { + } @@ -626,9 +613,7 @@ const App = () => { + } @@ -636,9 +621,7 @@ const App = () => { + } @@ -659,12 +642,7 @@ const App = () => { + } @@ -672,12 +650,7 @@ const App = () => { + } @@ -765,9 +738,7 @@ const App = () => { + } @@ -791,9 +762,7 @@ const App = () => { + } @@ -816,9 +785,7 @@ const App = () => { + } @@ -826,9 +793,7 @@ const App = () => { + } @@ -845,10 +810,7 @@ const App = () => { path="contract-templates" element={ @@ -858,10 +820,7 @@ const App = () => { path="contract-templates/:code" element={ @@ -874,7 +833,6 @@ const App = () => { permission={[ FREIGHT_PERMS.settings.supportContent.view, FREIGHT_PERMS.settings.supportContent.manage, - FREIGHT_PERMS.admin, ]} > @@ -899,9 +857,7 @@ const App = () => { + } @@ -909,9 +865,7 @@ const App = () => { +
diff --git a/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx b/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx index 66bdf8ab3..4ebca89b4 100644 --- a/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx +++ b/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx @@ -196,22 +196,19 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] label: "Routes", href: "/dashboard/routes", icon: , - permission: [FREIGHT_PERMS.routes.view, FREIGHT_PERMS.fleet.view], + permission: FREIGHT_PERMS.routes.view, }, { label: "Locomotives", href: "/dashboard/locomotives", icon: , - permission: [ - FREIGHT_PERMS.locomotives.view, - FREIGHT_PERMS.fleet.view, - ], + permission: FREIGHT_PERMS.locomotives.view, }, { label: "Train Builder", href: "/dashboard/train-builder", icon: , - permission: [FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view], + permission: FREIGHT_PERMS.trains.view, }, // { @@ -223,7 +220,7 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] label: "Wagons", href: "/dashboard/wagons", icon: , - permission: [FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.fleet.view], + permission: FREIGHT_PERMS.wagons.view, }, { label: "Wagon Transfers", @@ -280,21 +277,23 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] label: "Compliance & Alerts", href: "/dashboard/compliance", icon: , - permission: [FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view], + permission: FREIGHT_PERMS.compliance.view, }, { label: "Incidents", href: "/dashboard/incidents", icon: , - // No dedicated backend key exists for incidents yet — stuck on the - // blanket fleet:view fallback until one is added. + // No dedicated backend key exists for incidents yet. Not part of + // the fleet.view/admin fallback cleanup — removing fleet.view + // here with nothing to replace it would lock the page to + // super-admin only, so it stays as the sole (if coarse) gate. permission: FREIGHT_PERMS.fleet.view, }, { label: "Procurement", href: "/dashboard/procurement", icon: , - permission: [FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view], + permission: FREIGHT_PERMS.procurement.view, }, { label: "Financial Reports", @@ -479,23 +478,20 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] label: "File settings", href: "/dashboard/file-settings", icon: , - permission: [FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin], + permission: FREIGHT_PERMS.settings.fileUpload.view, }, { label: "Dropdown settings", href: "/dashboard/dropdown-settings", icon: , - permission: [FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin], + permission: FREIGHT_PERMS.settings.dropdown.view, }, { label: "Contract templates", href: "/dashboard/contract-templates", icon: , // `view` opens the page; `read` alone is API-only and shows no menu. - permission: [ - FREIGHT_PERMS.settings.contractTemplates.view, - FREIGHT_PERMS.admin, - ], + permission: FREIGHT_PERMS.settings.contractTemplates.view, }, { label: "Portal content", @@ -504,7 +500,6 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] permission: [ FREIGHT_PERMS.settings.supportContent.view, FREIGHT_PERMS.settings.supportContent.manage, - FREIGHT_PERMS.admin, ], }, { @@ -527,12 +522,12 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[] { label: "Trade access", href: "/dashboard/configuration/trade-access", - permission: [FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin], + permission: FREIGHT_PERMS.tradeAccess.view, }, { label: "Exchange rate", href: "/dashboard/configuration/exchange-rate", - permission: [FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin], + permission: FREIGHT_PERMS.settings.exchangeRate.view, }, ], }, diff --git a/apps/edr-freight-web/backoffice/src/lib/permissions.ts b/apps/edr-freight-web/backoffice/src/lib/permissions.ts index 511017805..6e3de9528 100644 --- a/apps/edr-freight-web/backoffice/src/lib/permissions.ts +++ b/apps/edr-freight-web/backoffice/src/lib/permissions.ts @@ -658,19 +658,13 @@ export type FleetCrudResource = | "vehicles" | "drivers"; -/** - * Per-resource fleet CRUD check. The legacy coarse fleet:manage key still - * grants every action (mirrors the API's one-of guard fallback). - */ +/** Per-resource fleet CRUD check — each resource needs its own grant. */ export function canFleetAction( user: AuthUser | null | undefined, resource: FleetCrudResource, action: "create" | "update" | "delete", ): boolean { - return ( - hasPermission(user, FREIGHT_PERMS[resource][action]) || - hasPermission(user, FREIGHT_PERMS.fleet.manage) - ); + return hasPermission(user, FREIGHT_PERMS[resource][action]); } /** diff --git a/apps/edr-freight-web/backoffice/src/pages/dashboard/OverviewPage.tsx b/apps/edr-freight-web/backoffice/src/pages/dashboard/OverviewPage.tsx index 12bce6aae..008149adb 100644 --- a/apps/edr-freight-web/backoffice/src/pages/dashboard/OverviewPage.tsx +++ b/apps/edr-freight-web/backoffice/src/pages/dashboard/OverviewPage.tsx @@ -87,11 +87,7 @@ const TAB_ITEMS: Array<{ icon: TrainFront, kpiKey: "operations", metricKey: "wagonsAvailable", - permission: [ - FREIGHT_PERMS.fleet.view, - FREIGHT_PERMS.wagons.view, - FREIGHT_PERMS.trainScheduling.view, - ], + permission: [FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.trainScheduling.view], }, { value: "customers", diff --git a/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx index 63f45617e..5291e26f1 100644 --- a/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx +++ b/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx @@ -85,9 +85,7 @@ export default function TrainBuilderDetailPage() { const { user } = useAuth(); const canUpdate = canFleetAction(user, "trains", "update"); const canDelete = canFleetAction(user, "trains", "delete"); - const canAssign = - hasPermission(user, FREIGHT_PERMS.trains.assignWagons) || - hasPermission(user, FREIGHT_PERMS.fleet.manage); + const canAssign = hasPermission(user, FREIGHT_PERMS.trains.assignWagons); const compositionQuery = useQuery( api.trainBuilder.composition.queryOptions({ input: { id }, enabled: Boolean(id) }),