Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(freight:backoffice): remove coarse fleet.view/fleet.manage/admin fallbacks

Browse Source 
Now that every fleet-resource page and settings page has its own
dedicated permission key (previous commit), the broad fallbacks are
redundant and over-grant: anyone holding only fleet:view/fleet:manage
or admin could reach every page in that whole section, not just one.

Removed fleet.view fallback from: Routes, Locomotives, Train Builder,
Wagons, Containers, Cargoes, Compliance & Alerts, Procurement, and the
Overview dashboard's Fleet KPI tab.

Removed fleet.manage fallback from: canFleetAction() (per-resource
fleet CRUD, lib/permissions.ts) and TrainBuilderDetailPage's wagon-
assignment check. Hard-delete already had no such fallback.

Removed admin fallback from: File settings, Dropdown settings,
Contract templates, Portal content, Trade access, Exchange rate.

Left untouched: Incidents (sole gate is fleet.view — no dedicated
edr_freight_app:incidents:* key exists on the backend yet, so there's
nothing to fall back FROM; removing it would make the page
super-admin-only).

Access-narrowing change: anyone currently relying on the coarse grant
without also holding the specific resource/settings key will lose
access to these pages until roles are updated to grant the specific
keys directly. Audit role assignments before this deploys.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Nathnael
2026-08-08 13:59:06 +00:00
parent a8591c0071
commit d337fa0d85
5 changed files with 36 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
apps/edr-freight-web/backoffice/src/App.tsx
View File

@@ -573,9 +573,7 @@ const App = () => {
<Route
path="routes"
element={
<RequirePermission
permission={[FREIGHT_PERMS.routes.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.routes.view}>
<RoutesPage />
</RequirePermission>
}
@@ -583,12 +581,7 @@ const App = () => {
<Route
path="locomotives"
element={
<RequirePermission
permission={[
FREIGHT_PERMS.locomotives.view,
FREIGHT_PERMS.fleet.view,
]}
>
<RequirePermission permission={FREIGHT_PERMS.locomotives.view}>
<FleetResourcePage />
</RequirePermission>
}
@@ -596,9 +589,7 @@ const App = () => {
<Route
path="trains"
element={
<RequirePermission
permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.trains.view}>
<FleetResourcePage />
</RequirePermission>
}
@@ -606,9 +597,7 @@ const App = () => {
<Route
path="trains/:id"
element={
<RequirePermission
permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.trains.view}>
<TrainDetailPage />
</RequirePermission>
}
@@ -616,9 +605,7 @@ const App = () => {
<Route
path="train-builder"
element={
<RequirePermission
permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.trains.view}>
<TrainBuilderListPage />
</RequirePermission>
}
@@ -626,9 +613,7 @@ const App = () => {
<Route
path="train-builder/:id"
element={
<RequirePermission
permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.trains.view}>
<TrainBuilderDetailPage />
</RequirePermission>
}
@@ -636,9 +621,7 @@ const App = () => {
<Route
path="wagons"
element={
<RequirePermission
permission={[FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.wagons.view}>
<FleetResourcePage />
</RequirePermission>
}
@@ -659,12 +642,7 @@ const App = () => {
<Route
path="containers"
element={
<RequirePermission
permission={[
FREIGHT_PERMS.containers.view,
FREIGHT_PERMS.fleet.view,
]}
>
<RequirePermission permission={FREIGHT_PERMS.containers.view}>
<FleetResourcePage />
</RequirePermission>
}
@@ -672,12 +650,7 @@ const App = () => {
<Route
path="cargoes"
element={
<RequirePermission
permission={[
FREIGHT_PERMS.cargoes.view,
FREIGHT_PERMS.fleet.view,
]}
>
<RequirePermission permission={FREIGHT_PERMS.cargoes.view}>
<FleetResourcePage />
</RequirePermission>
}
@@ -765,9 +738,7 @@ const App = () => {
<Route
path="compliance"
element={
<RequirePermission
permission={[FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.compliance.view}>
<CompliancePage />
</RequirePermission>
}
@@ -791,9 +762,7 @@ const App = () => {
<Route
path="procurement"
element={
<RequirePermission
permission={[FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view]}
>
<RequirePermission permission={FREIGHT_PERMS.procurement.view}>
<ProcurementPage />
</RequirePermission>
}
@@ -816,9 +785,7 @@ const App = () => {
<Route
path="file-settings"
element={
<RequirePermission
permission={[FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin]}
>
<RequirePermission permission={FREIGHT_PERMS.settings.fileUpload.view}>
<FileUploadSettingsPage />
</RequirePermission>
}
@@ -826,9 +793,7 @@ const App = () => {
<Route
path="dropdown-settings"
element={
<RequirePermission
permission={[FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin]}
>
<RequirePermission permission={FREIGHT_PERMS.settings.dropdown.view}>
<DropdownSettingsPage />
</RequirePermission>
}
@@ -845,10 +810,7 @@ const App = () => {
path="contract-templates"
element={
<RequirePermission
permission={[
FREIGHT_PERMS.settings.contractTemplates.view,
FREIGHT_PERMS.admin,
]}
permission={FREIGHT_PERMS.settings.contractTemplates.view}
>
<ContractTemplatesPage />
</RequirePermission>
@@ -858,10 +820,7 @@ const App = () => {
path="contract-templates/:code"
element={
<RequirePermission
permission={[
FREIGHT_PERMS.settings.contractTemplates.view,
FREIGHT_PERMS.admin,
]}
permission={FREIGHT_PERMS.settings.contractTemplates.view}
>
<ContractTemplateEditorPage />
</RequirePermission>
@@ -874,7 +833,6 @@ const App = () => {
permission={[
FREIGHT_PERMS.settings.supportContent.view,
FREIGHT_PERMS.settings.supportContent.manage,
FREIGHT_PERMS.admin,
]}
>
<PortalContentPage />
@@ -899,9 +857,7 @@ const App = () => {
<Route
path="configuration/trade-access"
element={
<RequirePermission
permission={[FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin]}
>
<RequirePermission permission={FREIGHT_PERMS.tradeAccess.view}>
<TradeAccessPage />
</RequirePermission>
}
@@ -909,9 +865,7 @@ const App = () => {
<Route
path="configuration/exchange-rate"
element={
<RequirePermission
permission={[FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin]}
>
<RequirePermission permission={FREIGHT_PERMS.settings.exchangeRate.view}>
<div className="p-4">
<ExchangeRateSettingsCard />
</div>

35
apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
View File

@@ -196,22 +196,19 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
label: "Routes",
href: "/dashboard/routes",
icon: <Network />,
permission: [FREIGHT_PERMS.routes.view, FREIGHT_PERMS.fleet.view],
permission: FREIGHT_PERMS.routes.view,
},
{
label: "Locomotives",
href: "/dashboard/locomotives",
icon: <Train />,
permission: [
FREIGHT_PERMS.locomotives.view,
FREIGHT_PERMS.fleet.view,
],
permission: FREIGHT_PERMS.locomotives.view,
},
{
label: "Train Builder",
href: "/dashboard/train-builder",
icon: <Hammer />,
permission: [FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view],
permission: FREIGHT_PERMS.trains.view,
},
// {
@@ -223,7 +220,7 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
label: "Wagons",
href: "/dashboard/wagons",
icon: <Truck />,
permission: [FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.fleet.view],
permission: FREIGHT_PERMS.wagons.view,
},
{
label: "Wagon Transfers",
@@ -280,21 +277,23 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
label: "Compliance & Alerts",
href: "/dashboard/compliance",
icon: <ShieldCheck />,
permission: [FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view],
permission: FREIGHT_PERMS.compliance.view,
},
{
label: "Incidents",
href: "/dashboard/incidents",
icon: <FileText />,
// No dedicated backend key exists for incidents yet — stuck on the
// blanket fleet:view fallback until one is added.
// No dedicated backend key exists for incidents yet. Not part of
// the fleet.view/admin fallback cleanup — removing fleet.view
// here with nothing to replace it would lock the page to
// super-admin only, so it stays as the sole (if coarse) gate.
permission: FREIGHT_PERMS.fleet.view,
},
{
label: "Procurement",
href: "/dashboard/procurement",
icon: <Package />,
permission: [FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view],
permission: FREIGHT_PERMS.procurement.view,
},
{
label: "Financial Reports",
@@ -479,23 +478,20 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
label: "File settings",
href: "/dashboard/file-settings",
icon: <Paperclip />,
permission: [FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin],
permission: FREIGHT_PERMS.settings.fileUpload.view,
},
{
label: "Dropdown settings",
href: "/dashboard/dropdown-settings",
icon: <Settings />,
permission: [FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin],
permission: FREIGHT_PERMS.settings.dropdown.view,
},
{
label: "Contract templates",
href: "/dashboard/contract-templates",
icon: <ScrollText />,
// `view` opens the page; `read` alone is API-only and shows no menu.
permission: [
FREIGHT_PERMS.settings.contractTemplates.view,
FREIGHT_PERMS.admin,
],
permission: FREIGHT_PERMS.settings.contractTemplates.view,
},
{
label: "Portal content",
@@ -504,7 +500,6 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
permission: [
FREIGHT_PERMS.settings.supportContent.view,
FREIGHT_PERMS.settings.supportContent.manage,
FREIGHT_PERMS.admin,
],
},
{
@@ -527,12 +522,12 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
{
label: "Trade access",
href: "/dashboard/configuration/trade-access",
permission: [FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin],
permission: FREIGHT_PERMS.tradeAccess.view,
},
{
label: "Exchange rate",
href: "/dashboard/configuration/exchange-rate",
permission: [FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin],
permission: FREIGHT_PERMS.settings.exchangeRate.view,
},
],
},

10
apps/edr-freight-web/backoffice/src/lib/permissions.ts
View File

@@ -658,19 +658,13 @@ export type FleetCrudResource =
| "vehicles"
| "drivers";
/**
* Per-resource fleet CRUD check. The legacy coarse fleet:manage key still
* grants every action (mirrors the API's one-of guard fallback).
*/
/** Per-resource fleet CRUD check — each resource needs its own grant. */
export function canFleetAction(
user: AuthUser | null | undefined,
resource: FleetCrudResource,
action: "create" | "update" | "delete",
): boolean {
return (
hasPermission(user, FREIGHT_PERMS[resource][action]) ||
hasPermission(user, FREIGHT_PERMS.fleet.manage)
);
return hasPermission(user, FREIGHT_PERMS[resource][action]);
}
/**

6
apps/edr-freight-web/backoffice/src/pages/dashboard/OverviewPage.tsx
View File

@@ -87,11 +87,7 @@ const TAB_ITEMS: Array<{
icon: TrainFront,
kpiKey: "operations",
metricKey: "wagonsAvailable",
permission: [
FREIGHT_PERMS.fleet.view,
FREIGHT_PERMS.wagons.view,
FREIGHT_PERMS.trainScheduling.view,
],
permission: [FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.trainScheduling.view],
},
{
value: "customers",

4
apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx
View File

@@ -85,9 +85,7 @@ export default function TrainBuilderDetailPage() {
const { user } = useAuth();
const canUpdate = canFleetAction(user, "trains", "update");
const canDelete = canFleetAction(user, "trains", "delete");
const canAssign =
hasPermission(user, FREIGHT_PERMS.trains.assignWagons) ||
hasPermission(user, FREIGHT_PERMS.fleet.manage);
const canAssign = hasPermission(user, FREIGHT_PERMS.trains.assignWagons);
const compositionQuery = useQuery(
api.trainBuilder.composition.queryOptions({ input: { id }, enabled: Boolean(id) }),