fix: ( passenger ) read permissions from position types and all positions

apps/edr-passenger-web/backoffice/src/lib/auth-store.ts

@@ -6,6 +6,33 @@ import axios from 'axios';
 
 const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';
 
+/**
+ * Every permission key a single IAM position grants.
+ *
+ * A position's own `permissions[]` used to be the whole story. IAM now also
+ * hangs grants off *position types* — the legacy singular `positionType` plus
+ * the newer `positionTypes[]` array, whose entries expose
+ * `positionTypePermissions[].permission.key` (note the extra `permission`
+ * wrapper). Union all three rather than trust IAM to have merged them back into
+ * `permissions[]`. Mirrors collectPermissionKeys() on the API.
+ */
+export function positionPermissionKeys(pos: any): string[] {
+  const keys: string[] = (pos?.permissions ?? [])
+    .map((p: any) => p?.key)
+    .filter(Boolean)
+    .map(String);
+
+  const positionTypes: any[] = [pos?.positionType, ...(pos?.positionTypes ?? [])];
+  for (const pt of positionTypes) {
+    for (const ptp of pt?.positionTypePermissions ?? []) {
+      const key = ptp?.permission?.key;
+      if (key) keys.push(String(key));
+    }
+  }
+
+  return keys;
+}
+
 function mapIamRole(roles: { key?: string }[]): 'ADMIN' | 'AGENT' | 'SUPERVISOR' {
   const keys = roles.map((r) => r.key ?? '');
   if (keys.some((k) => k.includes('admin') || k === 'super_admin' || k === 'organization_admin')) return 'ADMIN';
@@ -70,12 +97,11 @@ export const useAuthStore = create<AuthState>((set, get) => ({
 
     // Role permissions — flat array in data.permissions
     const rolePerms = (iamUser.permissions ?? []).map((p: any) => String(p.key));
-    // Position permissions — employee[] is an array here; positions[].permissions[] merged by IAM
+    // Position permissions — employee[] is an array here; each position contributes
+    // its own permissions[] plus everything its position type(s) grant.
     const employeeArr: any[] = Array.isArray(iamUser.employee) ? iamUser.employee : [];
     const positionPerms = employeeArr.flatMap((emp: any) =>
-      (emp.positions ?? []).flatMap((pos: any) =>
-        (pos.permissions ?? []).map((p: any) => String(p.key))
-      )
+      (emp.positions ?? []).flatMap((pos: any) => positionPermissionKeys(pos))
     );
     const permissions = Array.from(new Set([...rolePerms, ...positionPerms]));