Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-29 17:38:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ( bookings ) require explicit tickets:generate to issue reservations

Browse Source
This commit is contained in:
Abubeker Yasin
2026-07-28 12:18:25 +03:00
parent 0d46f3715e
commit ed09bfd8b6
7 changed files with 79 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/edr-passenger-web/backoffice/src/app/seats/page.tsx
View File

@@ -4,7 +4,7 @@ import { useState } from 'react';
import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
import { seatsApi, schedulesApi, fleetApi, routeCoachTemplatesApi, bookingsApi } from '@/lib/api';
import { routesApi } from '@/lib/api/routes';
import { usePermission } from '@/lib/use-permission';
import { usePermissionStrict } from '@/lib/use-permission';
import { PERMS } from '@/lib/permissions';
import Modal from '@/components/ui/Modal';
import ActionButton from '@/components/ui/ActionButton'
@@ -44,9 +44,10 @@ export default function SeatsPage() {
const [issueBookingResult, setIssueBookingResult] = useState<{ payUrl?: string; bookingRef?: string } | null>(null);
const queryClient = useQueryClient();
// Issuing a booking off a reserved seat is admin-only (POST /bookings/reservations/:seatId/issue
// is guarded by @PassengerAdmin) — hide the ticket action for everyone else.
const canIssueBooking = usePermission(PERMS.admin);
// Issuing a booking off a reserved seat needs edr_passenger_app:tickets:generate
// (POST /bookings/reservations/:seatId/issue is guarded by @PassengerStaffStrict).
// Strict: being an admin is not enough, the permission has to be granted.
const canIssueBooking = usePermissionStrict(PERMS.tickets.generate);
const { data: schedulesData } = useQuery({
queryKey: ['schedules'],