fix: ( bookings ) require explicit tickets:generate to issue reservations

apps/edr-passenger-web/backoffice/src/lib/auth-store.ts

@@ -23,6 +23,7 @@ interface AuthState {
   setUser: (user: AdminUser, token: string) => void;
   initialize: () => void;
   hasPermission: (key: string) => boolean;
+  hasPermissionStrict: (key: string) => boolean;
 }
 
 export const useAuthStore = create<AuthState>((set, get) => ({
@@ -123,4 +124,12 @@ export const useAuthStore = create<AuthState>((set, get) => ({
     if (user.isSuperAdmin || user.isOrgAdmin) return true;
     return user.permissions.includes(key);
   },
+
+  // No super-admin / org-admin bypass — mirrors PassengerStaffStrict on the API,
+  // so we don't render actions that would 403.
+  hasPermissionStrict: (key: string) => {
+    const { user } = get();
+    if (!user) return false;
+    return user.permissions.includes(key);
+  },
 }));

apps/edr-passenger-web/backoffice/src/lib/use-permission.ts

@@ -13,3 +13,15 @@ import { useAuthStore } from './auth-store';
 export function usePermission(key: string): boolean {
   return useAuthStore((s) => s.hasPermission(key));
 }
+
+/**
+ * Same as usePermission but WITHOUT the super-admin / org-admin bypass — the
+ * permission must be explicitly granted. Use it wherever the API endpoint is
+ * guarded with PassengerStaffStrict, so the UI matches what the API allows.
+ *
+ * Usage:
+ *   const canIssue = usePermissionStrict(PERMS.tickets.generate);
+ */
+export function usePermissionStrict(key: string): boolean {
+  return useAuthStore((s) => s.hasPermissionStrict(key));
+}