From ee25de8817939cb96927745797a35fca232b7f55 Mon Sep 17 00:00:00 2001
From: Nathnael <nathnael@example.com>
Date: Sat, 8 Aug 2026 09:36:51 +0000
Subject: [PATCH] fix(freight:backoffice): wire dedicated permission keys
 instead of broad fallbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compliance & Alerts, Procurement, File settings, Dropdown settings,
Trade access, and Exchange rate all fell back to a broad permission
(fleet:view or admin) even though a dedicated key already existed in
FREIGHT_PERMS — meaning granting one of these pages meant granting
several unrelated ones too. Each now checks its own key first, with
the broad permission kept as a fallback for existing role grants.

Incidents left as-is: no dedicated edr_freight_app:incidents:* key
exists yet on the backend.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 apps/edr-freight-web/backoffice/src/App.tsx   | 24 ++++++++++++++-----
 .../components/layout/sidebar-sections.tsx    | 14 ++++++-----
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/apps/edr-freight-web/backoffice/src/App.tsx b/apps/edr-freight-web/backoffice/src/App.tsx
index 07299462c..7ef07dd09 100644
--- a/apps/edr-freight-web/backoffice/src/App.tsx
+++ b/apps/edr-freight-web/backoffice/src/App.tsx
@@ -764,7 +764,9 @@ const App = () => {
         <Route
           path="compliance"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission
+              permission={[FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view]}
+            >
               <CompliancePage />
             </RequirePermission>
           }
@@ -788,7 +790,9 @@ const App = () => {
         <Route
           path="procurement"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.fleet.view}>
+            <RequirePermission
+              permission={[FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view]}
+            >
               <ProcurementPage />
             </RequirePermission>
           }
@@ -811,7 +815,9 @@ const App = () => {
         <Route
           path="file-settings"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.admin}>
+            <RequirePermission
+              permission={[FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin]}
+            >
               <FileUploadSettingsPage />
             </RequirePermission>
           }
@@ -819,7 +825,9 @@ const App = () => {
         <Route
           path="dropdown-settings"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.admin}>
+            <RequirePermission
+              permission={[FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin]}
+            >
               <DropdownSettingsPage />
             </RequirePermission>
           }
@@ -876,7 +884,9 @@ const App = () => {
         <Route
           path="configuration/trade-access"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.admin}>
+            <RequirePermission
+              permission={[FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin]}
+            >
               <TradeAccessPage />
             </RequirePermission>
           }
@@ -884,7 +894,9 @@ const App = () => {
         <Route
           path="configuration/exchange-rate"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.admin}>
+            <RequirePermission
+              permission={[FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin]}
+            >
               <div className="p-4">
                 <ExchangeRateSettingsCard />
               </div>
diff --git a/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx b/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
index 5883da5b8..8b9e7bd3f 100644
--- a/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
@@ -279,19 +279,21 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
             label: "Compliance & Alerts",
             href: "/dashboard/compliance",
             icon: <ShieldCheck />,
-            permission: FREIGHT_PERMS.fleet.view,
+            permission: [FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view],
           },
           {
             label: "Incidents",
             href: "/dashboard/incidents",
             icon: <FileText />,
+            // No dedicated backend key exists for incidents yet — stuck on the
+            // blanket fleet:view fallback until one is added.
             permission: FREIGHT_PERMS.fleet.view,
           },
           {
             label: "Procurement",
             href: "/dashboard/procurement",
             icon: <Package />,
-            permission: FREIGHT_PERMS.fleet.view,
+            permission: [FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view],
           },
           {
             label: "Financial Reports",
@@ -476,13 +478,13 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
         label: "File settings",
         href: "/dashboard/file-settings",
         icon: <Paperclip />,
-        permission: FREIGHT_PERMS.admin,
+        permission: [FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin],
       },
       {
         label: "Dropdown settings",
         href: "/dashboard/dropdown-settings",
         icon: <Settings />,
-        permission: FREIGHT_PERMS.admin,
+        permission: [FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin],
       },
       {
         label: "Contract templates",
@@ -514,12 +516,12 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
           {
             label: "Trade access",
             href: "/dashboard/configuration/trade-access",
-            permission: FREIGHT_PERMS.admin,
+            permission: [FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin],
           },
           {
             label: "Exchange rate",
             href: "/dashboard/configuration/exchange-rate",
-            permission: FREIGHT_PERMS.admin,
+            permission: [FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin],
           },
         ],
       },