Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(freight:backoffice): wire dedicated permission keys instead of broad fallbacks

Browse Source 
Compliance & Alerts, Procurement, File settings, Dropdown settings,
Trade access, and Exchange rate all fell back to a broad permission
(fleet:view or admin) even though a dedicated key already existed in
FREIGHT_PERMS — meaning granting one of these pages meant granting
several unrelated ones too. Each now checks its own key first, with
the broad permission kept as a fallback for existing role grants.

Incidents left as-is: no dedicated edr_freight_app:incidents:* key
exists yet on the backend.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Nathnael
2026-08-08 09:36:51 +00:00
parent 3a78605893
commit ee25de8817
2 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
apps/edr-freight-web/backoffice/src/App.tsx
View File

@@ -764,7 +764,9 @@ const App = () => {
<Route <Route
path="compliance" path="compliance"
element={ element={
<RequirePermission permission={FREIGHT_PERMS.fleet.view}> <RequirePermission
permission={[FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view]}
>
<CompliancePage /> <CompliancePage />
</RequirePermission> </RequirePermission>
} }
@@ -788,7 +790,9 @@ const App = () => {
<Route <Route
path="procurement" path="procurement"
element={ element={
<RequirePermission permission={FREIGHT_PERMS.fleet.view}> <RequirePermission
permission={[FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view]}
>
<ProcurementPage /> <ProcurementPage />
</RequirePermission> </RequirePermission>
} }
@@ -811,7 +815,9 @@ const App = () => {
<Route <Route
path="file-settings" path="file-settings"
element={ element={
<RequirePermission permission={FREIGHT_PERMS.admin}> <RequirePermission
permission={[FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin]}
>
<FileUploadSettingsPage /> <FileUploadSettingsPage />
</RequirePermission> </RequirePermission>
} }
@@ -819,7 +825,9 @@ const App = () => {
<Route <Route
path="dropdown-settings" path="dropdown-settings"
element={ element={
<RequirePermission permission={FREIGHT_PERMS.admin}> <RequirePermission
permission={[FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin]}
>
<DropdownSettingsPage /> <DropdownSettingsPage />
</RequirePermission> </RequirePermission>
} }
@@ -876,7 +884,9 @@ const App = () => {
<Route <Route
path="configuration/trade-access" path="configuration/trade-access"
element={ element={
<RequirePermission permission={FREIGHT_PERMS.admin}> <RequirePermission
permission={[FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin]}
>
<TradeAccessPage /> <TradeAccessPage />
</RequirePermission> </RequirePermission>
} }
@@ -884,7 +894,9 @@ const App = () => {
<Route <Route
path="configuration/exchange-rate" path="configuration/exchange-rate"
element={ element={
<RequirePermission permission={FREIGHT_PERMS.admin}> <RequirePermission
permission={[FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin]}
>
<div className="p-4"> <div className="p-4">
<ExchangeRateSettingsCard /> <ExchangeRateSettingsCard />
</div> </div>

14
apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
View File

@@ -279,19 +279,21 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
label: "Compliance & Alerts", label: "Compliance & Alerts",
href: "/dashboard/compliance", href: "/dashboard/compliance",
icon: <ShieldCheck />, icon: <ShieldCheck />,
permission: FREIGHT_PERMS.fleet.view, permission: [FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view],
}, },
{ {
label: "Incidents", label: "Incidents",
href: "/dashboard/incidents", href: "/dashboard/incidents",
icon: <FileText />, icon: <FileText />,
// No dedicated backend key exists for incidents yet — stuck on the
// blanket fleet:view fallback until one is added.
permission: FREIGHT_PERMS.fleet.view, permission: FREIGHT_PERMS.fleet.view,
}, },
{ {
label: "Procurement", label: "Procurement",
href: "/dashboard/procurement", href: "/dashboard/procurement",
icon: <Package />, icon: <Package />,
permission: FREIGHT_PERMS.fleet.view, permission: [FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view],
}, },
{ {
label: "Financial Reports", label: "Financial Reports",
@@ -476,13 +478,13 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
label: "File settings", label: "File settings",
href: "/dashboard/file-settings", href: "/dashboard/file-settings",
icon: <Paperclip />, icon: <Paperclip />,
permission: FREIGHT_PERMS.admin, permission: [FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin],
}, },
{ {
label: "Dropdown settings", label: "Dropdown settings",
href: "/dashboard/dropdown-settings", href: "/dashboard/dropdown-settings",
icon: <Settings />, icon: <Settings />,
permission: FREIGHT_PERMS.admin, permission: [FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin],
}, },
{ {
label: "Contract templates", label: "Contract templates",
@@ -514,12 +516,12 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
{ {
label: "Trade access", label: "Trade access",
href: "/dashboard/configuration/trade-access", href: "/dashboard/configuration/trade-access",
permission: FREIGHT_PERMS.admin, permission: [FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin],
}, },
{ {
label: "Exchange rate", label: "Exchange rate",
href: "/dashboard/configuration/exchange-rate", href: "/dashboard/configuration/exchange-rate",
permission: FREIGHT_PERMS.admin, permission: [FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin],
}, },
], ],
}, },