case 4735 - role rights match the documentation

Audit of every documented role right against BizRoles, decided with John:
Tech restricted reads tax codes, projects, unit models and meter readings;
Business administration reads server metrics; Accounting no longer enters
meter readings (both meter reading routes checked Unit rights, now meter
reading rights); no Subcontractor roles on memos; integrations: data
operations open to all full staff roles, switching Active and deleting are
Business administration only. Integrated applications page and changelog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/Controllers/UnitController.cs

@@ -397,7 +397,8 @@ namespace AyaNova.Api.Controllers
             if (!serverState.IsOpen)
                 return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
             UnitMeterReadingBiz biz = UnitMeterReadingBiz.GetBiz(ct, HttpContext);
-            if (!Authorized.HasCreateRole(HttpContext.Items, AyaType.Unit))
+            //case 4735: meter reading rights (were the Unit rights, which let Accounting enter meter readings)
+            if (!Authorized.HasCreateRole(HttpContext.Items, biz.BizType))
                 return StatusCode(403, new ApiNotAuthorizedResponse());
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
@@ -419,7 +420,8 @@ namespace AyaNova.Api.Controllers
             if (!serverState.IsOpen)
                 return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
             UnitMeterReadingBiz biz = UnitMeterReadingBiz.GetBiz(ct, HttpContext);
-            if (!Authorized.HasReadFullRole(HttpContext.Items, AyaType.Unit))
+            //case 4735: meter reading rights (were the Unit rights, which let Accounting enter meter readings)
+            if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType))
                 return StatusCode(403, new ApiNotAuthorizedResponse());
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));

server/AyaNova/biz/BizRoles.cs

@@ -297,6 +297,7 @@ namespace AyaNova.Biz
                                  | AuthorizationRoles.Sales
                                  | AuthorizationRoles.SalesRestricted
                                  | AuthorizationRoles.Tech
+                                 | AuthorizationRoles.TechRestricted//case 4735: as documented, like Tech
                                  ,
                 Select = AuthorizationRoles.All
             });
@@ -344,6 +345,7 @@ namespace AyaNova.Biz
                 ReadFullRecord = AuthorizationRoles.Service
                                  | AuthorizationRoles.Sales
                                  | AuthorizationRoles.Tech
+                                 | AuthorizationRoles.TechRestricted//case 4735: as documented, like Tech
                                  | AuthorizationRoles.BizAdminRestricted
                                  | AuthorizationRoles.ServiceRestricted
                                  | AuthorizationRoles.SalesRestricted
@@ -398,7 +400,8 @@ namespace AyaNova.Biz
                                  | AuthorizationRoles.ServiceRestricted
                                  | AuthorizationRoles.Sales
                                  | AuthorizationRoles.SalesRestricted
-                                 | AuthorizationRoles.Tech,
+                                 | AuthorizationRoles.Tech
+                                 | AuthorizationRoles.TechRestricted,//case 4735: as documented, like Tech
                 Select = AuthorizationRoles.All
             });
 
@@ -407,11 +410,13 @@ namespace AyaNova.Biz
             //            
             roles.Add(AyaType.UnitMeterReading, new BizRoleSet()
             {
-                Change = AuthorizationRoles.BizAdmin | AuthorizationRoles.Service | AuthorizationRoles.Tech | AuthorizationRoles.Accounting,
+                //case 4735: Accounting no longer changes meter readings; Tech restricted reads them, as documented
+                Change = AuthorizationRoles.BizAdmin | AuthorizationRoles.Service | AuthorizationRoles.Tech,
                 ReadFullRecord = AuthorizationRoles.BizAdminRestricted
                                  | AuthorizationRoles.ServiceRestricted
                                  | AuthorizationRoles.Sales
-                                 | AuthorizationRoles.SalesRestricted,
+                                 | AuthorizationRoles.SalesRestricted
+                                 | AuthorizationRoles.TechRestricted,
                 Select = AuthorizationRoles.All
             });
 
@@ -780,7 +785,8 @@ namespace AyaNova.Biz
             roles.Add(AyaType.ServerMetrics, new BizRoleSet()
             {
                 Change = AuthorizationRoles.OpsAdmin,//this is to turn on extra metrics (profiler)
-                ReadFullRecord = AuthorizationRoles.OpsAdmin | AuthorizationRoles.OpsAdminRestricted
+                //case 4735: Business administration views metrics, as documented and as for the other operations forms
+                ReadFullRecord = AuthorizationRoles.OpsAdmin | AuthorizationRoles.OpsAdminRestricted | AuthorizationRoles.BizAdmin | AuthorizationRoles.BizAdminRestricted
             });
 
 
@@ -900,6 +906,7 @@ namespace AyaNova.Biz
             // (everyone but outside users Customer and HO can send and receive memos)
             roles.Add(AyaType.Memo, new BizRoleSet()
             {
+                //case 4735: no Subcontractor roles; subcontractors have no memo feature (as documented)
                 Change = AuthorizationRoles.BizAdminRestricted
                 | AuthorizationRoles.BizAdmin
                 | AuthorizationRoles.ServiceRestricted
@@ -909,8 +916,6 @@ namespace AyaNova.Biz
                 | AuthorizationRoles.Accounting
                 | AuthorizationRoles.TechRestricted
                 | AuthorizationRoles.Tech
-                | AuthorizationRoles.SubContractorRestricted
-                | AuthorizationRoles.SubContractor
                 | AuthorizationRoles.Sales
                 | AuthorizationRoles.SalesRestricted
                 | AuthorizationRoles.OpsAdminRestricted
@@ -924,8 +929,6 @@ namespace AyaNova.Biz
                 | AuthorizationRoles.Accounting
                 | AuthorizationRoles.TechRestricted
                 | AuthorizationRoles.Tech
-                | AuthorizationRoles.SubContractorRestricted
-                | AuthorizationRoles.SubContractor
                 | AuthorizationRoles.Sales
                 | AuthorizationRoles.SalesRestricted
                 | AuthorizationRoles.OpsAdminRestricted
@@ -939,8 +942,6 @@ namespace AyaNova.Biz
                 | AuthorizationRoles.Accounting
                 | AuthorizationRoles.TechRestricted
                 | AuthorizationRoles.Tech
-                | AuthorizationRoles.SubContractorRestricted
-                | AuthorizationRoles.SubContractor
                 | AuthorizationRoles.Sales
                 | AuthorizationRoles.SalesRestricted
                 | AuthorizationRoles.OpsAdminRestricted

server/AyaNova/biz/IntegrationBiz.cs

@@ -234,11 +234,18 @@ namespace AyaNova.Biz
                 }
             }
 
+            //case 4735: an integrated application, whatever role it signs in as, works with its own data; switching an
+            //integration on or off is for Business administration (Integrated applications form)
+            if (!isNew && proposedObj.Active != currentObj.Active && !CurrentUserRoles.HasFlag(AuthorizationRoles.BizAdmin))
+                AddError(ApiErrorCode.NOT_AUTHORIZED, "Active");
+
         }
 
         private void ValidateCanDelete(Integration inObj)
         {
-            //whatever needs to be check to delete this object
+            //case 4735: deleting an integration is for Business administration (Integrated applications form)
+            if (!CurrentUserRoles.HasFlag(AuthorizationRoles.BizAdmin))
+                AddError(ApiErrorCode.NOT_AUTHORIZED);
         }