admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4735 - role rights match the documentation

Browse Source 
Audit of every documented role right against BizRoles, decided with John:
Tech restricted reads tax codes, projects, unit models and meter readings;
Business administration reads server metrics; Accounting no longer enters
meter readings (both meter reading routes checked Unit rights, now meter
reading rights); no Subcontractor roles on memos; integrations: data
operations open to all full staff roles, switching Active and deleting are
Business administration only. Integrated applications page and changelog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-25 20:58:27 -07:00
parent ed641c4985
commit 27b56db6b0
6 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/AyaNova/Controllers/UnitController.cs
View File

@@ -397,7 +397,8 @@ namespace AyaNova.Api.Controllers
if (!serverState.IsOpen)
return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
UnitMeterReadingBiz biz = UnitMeterReadingBiz.GetBiz(ct, HttpContext);
if (!Authorized.HasCreateRole(HttpContext.Items, AyaType.Unit))
//case 4735: meter reading rights (were the Unit rights, which let Accounting enter meter readings)
if (!Authorized.HasCreateRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse());
if (!ModelState.IsValid)
return BadRequest(new ApiErrorResponse(ModelState));
@@ -419,7 +420,8 @@ namespace AyaNova.Api.Controllers
if (!serverState.IsOpen)
return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
UnitMeterReadingBiz biz = UnitMeterReadingBiz.GetBiz(ct, HttpContext);
if (!Authorized.HasReadFullRole(HttpContext.Items, AyaType.Unit))
//case 4735: meter reading rights (were the Unit rights, which let Accounting enter meter readings)
if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse());
if (!ModelState.IsValid)
return BadRequest(new ApiErrorResponse(ModelState));