feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.
2026-10-21 13:45:16 +03:30
parent 631a3267d1
commit 7ae6a5837a
23 changed files with 246 additions and 24 deletions
@@ -9,6 +9,7 @@ import {
  UseGuards,
 } from '@nestjs/common';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import { Roles } from '../auth/roles.decorator';
 import { RolesGuard } from '../auth/roles.guard';
@@ -18,7 +19,8 @@ import { InventoryService } from './inventory.service';
 type AuthUser = { organizationId: string };

@Controller('inventory')
-@UseGuards(JwtAuthGuard, RolesGuard)
+@UseGuards(JwtAuthGuard, RolesGuard, SectionPermissionGuard)
+@RequirePermission('products')
 export class InventoryController {
  constructor(private readonly inventory: InventoryService) {}