feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.
2026-10-21 13:45:16 +03:30
parent 631a3267d1
commit 7ae6a5837a
23 changed files with 246 additions and 24 deletions
@@ -46,10 +46,12 @@ import {
 import { LeadStagesService } from './lead-stages.service';
 import { LeadsImportService } from './leads-import.service';
 import { LeadsService } from './leads.service';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';

@Controller('leads')
-@UseGuards(JwtAuthGuard, OrgModuleGuard)
+@UseGuards(JwtAuthGuard, OrgModuleGuard, SectionPermissionGuard)
@RequireOrgModule('leads')
+@RequirePermission('leads', { reads: true })
 export class LeadsController {
  constructor(
    private readonly leads: LeadsService,