admin user and ui panel

apps/admin-panel/src/layouts/navMenuItems.ts

@@ -12,10 +12,19 @@
 // A "header" node is a section divider carrying `items`, not `submenu`.
 //
 // Legacy quirks preserved deliberately (see docs/ADMIN-PORT-PLAN.md):
-//   - two nodes have their permissionId COMMENTED OUT (banker-list, shopkeeper-list),
-//     so they are visible to everyone
-//   - "newsletters.newsletters" and "wallet.list" never match any granted rid (#7, #8)
 //   - several nodes repeat the same permissionId or reuse another view's `name`
+//
+// Two further legacy quirks were fixed rather than preserved, since both were
+// bugs (not intentional behaviour) and each has since caused real confusion:
+//   - banker-list / shopkeeper-list had their permissionId commented out, so
+//     the items showed for everyone even though the backing endpoints
+//     (admin/customers-omde/banker|shopkeeper/list) require
+//     persons.list.client.omde and 403'd on an unauthorized click. Filled in.
+//   - "newsletters.newsletters" never matched any rid in ALL_RIDS (the real
+//     one is "newsletters"), so the item was invisible to every user,
+//     including super-admin. Corrected to "newsletters".
+// "wallet.list" is a real, seeded rid (see acl.constants.ts) and was never
+// actually broken — the old note above was itself mistaken.
 import { isBranch } from '../utils';
 
 export interface NavMenuNode {
@@ -57,9 +66,16 @@ export const adminMenu: NavMenuNode[] = [
         i18n: 'اشخاص',
         permissionId:"persons",
         submenu: [
-          // 'اضافه کردن شخص' removed: adding a wholesale customer is now the
-          // add button on the list page itself (OmdeList), so the nav entry
-          // duplicated it. The /customer/add route still works.
+          // Restored per request: the add button on OmdeList only covers
+          // wholesale customers, so removing this entry left no nav path to
+          // the general "add person" form.
+          {
+            url: '/customer/add',
+            name: 'AddCustomer',
+            slug: 'add-customer',
+            i18n: 'اضافه کردن شخص',
+            permissionId:"persons.create"
+          },
           {
             url: '/customer/reagent-list',
             name: 'List',
@@ -99,8 +115,13 @@ export const adminMenu: NavMenuNode[] = [
             url: '/customer/banker-list',
             name: 'List',
             slug: 'banker-list',
-            i18n: 'لیست بنکداران'
-            // permissionId:"persons.list.client."
+            i18n: 'لیست بنکداران',
+            // Legacy left this rid commented out, so the item showed for
+            // everyone regardless of permission — a bug, not a feature: the
+            // API route it points at (admin/customers-omde/banker/list) is
+            // gated on exactly this rid, so an unauthorized click 403'd.
+            // Filled in to match what the server actually enforces.
+            permissionId:"persons.list.client.omde"
           },
           {
             // legacy navMenuItems.js:90 spelled this with a capital S while the route
@@ -109,8 +130,10 @@ export const adminMenu: NavMenuNode[] = [
             url: '/customer/shopkeeper-list',
             name: 'List',
             slug: 'shopkeeper-list',
-            i18n: 'لیست مغازه داران حضوری'
-            // permissionId:"persons.list.client."
+            i18n: 'لیست مغازه داران حضوری',
+            // Same fix as banker-list above — the backing endpoint
+            // (admin/customers-omde/shopkeeper/list) requires this rid.
+            permissionId:"persons.list.client.omde"
           },
         ]
       },
@@ -398,7 +421,12 @@ export const adminMenu: NavMenuNode[] = [
         name: 'newsletters',
         icon: 'FileTextIcon',
         i18n: 'خبرنامه',
-        permissionId:"newsletters.newsletters",
+        // Legacy typo'd this as "newsletters.newsletters", a rid that never
+        // exists in ALL_RIDS — so the item was permanently invisible to
+        // everyone, including super-admin. The route's own guard
+        // (POST newsletter/list, admin-misc.controller.ts) requires the
+        // plain "newsletters" rid; matched here.
+        permissionId:"newsletters",
       },
     ]
   },