Fixed: Corrected security permissions to allow all the positive actio…

…ns without COMMON_ADMIN permission. Imposed security check only on Reject Order button.
hotwax · Oct 19, 2023 · 7522f35 · 7522f35
1 parent 741ffb8
commit 7522f35
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 4 deletions.
diff --git a/src/authorization/Actions.ts b/src/authorization/Actions.ts
@@ -1,4 +1,5 @@
 export default {
   'APP_ORDER_UPDATE': 'APP_ORDER_UPDATE',
+  'APP_REJECT_ORDER': 'APP_REJECT_ORDER',
   'APP_RF_CONFIG_UPDATE': 'APP_RF_CONFIG_UPDATE',
 }
diff --git a/src/authorization/Rules.ts b/src/authorization/Rules.ts
@@ -3,6 +3,9 @@ export default {
     "APP_CATALOG_VIEW": "",
     "APP_ORDER_DETAIL_VIEW": "",
     "APP_PRODUCT_DETAIL_VIEW": "",
-    "APP_ORDER_UPDATE": "COMMON_ADMIN",
-    "APP_RF_CONFIG_UPDATE": "COMMON_ADMIN"
+    "APP_REJECT_ORDER": "COMMON_ADMIN",
+    "APP_ORDER_UPDATE": "",
+    "APP_RF_CONFIG_UPDATE": "COMMON_ADMIN",
+    "APP_PARTIAL_ORDER_REJECTION_CONFIG_UPDATE": "COMMON_ADMIN",
+    "APP_STOREFULFILLMENT_ADMIN": "STOREFULFILLMENT_ADMIN"
 } as any 
diff --git a/src/views/OrderDetail.vue b/src/views/OrderDetail.vue
@@ -52,8 +52,8 @@
           <ion-icon :icon="sendOutline" slot="end" />
         </ion-button> -->
 
-        <ion-button :disabled="!hasPermission(Actions.APP_ORDER_UPDATE)" expand="block" color="danger" fill="outline" @click="updateOrder(order)">
-          {{ $t("Reject Order") }}
+        <ion-button :disabled="!hasPermission(Actions.APP_REJECT_ORDER)" expand="block" color="danger" fill="outline" @click="updateOrder(order)">
+          {{ translate("Reject Order") }}
         </ion-button>
       </main>  
     </ion-content>