@7365admin1/core 3.47.1-staging.135 → 3.47.1-staging.136

package/.changeset/vehicle-approve-permission-prefix.md

@@ -0,0 +1,22 @@
+---
+"@7365admin1/core": patch
+---
+
+Check the vehicle-approval permission under the resource name the catalogues
+actually grant.
+
+When a security agency adds a vehicle, the vehicle is parked at `PENDING` unless
+the caller may approve one. `vehicle.service.ts:125` asked for
+`vehicleManagement:approve-vehicle`, but every catalogue that can grant a
+permission spells that resource `vehicle-mgmt` — `web-app-security`
+`composables/useSecurityPermission.ts:87,111`, `web-app-org`
+`composables/usePropertyPermission.ts:312`, `ma-mobile-app`
+`src/features/permissions/permission.catalog.ts:7`, `isecure365-mobile-app`
+`src/features/permissions/permission.catalog.ts:32`. Only the prefix differed,
+so the string checked here was one no role could hold and the bypass could never
+be reached by granting the permission — the agency's vehicles stayed pending
+however the role was set up. `vehicleManagement:` appears nowhere else in any
+repository in the organisation.
+
+The `*` wildcard branch is untouched, so a role holding all permissions behaves
+exactly as before; this only makes the specific grant work as intended.

package/dist/index.js

@@ -32187,7 +32187,7 @@ function useVehicleService() {
       user,
       org: value.org
     });
-    const hasSecurityBypass = addedBySecurity && Array.isArray(userPermissions) && (userPermissions.includes("*") || userPermissions.includes("vehicleManagement:approve-vehicle"));
+    const hasSecurityBypass = addedBySecurity && Array.isArray(userPermissions) && (userPermissions.includes("*") || userPermissions.includes("vehicle-mgmt:approve-vehicle"));
     if (hasSecurityBypass) {
       addedByPM = true;
     }