@escapenavigator/utils 2.1.30 → 2.2.1

package/dist/employee-access-permissions.d.ts

@@ -0,0 +1,23 @@
+import { EmployeeAccess, EmployeeAccessScope } from '@escapenavigator/types/dist/role/employee-access';
+import { RoleRO } from '@escapenavigator/types/dist/role/role.ro';
+export type EmployeeAccessSection = keyof EmployeeAccess;
+export type EmployeeAccessAction = 'view' | 'create' | 'edit' | 'delete';
+type LegacyEmployeeAccessRole = Pick<RoleRO, 'totalAccess' | 'canEditUsersAccessAndTime' | 'canEditUsersAccess' | 'canEditModerators' | 'canEditWorkedHours' | 'canEditOwnWorkedHours' | 'canEditFines' | 'canSeeEmployeeReport' | 'accessToFinanceSection' | 'financePaymentsOnly'> & Partial<Pick<RoleRO, 'employeeAccess'>>;
+export declare const createFullEmployeeAccess: () => EmployeeAccess;
+/**
+ * Exact compatibility mapping for roles that have not been saved using the
+ * granular editor yet. No existing role is migrated or silently restricted.
+ */
+export declare const deriveLegacyEmployeeAccess: (role?: LegacyEmployeeAccessRole | null) => EmployeeAccess;
+/**
+ * Form values must always have every section. A stored object with no sections
+ * (legacy null, or a nested DTO stripped by serialization) keeps the fallback.
+ * A partial object keeps what was saved and denies only the missing sections.
+ */
+export declare const completeEmployeeAccess: (access: Partial<EmployeeAccess> | null | undefined, fallback: EmployeeAccess) => EmployeeAccess;
+export declare const resolveEmployeeAccess: (role?: LegacyEmployeeAccessRole | null) => EmployeeAccess;
+export declare const hasEmployeeAccess: (role: LegacyEmployeeAccessRole | null | undefined, section: EmployeeAccessSection, action: EmployeeAccessAction) => boolean;
+export declare const getEmployeeAccessScope: (role: LegacyEmployeeAccessRole | null | undefined, section: "shifts" | "bonuses" | "fines" | "payroll") => EmployeeAccessScope;
+export declare const canManageEmployeeAccess: (role: LegacyEmployeeAccessRole | null | undefined) => boolean;
+export declare const canAssignEmployeeRoles: (role: LegacyEmployeeAccessRole | null | undefined) => boolean;
+export {};

package/dist/employee-access-permissions.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAssignEmployeeRoles = exports.canManageEmployeeAccess = exports.getEmployeeAccessScope = exports.hasEmployeeAccess = exports.resolveEmployeeAccess = exports.completeEmployeeAccess = exports.deriveLegacyEmployeeAccess = exports.createFullEmployeeAccess = void 0;
+const employee_access_1 = require("@escapenavigator/types/dist/role/employee-access");
+const crud = (view, create = view, edit = create, remove = edit) => ({
+    view,
+    create,
+    edit,
+    delete: remove,
+});
+const scoped = (permissions, scope) => ({
+    ...permissions,
+    scope,
+});
+const createFullEmployeeAccess = () => ({
+    employees: { ...crud(true), manageAccess: true },
+    shifts: scoped(crud(true), employee_access_1.EmployeeAccessScope.ALL),
+    bonuses: scoped(crud(true), employee_access_1.EmployeeAccessScope.ALL),
+    fines: scoped(crud(true), employee_access_1.EmployeeAccessScope.ALL),
+    roles: crud(true),
+    positions: crud(true),
+    reports: crud(true, false, false, false),
+    payroll: scoped(crud(true), employee_access_1.EmployeeAccessScope.ALL),
+});
+exports.createFullEmployeeAccess = createFullEmployeeAccess;
+/**
+ * Exact compatibility mapping for roles that have not been saved using the
+ * granular editor yet. No existing role is migrated or silently restricted.
+ */
+const deriveLegacyEmployeeAccess = (role) => {
+    if (role?.totalAccess)
+        return (0, exports.createFullEmployeeAccess)();
+    const usersBase = !!role?.canEditUsersAccessAndTime;
+    const manageAccess = usersBase && !!role?.canEditUsersAccess;
+    const editOthers = usersBase && !!role?.canEditModerators;
+    const manageShifts = !!role?.canEditWorkedHours;
+    const ownShifts = !!role?.canEditOwnWorkedHours;
+    const manageAdjustments = usersBase && !!role?.canEditFines;
+    const managePayroll = !!role?.accessToFinanceSection && !role?.financePaymentsOnly;
+    return {
+        employees: {
+            ...crud(usersBase, manageAccess, editOthers, manageAccess && editOthers),
+            manageAccess,
+        },
+        shifts: scoped(crud(usersBase || ownShifts, manageShifts || ownShifts, manageShifts || ownShifts), usersBase || manageShifts ? employee_access_1.EmployeeAccessScope.ALL : employee_access_1.EmployeeAccessScope.SELF),
+        bonuses: scoped(crud(manageAdjustments), employee_access_1.EmployeeAccessScope.ALL),
+        fines: scoped(crud(manageAdjustments), employee_access_1.EmployeeAccessScope.ALL),
+        roles: crud(false),
+        positions: crud(usersBase),
+        reports: crud(!!role?.canSeeEmployeeReport, false, false, false),
+        payroll: scoped(crud(managePayroll), employee_access_1.EmployeeAccessScope.ALL),
+    };
+};
+exports.deriveLegacyEmployeeAccess = deriveLegacyEmployeeAccess;
+const deniedCrud = () => crud(false);
+const deniedScoped = () => scoped(deniedCrud(), employee_access_1.EmployeeAccessScope.SELF);
+const EMPLOYEE_ACCESS_SECTIONS = [
+    'employees',
+    'shifts',
+    'bonuses',
+    'fines',
+    'roles',
+    'positions',
+    'reports',
+    'payroll',
+];
+/**
+ * Form values must always have every section. A stored object with no sections
+ * (legacy null, or a nested DTO stripped by serialization) keeps the fallback.
+ * A partial object keeps what was saved and denies only the missing sections.
+ */
+const completeEmployeeAccess = (access, fallback) => {
+    const hasSection = !!access && EMPLOYEE_ACCESS_SECTIONS.some((section) => access[section] != null);
+    if (!hasSection)
+        return fallback;
+    return {
+        employees: access.employees ?? { ...deniedCrud(), manageAccess: false },
+        shifts: access.shifts ?? deniedScoped(),
+        bonuses: access.bonuses ?? deniedScoped(),
+        fines: access.fines ?? deniedScoped(),
+        roles: access.roles ?? deniedCrud(),
+        positions: access.positions ?? deniedCrud(),
+        reports: access.reports ?? deniedCrud(),
+        payroll: access.payroll ?? deniedScoped(),
+    };
+};
+exports.completeEmployeeAccess = completeEmployeeAccess;
+const resolveEmployeeAccess = (role) => role?.totalAccess
+    ? (0, exports.createFullEmployeeAccess)()
+    : role?.employeeAccess || (0, exports.deriveLegacyEmployeeAccess)(role);
+exports.resolveEmployeeAccess = resolveEmployeeAccess;
+const hasEmployeeAccess = (role, section, action) => !!(0, exports.resolveEmployeeAccess)(role)[section][action];
+exports.hasEmployeeAccess = hasEmployeeAccess;
+const getEmployeeAccessScope = (role, section) => (0, exports.resolveEmployeeAccess)(role)[section].scope;
+exports.getEmployeeAccessScope = getEmployeeAccessScope;
+const canManageEmployeeAccess = (role) => !!(0, exports.resolveEmployeeAccess)(role).employees.manageAccess;
+exports.canManageEmployeeAccess = canManageEmployeeAccess;
+const canAssignEmployeeRoles = (role) => !!role?.totalAccess ||
+    (role?.employeeAccess
+        ? !!role.employeeAccess.roles.edit
+        : !!role?.canEditUsersAccessAndTime && !!role?.canEditUsersAccess);
+exports.canAssignEmployeeRoles = canAssignEmployeeRoles;

package/dist/employee-access-permissions.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/employee-access-permissions.spec.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const employee_access_1 = require("@escapenavigator/types/dist/role/employee-access");
+const employee_access_permissions_1 = require("./employee-access-permissions");
+const role = (overrides = {}) => ({
+    totalAccess: false,
+    canEditUsersAccessAndTime: false,
+    canEditUsersAccess: false,
+    canEditModerators: false,
+    canEditWorkedHours: false,
+    canEditOwnWorkedHours: false,
+    canEditFines: false,
+    canSeeEmployeeReport: false,
+    accessToFinanceSection: false,
+    financePaymentsOnly: false,
+    ...overrides,
+});
+describe('employee access permissions', () => {
+    it('keeps a legacy role on the old coarse permissions', () => {
+        const permissions = (0, employee_access_permissions_1.deriveLegacyEmployeeAccess)(role({
+            canEditUsersAccessAndTime: true,
+            canEditWorkedHours: true,
+            canEditFines: true,
+        }));
+        expect(permissions.employees.view).toBe(true);
+        expect(permissions.shifts.edit).toBe(true);
+        expect(permissions.shifts.scope).toBe(employee_access_1.EmployeeAccessScope.ALL);
+        expect(permissions.fines.create).toBe(true);
+        expect(permissions.roles.view).toBe(false);
+    });
+    it('keeps own-shift access scoped to self', () => {
+        const permissions = (0, employee_access_permissions_1.deriveLegacyEmployeeAccess)(role({ canEditOwnWorkedHours: true }));
+        expect(permissions.shifts.create).toBe(true);
+        expect(permissions.shifts.scope).toBe(employee_access_1.EmployeeAccessScope.SELF);
+    });
+    it('uses explicit granular permissions without merging legacy flags', () => {
+        const explicit = (0, employee_access_permissions_1.deriveLegacyEmployeeAccess)(role({ totalAccess: true }));
+        explicit.employees.view = false;
+        explicit.shifts.view = false;
+        const current = role({
+            canEditUsersAccessAndTime: true,
+            employeeAccess: explicit,
+        });
+        expect((0, employee_access_permissions_1.resolveEmployeeAccess)(current)).toBe(explicit);
+        expect((0, employee_access_permissions_1.hasEmployeeAccess)(current, 'employees', 'view')).toBe(false);
+        expect((0, employee_access_permissions_1.hasEmployeeAccess)(current, 'positions', 'view')).toBe(true);
+    });
+    it('gives total-access roles every supported permission', () => {
+        const explicit = (0, employee_access_permissions_1.deriveLegacyEmployeeAccess)(role());
+        const permissions = (0, employee_access_permissions_1.resolveEmployeeAccess)(role({ totalAccess: true, employeeAccess: explicit }));
+        expect(permissions.employees.manageAccess).toBe(true);
+        expect(permissions.roles.delete).toBe(true);
+        expect(permissions.payroll.scope).toBe(employee_access_1.EmployeeAccessScope.ALL);
+        expect(permissions.reports.create).toBe(false);
+    });
+    it('keeps a legacy fallback when stored access has no sections', () => {
+        const fallback = (0, employee_access_permissions_1.deriveLegacyEmployeeAccess)(role({ canEditUsersAccessAndTime: true }));
+        expect((0, employee_access_permissions_1.completeEmployeeAccess)(null, fallback)).toBe(fallback);
+        expect((0, employee_access_permissions_1.completeEmployeeAccess)({}, fallback).employees.view).toBe(true);
+    });
+    it('fills only the sections missing from a partial access object', () => {
+        const fallback = (0, employee_access_permissions_1.deriveLegacyEmployeeAccess)(role({ canEditUsersAccessAndTime: true }));
+        const access = (0, employee_access_permissions_1.completeEmployeeAccess)({
+            employees: {
+                view: true,
+                create: false,
+                edit: false,
+                delete: false,
+                manageAccess: false,
+            },
+        }, fallback);
+        expect(access.employees.create).toBe(false);
+        expect(access.payroll.view).toBe(false);
+        expect(access.payroll.scope).toBe(employee_access_1.EmployeeAccessScope.SELF);
+    });
+});

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export * from './convert-hhmm-to-minutes';
 export * from './convert-minutes-to-hhmm';
 export * from './convert-to-options';
 export * from './date';
+export * from './employee-access-permissions';
 export * from './enum-to-options';
 export * from './format-flex-duration-label';
 export * from './format-slot-discount';

package/dist/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./convert-hhmm-to-minutes"), exports);
 __exportStar(require("./convert-minutes-to-hhmm"), exports);
 __exportStar(require("./convert-to-options"), exports);
 __exportStar(require("./date"), exports);
+__exportStar(require("./employee-access-permissions"), exports);
 __exportStar(require("./enum-to-options"), exports);
 __exportStar(require("./format-flex-duration-label"), exports);
 __exportStar(require("./format-slot-discount"), exports);

package/dist/role-employee-report-permissions.d.ts

@@ -1,5 +1,5 @@
 import { RoleRO } from '@escapenavigator/types/dist/role/role.ro';
-export type RoleEmployeeReportPermissions = Pick<RoleRO, 'totalAccess' | 'canSeeEmployeeReport'>;
+export type RoleEmployeeReportPermissions = Pick<RoleRO, 'totalAccess' | 'canSeeEmployeeReport'> & Partial<Pick<RoleRO, 'employeeAccess'>>;
 /**
  * Право видеть отчёт по работникам.
  * Владелец (`totalAccess`) — как будто флаг включён.

package/dist/role-employee-report-permissions.js

@@ -1,9 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.canSeeEmployeeReport = void 0;
+const employee_access_permissions_1 = require("./employee-access-permissions");
 /**
  * Право видеть отчёт по работникам.
  * Владелец (`totalAccess`) — как будто флаг включён.
  */
-const canSeeEmployeeReport = (role) => !!role?.totalAccess || !!role?.canSeeEmployeeReport;
+const canSeeEmployeeReport = (role) => role?.employeeAccess
+    ? (0, employee_access_permissions_1.hasEmployeeAccess)(role, 'reports', 'view')
+    : !!role?.totalAccess || !!role?.canSeeEmployeeReport;
 exports.canSeeEmployeeReport = canSeeEmployeeReport;

package/dist/serialize-role-employee-access.spec.d.ts

@@ -0,0 +1 @@
+import 'reflect-metadata';

package/dist/serialize-role-employee-access.spec.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const create_role_dto_1 = require("@escapenavigator/types/dist/role/create-role.dto");
+const employee_access_1 = require("@escapenavigator/types/dist/role/employee-access");
+const serialize_record_1 = require("./serialize-record");
+describe('CreateRoleDto employeeAccess', () => {
+    it('сохраняет вложенные права при сборке формы роли', () => {
+        const dto = (0, serialize_record_1.serializeRecord)(create_role_dto_1.CreateRoleDto, {
+            title: 'Администратор',
+            totalAccess: false,
+            employeeAccess: {
+                employees: {
+                    view: true,
+                    create: false,
+                    edit: true,
+                    delete: false,
+                    manageAccess: true,
+                },
+                shifts: {
+                    view: true,
+                    create: false,
+                    edit: false,
+                    delete: false,
+                    scope: employee_access_1.EmployeeAccessScope.ALL,
+                },
+                bonuses: {
+                    view: false,
+                    create: false,
+                    edit: false,
+                    delete: false,
+                    scope: employee_access_1.EmployeeAccessScope.SELF,
+                },
+                fines: {
+                    view: false,
+                    create: false,
+                    edit: false,
+                    delete: false,
+                    scope: employee_access_1.EmployeeAccessScope.SELF,
+                },
+                roles: { view: true, create: false, edit: false, delete: false },
+                positions: { view: true, create: true, edit: false, delete: false },
+                reports: { view: true, create: false, edit: false, delete: false },
+                payroll: {
+                    view: true,
+                    create: false,
+                    edit: false,
+                    delete: false,
+                    scope: employee_access_1.EmployeeAccessScope.ASSIGNED_LOCATIONS,
+                },
+            },
+        });
+        expect(dto.employeeAccess?.employees.view).toBe(true);
+        expect(dto.employeeAccess?.employees.manageAccess).toBe(true);
+        expect(dto.employeeAccess?.shifts.scope).toBe(employee_access_1.EmployeeAccessScope.ALL);
+        expect(dto.employeeAccess?.payroll.view).toBe(true);
+        expect(dto.employeeAccess?.roles.view).toBe(true);
+    });
+});

package/dist/user-session-permissions.d.ts

@@ -10,10 +10,12 @@ export declare const USER_SESSION_ERROR_KEYS: {
 };
 export type UserSessionErrorKey = keyof typeof USER_SESSION_ERROR_KEYS;
 export declare const USER_SESSION_ERRORS_EN: Record<UserSessionErrorKey, string>;
-export type UserSessionRolePermissions = Pick<RoleRO, 'totalAccess' | 'canEditWorkedHours' | 'canEditOwnWorkedHours'>;
+export type UserSessionRolePermissions = Pick<RoleRO, 'totalAccess' | 'canEditWorkedHours' | 'canEditOwnWorkedHours'> & Partial<Pick<RoleRO, 'employeeAccess'>>;
 export type UserSessionPermissionTarget = {
     hold?: boolean;
     authorId?: number | null;
+    /** Employee the shift is assigned to. Null when the shift is still open. */
+    userId?: number | null;
     date: string;
 };
 export type UserSessionClaimTarget = {
@@ -35,6 +37,7 @@ export type UserSessionClaimDto = {
     hold?: boolean;
 };
 export declare const canEditOtherUserSessions: (role: UserSessionRolePermissions) => boolean;
+export declare const canCreateOtherUserSessions: (role: UserSessionRolePermissions) => boolean;
 export declare const isSessionDateTodayOrFuture: (date: string, today?: string) => boolean;
 /** Unassigned shift or a shift with an open replace request — any employee may claim it. */
 export declare const isOpenUserSession: (session: Pick<UserSessionClaimTarget, "userId" | "needReplace">) => boolean;
@@ -52,6 +55,7 @@ export declare const getUserSessionEditDenial: (params: {
     session: UserSessionPermissionTarget;
     role: UserSessionRolePermissions;
     userId: number;
+    action?: "edit" | "delete";
 }) => string | null;
 /** Returns an English denial message, or null when creating a shift is allowed. */
 export declare const getUserSessionCreateDenial: (params: {

package/dist/user-session-permissions.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.canEditUserSession = exports.getUserSessionCreateDenial = exports.getUserSessionEditDenial = exports.isTakingOpenUserSession = exports.isOpenUserSession = exports.isSessionDateTodayOrFuture = exports.canEditOtherUserSessions = exports.USER_SESSION_ERRORS_EN = exports.USER_SESSION_ERROR_KEYS = void 0;
+exports.canEditUserSession = exports.getUserSessionCreateDenial = exports.getUserSessionEditDenial = exports.isTakingOpenUserSession = exports.isOpenUserSession = exports.isSessionDateTodayOrFuture = exports.canCreateOtherUserSessions = exports.canEditOtherUserSessions = exports.USER_SESSION_ERRORS_EN = exports.USER_SESSION_ERROR_KEYS = void 0;
+const employee_access_1 = require("@escapenavigator/types/dist/role/employee-access");
+const employee_access_permissions_1 = require("./employee-access-permissions");
 exports.USER_SESSION_ERROR_KEYS = {
     shiftLocked: 'shiftLocked',
     noPermission: 'noPermission',
@@ -13,14 +15,23 @@ exports.USER_SESSION_ERROR_KEYS = {
 exports.USER_SESSION_ERRORS_EN = {
     shiftLocked: 'This shift is locked. Unlock it before editing or deleting.',
     noPermission: 'You do not have permission to manage work shifts.',
-    notShiftAuthor: 'You can only edit shifts that you created. Ask a manager with worked-hours access to change this shift.',
+    notShiftAuthor: 'You can only edit shifts assigned to you, or shifts that you created. Ask a manager with worked-hours access to change this shift.',
     ownShiftPastDate: 'You can only edit or delete your own shifts on today or future dates.',
     cannotAssignOthers: 'You cannot create or assign shifts for other employees. Enable "Can edit logged time" on your role.',
     cannotCreateUnassigned: 'You cannot create unassigned shifts. Enable "Can edit logged time" on your role.',
     sessionNotFound: 'Work shift not found.',
 };
-const canEditOtherUserSessions = (role) => !!role.totalAccess || !!role.canEditWorkedHours;
+const canMutateOtherUserSessions = (role, action) => role.employeeAccess
+    ? (0, employee_access_permissions_1.hasEmployeeAccess)(role, 'shifts', action) &&
+        (0, employee_access_permissions_1.getEmployeeAccessScope)(role, 'shifts') !== employee_access_1.EmployeeAccessScope.SELF
+    : !!role.totalAccess || !!role.canEditWorkedHours;
+const canMutateOwnUserSessions = (role, action) => role.employeeAccess
+    ? (0, employee_access_permissions_1.hasEmployeeAccess)(role, 'shifts', action)
+    : !!role.totalAccess || !!role.canEditWorkedHours || !!role.canEditOwnWorkedHours;
+const canEditOtherUserSessions = (role) => canMutateOtherUserSessions(role, 'edit');
 exports.canEditOtherUserSessions = canEditOtherUserSessions;
+const canCreateOtherUserSessions = (role) => canMutateOtherUserSessions(role, 'create');
+exports.canCreateOtherUserSessions = canCreateOtherUserSessions;
 const isSessionDateTodayOrFuture = (date, today = formatTodayYmd()) => today <= date;
 exports.isSessionDateTodayOrFuture = isSessionDateTodayOrFuture;
 /** Unassigned shift or a shift with an open replace request — any employee may claim it. */
@@ -65,17 +76,22 @@ const formatTodayYmd = () => {
 };
 /** Returns an English denial message, or null when edit/delete is allowed. */
 const getUserSessionEditDenial = (params) => {
-    const { session, role, userId } = params;
+    const { session, role, userId, action = 'edit' } = params;
     if (session.hold) {
         return exports.USER_SESSION_ERRORS_EN.shiftLocked;
     }
-    if ((0, exports.canEditOtherUserSessions)(role)) {
+    if (canMutateOtherUserSessions(role, action)) {
         return null;
     }
-    if (!role.canEditOwnWorkedHours) {
+    if (!canMutateOwnUserSessions(role, action)) {
         return exports.USER_SESSION_ERRORS_EN.noPermission;
     }
-    if (session.authorId !== userId) {
+    const assignedToActor = session.userId != null && session.userId === userId;
+    const authoredByActor = session.authorId === userId;
+    // Own-hours access covers the worker's assigned shift even when a location
+    // admin created it. Unassigned shifts and other people's shifts stay limited
+    // to the author.
+    if (!assignedToActor && !authoredByActor) {
         return exports.USER_SESSION_ERRORS_EN.notShiftAuthor;
     }
     if (!(0, exports.isSessionDateTodayOrFuture)(session.date)) {
@@ -87,10 +103,10 @@ exports.getUserSessionEditDenial = getUserSessionEditDenial;
 /** Returns an English denial message, or null when creating a shift is allowed. */
 const getUserSessionCreateDenial = (params) => {
     const { assigneeUserId, role, actorId } = params;
-    if ((0, exports.canEditOtherUserSessions)(role)) {
+    if ((0, exports.canCreateOtherUserSessions)(role)) {
         return null;
     }
-    if (!role.canEditOwnWorkedHours) {
+    if (!canMutateOwnUserSessions(role, 'create')) {
         return exports.USER_SESSION_ERRORS_EN.noPermission;
     }
     if (assigneeUserId != null && assigneeUserId !== actorId) {

package/dist/user-session-permissions.spec.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const employee_access_permissions_1 = require("./employee-access-permissions");
 const user_session_permissions_1 = require("./user-session-permissions");
 const openSession = {
     hold: false,
@@ -79,16 +80,80 @@ describe('isTakingOpenUserSession', () => {
         })).toBe(false);
     });
 });
+const ownHoursRole = {
+    totalAccess: false,
+    canEditWorkedHours: false,
+    canEditOwnWorkedHours: true,
+};
 describe('getUserSessionEditDenial', () => {
     it("still requires author for non-manager edit of someone else's unassigned shift", () => {
         expect((0, user_session_permissions_1.getUserSessionEditDenial)({
             session: { hold: false, authorId: 1, date: '2099-01-01' },
-            role: {
-                totalAccess: false,
-                canEditWorkedHours: false,
-                canEditOwnWorkedHours: true,
-            },
+            role: ownHoursRole,
             userId: 42,
         })).toBe(user_session_permissions_1.USER_SESSION_ERRORS_EN.notShiftAuthor);
     });
+    it('allows a worker to edit an unlocked shift assigned to them when an admin created it', () => {
+        expect((0, user_session_permissions_1.getUserSessionEditDenial)({
+            session: {
+                hold: false,
+                authorId: 1,
+                userId: 42,
+                date: '2099-01-01',
+            },
+            role: ownHoursRole,
+            userId: 42,
+        })).toBeNull();
+    });
+    it('still blocks a locked shift assigned to the worker', () => {
+        expect((0, user_session_permissions_1.getUserSessionEditDenial)({
+            session: {
+                hold: true,
+                authorId: 1,
+                userId: 42,
+                date: '2099-01-01',
+            },
+            role: ownHoursRole,
+            userId: 42,
+        })).toBe(user_session_permissions_1.USER_SESSION_ERRORS_EN.shiftLocked);
+    });
+    it('still blocks a past shift assigned to the worker', () => {
+        expect((0, user_session_permissions_1.getUserSessionEditDenial)({
+            session: {
+                hold: false,
+                authorId: 1,
+                userId: 42,
+                date: '2000-01-01',
+            },
+            role: ownHoursRole,
+            userId: 42,
+        })).toBe(user_session_permissions_1.USER_SESSION_ERRORS_EN.ownShiftPastDate);
+    });
+});
+describe('granular shift actions', () => {
+    it('does not let edit permission imply create or delete', () => {
+        const employeeAccess = (0, employee_access_permissions_1.createFullEmployeeAccess)();
+        employeeAccess.shifts.create = false;
+        employeeAccess.shifts.delete = false;
+        const role = {
+            ...ownHoursRole,
+            employeeAccess,
+        };
+        expect((0, user_session_permissions_1.getUserSessionCreateDenial)({
+            assigneeUserId: 42,
+            role,
+            actorId: 42,
+        })).toBe(user_session_permissions_1.USER_SESSION_ERRORS_EN.noPermission);
+        expect((0, user_session_permissions_1.getUserSessionEditDenial)({
+            session: {
+                hold: false,
+                authorId: 42,
+                userId: 42,
+                date: '2099-01-01',
+            },
+            role,
+            userId: 42,
+            action: 'delete',
+        })).toBe(user_session_permissions_1.USER_SESSION_ERRORS_EN.noPermission);
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@escapenavigator/utils",
-  "version": "2.1.30",
+  "version": "2.2.1",
   "publishConfig": {
     "access": "public"
   },
@@ -14,7 +14,7 @@
     "test": "jest"
   },
   "dependencies": {
-    "@escapenavigator/types": "^2.1.30",
+    "@escapenavigator/types": "^2.2.1",
     "axios": "^0.21.4",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.13.2",
@@ -29,5 +29,5 @@
     "ts-jest": "^29.1.1",
     "typescript": "^5.6"
   },
-  "gitHead": "089c7026734588a852850ab98ef6984711a5f343"
+  "gitHead": "ea7b4af0c3cf4882d2d5359bf6adeee25dde246e"
 }