fix: solución de bloqueos y estandarización de permisos

This commit is contained in:
2026-04-27 10:47:30 -05:00
parent fa3cbb4d0a
commit 5c2a84e95d
312 changed files with 13889 additions and 7911 deletions

View File

@@ -42,7 +42,7 @@ async def get_clients_and_providers(
current_user: dict = Depends(get_current_user),
):
"""Get clients and providers"""
tenant_id = validate_access_to_resource(db, company_id, current_user)
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.view"])
query = db.query(ClientProvider).options(
joinedload(ClientProvider.address),
@@ -83,7 +83,7 @@ async def get_clients_and_providers_basic_info(
current_user: dict = Depends(get_current_user),
):
"""Get basic information for a client/provider (without address and programs)"""
tenant_id = validate_access_to_resource(db, company_id, current_user)
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.view"])
client = ClientProviderService.get_by_id(db, client_id, tenant_id, company_id)
if not client:
@@ -100,7 +100,7 @@ async def create_client_provider(
current_user: dict = Depends(get_current_user),
):
"""Create a new client/provider"""
tenant_id = validate_access_to_resource(db, company_id, current_user)
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.create"])
return ClientProviderService.create(db, client_data, tenant_id, company_id)
@@ -114,7 +114,7 @@ async def update_client_provider(
current_user: dict = Depends(get_current_user),
):
"""Update a client/provider"""
tenant_id = validate_access_to_resource(db, company_id, current_user)
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.edit"])
client = ClientProviderService.update(
db, client_id, tenant_id, company_id, client_data
@@ -135,7 +135,7 @@ async def get_client_provider_detail(
Obtener un cliente/proveedor completo por ID.
Esta es la ruta que tu formulario necesita para cargar los datos.
"""
tenant_id = validate_access_to_resource(db, company_id, current_user)
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.view"])
# Usamos el servicio para buscar por ID
client = ClientProviderService.get_by_id(db, client_id, tenant_id, company_id)
@@ -153,7 +153,7 @@ async def delete_client_provider(
current_user: dict = Depends(get_current_user),
):
"""Delete a client/provider"""
tenant_id = validate_access_to_resource(db, company_id, current_user)
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.delete"])
success = ClientProviderService.delete(db, client_id, tenant_id, company_id)
if not success: