fix: solución de bloqueos y estandarización de permisos
This commit is contained in:
@@ -42,7 +42,7 @@ async def get_clients_and_providers(
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
"""Get clients and providers"""
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user)
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.view"])
|
||||
|
||||
query = db.query(ClientProvider).options(
|
||||
joinedload(ClientProvider.address),
|
||||
@@ -83,7 +83,7 @@ async def get_clients_and_providers_basic_info(
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
"""Get basic information for a client/provider (without address and programs)"""
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user)
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.view"])
|
||||
|
||||
client = ClientProviderService.get_by_id(db, client_id, tenant_id, company_id)
|
||||
if not client:
|
||||
@@ -100,7 +100,7 @@ async def create_client_provider(
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
"""Create a new client/provider"""
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user)
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.create"])
|
||||
|
||||
return ClientProviderService.create(db, client_data, tenant_id, company_id)
|
||||
|
||||
@@ -114,7 +114,7 @@ async def update_client_provider(
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
"""Update a client/provider"""
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user)
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.edit"])
|
||||
|
||||
client = ClientProviderService.update(
|
||||
db, client_id, tenant_id, company_id, client_data
|
||||
@@ -135,7 +135,7 @@ async def get_client_provider_detail(
|
||||
Obtener un cliente/proveedor completo por ID.
|
||||
Esta es la ruta que tu formulario necesita para cargar los datos.
|
||||
"""
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user)
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.view"])
|
||||
|
||||
# Usamos el servicio para buscar por ID
|
||||
client = ClientProviderService.get_by_id(db, client_id, tenant_id, company_id)
|
||||
@@ -153,7 +153,7 @@ async def delete_client_provider(
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
"""Delete a client/provider"""
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user)
|
||||
tenant_id = validate_access_to_resource(db, company_id, current_user, ["partners_mgmt.delete"])
|
||||
|
||||
success = ClientProviderService.delete(db, client_id, tenant_id, company_id)
|
||||
if not success:
|
||||
|
||||
Reference in New Issue
Block a user