From 0da6c047908eacf49b638561eefa507871d6f956 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=98=D0=BB=D1=8C=D1=8F=D1=81=20=D0=A1=D1=83=D0=BB=D1=82?= =?UTF-8?q?=D0=B0=D0=BD=D0=BE=D0=B2?= Date: Mon, 13 Jul 2026 16:16:46 +0300 Subject: [PATCH] fix(permissions): restore admin access after page reload - /api/auth/me now returns app-role permissions (was empty after reload). - client hasPermission/hasAnyPermission now bypass admin so UI queries are not disabled when permissions array is stale. --- client/src/lib/permissions.ts | 8 ++++++-- server/routes/auth.core.routes.ts | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/client/src/lib/permissions.ts b/client/src/lib/permissions.ts index 8382dcd..b8497c8 100644 --- a/client/src/lib/permissions.ts +++ b/client/src/lib/permissions.ts @@ -1,11 +1,15 @@ import type { User } from '@/types/auth.types'; export function hasPermission(user: User | null, code: string): boolean { - return user?.permissions?.includes(code) ?? false; + if (!user) return false; + if (user.appRole === 'admin') return true; + return user.permissions?.includes(code) ?? false; } export function hasAnyPermission(user: User | null, ...codes: string[]): boolean { - return codes.some(c => user?.permissions?.includes(c)); + if (!user) return false; + if (user.appRole === 'admin') return true; + return codes.some(c => user.permissions?.includes(c)); } export function isAdmin(user: User | null): boolean { diff --git a/server/routes/auth.core.routes.ts b/server/routes/auth.core.routes.ts index 68c857b..4fb17db 100644 --- a/server/routes/auth.core.routes.ts +++ b/server/routes/auth.core.routes.ts @@ -189,6 +189,7 @@ export function registerAuthCoreRoutes(router: Router): void { if (!user) { return res.status(401).json({ success: false, error: 'Пользователь не найден' }); } + const permissions = await storage.getAppRolePermissions(user.appRole); res.json({ success: true, user: { @@ -198,7 +199,7 @@ export function registerAuthCoreRoutes(router: Router): void { lastName: user.lastName, middleName: user.middleName, appRole: user.appRole, - permissions: (user as any).permissions || [], + permissions, organization: user.organization ? { id: user.organization.id, name: user.organization.name,