hotel-manage-stack/cashup
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions
22 commits 1 branch 0 tags 765 KiB
Commit graph

3 commits

Author SHA1 Message Date
jtricerolph
4754231f6f Split floats→safe_count, reports→cash_summary, add history cap 
Adds three new granular capabilities:
- history: gates /history page and GET /api/cashup/history
- cash_summary: gates /summary page and GET /api/reports/cash-summary
- safe_count: gates /safe page and safe_cash float routes

Updates legacy-token fallback to include all seven non-settings caps.
Route guards and nav items updated to use the split caps.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 14:35:56 +00:00
jtricerolph
be670f724d Enforce granular capabilities across cashup 
Backend (server-side enforcement, not just UI):
- auth.js: read caps from JWT; hasCap() + requireCap() helpers;
  legacy-token fallback (full access minus settings) so existing
  sessions keep working until re-login
- finalise: submit final, delete draft, bulk-finalise, attachments
- reports: multiday report, cash summary, debtors
- floats: float management + safe count
- settings: settings mutations (was is_admin)
- count: draft save, newbook fetch

Frontend:
- can(user, cap) helper; User.caps from /verify
- Nav items, routes and actions (Submit Final, delete, bulk-finalise)
  gated on capabilities; non-finalisers see a draft-only hint

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-02 14:19:30 +00:00
jtricerolph
63a5a72fa3 Wire Newbook credentials to settings service 2026-07-01 19:33:16 +00:00