Enforce granular capabilities across cashup
Backend (server-side enforcement, not just UI):
- auth.js: read caps from JWT; hasCap() + requireCap() helpers;
legacy-token fallback (full access minus settings) so existing
sessions keep working until re-login
- finalise: submit final, delete draft, bulk-finalise, attachments
- reports: multiday report, cash summary, debtors
- floats: float management + safe count
- settings: settings mutations (was is_admin)
- count: draft save, newbook fetch
Frontend:
- can(user, cap) helper; User.caps from /verify
- Nav items, routes and actions (Submit Final, delete, bulk-finalise)
gated on capabilities; non-finalisers see a draft-only hint
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jtricerolph
be670f724d