Aman-Mittal commented on issue #142:
URL:
https://github.com/apache/fineract-backoffice-ui/issues/142#issuecomment-5306476187
Implemented in #368, and taken past PHASE 1.
The four groups this issue names — Interop, Campaigns, Working Capital and
Account Transfer — were
gated by earlier work. What was still missing is everything else:
`NAV_CONFIG` had **21
`requiredPermissions` declarations across 115 routed entries**, so roughly
80% of the sidebar was
visible to every authenticated user, including one with zero permissions.
That is now **100 declarations covering every routed entry whose route is
gated**. `filterNavItems()`
is unchanged and no second navigation permission system was added — this is
data.
Two things worth flagging for review:
- **The nav entry now matches its route.** Each `requiredPermissions` is the
code the corresponding
route declares in `data.permissions`, and
`scripts/check-route-permissions.mjs` fails CI if the
two ever disagree, if a nav entry points at a path no route serves, or if
an exemption goes stale.
Gating the sidebar was only ever half the problem: the URL still opened
every one of those screens
(#367), so hiding an entry without refusing the route just moved the gap
somewhere less visible.
- **`/transfers/account-transfer` moved from `READ_ACCOUNTTRANSFER` to
`CREATE_ACCOUNTTRANSFER`.**
The screen is a form that posts a transfer, so offering it on a read
permission led straight to a
refusal. `READ_ACCOUNTTRANSFER` now gates the transfer history instead.
15 entries remain ungated, all deliberately: self-service destinations
(`/dashboard`, `/profile`,
`/search`, `/notifications`) and screens for which Fineract's catalogue
defines **no read
permission at all** — tellers, share products and accounts, provisioning,
ad-hoc queries, entity
mapping, group levels, external asset owners, SPM. Each is recorded with its
reason rather than
given a fabricated code that no role could ever satisfy. Where write codes
do exist for the same
feature, the write routes are gated even though the read route is not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
