From 6f6247c8e681908372c5580b9e2ef666e45ea7a2 Mon Sep 17 00:00:00 2001 From: A R R R Associates Date: Fri, 10 Jul 2026 20:28:47 +0530 Subject: [PATCH] Fix Manager dashboard permission lookup --- app/modules/manager_dashboard/service.py | 29 +++++++++++++----------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/app/modules/manager_dashboard/service.py b/app/modules/manager_dashboard/service.py index 7b60066..f1aa25e 100644 --- a/app/modules/manager_dashboard/service.py +++ b/app/modules/manager_dashboard/service.py @@ -8,7 +8,7 @@ from sqlalchemy.orm import Session, selectinload from app.modules.clients.models import Client from app.modules.core.iam.models import User -from app.modules.core.rbac.models import Role, UserRole +from app.modules.core.rbac.models import Permission, Role, RolePermission, UserRole from app.modules.employees.service import build_employee_scope, list_employee_work_assignable_users from app.modules.services.execution import CLOSED_TASK_STATUSES from app.modules.services.models import ClientServiceSubscription, ClientServiceTaskInstance, ServiceCatalogue, ServiceTaskComment @@ -35,21 +35,24 @@ def get_user_role_names(db: Session, user_id: int) -> list[str]: def get_user_permission_names(db: Session, user_id: int) -> set[str]: - # Lightweight best-effort permission lookup through the active roles already used by the ERP RBAC tables. + """Return active permission codes granted through the user's active roles. + + The ERP stores permissions in the normalized RolePermission mapping table; + Role itself intentionally has no ``permissions`` column. + """ rows = db.execute( - select(Role.permissions) + select(Permission.code) + .join(RolePermission, RolePermission.permission_id == Permission.id) + .join(Role, Role.id == RolePermission.role_id) .join(UserRole, UserRole.role_id == Role.id) - .where(UserRole.user_id == int(user_id), Role.is_active.is_(True)) + .where( + UserRole.user_id == int(user_id), + Role.is_active.is_(True), + Permission.is_active.is_(True), + ) + .distinct() ).scalars().all() - permissions: set[str] = set() - for value in rows: - if isinstance(value, (list, tuple, set)): - permissions.update(str(v) for v in value if v) - elif isinstance(value, str): - # Supports both comma separated and JSON-like textual storage without being destructive. - cleaned = value.replace("[", "").replace("]", "").replace('"', "").replace("'", "") - permissions.update(v.strip() for v in cleaned.split(",") if v.strip()) - return permissions + return {str(code).strip() for code in rows if code and str(code).strip()} def can_access_manager_dashboard(db: Session, current_user) -> bool: