Fix Manager dashboard permission lookup

app/modules/manager_dashboard/service.py

@@ -8,7 +8,7 @@ from sqlalchemy.orm import Session, selectinload
 
 from app.modules.clients.models import Client
 from app.modules.core.iam.models import User
-from app.modules.core.rbac.models import Role, UserRole
+from app.modules.core.rbac.models import Permission, Role, RolePermission, UserRole
 from app.modules.employees.service import build_employee_scope, list_employee_work_assignable_users
 from app.modules.services.execution import CLOSED_TASK_STATUSES
 from app.modules.services.models import ClientServiceSubscription, ClientServiceTaskInstance, ServiceCatalogue, ServiceTaskComment
@@ -35,21 +35,24 @@ def get_user_role_names(db: Session, user_id: int) -> list[str]:
 
 
 def get_user_permission_names(db: Session, user_id: int) -> set[str]:
-    # Lightweight best-effort permission lookup through the active roles already used by the ERP RBAC tables.
+    """Return active permission codes granted through the user's active roles.
+
+    The ERP stores permissions in the normalized RolePermission mapping table;
+    Role itself intentionally has no ``permissions`` column.
+    """
     rows = db.execute(
-        select(Role.permissions)
+        select(Permission.code)
+        .join(RolePermission, RolePermission.permission_id == Permission.id)
+        .join(Role, Role.id == RolePermission.role_id)
         .join(UserRole, UserRole.role_id == Role.id)
-        .where(UserRole.user_id == int(user_id), Role.is_active.is_(True))
+        .where(
+            UserRole.user_id == int(user_id),
+            Role.is_active.is_(True),
+            Permission.is_active.is_(True),
+        )
+        .distinct()
     ).scalars().all()
-    permissions: set[str] = set()
+    return {str(code).strip() for code in rows if code and str(code).strip()}
-    for value in rows:
-        if isinstance(value, (list, tuple, set)):
-            permissions.update(str(v) for v in value if v)
-        elif isinstance(value, str):
-            # Supports both comma separated and JSON-like textual storage without being destructive.
-            cleaned = value.replace("[", "").replace("]", "").replace('"', "").replace("'", "")
-            permissions.update(v.strip() for v in cleaned.split(",") if v.strip())
-    return permissions
 
 
 def can_access_manager_dashboard(db: Session, current_user) -> bool: