Merge pull request #106 from copenhagentruckwash/fix-booking-delete-access-permission

Fix booking delete action visibility

src/components/displays/buttons/ActionSettingsWheelButton.vue

@@ -97,6 +97,10 @@ const props = defineProps({
     type: Boolean,
     default: false,
   },
+  allowBookingDeletion: {
+    type: Boolean,
+    default: false,
+  },
   department_lane_id: {
     type: Number,
     default: null,
@@ -1752,6 +1756,11 @@ const acceptSelfServeWashDraft = async () => {
   }
 };
 
+const canDeleteOrderBooking = computed(() =>
+  !props.order_id &&
+  (props.allowBookingDeletion || SessionUser.canAccessAdmin() || SessionUser.canAccessSuperUser())
+);
+
 const flatBuiltInMenuSections = computed(() => {
   const sections = [];
 
@@ -1806,7 +1815,7 @@ const flatBuiltInMenuSections = computed(() => {
               ),
           })
         : null,
-      !props.order_id
+      canDeleteOrderBooking.value
         ? buildMenuAction("booking-delete", {
             icon: "fas fa-trash-alt",
             label: t("admin.pos.settings_wheel.delete_booking"),

src/views/dashboards/userDashboard/bookings/displays/tables/OrderBookingsTable.vue

@@ -143,11 +143,32 @@ const onItemsClick = (event, booking) => {
   showPopper(popperBox(t("bookings_table.services"), content), event.currentTarget || event.target);
 };
 
+const normalizePositiveInteger = (value) => {
+  const parsedValue = Number.parseInt(String(value ?? ""), 10);
+  return Number.isInteger(parsedValue) && parsedValue > 0 ? parsedValue : null;
+};
+
+const getCurrentCustomerNumber = () =>
+  normalizePositiveInteger(
+    SessionUser.isSubuser.value
+      ? SessionUser.subuser.selectedGrantCustomerNumber.value
+      : SessionUser.getCustomerNumber()
+  );
+
+const isOwnBooking = (bookingobj) =>
+  normalizePositiveInteger(bookingobj?.customer_number) === getCurrentCustomerNumber();
+
 const canEditBooking = (bookingobj) => {
   // Admins can always edit
   if (SessionUser.canAccessAdmin() && SessionUser.hasPermission("edit_bookings")) return true;
   if (!!bookingobj.order_id) return false; // Only allow editing bookings without an order
-  if (SessionUser.hasPermission("edit_own_bookings")) return true;
+  if (SessionUser.hasPermission("edit_own_bookings") && isOwnBooking(bookingobj)) return true;
+};
+
+const canDeleteBooking = (bookingobj) => {
+  if (!!bookingobj.order_id) return false;
+  if (SessionUser.canAccessAdmin() || SessionUser.canAccessSuperUser()) return true;
+  return SessionUser.hasPermission("edit_own_bookings") && isOwnBooking(bookingobj);
 };
 
 const sortedList = computed(() => {
@@ -467,6 +488,7 @@ const getColspan = () => {
                           :customer_number="booking.customer_number"
                           :department_id="booking.department"
                           :refresh-function="loadList"
+                          :allow-booking-deletion="canDeleteBooking(booking)"
                           :reg_1="booking.reg_1"
                           :reg_2="booking.reg_2"
                           :icon="'fas fa-ellipsis-v'"
@@ -532,6 +554,7 @@ const getColspan = () => {
                           <span>{{ getDepartmentName(parseInt(booking.department)) }}</span>
                         </span>
                         <button
+                          v-if="canDeleteBooking(booking)"
                           class="button is-light is-danger is-small order-booking-card-header__delete"
                           type="button"
                           aria-label="Slet booking"
@@ -598,6 +621,7 @@ const getColspan = () => {
                         :customer_number="booking.customer_number"
                         :department_id="booking.department"
                         :refresh-function="loadList"
+                        :allow-booking-deletion="canDeleteBooking(booking)"
                         :reg_1="booking.reg_1"
                         :reg_2="booking.reg_2"
                         :displayActionsDirectly="true"