From c994eaaa8e452fc22a763cda7a9d5c54ac824ee6 Mon Sep 17 00:00:00 2001
From: Allan Carr <allan.carr@thinkimex.com>
Date: Thu, 29 Aug 2024 13:48:39 -0700
Subject: [PATCH] IO-2893 Correct RBACs for editing tickets

Signed-off-by: Allan Carr <allan.carr@thinkimex.com>
---
 .../time-ticket-list.component.jsx            | 45 +++++++++++++------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/client/src/components/time-ticket-list/time-ticket-list.component.jsx b/client/src/components/time-ticket-list/time-ticket-list.component.jsx
index 73de57e33..11ec514fe 100644
--- a/client/src/components/time-ticket-list/time-ticket-list.component.jsx
+++ b/client/src/components/time-ticket-list/time-ticket-list.component.jsx
@@ -254,24 +254,41 @@ export function TimeTicketList({
                   timeticket: record
                 }}
                 disabled={
-                  record.committed_at
-                    ? HasRbacAccess({
-                        bodyshop,
-                        authLevel: authLevel,
-                        action: "timetickets:editcommitted"
-                      }) &&
-                      HasRbacAccess({
-                        bodyshop,
-                        authLevel: authLevel,
-                        action: "timetickets:shiftedit"
-                      })
-                    : HasRbacAccess({
+                  record.ciecacode
+                    ? record.committed_at
+                      ? HasRbacAccess({
+                          bodyshop,
+                          authLevel: authLevel,
+                          action: "timetickets:editcommitted"
+                        }) &&
+                        HasRbacAccess({
+                          bodyshop,
+                          authLevel: authLevel,
+                          action: "timetickets:edit"
+                        })
+                      : HasRbacAccess({
+                          bodyshop,
+                          authLevel: authLevel,
+                          action: "timetickets:edit"
+                        })
+                    : record.committed_at
+                      ? HasRbacAccess({
+                          bodyshop,
+                          authLevel: authLevel,
+                          action: "timetickets:editcommitted"
+                        }) &&
+                        HasRbacAccess({
                           bodyshop,
                           authLevel: authLevel,
                           action: "timetickets:shiftedit"
                         })
-                      ? disabled
-                      : !record.jobid
+                      : HasRbacAccess({
+                            bodyshop,
+                            authLevel: authLevel,
+                            action: "timetickets:shiftedit"
+                          })
+                        ? disabled
+                        : !record.jobid
                 }
               >
                 <EditFilled />