IO-3596 Manual Line Lock Down

Signed-off-by: Allan Carr <allan@imexsystems.ca>

client/src/components/job-detail-lines/job-lines.component.jsx

@@ -33,7 +33,7 @@ import JobLinesBillRefernece from "../job-lines-bill-reference/job-lines-bill-re
 import { useTreatmentsWithConfig } from "@splitsoftware/splitio-react";
 import _ from "lodash";
 import { FaTasks } from "react-icons/fa";
-import { selectBodyshop } from "../../redux/user/user.selectors";
+import { selectAuthLevel, selectBodyshop } from "../../redux/user/user.selectors";
 import dayjs from "../../utils/day";
 import InstanceRenderManager from "../../utils/instanceRenderMgr";
 import { HasFeatureAccess } from "../feature-wrapper/feature-wrapper.component";
@@ -49,6 +49,7 @@ import JobLinesPartPriceChange from "./job-lines-part-price-change.component";
 import JobLinesExpanderSimple from "./jobs-lines-expander-simple.component";
 import { logImEXEvent } from "../../firebase/firebase.utils";
 import { useNotification } from "../../contexts/Notifications/notificationContext.jsx";
+import { HasRbacAccess } from "../rbac-wrapper/rbac-wrapper.component.jsx";
 
 const UPDATE_JOB_LINES_LOCATION_BULK = gql`
   mutation UPDATE_JOB_LINES_LOCATION_BULK($ids: [uuid!]!, $location: String!) {
@@ -66,7 +67,8 @@ const mapStateToProps = createStructuredSelector({
   bodyshop: selectBodyshop,
   jobRO: selectJobReadOnly,
   technician: selectTechnician,
-  isPartsEntry: selectIsPartsEntry
+  isPartsEntry: selectIsPartsEntry,
+  authLevel: selectAuthLevel
 });
 
 const mapDispatchToProps = (dispatch) => ({
@@ -94,7 +96,8 @@ export function JobLinesComponent({
   setTaskUpsertContext,
   billsQuery,
   handlePartsOrderOnRowClick,
-  isPartsEntry
+  isPartsEntry,
+  authLevel
 }) {
   const [deleteJobLine] = useMutation(DELETE_JOB_LINE_BY_PK);
   const [bulkUpdateLocations] = useMutation(UPDATE_JOB_LINES_LOCATION_BULK);
@@ -386,18 +389,20 @@ export function JobLinesComponent({
             key: "actions",
             render: (text, record) => (
               <Space>
-                {(record.manual_line || jobIsPrivate) && !technician && (
-                  <Button
-                    disabled={jobRO}
-                    onClick={() => {
-                      setJobLineEditContext({
-                        actions: { refetch: refetch, submit: form && form.submit },
-                        context: { ...record, jobid: job.id }
-                      });
-                    }}
-                    icon={<EditFilled />}
-                  />
-                )}
+                {(record.manual_line || jobIsPrivate) &&
+                  !technician &&
+                  HasRbacAccess({ bodyshop, authLevel, action: "jobs:manual-line" }) && (
+                    <Button
+                      disabled={jobRO}
+                      onClick={() => {
+                        setJobLineEditContext({
+                          actions: { refetch: refetch, submit: form && form.submit },
+                          context: { ...record, jobid: job.id }
+                        });
+                      }}
+                      icon={<EditFilled />}
+                    />
+                  )}
                 <Button
                   title={t("tasks.buttons.create")}
                   onClick={() => {
@@ -410,29 +415,30 @@ export function JobLinesComponent({
                   }}
                   icon={<FaTasks />}
                 />
-
-                {(record.manual_line || jobIsPrivate) && !technician && (
-                  <Button
-                    disabled={jobRO}
-                    onClick={async () => {
-                      await deleteJobLine({
-                        variables: { joblineId: record.id },
-                        update(cache) {
-                          cache.modify({
-                            fields: {
-                              joblines(existingJobLines, { readField }) {
-                                return existingJobLines.filter((jlRef) => record.id !== readField("id", jlRef));
+                {(record.manual_line || jobIsPrivate) &&
+                  !technician &&
+                  HasRbacAccess({ bodyshop, authLevel, action: "jobs:manual-line" }) && (
+                    <Button
+                      disabled={jobRO}
+                      onClick={async () => {
+                        await deleteJobLine({
+                          variables: { joblineId: record.id },
+                          update(cache) {
+                            cache.modify({
+                              fields: {
+                                joblines(existingJobLines, { readField }) {
+                                  return existingJobLines.filter((jlRef) => record.id !== readField("id", jlRef));
+                                }
                               }
-                            }
-                          });
-                        }
-                      });
-                      await axios.post("/job/totalsssu", { id: job.id });
-                      if (refetch) refetch();
-                    }}
-                    icon={<DeleteFilled />}
-                  />
-                )}
+                            });
+                          }
+                        });
+                        await axios.post("/job/totalsssu", { id: job.id });
+                        if (refetch) refetch();
+                      }}
+                      icon={<DeleteFilled />}
+                    />
+                  )}
               </Space>
             )
           }
@@ -657,7 +663,7 @@ export function JobLinesComponent({
               <Button id="repair-data-mark-button">{t("jobs.actions.mark")}</Button>
             </Dropdown>
 
-            {!isPartsEntry && (
+            {!isPartsEntry && HasRbacAccess({ bodyshop, authLevel, action: "jobs:manual-line" }) && (
               <Button
                 disabled={jobRO || technician}
                 onClick={() => {

client/src/components/rbac-wrapper/rbac-defaults.js

@@ -26,6 +26,7 @@ const ret = {
   "jobs:partsqueue": 4,
   "jobs:checklist-view": 2,
   "jobs:list-ready": 1,
+  "jobs:manual-line": 1,
   "jobs:void": 5,
 
   "bills:enter": 2,

client/src/components/shop-info/shop-info.rbac.component.jsx

@@ -435,6 +435,19 @@ export function ShopInfoRbacComponent({ bodyshop }) {
           >
             <InputNumber />
           </Form.Item>,
+          <Form.Item
+            key="jobs:manual-line"
+            label={t("bodyshop.fields.rbac.jobs.manual-line")}
+            rules={[
+              {
+                required: true
+                //message: t("general.validation.required"),
+              }
+            ]}
+            name={["md_rbac", "jobs:manual-line"]}
+          >
+            <InputNumber />
+          </Form.Item>,
           <Form.Item
             key="jobs:partsqueue"
             label={t("bodyshop.fields.rbac.jobs.partsqueue")}

client/src/translations/en_us/common.json

@@ -519,6 +519,7 @@
             "list-active": "Jobs -> List Active",
             "list-all": "Jobs -> List All",
             "list-ready": "Jobs -> List Ready",
+            "manual-line": "Jobs -> Manual Line",
             "partsqueue": "Jobs -> Parts Queue",
             "void": "Jobs -> Void"
           },

client/src/translations/es/common.json

@@ -519,6 +519,7 @@
             "list-active": "",
             "list-all": "",
             "list-ready": "",
+            "manual-line": "",
             "partsqueue": "",
             "void": ""
           },

client/src/translations/fr/common.json

@@ -519,6 +519,7 @@
             "list-active": "",
             "list-all": "",
             "list-ready": "",
+            "manual-line": "",
             "partsqueue": "",
             "void": ""
           },

server/accounting/qbo/qbo-payables.js

@@ -130,13 +130,12 @@ exports.default = async (req, res) => {
 
 async function QueryVendorRecord(oauthClient, qbo_realmId, req, bill) {
   try {
-    const url = urlBuilder(
-      qbo_realmId,
-      "query",
-      `select * From vendor where DisplayName = '${StandardizeName(bill.vendor.name)}'`
-    );
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(
+        qbo_realmId,
+        "query",
+        `select * From vendor where DisplayName = '${StandardizeName(bill.vendor.name)}'`
+      ),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -151,11 +150,6 @@ async function QueryVendorRecord(oauthClient, qbo_realmId, req, bill) {
       bodyshopid: bill.job.shopid,
       email: req.user.email
     });
-    logger.log("qbo-payables-query", "DEBUG", req.user.email, null, {
-      method: "QueryVendorRecord",
-      call: url,
-      result: result.json
-    });
 
     return result.json?.QueryResponse?.Vendor?.[0];
   } catch (error) {
@@ -173,9 +167,8 @@ async function InsertVendorRecord(oauthClient, qbo_realmId, req, bill) {
     DisplayName: StandardizeName(bill.vendor.name)
   };
   try {
-    const url = urlBuilder(qbo_realmId, "vendor");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, "vendor"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -191,12 +184,6 @@ async function InsertVendorRecord(oauthClient, qbo_realmId, req, bill) {
       bodyshopid: bill.job.shopid,
       email: req.user.email
     });
-    logger.log("qbo-payments-insert", "DEBUG", req.user.email, null, {
-      method: "InsertVendorRecord",
-      call: url,
-      Vendor: Vendor,
-      result: result.json
-    });
 
     if (result.status >= 400) {
       throw new Error(JSON.stringify(result.json.Fault));
@@ -287,12 +274,11 @@ async function InsertBill(oauthClient, qbo_realmId, req, bill, vendor, bodyshop)
     VendorRef: {
       value: vendor.Id
     },
-    ...(vendor.TermRef &&
-      !bill.is_credit_memo && {
-        SalesTermRef: {
-          value: vendor.TermRef.value
-        }
-      }),
+    ...(vendor.TermRef && !bill.is_credit_memo && {
+      SalesTermRef: {
+        value: vendor.TermRef.value
+      }
+    }),
     TxnDate: moment(bill.date)
       //.tz(bill.job.bodyshop.timezone)
       .format("YYYY-MM-DD"),
@@ -332,9 +318,8 @@ async function InsertBill(oauthClient, qbo_realmId, req, bill, vendor, bodyshop)
     [logKey]: logValue
   });
   try {
-    const url = urlBuilder(qbo_realmId, bill.is_credit_memo ? "vendorcredit" : "bill");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, bill.is_credit_memo ? "vendorcredit" : "bill"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -350,12 +335,6 @@ async function InsertBill(oauthClient, qbo_realmId, req, bill, vendor, bodyshop)
       bodyshopid: bill.job.shopid,
       email: req.user.email
     });
-    logger.log("qbo-payables-insert", "DEBUG", req.user.email, null, {
-      method: "InsertBill",
-      call: url,
-      postingObj: bill.is_credit_memo ? VendorCredit : billQbo,
-      result: result.json
-    });
 
     if (result.status >= 400) {
       throw new Error(JSON.stringify(result.json.Fault));

server/accounting/qbo/qbo-payments.js

@@ -82,7 +82,14 @@ exports.default = async (req, res) => {
 
         if (isThreeTier || (!isThreeTier && twoTierPref === "name")) {
           //Insert the name/owner and account for whether the source should be the ins co in 3 tier..
-          ownerCustomerTier = await QueryOwner(oauthClient, qbo_realmId, req, payment.job, insCoCustomerTier);
+          ownerCustomerTier = await QueryOwner(
+            oauthClient,
+            qbo_realmId,
+            req,
+            payment.job,
+            isThreeTier,
+            insCoCustomerTier
+          );
           //Query for the owner itself.
           if (!ownerCustomerTier) {
             ownerCustomerTier = await InsertOwner(
@@ -222,9 +229,8 @@ async function InsertPayment(oauthClient, qbo_realmId, req, payment, parentRef)
     paymentQbo
   });
   try {
-    const url = urlBuilder(qbo_realmId, "payment");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, "payment"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -240,12 +246,6 @@ async function InsertPayment(oauthClient, qbo_realmId, req, payment, parentRef)
       bodyshopid: payment.job.shopid,
       email: req.user.email
     });
-    logger.log("qbo-payments-insert", "DEBUG", req.user.email, null, {
-      method: "InsertPayment",
-      call: url,
-      paymentQbo: paymentQbo,
-      result: result.json
-    });
 
     if (result.status >= 400) {
       throw new Error(JSON.stringify(result.json.Fault));
@@ -428,9 +428,8 @@ async function InsertCreditMemo(oauthClient, qbo_realmId, req, payment, parentRe
     paymentQbo
   });
   try {
-    const url = urlBuilder(qbo_realmId, "creditmemo");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, "creditmemo"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -446,12 +445,6 @@ async function InsertCreditMemo(oauthClient, qbo_realmId, req, payment, parentRe
       bodyshopid: req.user.bodyshopid,
       email: req.user.email
     });
-    logger.log("qbo-metadata-query", "DEBUG", req.user.email, null, {
-      method: "InsertCreditMemo",
-      call: url,
-      paymentQbo: paymentQbo,
-      result: result.json
-    });
 
     if (result.status >= 400) {
       throw new Error(JSON.stringify(result.json.Fault));

server/accounting/qbo/qbo-receivables.js

@@ -213,13 +213,12 @@ exports.default = async (req, res) => {
 
 async function QueryInsuranceCo(oauthClient, qbo_realmId, req, job) {
   try {
-    const url = urlBuilder(
-      qbo_realmId,
-      "query",
-      `select * From Customer where DisplayName = '${StandardizeName(job.ins_co_nm.trim())}' and Active = true`
-    );
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(
+        qbo_realmId,
+        "query",
+        `select * From Customer where DisplayName = '${StandardizeName(job.ins_co_nm.trim())}' and Active = true`
+      ),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -234,11 +233,6 @@ async function QueryInsuranceCo(oauthClient, qbo_realmId, req, job) {
       jobid: job.id,
       email: req.user.email
     });
-    logger.log("qbo-receivables-query", "DEBUG", req.user.email, job.id, {
-      method: "QueryInsuranceCo",
-      call: url,
-      result: result.json
-    });
 
     return result.json?.QueryResponse?.Customer?.[0];
   } catch (error) {
@@ -272,9 +266,8 @@ async function InsertInsuranceCo(oauthClient, qbo_realmId, req, job, bodyshop) {
     }
   };
   try {
-    const url = urlBuilder(qbo_realmId, "customer");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, "customer"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -290,12 +283,6 @@ async function InsertInsuranceCo(oauthClient, qbo_realmId, req, job, bodyshop) {
       jobid: job.id,
       email: req.user.email
     });
-    logger.log("qbo-receivables-insert", "DEBUG", req.user.email, job.id, {
-      method: "InsertInsuranceCo",
-      call: url,
-      customerObj: Customer,
-      result: result.json
-    });
 
     return result.json?.Customer;
   } catch (error) {
@@ -311,13 +298,12 @@ exports.InsertInsuranceCo = InsertInsuranceCo;
 
 async function QueryOwner(oauthClient, qbo_realmId, req, job, parentTierRef) {
   const ownerName = generateOwnerTier(job, true, null);
-  const url = urlBuilder(
-    qbo_realmId,
-    "query",
-    `select * From Customer where DisplayName = '${StandardizeName(ownerName)}' and Active = true`
-  );
   const result = await oauthClient.makeApiCall({
-    url: url,
+    url: urlBuilder(
+      qbo_realmId,
+      "query",
+      `select * From Customer where DisplayName = '${StandardizeName(ownerName)}' and Active = true`
+    ),
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -332,11 +318,6 @@ async function QueryOwner(oauthClient, qbo_realmId, req, job, parentTierRef) {
     jobid: job.id,
     email: req.user.email
   });
-  logger.log("qbo-receivables-query", "DEBUG", req.user.email, job.id, {
-    method: "QueryOwner",
-    call: url,
-    result: result.json
-  });
 
   return result.json?.QueryResponse?.Customer?.find((x) => x.ParentRef?.value === parentTierRef?.Id);
 }
@@ -366,9 +347,8 @@ async function InsertOwner(oauthClient, qbo_realmId, req, job, isThreeTier, pare
       : {})
   };
   try {
-    const url = urlBuilder(qbo_realmId, "customer");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, "customer"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -384,12 +364,6 @@ async function InsertOwner(oauthClient, qbo_realmId, req, job, isThreeTier, pare
       jobid: job.id,
       email: req.user.email
     });
-    logger.log("qbo-receivables-insert", "DEBUG", req.user.email, job.id, {
-      method: "InsertOwner",
-      call: url,
-      customerObj: Customer,
-      result: result.json
-    });
 
     return result.json?.Customer;
   } catch (error) {
@@ -404,13 +378,12 @@ async function InsertOwner(oauthClient, qbo_realmId, req, job, isThreeTier, pare
 exports.InsertOwner = InsertOwner;
 
 async function QueryJob(oauthClient, qbo_realmId, req, job, parentTierRef) {
-  const url = urlBuilder(
-    qbo_realmId,
-    "query",
-    `select * From Customer where DisplayName = '${job.ro_number}' and Active = true`
-  );
   const result = await oauthClient.makeApiCall({
-    url: url,
+    url: urlBuilder(
+      qbo_realmId,
+      "query",
+      `select * From Customer where DisplayName = '${job.ro_number}' and Active = true`
+    ),
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -425,11 +398,6 @@ async function QueryJob(oauthClient, qbo_realmId, req, job, parentTierRef) {
     jobid: job.id,
     email: req.user.email
   });
-  logger.log("qbo-receivables-query", "DEBUG", req.user.email, job.id, {
-    method: "QueryJob",
-    call: url,
-    result: result.json
-  });
 
   const customers = result.json?.QueryResponse?.Customer;
   return customers && (parentTierRef ? customers.find((x) => x.ParentRef.value === parentTierRef.Id) : customers[0]);
@@ -455,9 +423,8 @@ async function InsertJob(oauthClient, qbo_realmId, req, job, parentTierRef) {
     }
   };
   try {
-    const url = urlBuilder(qbo_realmId, "customer");
     const result = await oauthClient.makeApiCall({
-      url: url,
+      url: urlBuilder(qbo_realmId, "customer"),
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -473,12 +440,6 @@ async function InsertJob(oauthClient, qbo_realmId, req, job, parentTierRef) {
       jobid: job.id,
       email: req.user.email
     });
-    logger.log("qbo-receivables-insert", "DEBUG", req.user.email, job.id, {
-      method: "InsertJob",
-      call: url,
-      customerObj: Customer,
-      result: result.json
-    });
 
     if (result.status >= 400) {
       throw new Error(JSON.stringify(result.json.Fault));