feat(ticket_sale): role restriction to create payBack

e2e/paths/05-ticket/01-sale/02_edit_sale.spec.js

@@ -207,6 +207,10 @@ describe('Ticket Edit sale path', () => {
     });
 
     it('should select the third sale and create a pay back', async() => {
+        await page.loginAndModule('salesAssistant', 'ticket');
+        await page.accessToSearchResult('16');
+        await page.accessToSection('ticket.card.sale');
+
         await page.waitToClick(selectors.ticketSales.firstSaleCheckbox);
         await page.waitToClick(selectors.ticketSales.moreMenu);
         await page.waitToClick(selectors.ticketSales.moreMenuPayBack);

loopback/locale/es.json

@@ -216,5 +216,6 @@
 	"The worker has hours recorded that day": "El trabajador tiene horas fichadas ese día",
 	"The worker has a marked absence that day": "El trabajador tiene marcada una ausencia ese día",
 	"You can not modify is pay method checked": "No se puede modificar el campo método de pago validado",
-	"Can't transfer claimed sales": "No puedes transferir lineas reclamadas"
+	"Can't transfer claimed sales": "No puedes transferir lineas reclamadas",
-	}
+	"You don't have privileges to create pay back": "No tienes permisos para crear un abono"
+}

modules/ticket/back/methods/sale/payBack.js

@@ -1,3 +1,5 @@
+const UserError = require('vn-loopback/util/user-error');
+
 module.exports = Self => {
     Self.remoteMethodCtx('payBack', {
         description: 'Create ticket with the selected lines changing the sign to the quantites',
@@ -39,6 +41,15 @@ module.exports = Self => {
         try {
             const salesIds = [];
             const params = [];
+            const userId = ctx.req.accessToken.userId;
+
+            const isClaimManager = await Self.app.models.Account.hasRole(userId, 'claimManager');
+            const isSalesAssistant = await Self.app.models.Account.hasRole(userId, 'salesAssistant');
+            const checkRoles = isClaimManager || isSalesAssistant;
+
+            if (!checkRoles)
+                throw new UserError(`You don't have privileges to create pay back`);
+
             sales.forEach(sale => {
                 salesIds.push(sale.id);
                 params.push('?');

modules/ticket/back/methods/sale/specs/payBack.spec.js

@@ -3,15 +3,17 @@ const models = require('vn-loopback/server/server').models;
 describe('sale payBack()', () => {
     it('should create ticket with the selected lines changing the sign to the quantites', async() => {
         const tx = await models.Sale.beginTransaction({});
+        const ctx = {req: {accessToken: {userId: 9}}};
+
         const ticketId = 11;
         const sales = [
             {id: 7, ticketFk: 11},
             {id: 8, ticketFk: 11}
         ];
+
         try {
             const options = {transaction: tx};
 
-            const ctx = {req: {accessToken: {userId: 9}}};
             const response = await models.Sale.payBack(ctx, sales, ticketId, options);
             const [newTicketId] = await models.Sale.rawSql('SELECT MAX(t.id) id FROM vn.ticket t;', null, options);
 
@@ -23,4 +25,30 @@ describe('sale payBack()', () => {
             throw e;
         }
     });
+
+    it('should throw error for not have privileges', async() => {
+        const tx = await models.Sale.beginTransaction({});
+        const ctx = {req: {accessToken: {userId: 1}}};
+
+        const ticketId = 11;
+        const sales = [
+            {id: 7, ticketFk: 11}
+        ];
+
+        let error;
+
+        try {
+            const options = {transaction: tx};
+
+            await models.Sale.payBack(ctx, sales, ticketId, options);
+
+            await tx.rollback();
+        } catch (e) {
+            await tx.rollback();
+            error = e;
+        }
+
+        expect(error).toBeDefined();
+        expect(error.message).toEqual(`You don't have privileges to create pay back`);
+    });
 });

modules/ticket/front/sale/index.html

@@ -492,7 +492,9 @@
     </vn-item>
     <vn-item translate
         name="payBack"
-        ng-click="$ctrl.createPayBack()">
+        ng-click="$ctrl.createPayBack()"
+        vn-acl="claimManager, salesAssistant"
+        vn-acl-action="remove">
         Pay Back
     </vn-item>
 </vn-menu>