From db19f153fbe0f0ae1090b5675d74e59ae58226a7 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Tue, 18 Apr 2023 15:03:23 +0200
Subject: [PATCH 01/19] refs #5488 removes 'role =='

---
 db/changes/231601/00-acls.sql                        | 6 ++++++
 modules/ticket/back/methods/ticket/updateDiscount.js | 7 ++-----
 modules/zone/back/methods/agency/getLanded.js        | 9 +++------
 modules/zone/back/methods/zone/includingExpired.js   | 6 +-----
 4 files changed, 12 insertions(+), 16 deletions(-)
 create mode 100644 db/changes/231601/00-acls.sql

diff --git a/db/changes/231601/00-acls.sql b/db/changes/231601/00-acls.sql
new file mode 100644
index 000000000..359448672
--- /dev/null
+++ b/db/changes/231601/00-acls.sql
@@ -0,0 +1,6 @@
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    VALUES
+        ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson');
+        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative');
+        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss');
diff --git a/modules/ticket/back/methods/ticket/updateDiscount.js b/modules/ticket/back/methods/ticket/updateDiscount.js
index 4dd346161..4b31c0ce4 100644
--- a/modules/ticket/back/methods/ticket/updateDiscount.js
+++ b/modules/ticket/back/methods/ticket/updateDiscount.js
@@ -85,17 +85,14 @@ module.exports = Self => {
 
             const userId = ctx.req.accessToken.userId;
             const isLocked = await models.Ticket.isLocked(id, myOptions);
-            const roles = await models.Account.getRoles(userId, myOptions);
-            const hasAllowedRoles = roles.filter(role =>
-                role == 'salesPerson' || role == 'claimManager'
-            );
+            const canEditDiscount = await models.ACL.checkAccessAcl(ctx, 'Ticket', 'editDiscount');
 
             const state = await Self.app.models.TicketState.findOne({
                 where: {ticketFk: id}
             }, myOptions);
             const alertLevel = state ? state.alertLevel : null;
 
-            if (isLocked || (!hasAllowedRoles && alertLevel > 0))
+            if (isLocked || (!canEditDiscount && alertLevel > 0))
                 throw new UserError(`The sales of this ticket can't be modified`);
 
             const usesMana = await models.Sale.usesMana(ctx, myOptions);
diff --git a/modules/zone/back/methods/agency/getLanded.js b/modules/zone/back/methods/agency/getLanded.js
index a662f59dd..ef5a183f3 100644
--- a/modules/zone/back/methods/agency/getLanded.js
+++ b/modules/zone/back/methods/agency/getLanded.js
@@ -35,17 +35,14 @@ module.exports = Self => {
     });
 
     Self.getLanded = async(ctx, shipped, addressFk, agencyModeFk, warehouseFk, options) => {
+        const models = Self.app.models;
         const myOptions = {};
 
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
-        const userId = ctx.req.accessToken.userId;
-        const models = Self.app.models;
-        const roles = await models.Account.getRoles(userId);
-        const canSeeExpired = roles.filter(role =>
-            role == 'productionBoss' || role == 'administrative'
-        );
+        const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'editDiscount');
+
         let showExpired = false;
         if (canSeeExpired.length) showExpired = true;
 
diff --git a/modules/zone/back/methods/zone/includingExpired.js b/modules/zone/back/methods/zone/includingExpired.js
index e93b86471..31678c83d 100644
--- a/modules/zone/back/methods/zone/includingExpired.js
+++ b/modules/zone/back/methods/zone/includingExpired.js
@@ -24,7 +24,6 @@ module.exports = Self => {
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
-        const userId = ctx.req.accessToken.userId;
         const conn = Self.dataSource.connector;
         const models = Self.app.models;
         const where = filter.where;
@@ -36,10 +35,7 @@ module.exports = Self => {
             && where.agencyModeFk && where.warehouseFk;
 
         if (filterByAvailability) {
-            const roles = await models.Account.getRoles(userId, myOptions);
-            const canSeeExpired = roles.filter(role =>
-                role == 'productionBoss' || role == 'administrative'
-            );
+            const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'editDiscount');
             let showExpired = false;
             if (canSeeExpired.length) showExpired = true;
 

From c1d4281b1bcc9e7ee935f872ae2dd8e49c9451ea Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Wed, 19 Apr 2023 13:59:26 +0200
Subject: [PATCH 02/19] refs #5488 replace hasWriteRole, hasReadRole

---
 back/methods/dms/removeFile.js                |  8 +--
 back/methods/dms/updateFile.js                |  2 +-
 back/methods/dms/uploadFile.js                |  2 +-
 back/methods/image/download.js                |  2 +-
 back/methods/image/upload.js                  |  2 +-
 back/models/dms-type.js                       | 55 ++--------------
 back/models/dms-type.json                     | 31 +++++++--
 back/models/dms.js                            |  4 +-
 back/models/image-collection.js               | 64 -------------------
 back/models/specs/dms.spec.js                 |  4 +-
 .../{00-acls.sql => 00-useSpecificsAcls.sql}  |  8 ++-
 .../01-dmsTypeAndImageCollectionAcls.sql      | 22 +++++++
 db/dump/fixtures.sql                          | 50 +++++++++------
 .../claim/back/methods/claim/uploadFile.js    |  2 +-
 .../fixed-price/specs/editFixedPrice.spec.js  |  4 +-
 .../back/methods/worker-dms/downloadFile.js   |  2 +-
 .../worker-dms/specs/downloadFile.spec.js     |  6 +-
 modules/zone/back/methods/agency/getLanded.js |  7 +-
 18 files changed, 106 insertions(+), 169 deletions(-)
 delete mode 100644 back/models/image-collection.js
 rename db/changes/231601/{00-acls.sql => 00-useSpecificsAcls.sql} (66%)
 create mode 100644 db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql

diff --git a/back/methods/dms/removeFile.js b/back/methods/dms/removeFile.js
index a9ff36883..8007407d5 100644
--- a/back/methods/dms/removeFile.js
+++ b/back/methods/dms/removeFile.js
@@ -35,14 +35,14 @@ module.exports = Self => {
 
         try {
             const dms = await models.Dms.findById(id, null, myOptions);
-            const trashDmsType = await models.DmsType.findOne({
-                where: {code: 'trash'}
-            }, myOptions);
 
-            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, dms.dmsTypeFk, myOptions);
+            const hasWriteRole = await models.DmsType.checkRole(ctx, dms.dmsTypeFk, 'WRITE', myOptions);
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
+            const trashDmsType = await models.DmsType.findOne({
+                where: {code: 'trash'}
+            }, myOptions);
             await dms.updateAttribute('dmsTypeFk', trashDmsType.id, myOptions);
 
             if (tx) await tx.commit();
diff --git a/back/methods/dms/updateFile.js b/back/methods/dms/updateFile.js
index cfc4c322f..0ecced31a 100644
--- a/back/methods/dms/updateFile.js
+++ b/back/methods/dms/updateFile.js
@@ -71,7 +71,7 @@ module.exports = Self => {
         }
 
         try {
-            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId);
+            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE');
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/methods/dms/uploadFile.js b/back/methods/dms/uploadFile.js
index a4212b804..ca1c1339d 100644
--- a/back/methods/dms/uploadFile.js
+++ b/back/methods/dms/uploadFile.js
@@ -66,7 +66,7 @@ module.exports = Self => {
 
         let srcFile;
         try {
-            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId, myOptions);
+            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE');
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/methods/image/download.js b/back/methods/image/download.js
index 3a8bcf30e..e3e8c495c 100644
--- a/back/methods/image/download.js
+++ b/back/methods/image/download.js
@@ -67,7 +67,7 @@ module.exports = Self => {
 
         if (!image) return false;
 
-        const hasReadRole = models.ImageCollection.hasReadRole(ctx, collection);
+        const hasReadRole = await models.ACL.checkAccessAcl(ctx, 'ImageCollection', collection, 'READ');
         if (!hasReadRole)
             throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/methods/image/upload.js b/back/methods/image/upload.js
index 1de0064f6..53c6fcd3a 100644
--- a/back/methods/image/upload.js
+++ b/back/methods/image/upload.js
@@ -37,7 +37,7 @@ module.exports = Self => {
 
         let tempFilePath;
         try {
-            const hasWriteRole = await models.ImageCollection.hasWriteRole(ctx, args.collection);
+            const hasWriteRole = await models.ACL.checkAccessAcl(ctx, 'ImageCollection', args.collection, 'WRITE');
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/models/dms-type.js b/back/models/dms-type.js
index c9329f30b..43f258319 100644
--- a/back/models/dms-type.js
+++ b/back/models/dms-type.js
@@ -1,65 +1,18 @@
 module.exports = Self => {
-    /**
-     * Checks if current user has
-     * read privileges over a dms
-     *
-     * @param {Object} ctx - Request context
-     * @param {Interger} id - DmsType id
-     * @param {Object} options - Query options
-     * @return {Boolean} True for user with read privileges
-     */
-    Self.hasReadRole = async(ctx, id, options) => {
-        const models = Self.app.models;
-        const dmsType = await models.DmsType.findById(id, {
-            include: {
-                relation: 'readRole'
-            }
-        }, options);
-
-        return await hasRole(ctx, dmsType, options);
-    };
-
     /**
      * Checks if current user has
      * write privileges over a dms
      *
      * @param {Object} ctx - Request context
      * @param {Interger} id - DmsType id
+     * @param {String} type - Acl accessType
      * @param {Object} options - Query options
      * @return {Boolean} True for user with write privileges
      */
-    Self.hasWriteRole = async(ctx, id, options) => {
+    Self.checkRole = async(ctx, id, type, options) => {
         const models = Self.app.models;
-        const dmsType = await models.DmsType.findById(id, {
-            include: {
-                relation: 'writeRole'
-            }
-        }, options);
+        const dmsType = await models.DmsType.findById(id, {fields: ['code']}, options);
 
-        return await hasRole(ctx, dmsType, options);
+        return await models.ACL.checkAccessAcl(ctx, 'DmsType', dmsType.code, type);
     };
-
-    /**
-     * Checks if current user has
-     * read or write privileges
-     * @param {Object} ctx - Context
-     * @param {Object} dmsType - Dms type [read/write]
-     * @param {Object} options - Query options
-     */
-    async function hasRole(ctx, dmsType, options) {
-        const models = Self.app.models;
-        const myUserId = ctx.req.accessToken.userId;
-
-        const readRole = dmsType.readRole() && dmsType.readRole().name;
-        const writeRole = dmsType.writeRole() && dmsType.writeRole().name;
-        const requiredRole = readRole || writeRole;
-
-        const hasRequiredRole = await models.VnUser.hasRole(myUserId, requiredRole, options);
-        const isRoot = await models.VnUser.hasRole(myUserId, 'root', options);
-
-        if (isRoot || hasRequiredRole)
-            return true;
-
-        return false;
-    }
 };
diff --git a/back/models/dms-type.json b/back/models/dms-type.json
index c7a1815fe..c986060ac 100644
--- a/back/models/dms-type.json
+++ b/back/models/dms-type.json
@@ -38,10 +38,27 @@
             "foreignKey": "writeRoleFk"
     	}
   	},
-    "acls": [{
-        "accessType": "READ",
-        "principalType": "ROLE",
-        "principalId": "$everyone",
-        "permission": "ALLOW"
-    }]
-}
\ No newline at end of file
+      "acls": [
+        {
+            "property": "find",
+            "accessType": "READ",
+            "principalType": "ROLE",
+            "principalId": "$everyone",
+            "permission": "ALLOW"
+        },
+        {
+            "property": "findById",
+            "accessType": "READ",
+            "principalType": "ROLE",
+            "principalId": "$everyone",
+            "permission": "ALLOW"
+        },
+        {
+            "property": "findOne",
+            "accessType": "READ",
+            "principalType": "ROLE",
+            "principalId": "$everyone",
+            "permission": "ALLOW"
+        }
+    ]
+}
diff --git a/back/models/dms.js b/back/models/dms.js
index 24c072f56..8ecd10cb1 100644
--- a/back/models/dms.js
+++ b/back/models/dms.js
@@ -7,11 +7,11 @@ module.exports = Self => {
     require('../methods/dms/updateFile')(Self);
     require('../methods/dms/deleteTrashFiles')(Self);
 
-    Self.checkRole = async function(ctx, id) {
+    Self.checkRole = async function(ctx, id, type) {
         const models = Self.app.models;
         const dms = await Self.findById(id);
 
-        return await models.DmsType.hasReadRole(ctx, dms.dmsTypeFk);
+        return await models.DmsType.checkRole(ctx, dms.dmsTypeFk, type);
     };
 
     Self.getFile = async function(id) {
diff --git a/back/models/image-collection.js b/back/models/image-collection.js
deleted file mode 100644
index 2c4d274ee..000000000
--- a/back/models/image-collection.js
+++ /dev/null
@@ -1,64 +0,0 @@
-module.exports = Self => {
-    /**
-     * Checks if current user has
-     * read privileges over a collection
-     *
-     * @param {object} ctx - Request context
-     * @param {interger} name - Collection name
-     * @param {object} options - Query options
-     * @return {boolean} True for user with read privileges
-     */
-    Self.hasReadRole = async(ctx, name, options) => {
-        const collection = await Self.findOne({where: {name}}, {
-            include: {
-                relation: 'readRole'
-            }
-        }, options);
-
-        return await hasRole(ctx, collection, options);
-    };
-
-    /**
-     * Checks if current user has
-     * write privileges over a collection
-     *
-     * @param {object} ctx - Request context
-     * @param {string} name - Collection name
-     * @param {object} options - Query options
-     * @return {boolean} True for user with write privileges
-     */
-    Self.hasWriteRole = async(ctx, name, options) => {
-        const collection = await Self.findOne({
-            include: {
-                relation: 'writeRole'
-            },
-            where: {name}
-        }, options);
-
-        return await hasRole(ctx, collection, options);
-    };
-
-    /**
-     * Checks if current user has
-     * read or write privileges
-     * @param {Object} ctx - Context
-     * @param {Object} collection - Collection [read/write]
-     * @param {Object} options - Query options
-     */
-    async function hasRole(ctx, collection, options) {
-        const models = Self.app.models;
-        const myUserId = ctx.req.accessToken.userId;
-
-        const readRole = collection.readRole() && collection.readRole().name;
-        const writeRole = collection.writeRole() && collection.writeRole().name;
-        const requiredRole = readRole || writeRole;
-
-        const hasRequiredRole = await models.VnUser.hasRole(myUserId, requiredRole, options);
-        const isRoot = await models.VnUser.hasRole(myUserId, 'root', options);
-
-        if (isRoot || hasRequiredRole)
-            return true;
-
-        return false;
-    }
-};
diff --git a/back/models/specs/dms.spec.js b/back/models/specs/dms.spec.js
index 3f13e88ff..e539387fb 100644
--- a/back/models/specs/dms.spec.js
+++ b/back/models/specs/dms.spec.js
@@ -37,14 +37,14 @@ describe('Dms', () => {
         const dmsId = 1;
         it('should return a true for an employee with permission', async() => {
             let ctx = {req: {accessToken: {userId: 1107}}};
-            const result = await Dms.checkRole(ctx, dmsId);
+            const result = await Dms.checkRole(ctx, dmsId, 'READ');
 
             expect(result).toBeTruthy();
         });
 
         it('should return false for an employee without permission', async() => {
             let ctx = {req: {accessToken: {userId: 1101}}};
-            const result = await Dms.checkRole(ctx, dmsId);
+            const result = await Dms.checkRole(ctx, dmsId, 'READ');
 
             expect(result).toBeFalsy();
         });
diff --git a/db/changes/231601/00-acls.sql b/db/changes/231601/00-useSpecificsAcls.sql
similarity index 66%
rename from db/changes/231601/00-acls.sql
rename to db/changes/231601/00-useSpecificsAcls.sql
index 359448672..a9610ab31 100644
--- a/db/changes/231601/00-acls.sql
+++ b/db/changes/231601/00-useSpecificsAcls.sql
@@ -1,6 +1,8 @@
 INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
     VALUES
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
-        ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson');
-        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative');
-        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss');
+        ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative'),
+        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss'),
+        ('Claim', 'createAfterDeadline', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager');
diff --git a/db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql b/db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql
new file mode 100644
index 000000000..eb4093e93
--- /dev/null
+++ b/db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql
@@ -0,0 +1,22 @@
+-- DmsType model
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'DmsType', d.code, 'WRITE', 'ALLOW', 'ROLE', r.name
+        FROM `vn`.`dmsType` d
+            JOIN `account`.`role` r ON r.id = d.writeRoleFk;
+
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'DmsType', d.code, 'READ', 'ALLOW', 'ROLE', r.name
+        FROM `vn`.`dmsType` d
+            JOIN `account`.`role` r ON r.id = d.readRoleFk;
+
+-- ImageCollection model
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'ImageCollection', i.name, 'WRITE', 'ALLOW', 'ROLE', r.name
+        FROM `hedera`.`imageCollection` i
+            JOIN `account`.`role` r ON r.id = i.writeRoleFk;
+
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'ImageCollection', i.name, 'READ', 'ALLOW', 'ROLE', r.name
+        FROM `hedera`.`imageCollection` i
+            JOIN `account`.`role` r ON r.id = i.readRoleFk;
+
diff --git a/db/dump/fixtures.sql b/db/dump/fixtures.sql
index d6be639c5..041a57cc0 100644
--- a/db/dump/fixtures.sql
+++ b/db/dump/fixtures.sql
@@ -2320,26 +2320,36 @@ INSERT INTO `vn`.`workerTimeControl`(`userFk`, `timed`, `manual`, `direction`, `
 
 INSERT INTO `vn`.`dmsType`(`id`, `name`, `path`, `readRoleFk`, `writeRoleFk`, `code`)
     VALUES
-        (1,  'Facturas Recibidas',   'recibidas',       NULL,   NULL, 'invoiceIn'),
-        (2,  'Doc oficial',          'oficial',         NULL,   NULL, 'officialDoc'),
-        (3,  'Laboral',              'laboral',         37,     37, 'hhrrData'),
-        (4,  'Albaranes recibidos',  'entradas',        NULL,   NULL, 'deliveryNote'),
-        (5,  'Otros',                'otros',           1,      1,    'miscellaneous'),
-        (6,  'Pruebas',              'pruebas',         NULL,   NULL, 'tests'),
-        (7,  'IAE Clientes',         'IAE_Clientes',    1,      1, 'economicActivitiesTax'),
-        (8,  'Fiscal',               'fiscal',          NULL,   NULL, 'fiscal'),
-        (9,  'Vehiculos',            'vehiculos',       NULL,   NULL, 'vehicles'),
-        (10, 'Plantillas',           'plantillas',      NULL,   NULL, 'templates'),
-        (11, 'Contratos',            'contratos',       NULL,   NULL, 'contracts'),
-        (12, 'ley de pagos',         'ley pagos',       1,      1,    'paymentsLaw'),
-        (13, 'Basura',               'basura',          1,      1,    'trash'),
-        (14, 'Ticket',               'tickets',         1,      1,    'ticket'),
-        (15, 'Presupuestos',         'Presupuestos',    NULL,   NULL, 'budgets'),
-        (16, 'Logistica',            'logistica',       NULL,   NULL, 'logistics'),
-        (17, 'cmr',                  'cmr',             NULL,   NULL, 'cmr'),
-        (18, 'dua',                  'dua',             NULL,   NULL, 'dua'),
-        (19, 'inmovilizado',         'inmovilizado',    NULL,   NULL, 'fixedAssets'),
-        (20, 'Reclamación',          'reclamacion',     1,      1, 'claim');
+        (1,  'Facturas Recibidas',   'recibidas',       1,      1,          'invoiceIn'),
+        (2,  'Doc oficial',          'oficial',         1,      1,          'officialDoc'),
+        (3,  'Laboral',              'laboral',         37,     37,         'hhrrData'),
+        (4,  'Albaranes recibidos',  'entradas',        1,      1,          'deliveryNote'),
+        (5,  'Otros',                'otros',           1,      1,          'miscellaneous'),
+        (6,  'Pruebas',              'pruebas',         1,      1,          'tests'),
+        (7,  'IAE Clientes',         'IAE_Clientes',    1,      1,          'economicActivitiesTax'),
+        (8,  'Fiscal',               'fiscal',          1,      1,          'fiscal'),
+        (9,  'Vehiculos',            'vehiculos',       1,      1,          'vehicles'),
+        (10, 'Plantillas',           'plantillas',      1,      1,          'templates'),
+        (11, 'Contratos',            'contratos',       1,      1,          'contracts'),
+        (12, 'ley de pagos',         'ley pagos',       1,      1,          'paymentsLaw'),
+        (13, 'Basura',               'basura',          1,      1,          'trash'),
+        (14, 'Ticket',               'tickets',         1,      1,          'ticket'),
+        (15, 'Presupuestos',         'Presupuestos',    1,      1,          'budgets'),
+        (16, 'Logistica',            'logistica',       1,      1,          'logistics'),
+        (17, 'cmr',                  'cmr',             1,      1,          'cmr'),
+        (18, 'dua',                  'dua',             1,      1,          'dua'),
+        (19, 'inmovilizado',         'inmovilizado',    1,      1,          'fixedAssets'),
+        (20, 'Reclamación',          'reclamacion',     1,      1,          'claim');
+
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'DmsType', d.code, 'WRITE', 'ALLOW', 'ROLE', r.name
+        FROM `vn`.`dmsType` d
+            JOIN `account`.`role` r ON r.id = d.writeRoleFk;
+
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'DmsType', d.code, 'READ', 'ALLOW', 'ROLE', r.name
+        FROM `vn`.`dmsType` d
+            JOIN `account`.`role` r ON r.id = d.readRoleFk;
 
 INSERT INTO `vn`.`dms`(`id`, `dmsTypeFk`, `file`, `contentType`, `workerFk`, `warehouseFk`, `companyFk`, `hardCopyNumber`, `hasFile`, `reference`, `description`, `created`)
     VALUES
diff --git a/modules/claim/back/methods/claim/uploadFile.js b/modules/claim/back/methods/claim/uploadFile.js
index 3d0737cf8..14aa088a4 100644
--- a/modules/claim/back/methods/claim/uploadFile.js
+++ b/modules/claim/back/methods/claim/uploadFile.js
@@ -75,7 +75,7 @@ module.exports = Self => {
 
         let srcFile;
         try {
-            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId, myOptions);
+            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE', myOptions);
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/modules/item/back/methods/fixed-price/specs/editFixedPrice.spec.js b/modules/item/back/methods/fixed-price/specs/editFixedPrice.spec.js
index 9c265f28a..db255a91e 100644
--- a/modules/item/back/methods/fixed-price/specs/editFixedPrice.spec.js
+++ b/modules/item/back/methods/fixed-price/specs/editFixedPrice.spec.js
@@ -37,7 +37,7 @@ describe('Item editFixedPrice()', () => {
         const options = {transaction: tx};
 
         try {
-            const filter = {'it.categoryFk': 1};
+            const filter = {where: {'it.categoryFk': 1}};
             const ctx = {
                 args: {
                     filter: filter
@@ -48,7 +48,7 @@ describe('Item editFixedPrice()', () => {
             const field = 'rate2';
             const newValue = 88;
 
-            await models.FixedPrice.editFixedPrice(ctx, field, newValue, null, filter, options);
+            await models.FixedPrice.editFixedPrice(ctx, field, newValue, null, filter.where, options);
 
             const [result] = await models.FixedPrice.filter(ctx, filter, options);
 
diff --git a/modules/worker/back/methods/worker-dms/downloadFile.js b/modules/worker/back/methods/worker-dms/downloadFile.js
index cc8653e0e..d129814a2 100644
--- a/modules/worker/back/methods/worker-dms/downloadFile.js
+++ b/modules/worker/back/methods/worker-dms/downloadFile.js
@@ -33,7 +33,7 @@ module.exports = Self => {
     });
 
     Self.downloadFile = async function(ctx, id) {
-        if (!await Self.app.models.Dms.checkRole(ctx, id) && !await Self.isMine(ctx, id))
+        if (!await Self.app.models.Dms.checkRole(ctx, id, 'READ') && !await Self.isMine(ctx, id))
             throw new UserError(`You don't have enough privileges`);
         return await Self.app.models.Dms.getFile(id);
     };
diff --git a/modules/worker/back/methods/worker-dms/specs/downloadFile.spec.js b/modules/worker/back/methods/worker-dms/specs/downloadFile.spec.js
index ac8e4539f..bdeec215c 100644
--- a/modules/worker/back/methods/worker-dms/specs/downloadFile.spec.js
+++ b/modules/worker/back/methods/worker-dms/specs/downloadFile.spec.js
@@ -1,4 +1,4 @@
-const app = require('vn-loopback/server/server');
+const models = require('vn-loopback/server/server').models;
 
 describe('worker-dms downloadFile()', () => {
     let dmsId = 4;
@@ -6,7 +6,7 @@ describe('worker-dms downloadFile()', () => {
     it('should return a response for an employee with text content-type', async() => {
         let workerId = 1106;
         let ctx = {req: {accessToken: {userId: workerId}}};
-        const result = await app.models.WorkerDms.downloadFile(ctx, dmsId);
+        const result = await models.WorkerDms.downloadFile(ctx, dmsId);
 
         expect(result[1]).toEqual('text/plain');
     });
@@ -17,7 +17,7 @@ describe('worker-dms downloadFile()', () => {
 
         let error;
         try {
-            await app.models.WorkerDms.downloadFile(ctx, dmsId);
+            await models.WorkerDms.downloadFile(ctx, dmsId);
         } catch (e) {
             error = e;
         }
diff --git a/modules/zone/back/methods/agency/getLanded.js b/modules/zone/back/methods/agency/getLanded.js
index ef5a183f3..ebaa2db62 100644
--- a/modules/zone/back/methods/agency/getLanded.js
+++ b/modules/zone/back/methods/agency/getLanded.js
@@ -41,10 +41,7 @@ module.exports = Self => {
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
-        const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'editDiscount');
-
-        let showExpired = false;
-        if (canSeeExpired.length) showExpired = true;
+        const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'seeExpired', 'READ');
 
         const stmts = [];
         stmts.push(new ParameterizedSQL(
@@ -53,7 +50,7 @@ module.exports = Self => {
                 addressFk,
                 agencyModeFk,
                 warehouseFk,
-                showExpired
+                canSeeExpired
             ]
         ));
 

From 39333a9119cab4880db63beb1f058d8b5edb66a7 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Wed, 19 Apr 2023 15:23:32 +0200
Subject: [PATCH 03/19] refs #5488 replace hasRole for checkAccessAcl

---
 db/changes/231601/00-DROP_BEFORE_MERGE.sql    | 65 +++++++++++++++++++
 db/changes/231601/00-User.sql                 |  2 +-
 ...geCollectionAcls.sql => 00-modelsAcls.sql} |  6 ++
 db/changes/231601/00-useSpecificsAcls.sql     |  1 +
 db/changes/231601/01-ClaimReAcl.sql           |  2 +
 db/dump/fixtures.sql                          |  5 ++
 .../back/methods/claim-state/isEditable.js    | 11 +---
 .../back/methods/claim/createFromSales.js     |  6 +-
 .../back/methods/client/updateAddress.js      |  6 +-
 9 files changed, 90 insertions(+), 14 deletions(-)
 create mode 100644 db/changes/231601/00-DROP_BEFORE_MERGE.sql
 rename db/changes/231601/{01-dmsTypeAndImageCollectionAcls.sql => 00-modelsAcls.sql} (80%)
 create mode 100644 db/changes/231601/01-ClaimReAcl.sql

diff --git a/db/changes/231601/00-DROP_BEFORE_MERGE.sql b/db/changes/231601/00-DROP_BEFORE_MERGE.sql
new file mode 100644
index 000000000..211a407ab
--- /dev/null
+++ b/db/changes/231601/00-DROP_BEFORE_MERGE.sql
@@ -0,0 +1,65 @@
+DELETE FROM `salix`.`ACL` WHERE id=7;
+
+INSERT INTO `salix`.`ACL` (model, property, accessType, permission, principalType, principalId)
+    VALUES
+        ('Client', 'setRating', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Client', 'setRating', 'WRITE', 'ALLOW', 'ROLE', 'financial');
+
+INSERT INTO `salix`.`ACL` (model, property, accessType, permission, principalType, principalId)
+	VALUES
+        ('Client', '*', 'READ', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'addressesPropagateRe', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'canBeInvoiced', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'canCreateTicket', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'consumption', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'createAddress', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'createWithUser', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'extendedListFilter', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'getAverageInvoiced', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'getCard', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'getDebt', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'getMana', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'transactions', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'hasCustomerRole', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'isValidClient', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'lastActiveTickets', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'sendSms', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'setPassword', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'summary', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'updateAddress', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'updateFiscalData', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'updateUser', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'uploadFile', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'campaignMetricsPdf', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'campaignMetricsEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'clientWelcomeHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'clientWelcomeEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'printerSetupHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'printerSetupEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'sepaCoreEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'letterDebtorPdf', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'letterDebtorStHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'letterDebtorStEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'letterDebtorNdHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'letterDebtorNdEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'clientDebtStatementPdf', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'clientDebtStatementHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'clientDebtStatementEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'creditRequestPdf', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'creditRequestHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'creditRequestEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'incotermsAuthorizationPdf', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'incotermsAuthorizationHtml', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'incotermsAuthorizationEmail', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'consumptionSendQueued', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'filter', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'getClientOrSupplierReference', '*', 'ALLOW', 'ROLE', 'employee'),
+        ('Client', 'upsert', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'create', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'replaceById', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'updateAttributes', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'updateAttributes', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'deleteById', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'replaceOrCreate', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'updateAll', '*', 'ALLOW', 'ROLE', 'employee'),
+		('Client', 'upsertWithWhere', '*', 'ALLOW', 'ROLE', 'employee');
diff --git a/db/changes/231601/00-User.sql b/db/changes/231601/00-User.sql
index 6c80d2c2d..8a7054403 100644
--- a/db/changes/231601/00-User.sql
+++ b/db/changes/231601/00-User.sql
@@ -1,4 +1,4 @@
-create or replace definer = root@localhost view User as
+create or replace definer = root@localhost view `salix`.`User` as
 select `account`.`user`.`id`                AS `id`,
        `account`.`user`.`realm`             AS `realm`,
        `account`.`user`.`name`              AS `name`,
diff --git a/db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql b/db/changes/231601/00-modelsAcls.sql
similarity index 80%
rename from db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql
rename to db/changes/231601/00-modelsAcls.sql
index eb4093e93..62f2b20d0 100644
--- a/db/changes/231601/01-dmsTypeAndImageCollectionAcls.sql
+++ b/db/changes/231601/00-modelsAcls.sql
@@ -20,3 +20,9 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         FROM `hedera`.`imageCollection` i
             JOIN `account`.`role` r ON r.id = i.readRoleFk;
 
+-- ClaimState
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'ClaimState', c.code, 'WRITE', 'ALLOW', 'ROLE', r.name
+        FROM `vn`.`claimState` c
+            JOIN `account`.`role` r ON r.id = c.roleFk;
+
diff --git a/db/changes/231601/00-useSpecificsAcls.sql b/db/changes/231601/00-useSpecificsAcls.sql
index a9610ab31..24d3c5723 100644
--- a/db/changes/231601/00-useSpecificsAcls.sql
+++ b/db/changes/231601/00-useSpecificsAcls.sql
@@ -5,4 +5,5 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative'),
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss'),
         ('Claim', 'createAfterDeadline', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Client', 'editAddressLogifloraAllowed', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
         ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager');
diff --git a/db/changes/231601/01-ClaimReAcl.sql b/db/changes/231601/01-ClaimReAcl.sql
new file mode 100644
index 000000000..c30ec2123
--- /dev/null
+++ b/db/changes/231601/01-ClaimReAcl.sql
@@ -0,0 +1,2 @@
+DELETE FROM salix.ACL
+WHERE id=101;
diff --git a/db/dump/fixtures.sql b/db/dump/fixtures.sql
index 041a57cc0..f76192be0 100644
--- a/db/dump/fixtures.sql
+++ b/db/dump/fixtures.sql
@@ -1774,6 +1774,11 @@ INSERT INTO `vn`.`claimState`(`id`, `code`, `description`, `roleFk`, `priority`,
         ( 6, 'mana',        'Mana',        72,  4,  0),
         ( 7, 'lack',        'Faltas',      72,  2,  0);
 
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    SELECT 'ClaimState', c.code, 'WRITE', 'ALLOW', 'ROLE', r.name
+        FROM `vn`.`claimState` c
+            JOIN `account`.`role` r ON r.id = c.roleFk;
+
 INSERT INTO `vn`.`claim`(`id`, `ticketCreated`, `claimStateFk`, `clientFk`, `workerFk`, `responsibility`, `isChargedToMana`, `created`, `packages`, `rma`, `ticketFk`)
     VALUES
         (1, util.VN_CURDATE(), 1,   1101, 18, 3, 0, util.VN_CURDATE(), 0, '02676A049183', 11),
diff --git a/modules/claim/back/methods/claim-state/isEditable.js b/modules/claim/back/methods/claim-state/isEditable.js
index 641bc3b42..73a8338da 100644
--- a/modules/claim/back/methods/claim-state/isEditable.js
+++ b/modules/claim/back/methods/claim-state/isEditable.js
@@ -20,19 +20,14 @@ module.exports = Self => {
     });
 
     Self.isEditable = async(ctx, id, options) => {
-        const userId = ctx.req.accessToken.userId;
         const models = Self.app.models;
         const myOptions = {};
 
         if (typeof options == 'object')
             Object.assign(myOptions, options);
+        const state = await models.ClaimState.findById(id, {fields: ['code']}, myOptions);
+        if (!state) return false;
 
-        const state = await models.ClaimState.findById(id, {
-            include: {
-                relation: 'writeRole'
-            }
-        }, myOptions);
-        const roleWithGrants = state && state.writeRole().name;
-        return await models.VnUser.hasRole(userId, roleWithGrants, myOptions);
+        return await models.ACL.checkAccessAcl(ctx, 'ClaimState', state.code);
     };
 };
diff --git a/modules/claim/back/methods/claim/createFromSales.js b/modules/claim/back/methods/claim/createFromSales.js
index 10d0b9b28..07bdb30aa 100644
--- a/modules/claim/back/methods/claim/createFromSales.js
+++ b/modules/claim/back/methods/claim/createFromSales.js
@@ -59,12 +59,14 @@ module.exports = Self => {
 
             const landedPlusWeek = new Date(ticket.landed);
             landedPlusWeek.setDate(landedPlusWeek.getDate() + 7);
-            const hasClaimManagerRole = await models.VnUser.hasRole(userId, 'claimManager', myOptions);
             const isClaimable = landedPlusWeek >= Date.vnNew();
 
+            const canCreateClaimAfterDeadline =
+                await models.ACL.checkAccessAcl(ctx, 'Claim', 'createAfterDeadline', 'WRITE');
+
             if (ticket.isDeleted)
                 throw new UserError(`You can't create a claim for a removed ticket`);
-            if (!isClaimable && !hasClaimManagerRole)
+            if (!isClaimable && !canCreateClaimAfterDeadline)
                 throw new UserError(`You can't create a claim from a ticket delivered more than seven days ago`);
 
             const newClaim = await Self.create({
diff --git a/modules/client/back/methods/client/updateAddress.js b/modules/client/back/methods/client/updateAddress.js
index e521870fd..7342b28f1 100644
--- a/modules/client/back/methods/client/updateAddress.js
+++ b/modules/client/back/methods/client/updateAddress.js
@@ -87,15 +87,15 @@ module.exports = function(Self) {
     Self.updateAddress = async(ctx, clientId, addressId, options) => {
         const models = Self.app.models;
         const args = ctx.args;
-        const userId = ctx.req.accessToken.userId;
         const myOptions = {};
 
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
-        const isSalesAssistant = await models.VnUser.hasRole(userId, 'salesAssistant', myOptions);
+        const canEditAddressLogifloraAllowed =
+            await models.ACL.checkAccessAcl(ctx, 'Client', 'editAddressLogifloraAllowed');
 
-        if (args.isLogifloraAllowed && !isSalesAssistant)
+        if (args.isLogifloraAllowed && !canEditAddressLogifloraAllowed)
             throw new UserError(`You don't have enough privileges`);
 
         const address = await models.Address.findOne({

From 8502b74dee18f0dbc6d584547de5161d4bdb89fd Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Mon, 24 Apr 2023 11:07:04 +0200
Subject: [PATCH 04/19] feat(): replace hasRole to checkAccessAcl

---
 db/changes/231601/00-DROP_BEFORE_MERGE.sql    | 65 -------------------
 db/changes/231601/00-client_setRatingAcl.sql  |  1 -
 db/changes/231601/00-useSpecificsAcls.sql     | 11 ++++
 db/changes/231601/01-ClaimReAcl.sql           |  2 -
 .../claim/back/methods/claim/updateClaim.js   |  5 +-
 .../back/methods/client/updateFiscalData.js   |  5 +-
 .../client/back/methods/client/updateUser.js  |  7 +-
 modules/client/back/models/client.js          | 18 ++---
 .../back/methods/invoiceOut/createPdf.js      |  5 +-
 9 files changed, 30 insertions(+), 89 deletions(-)
 delete mode 100644 db/changes/231601/00-DROP_BEFORE_MERGE.sql
 delete mode 100644 db/changes/231601/01-ClaimReAcl.sql

diff --git a/db/changes/231601/00-DROP_BEFORE_MERGE.sql b/db/changes/231601/00-DROP_BEFORE_MERGE.sql
deleted file mode 100644
index 211a407ab..000000000
--- a/db/changes/231601/00-DROP_BEFORE_MERGE.sql
+++ /dev/null
@@ -1,65 +0,0 @@
-DELETE FROM `salix`.`ACL` WHERE id=7;
-
-INSERT INTO `salix`.`ACL` (model, property, accessType, permission, principalType, principalId)
-    VALUES
-        ('Client', 'setRating', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Client', 'setRating', 'WRITE', 'ALLOW', 'ROLE', 'financial');
-
-INSERT INTO `salix`.`ACL` (model, property, accessType, permission, principalType, principalId)
-	VALUES
-        ('Client', '*', 'READ', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'addressesPropagateRe', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'canBeInvoiced', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'canCreateTicket', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'consumption', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'createAddress', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'createWithUser', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'extendedListFilter', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'getAverageInvoiced', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'getCard', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'getDebt', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'getMana', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'transactions', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'hasCustomerRole', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'isValidClient', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'lastActiveTickets', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'sendSms', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'setPassword', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'summary', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateAddress', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateFiscalData', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateUser', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'uploadFile', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'campaignMetricsPdf', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'campaignMetricsEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'clientWelcomeHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'clientWelcomeEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'printerSetupHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'printerSetupEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'sepaCoreEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'letterDebtorPdf', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'letterDebtorStHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'letterDebtorStEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'letterDebtorNdHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'letterDebtorNdEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'clientDebtStatementPdf', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'clientDebtStatementHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'clientDebtStatementEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'creditRequestPdf', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'creditRequestHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'creditRequestEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'incotermsAuthorizationPdf', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'incotermsAuthorizationHtml', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'incotermsAuthorizationEmail', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'consumptionSendQueued', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'filter', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'getClientOrSupplierReference', '*', 'ALLOW', 'ROLE', 'employee'),
-        ('Client', 'upsert', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'create', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'replaceById', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateAttributes', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateAttributes', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'deleteById', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'replaceOrCreate', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateAll', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'upsertWithWhere', '*', 'ALLOW', 'ROLE', 'employee');
diff --git a/db/changes/231601/00-client_setRatingAcl.sql b/db/changes/231601/00-client_setRatingAcl.sql
index b041b131a..6687b11ec 100644
--- a/db/changes/231601/00-client_setRatingAcl.sql
+++ b/db/changes/231601/00-client_setRatingAcl.sql
@@ -27,7 +27,6 @@ INSERT INTO `salix`.`ACL` (model, property, accessType, permission, principalTyp
 		('Client', 'summary', '*', 'ALLOW', 'ROLE', 'employee'),
 		('Client', 'updateAddress', '*', 'ALLOW', 'ROLE', 'employee'),
 		('Client', 'updateFiscalData', '*', 'ALLOW', 'ROLE', 'employee'),
-		('Client', 'updateUser', '*', 'ALLOW', 'ROLE', 'employee'),
 		('Client', 'uploadFile', '*', 'ALLOW', 'ROLE', 'employee'),
 		('Client', 'campaignMetricsPdf', '*', 'ALLOW', 'ROLE', 'employee'),
 		('Client', 'campaignMetricsEmail', '*', 'ALLOW', 'ROLE', 'employee'),
diff --git a/db/changes/231601/00-useSpecificsAcls.sql b/db/changes/231601/00-useSpecificsAcls.sql
index 24d3c5723..bd9642f30 100644
--- a/db/changes/231601/00-useSpecificsAcls.sql
+++ b/db/changes/231601/00-useSpecificsAcls.sql
@@ -6,4 +6,15 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss'),
         ('Claim', 'createAfterDeadline', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
         ('Client', 'editAddressLogifloraAllowed', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
+        ('Client', 'editFiscalDataWithoutTaxDataCheck', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
+        ('Client', 'editVerifiedDataWithoutTaxDataCheck', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
+        ('Client', 'editCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
+        ('Client', 'isNotEditableCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
+        ('InvoiceOut', 'canCreatePdf', 'WRITE', 'ALLOW', 'ROLE', 'invoicing'),
         ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager');
+
+DELETE FROM `salix`.`ACL`
+    WHERE
+        model = 'Claim'
+        AND property = '*'
+        AND accessType = '*';
diff --git a/db/changes/231601/01-ClaimReAcl.sql b/db/changes/231601/01-ClaimReAcl.sql
deleted file mode 100644
index c30ec2123..000000000
--- a/db/changes/231601/01-ClaimReAcl.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-DELETE FROM salix.ACL
-WHERE id=101;
diff --git a/modules/claim/back/methods/claim/updateClaim.js b/modules/claim/back/methods/claim/updateClaim.js
index f10c68b21..cc7392e39 100644
--- a/modules/claim/back/methods/claim/updateClaim.js
+++ b/modules/claim/back/methods/claim/updateClaim.js
@@ -46,7 +46,6 @@ module.exports = Self => {
 
     Self.updateClaim = async(ctx, id, options) => {
         const models = Self.app.models;
-        const userId = ctx.req.accessToken.userId;
         const args = ctx.args;
         let tx;
         const myOptions = {};
@@ -81,9 +80,9 @@ module.exports = Self => {
             if (args.claimStateFk) {
                 const canEditOldState = await models.ClaimState.isEditable(ctx, claim.claimStateFk, myOptions);
                 const canEditNewState = await models.ClaimState.isEditable(ctx, args.claimStateFk, myOptions);
-                const isClaimManager = await models.VnUser.hasRole(userId, 'claimManager', myOptions);
+                const canEditState = await models.ACL.checkAccessAcl(ctx, 'Claim', 'editState', 'WRITE');
 
-                if (!canEditOldState || !canEditNewState || changedHasToPickUp && !isClaimManager)
+                if (!canEditOldState || !canEditNewState || changedHasToPickUp && !canEditState)
                     throw new UserError(`You don't have enough privileges to change that field`);
             }
 
diff --git a/modules/client/back/methods/client/updateFiscalData.js b/modules/client/back/methods/client/updateFiscalData.js
index c63dc3991..697c567a3 100644
--- a/modules/client/back/methods/client/updateFiscalData.js
+++ b/modules/client/back/methods/client/updateFiscalData.js
@@ -131,9 +131,10 @@ module.exports = Self => {
             myOptions.transaction = tx;
         }
         try {
-            const isSalesAssistant = await models.VnUser.hasRole(userId, 'salesAssistant', myOptions);
+            const canEditNotTaxDataChecked =
+                await models.ACL.checkAccessAcl(ctx, 'Client', 'editFiscalDataWithoutTaxDataCheck', 'WRITE');
             const client = await models.Client.findById(clientId, null, myOptions);
-            if (!isSalesAssistant && client.isTaxDataChecked)
+            if (!canEditNotTaxDataChecked && client.isTaxDataChecked)
                 throw new UserError(`Not enough privileges to edit a client with verified data`);
             // Sage data validation
             const taxDataChecked = args.isTaxDataChecked;
diff --git a/modules/client/back/methods/client/updateUser.js b/modules/client/back/methods/client/updateUser.js
index 479b4da47..55f1accdd 100644
--- a/modules/client/back/methods/client/updateUser.js
+++ b/modules/client/back/methods/client/updateUser.js
@@ -2,6 +2,7 @@ const UserError = require('vn-loopback/util/user-error');
 module.exports = Self => {
     Self.remoteMethodCtx('updateUser', {
         description: 'Updates the user information',
+        accessType: 'WRITE',
         accepts: [
             {
                 arg: 'id',
@@ -32,7 +33,6 @@ module.exports = Self => {
 
     Self.updateUser = async function(ctx, id, options) {
         const models = Self.app.models;
-        const userId = ctx.req.accessToken.userId;
         let tx;
         const myOptions = {};
 
@@ -45,9 +45,8 @@ module.exports = Self => {
         }
 
         try {
-            const isSalesPerson = await models.VnUser.hasRole(userId, 'salesPerson', myOptions);
-
-            if (!isSalesPerson)
+            const canEdit = await models.ACL.checkAccessAcl(ctx, 'Client', 'updateUser', 'WRITE');
+            if (!canEdit)
                 throw new UserError(`Not enough privileges to edit a client`);
 
             const isClient = await models.Client.findById(id, null, myOptions);
diff --git a/modules/client/back/models/client.js b/modules/client/back/models/client.js
index a86a782e4..26813cf2b 100644
--- a/modules/client/back/models/client.js
+++ b/modules/client/back/models/client.js
@@ -217,9 +217,9 @@ module.exports = Self => {
         const models = Self.app.models;
 
         const loopBackContext = LoopBackContext.getCurrentContext();
-        const userId = loopBackContext.active.accessToken.userId;
+        const accessToken = {req: loopBackContext.active.accessToken};
 
-        const isSalesAssistant = await models.VnUser.hasRole(userId, 'salesAssistant', ctx.options);
+        const editVerifiedDataWithoutTaxDataChecked = models.ACL.checkAccessAcl(accessToken, 'Client', 'editVerifiedDataWithoutTaxDataCheck', 'WRITE');
         const hasChanges = orgData && changes;
 
         const isTaxDataChecked = hasChanges && (changes.isTaxDataChecked || orgData.isTaxDataChecked);
@@ -231,8 +231,8 @@ module.exports = Self => {
         const sageTransactionType = hasChanges && (changes.sageTransactionTypeFk || orgData.sageTransactionTypeFk);
         const sageTransactionTypeChanged = hasChanges && orgData.sageTransactionTypeFk != sageTransactionType;
 
-        const cantEditVerifiedData = isTaxDataCheckedChanged && !isSalesAssistant;
-        const cantChangeSageData = (sageTaxTypeChanged || sageTransactionTypeChanged) && !isSalesAssistant;
+        const cantEditVerifiedData = isTaxDataCheckedChanged && !editVerifiedDataWithoutTaxDataChecked;
+        const cantChangeSageData = (sageTaxTypeChanged || sageTransactionTypeChanged) && !editVerifiedDataWithoutTaxDataChecked;
 
         if (cantEditVerifiedData || cantChangeSageData)
             throw new UserError(`You don't have enough privileges`);
@@ -400,9 +400,10 @@ module.exports = Self => {
     Self.changeCredit = async function changeCredit(ctx, finalState, changes) {
         const models = Self.app.models;
         const userId = ctx.options.accessToken.userId;
+        const accessToken = {req: {accessToken: ctx.options.accessToken} };
 
-        const isFinancialBoss = await models.VnUser.hasRole(userId, 'financialBoss', ctx.options);
-        if (!isFinancialBoss) {
+        const canEditCredit = await models.ACL.checkAccessAcl(accessToken, 'Client', 'editCredit', 'WRITE');
+        if (!canEditCredit) {
             const lastCredit = await models.ClientCredit.findOne({
                 where: {
                     clientFk: finalState.id
@@ -411,10 +412,9 @@ module.exports = Self => {
             }, ctx.options);
 
             const lastAmount = lastCredit && lastCredit.amount;
-            const lastWorkerId = lastCredit && lastCredit.workerFk;
-            const lastWorkerIsFinancialBoss = await models.VnUser.hasRole(lastWorkerId, 'financialBoss', ctx.options);
+            const lastCreditIsNotEditable = !await models.ACL.checkAccessAcl(accessToken, 'Client', 'isNotEditableCredit', 'WRITE');
 
-            if (lastAmount == 0 && lastWorkerIsFinancialBoss)
+            if (lastAmount == 0 && lastCreditIsNotEditable)
                 throw new UserError(`You can't change the credit set to zero from a financialBoss`);
 
             const creditLimits = await models.ClientCreditLimit.find({
diff --git a/modules/invoiceOut/back/methods/invoiceOut/createPdf.js b/modules/invoiceOut/back/methods/invoiceOut/createPdf.js
index a9c151ae4..dfdb3c1a7 100644
--- a/modules/invoiceOut/back/methods/invoiceOut/createPdf.js
+++ b/modules/invoiceOut/back/methods/invoiceOut/createPdf.js
@@ -25,7 +25,6 @@ module.exports = Self => {
 
     Self.createPdf = async function(ctx, id, options) {
         const models = Self.app.models;
-        const userId = ctx.req.accessToken.userId;
 
         if (process.env.NODE_ENV == 'test')
             throw new UserError(`Action not allowed on the test environment`);
@@ -43,9 +42,9 @@ module.exports = Self => {
 
         try {
             const invoiceOut = await Self.findById(id, null, myOptions);
-            const hasInvoicing = await models.VnUser.hasRole(userId, 'invoicing', myOptions);
+            const canCreatePdf = await models.ACL.checkAccessAcl(ctx, 'InvoiceOut', 'canCreatePdf', 'WRITE');
 
-            if (invoiceOut.hasPdf && !hasInvoicing)
+            if (invoiceOut.hasPdf && !canCreatePdf)
                 throw new UserError(`You don't have enough privileges`);
 
             await invoiceOut.updateAttributes({

From 4cb231759fa47f69134b4fd67ee1cd1fed6a7e4a Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Tue, 25 Apr 2023 09:15:05 +0200
Subject: [PATCH 05/19] feat(State/Supplier): replace hasRole to acls

---
 db/changes/231601/00-useSpecificsAcls.sql           | 11 +++++++++++
 modules/supplier/back/models/supplier.js            | 10 ++++++----
 modules/ticket/back/methods/state/editableStates.js | 12 ++++++------
 modules/ticket/back/methods/state/isEditable.js     |  3 +++
 4 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/db/changes/231601/00-useSpecificsAcls.sql b/db/changes/231601/00-useSpecificsAcls.sql
index bd9642f30..9b9b3cebb 100644
--- a/db/changes/231601/00-useSpecificsAcls.sql
+++ b/db/changes/231601/00-useSpecificsAcls.sql
@@ -2,6 +2,10 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
     VALUES
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('State', 'editableStates', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'administrative'),
+        ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'production'),
+        ('State', 'seeFilteredEditableStates', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative'),
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss'),
         ('Claim', 'createAfterDeadline', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
@@ -11,6 +15,7 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Client', 'editCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
         ('Client', 'isNotEditableCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
         ('InvoiceOut', 'canCreatePdf', 'WRITE', 'ALLOW', 'ROLE', 'invoicing'),
+        ('Supplier', 'editPayMethodCheck', 'WRITE', 'ALLOW', 'ROLE', 'financial'),
         ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager');
 
 DELETE FROM `salix`.`ACL`
@@ -18,3 +23,9 @@ DELETE FROM `salix`.`ACL`
         model = 'Claim'
         AND property = '*'
         AND accessType = '*';
+
+DELETE FROM `salix`.`ACL`
+    WHERE
+        model = 'State'
+        AND property = '*'
+        AND accessType = 'READ';
diff --git a/modules/supplier/back/models/supplier.js b/modules/supplier/back/models/supplier.js
index c4ce0c517..c67f0055e 100644
--- a/modules/supplier/back/models/supplier.js
+++ b/modules/supplier/back/models/supplier.js
@@ -98,18 +98,20 @@ module.exports = Self => {
 
     Self.observe('before save', async function(ctx) {
         if (ctx.isNewInstance) return;
-        const loopbackContext = LoopBackContext.getCurrentContext();
         const changes = ctx.data || ctx.instance;
         const orgData = ctx.currentInstance;
-        const userId = loopbackContext.active.accessToken.userId;
+        const loopBackContext = LoopBackContext.getCurrentContext();
+        const accessToken = {req: loopBackContext.active.accessToken};
+
+        const editPayMethodCheck =
+            await Self.app.models.ACL.checkAccessAcl(accessToken, 'Supplier', 'editPayMethodCheck', 'WRITE');
 
-        const isNotFinancial = !await Self.app.models.VnUser.hasRole(userId, 'financial');
         const isPayMethodChecked = changes.isPayMethodChecked || orgData.isPayMethodChecked;
         const hasChanges = orgData && changes;
         const isPayMethodCheckedChanged = hasChanges
          && orgData.isPayMethodChecked != isPayMethodChecked;
 
-        if (isNotFinancial && isPayMethodCheckedChanged)
+        if (!editPayMethodCheck && isPayMethodCheckedChanged)
             throw new UserError('You can not modify is pay method checked');
     });
 
diff --git a/modules/ticket/back/methods/state/editableStates.js b/modules/ticket/back/methods/state/editableStates.js
index 061097a65..9c103c0b6 100644
--- a/modules/ticket/back/methods/state/editableStates.js
+++ b/modules/ticket/back/methods/state/editableStates.js
@@ -18,21 +18,21 @@ module.exports = Self => {
 
     Self.editableStates = async(ctx, filter, options) => {
         const models = Self.app.models;
-        const userId = ctx.req.accessToken.userId;
         const myOptions = {};
 
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
         let statesList = await models.State.find(filter, myOptions);
-        const isProduction = await models.VnUser.hasRole(userId, 'production', myOptions);
-        const isSalesPerson = await models.VnUser.hasRole(userId, 'salesPerson', myOptions);
-        const isAdministrative = await models.VnUser.hasRole(userId, 'administrative', myOptions);
+        const seeEditableStates = await models.ACL.checkAccessAcl(ctx, 'State', 'seeEditableStates', 'READ');
 
-        if (isProduction || isAdministrative)
+        if (seeEditableStates)
             return statesList;
 
-        if (isSalesPerson) {
+        const seeFilteredEditableStates =
+            await models.ACL.checkAccessAcl(ctx, 'State', 'seeFilteredEditableStates', 'READ');
+
+        if (seeFilteredEditableStates) {
             return statesList = statesList.filter(stateList =>
                 stateList.alertLevel === 0 || stateList.code === 'PICKER_DESIGNED'
             );
diff --git a/modules/ticket/back/methods/state/isEditable.js b/modules/ticket/back/methods/state/isEditable.js
index 730e6b9eb..5d5f6a205 100644
--- a/modules/ticket/back/methods/state/isEditable.js
+++ b/modules/ticket/back/methods/state/isEditable.js
@@ -30,6 +30,9 @@ module.exports = Self => {
         const isProduction = await models.VnUser.hasRole(userId, 'production', myOptions);
         const isSalesPerson = await models.VnUser.hasRole(userId, 'salesPerson', myOptions);
         const isAdministrative = await models.VnUser.hasRole(userId, 'administrative', myOptions);
+        //         const isEditableAlertLevel =
+        // await Self.app.models.ACL.checkAccessAcl(accessToken, 'Supplier', 'editPayMethodCheck', 'WRITE');
+
         const state = await models.State.findById(stateId, null, myOptions);
 
         const salesPersonAllowed = (isSalesPerson && (state.code == 'PICKER_DESIGNED' || state.code == 'PRINTED'));

From 0c668c6ade80a7b5578870d5065d357db616954d Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Tue, 25 Apr 2023 14:17:36 +0200
Subject: [PATCH 06/19] refs #5488 feat(): replace all hasRole to
 checkAccessAcl

---
 db/changes/231601/00-useSpecificsAcls.sql     | 32 ++++++++++++++++++-
 .../ticket/back/methods/state/isEditable.js   | 18 +++++------
 .../back/methods/ticket/componentUpdate.js    |  4 +--
 .../back/methods/ticket/isRoleAdvanced.js     | 18 ++---------
 .../back/methods/ticket/priceDifference.js    |  5 ++-
 .../ticket/back/methods/ticket/setDeleted.js  |  6 ++--
 .../worker-time-control/addTimeEntry.js       |  4 +--
 .../worker-time-control/deleteTimeEntry.js    |  2 +-
 .../worker-time-control/updateTimeEntry.js    |  2 +-
 .../back/methods/worker/createAbsence.js      |  2 +-
 .../back/methods/worker/deleteAbsence.js      |  2 +-
 .../back/methods/worker/isSubordinate.js      |  7 ++--
 .../back/methods/worker/updateAbsence.js      |  2 +-
 13 files changed, 58 insertions(+), 46 deletions(-)

diff --git a/db/changes/231601/00-useSpecificsAcls.sql b/db/changes/231601/00-useSpecificsAcls.sql
index 9b9b3cebb..01906d09c 100644
--- a/db/changes/231601/00-useSpecificsAcls.sql
+++ b/db/changes/231601/00-useSpecificsAcls.sql
@@ -2,10 +2,19 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
     VALUES
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'salesAssistant'),
+        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'deliveryBoss'),
+        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'buyer'),
+        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Ticket', 'deleteTicketWithPartPrepared', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
+        ('Ticket', 'editZone', 'WRITE', 'ALLOW', 'ROLE', 'deliveryBoss'),
         ('State', 'editableStates', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'administrative'),
         ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'production'),
         ('State', 'seeFilteredEditableStates', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('State', 'isSomeEditable', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('State', 'isAllEditable', 'READ', 'ALLOW', 'ROLE', 'production'),
+        ('State', 'isAllEditable', 'READ', 'ALLOW', 'ROLE', 'administrative'),
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative'),
         ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss'),
         ('Claim', 'createAfterDeadline', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
@@ -16,7 +25,10 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Client', 'isNotEditableCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
         ('InvoiceOut', 'canCreatePdf', 'WRITE', 'ALLOW', 'ROLE', 'invoicing'),
         ('Supplier', 'editPayMethodCheck', 'WRITE', 'ALLOW', 'ROLE', 'financial'),
-        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager');
+        ('Worker', 'isTeamBoss', 'WRITE', 'ALLOW', 'ROLE', 'teamBoss'),
+        ('Worker', 'forceIsSubordinate', 'READ', 'ALLOW', 'ROLE', 'hr'),
+        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee');
 
 DELETE FROM `salix`.`ACL`
     WHERE
@@ -24,8 +36,26 @@ DELETE FROM `salix`.`ACL`
         AND property = '*'
         AND accessType = '*';
 
+DELETE FROM `salix`.`ACL`
+    WHERE
+        model = 'Ticket'
+        AND property = '*'
+        AND accessType = '*';
+
 DELETE FROM `salix`.`ACL`
     WHERE
         model = 'State'
         AND property = '*'
         AND accessType = 'READ';
+
+DELETE FROM `salix`.`ACL`
+    WHERE
+        model = 'Worker'
+        AND property = '*'
+        AND accessType = 'READ';
+
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    VALUES
+        ('State', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('State', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('State', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee');
diff --git a/modules/ticket/back/methods/state/isEditable.js b/modules/ticket/back/methods/state/isEditable.js
index 5d5f6a205..ec246c61f 100644
--- a/modules/ticket/back/methods/state/isEditable.js
+++ b/modules/ticket/back/methods/state/isEditable.js
@@ -19,25 +19,23 @@ module.exports = Self => {
     });
 
     Self.isEditable = async(ctx, stateId, options) => {
-        const accessToken = ctx.req.accessToken;
         const models = Self.app.models;
-        const userId = accessToken.userId;
         const myOptions = {};
 
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
-        const isProduction = await models.VnUser.hasRole(userId, 'production', myOptions);
-        const isSalesPerson = await models.VnUser.hasRole(userId, 'salesPerson', myOptions);
-        const isAdministrative = await models.VnUser.hasRole(userId, 'administrative', myOptions);
-        //         const isEditableAlertLevel =
-        // await Self.app.models.ACL.checkAccessAcl(accessToken, 'Supplier', 'editPayMethodCheck', 'WRITE');
+        const isAllEditable = await models.ACL.checkAccessAcl(ctx, 'State', 'isAllEditable', 'READ');
 
         const state = await models.State.findById(stateId, null, myOptions);
+        const isSomeEditable = (
+            await models.ACL.checkAccessAcl(ctx, 'State', 'isSomeEditable', 'READ')
+             && (
+                 state.code == 'PICKER_DESIGNED' || state.code == 'PRINTED'
+             )
+        );
 
-        const salesPersonAllowed = (isSalesPerson && (state.code == 'PICKER_DESIGNED' || state.code == 'PRINTED'));
-
-        const isAllowed = isProduction || isAdministrative || salesPersonAllowed || state.alertLevel == 0;
+        const isAllowed = isAllEditable || isSomeEditable || state.alertLevel == 0;
         return isAllowed;
     };
 };
diff --git a/modules/ticket/back/methods/ticket/componentUpdate.js b/modules/ticket/back/methods/ticket/componentUpdate.js
index 531d13b51..65247bb4e 100644
--- a/modules/ticket/back/methods/ticket/componentUpdate.js
+++ b/modules/ticket/back/methods/ticket/componentUpdate.js
@@ -121,8 +121,8 @@ module.exports = Self => {
             if (!isEditable)
                 throw new UserError(`The sales of this ticket can't be modified`);
 
-            const isDeliveryBoss = await models.VnUser.hasRole(userId, 'deliveryBoss', myOptions);
-            if (!isDeliveryBoss) {
+            const editZone = await models.ACL.checkAccessAcl(ctx, 'Ticket', 'editZone', 'WRITE');
+            if (!editZone) {
                 const zoneShipped = await models.Agency.getShipped(
                     args.landed,
                     args.addressFk,
diff --git a/modules/ticket/back/methods/ticket/isRoleAdvanced.js b/modules/ticket/back/methods/ticket/isRoleAdvanced.js
index d6186a0c9..df6ef164c 100644
--- a/modules/ticket/back/methods/ticket/isRoleAdvanced.js
+++ b/modules/ticket/back/methods/ticket/isRoleAdvanced.js
@@ -12,21 +12,7 @@ module.exports = Self => {
         }
     });
 
-    Self.isRoleAdvanced = async(ctx, options) => {
-        const models = Self.app.models;
-        const userId = ctx.req.accessToken.userId;
-        const myOptions = {};
-
-        if (typeof options == 'object')
-            Object.assign(myOptions, options);
-
-        const isSalesAssistant = await models.VnUser.hasRole(userId, 'salesAssistant', myOptions);
-        const isDeliveryBoss = await models.VnUser.hasRole(userId, 'deliveryBoss', myOptions);
-        const isBuyer = await models.VnUser.hasRole(userId, 'buyer', myOptions);
-        const isClaimManager = await models.VnUser.hasRole(userId, 'claimManager', myOptions);
-
-        const isRoleAdvanced = isSalesAssistant || isDeliveryBoss || isBuyer || isClaimManager;
-
-        return isRoleAdvanced;
+    Self.isRoleAdvanced = async ctx => {
+        return Self.app.models.ACL.checkAccessAcl(ctx, 'Ticket', 'hasRoleAdvanced', '*');
     };
 };
diff --git a/modules/ticket/back/methods/ticket/priceDifference.js b/modules/ticket/back/methods/ticket/priceDifference.js
index a0a10d997..4f9bffa99 100644
--- a/modules/ticket/back/methods/ticket/priceDifference.js
+++ b/modules/ticket/back/methods/ticket/priceDifference.js
@@ -60,7 +60,6 @@ module.exports = Self => {
     Self.priceDifference = async(ctx, options) => {
         const args = ctx.args;
         const models = Self.app.models;
-        const userId = ctx.req.accessToken.userId;
         const myOptions = {};
         let tx;
 
@@ -78,8 +77,8 @@ module.exports = Self => {
             if (!isEditable)
                 throw new UserError(`The sales of this ticket can't be modified`);
 
-            const isDeliveryBoss = await models.VnUser.hasRole(userId, 'deliveryBoss', myOptions);
-            if (!isDeliveryBoss) {
+            const editZone = await models.ACL.checkAccessAcl(ctx, 'Ticket', 'editZone', 'WRITE');
+            if (!editZone) {
                 const zoneShipped = await models.Agency.getShipped(
                     args.landed,
                     args.addressId,
diff --git a/modules/ticket/back/methods/ticket/setDeleted.js b/modules/ticket/back/methods/ticket/setDeleted.js
index 2889160d1..81c95529f 100644
--- a/modules/ticket/back/methods/ticket/setDeleted.js
+++ b/modules/ticket/back/methods/ticket/setDeleted.js
@@ -36,7 +36,6 @@ module.exports = Self => {
         }
 
         try {
-            const userId = ctx.req.accessToken.userId;
             const isEditable = await Self.isEditable(ctx, id, myOptions);
 
             if (!isEditable)
@@ -51,7 +50,8 @@ module.exports = Self => {
                 throw new UserError($t('Tickets with associated refunds', {id: ticketRefunds[0].id}));
 
             // Check if has sales with shelving
-            const isSalesAssistant = await models.VnUser.hasRole(userId, 'salesAssistant', myOptions);
+            const canDeleteTicketWithPartPrepared =
+                await models.ACL.checkAccessAcl(ctx, 'Ticket', 'deleteTicketWithPartPrepared', 'WRITE');
             const sales = await models.Sale.find({
                 include: {relation: 'itemShelvingSale'},
                 where: {ticketFk: id}
@@ -60,7 +60,7 @@ module.exports = Self => {
                 return sale.itemShelvingSale();
             });
 
-            if (hasItemShelvingSales && !isSalesAssistant)
+            if (hasItemShelvingSales && !canDeleteTicketWithPartPrepared)
                 throw new UserError(`You cannot delete a ticket that part of it is being prepared`);
 
             // Check for existing claim
diff --git a/modules/worker/back/methods/worker-time-control/addTimeEntry.js b/modules/worker/back/methods/worker-time-control/addTimeEntry.js
index 01a5a16ee..bcc96985f 100644
--- a/modules/worker/back/methods/worker-time-control/addTimeEntry.js
+++ b/modules/worker/back/methods/worker-time-control/addTimeEntry.js
@@ -40,10 +40,10 @@ module.exports = Self => {
             Object.assign(myOptions, options);
 
         const isSubordinate = await models.Worker.isSubordinate(ctx, workerId, myOptions);
-        const isTeamBoss = await models.VnUser.hasRole(currentUserId, 'teamBoss', myOptions);
+        const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE');
         const isHimself = currentUserId == workerId;
 
-        if (isSubordinate === false || (isSubordinate && isHimself && !isTeamBoss))
+        if (!isSubordinate || (isSubordinate && isHimself && !isTeamBoss))
             throw new UserError(`You don't have enough privileges`);
 
         query = `CALL vn.workerTimeControl_clockIn(?,?,?)`;
diff --git a/modules/worker/back/methods/worker-time-control/deleteTimeEntry.js b/modules/worker/back/methods/worker-time-control/deleteTimeEntry.js
index 1dcd12f5b..80482901f 100644
--- a/modules/worker/back/methods/worker-time-control/deleteTimeEntry.js
+++ b/modules/worker/back/methods/worker-time-control/deleteTimeEntry.js
@@ -32,7 +32,7 @@ module.exports = Self => {
 
         const targetTimeEntry = await Self.findById(id, null, myOptions);
         const isSubordinate = await models.Worker.isSubordinate(ctx, targetTimeEntry.userFk, myOptions);
-        const isTeamBoss = await models.VnUser.hasRole(currentUserId, 'teamBoss', myOptions);
+        const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE');
         const isHimself = currentUserId == targetTimeEntry.userFk;
 
         if (isSubordinate === false || (isSubordinate && isHimself && !isTeamBoss))
diff --git a/modules/worker/back/methods/worker-time-control/updateTimeEntry.js b/modules/worker/back/methods/worker-time-control/updateTimeEntry.js
index 344421311..8231be7bb 100644
--- a/modules/worker/back/methods/worker-time-control/updateTimeEntry.js
+++ b/modules/worker/back/methods/worker-time-control/updateTimeEntry.js
@@ -38,7 +38,7 @@ module.exports = Self => {
 
         const targetTimeEntry = await Self.findById(id, null, myOptions);
         const isSubordinate = await models.Worker.isSubordinate(ctx, targetTimeEntry.userFk, myOptions);
-        const isTeamBoss = await models.VnUser.hasRole(currentUserId, 'teamBoss', myOptions);
+        const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE');
         const isHimself = currentUserId == targetTimeEntry.userFk;
 
         const notAllowed = isSubordinate === false || (isSubordinate && isHimself && !isTeamBoss);
diff --git a/modules/worker/back/methods/worker/createAbsence.js b/modules/worker/back/methods/worker/createAbsence.js
index f53164a50..cb2cf8330 100644
--- a/modules/worker/back/methods/worker/createAbsence.js
+++ b/modules/worker/back/methods/worker/createAbsence.js
@@ -53,7 +53,7 @@ module.exports = Self => {
 
         try {
             const isSubordinate = await models.Worker.isSubordinate(ctx, id, myOptions);
-            const isTeamBoss = await models.VnUser.hasRole(userId, 'teamBoss', myOptions);
+            const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE');
 
             if (!isSubordinate || (isSubordinate && userId == id && !isTeamBoss))
                 throw new UserError(`You don't have enough privileges`);
diff --git a/modules/worker/back/methods/worker/deleteAbsence.js b/modules/worker/back/methods/worker/deleteAbsence.js
index 2d0078ba7..c315f5178 100644
--- a/modules/worker/back/methods/worker/deleteAbsence.js
+++ b/modules/worker/back/methods/worker/deleteAbsence.js
@@ -40,7 +40,7 @@ module.exports = Self => {
 
         try {
             const isSubordinate = await models.Worker.isSubordinate(ctx, id, myOptions);
-            const isTeamBoss = await models.VnUser.hasRole(userId, 'teamBoss', myOptions);
+            const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE');
 
             if (!isSubordinate || (isSubordinate && userId == id && !isTeamBoss))
                 throw new UserError(`You don't have enough privileges`);
diff --git a/modules/worker/back/methods/worker/isSubordinate.js b/modules/worker/back/methods/worker/isSubordinate.js
index 6c17ad0d0..9a1f1e683 100644
--- a/modules/worker/back/methods/worker/isSubordinate.js
+++ b/modules/worker/back/methods/worker/isSubordinate.js
@@ -25,8 +25,6 @@ module.exports = Self => {
 
     Self.isSubordinate = async(ctx, id, options) => {
         const models = Self.app.models;
-        const myUserId = ctx.req.accessToken.userId;
-
         const myOptions = {};
 
         if (typeof options == 'object')
@@ -37,8 +35,9 @@ module.exports = Self => {
             return subordinate.workerFk == id;
         });
 
-        const isHr = await models.VnUser.hasRole(myUserId, 'hr', myOptions);
-        if (isHr || isSubordinate)
+        const forceIsSubordinate = await models.ACL.checkAccessAcl(ctx, 'Worker', 'forceIsSubordinate', 'READ');
+
+        if (forceIsSubordinate || isSubordinate)
             return true;
 
         return false;
diff --git a/modules/worker/back/methods/worker/updateAbsence.js b/modules/worker/back/methods/worker/updateAbsence.js
index d904c2c14..5e13097a0 100644
--- a/modules/worker/back/methods/worker/updateAbsence.js
+++ b/modules/worker/back/methods/worker/updateAbsence.js
@@ -30,7 +30,7 @@ module.exports = Self => {
         const models = Self.app.models;
         const userId = ctx.req.accessToken.userId;
         const isSubordinate = await models.Worker.isSubordinate(ctx, id);
-        const isTeamBoss = await models.VnUser.hasRole(userId, 'teamBoss');
+        const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE');
 
         if (!isSubordinate || (isSubordinate && userId == id && !isTeamBoss))
             throw new UserError(`You don't have enough privileges`);

From 42e3c8f29d82ca82dc96ba73f51bb4f12cf6ebe7 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Fri, 28 Apr 2023 09:35:15 +0200
Subject: [PATCH 07/19] refs #5488 fix(): use hasWriteRole

---
 back/methods/dms/removeFile.js                | 10 +--
 back/methods/dms/updateFile.js                |  2 +-
 back/methods/dms/uploadFile.js                |  2 +-
 back/methods/image/download.js                |  2 +-
 back/methods/image/upload.js                  |  2 +-
 back/models/dms-type.js                       | 55 ++++++++++++++--
 back/models/dms-type.json                     | 29 ++-------
 back/models/dms.js                            |  4 +-
 back/models/image-collection.js               | 64 +++++++++++++++++++
 db/changes/231601/00-modelsAcls.sql           | 28 --------
 db/dump/fixtures.sql                          | 55 ++++++----------
 .../back/methods/claim-state/isEditable.js    | 11 +++-
 .../claim/back/methods/claim/uploadFile.js    |  2 +-
 .../back/methods/worker-dms/downloadFile.js   |  2 +-
 14 files changed, 162 insertions(+), 106 deletions(-)
 create mode 100644 back/models/image-collection.js
 delete mode 100644 db/changes/231601/00-modelsAcls.sql

diff --git a/back/methods/dms/removeFile.js b/back/methods/dms/removeFile.js
index 8007407d5..a9ff36883 100644
--- a/back/methods/dms/removeFile.js
+++ b/back/methods/dms/removeFile.js
@@ -35,14 +35,14 @@ module.exports = Self => {
 
         try {
             const dms = await models.Dms.findById(id, null, myOptions);
-
-            const hasWriteRole = await models.DmsType.checkRole(ctx, dms.dmsTypeFk, 'WRITE', myOptions);
-            if (!hasWriteRole)
-                throw new UserError(`You don't have enough privileges`);
-
             const trashDmsType = await models.DmsType.findOne({
                 where: {code: 'trash'}
             }, myOptions);
+
+            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, dms.dmsTypeFk, myOptions);
+            if (!hasWriteRole)
+                throw new UserError(`You don't have enough privileges`);
+
             await dms.updateAttribute('dmsTypeFk', trashDmsType.id, myOptions);
 
             if (tx) await tx.commit();
diff --git a/back/methods/dms/updateFile.js b/back/methods/dms/updateFile.js
index 0ecced31a..cfc4c322f 100644
--- a/back/methods/dms/updateFile.js
+++ b/back/methods/dms/updateFile.js
@@ -71,7 +71,7 @@ module.exports = Self => {
         }
 
         try {
-            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE');
+            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId);
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/methods/dms/uploadFile.js b/back/methods/dms/uploadFile.js
index ca1c1339d..a4212b804 100644
--- a/back/methods/dms/uploadFile.js
+++ b/back/methods/dms/uploadFile.js
@@ -66,7 +66,7 @@ module.exports = Self => {
 
         let srcFile;
         try {
-            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE');
+            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId, myOptions);
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/methods/image/download.js b/back/methods/image/download.js
index e3e8c495c..c4037b809 100644
--- a/back/methods/image/download.js
+++ b/back/methods/image/download.js
@@ -67,7 +67,7 @@ module.exports = Self => {
 
         if (!image) return false;
 
-        const hasReadRole = await models.ACL.checkAccessAcl(ctx, 'ImageCollection', collection, 'READ');
+        const hasReadRole = await models.ImageCollection.hasReadRole(ctx, collection);
         if (!hasReadRole)
             throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/methods/image/upload.js b/back/methods/image/upload.js
index 1f89b9cc6..51da327f6 100644
--- a/back/methods/image/upload.js
+++ b/back/methods/image/upload.js
@@ -37,7 +37,7 @@ module.exports = Self => {
 
         let tempFilePath;
         try {
-            const hasWriteRole = await models.ACL.checkAccessAcl(ctx, 'ImageCollection', args.collection, 'WRITE');
+            const hasWriteRole = await models.ImageCollection.hasWriteRole(ctx, args.collection);
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/back/models/dms-type.js b/back/models/dms-type.js
index 43f258319..c9329f30b 100644
--- a/back/models/dms-type.js
+++ b/back/models/dms-type.js
@@ -1,18 +1,65 @@
 module.exports = Self => {
+    /**
+     * Checks if current user has
+     * read privileges over a dms
+     *
+     * @param {Object} ctx - Request context
+     * @param {Interger} id - DmsType id
+     * @param {Object} options - Query options
+     * @return {Boolean} True for user with read privileges
+     */
+    Self.hasReadRole = async(ctx, id, options) => {
+        const models = Self.app.models;
+        const dmsType = await models.DmsType.findById(id, {
+            include: {
+                relation: 'readRole'
+            }
+        }, options);
+
+        return await hasRole(ctx, dmsType, options);
+    };
+
     /**
      * Checks if current user has
      * write privileges over a dms
      *
      * @param {Object} ctx - Request context
      * @param {Interger} id - DmsType id
-     * @param {String} type - Acl accessType
      * @param {Object} options - Query options
      * @return {Boolean} True for user with write privileges
      */
-    Self.checkRole = async(ctx, id, type, options) => {
+    Self.hasWriteRole = async(ctx, id, options) => {
         const models = Self.app.models;
-        const dmsType = await models.DmsType.findById(id, {fields: ['code']}, options);
+        const dmsType = await models.DmsType.findById(id, {
+            include: {
+                relation: 'writeRole'
+            }
+        }, options);
 
-        return await models.ACL.checkAccessAcl(ctx, 'DmsType', dmsType.code, type);
+        return await hasRole(ctx, dmsType, options);
     };
+
+    /**
+     * Checks if current user has
+     * read or write privileges
+     * @param {Object} ctx - Context
+     * @param {Object} dmsType - Dms type [read/write]
+     * @param {Object} options - Query options
+     */
+    async function hasRole(ctx, dmsType, options) {
+        const models = Self.app.models;
+        const myUserId = ctx.req.accessToken.userId;
+
+        const readRole = dmsType.readRole() && dmsType.readRole().name;
+        const writeRole = dmsType.writeRole() && dmsType.writeRole().name;
+        const requiredRole = readRole || writeRole;
+
+        const hasRequiredRole = await models.VnUser.hasRole(myUserId, requiredRole, options);
+        const isRoot = await models.VnUser.hasRole(myUserId, 'root', options);
+
+        if (isRoot || hasRequiredRole)
+            return true;
+
+        return false;
+    }
 };
diff --git a/back/models/dms-type.json b/back/models/dms-type.json
index c986060ac..de3d564b4 100644
--- a/back/models/dms-type.json
+++ b/back/models/dms-type.json
@@ -38,27 +38,10 @@
             "foreignKey": "writeRoleFk"
     	}
   	},
-      "acls": [
-        {
-            "property": "find",
-            "accessType": "READ",
-            "principalType": "ROLE",
-            "principalId": "$everyone",
-            "permission": "ALLOW"
-        },
-        {
-            "property": "findById",
-            "accessType": "READ",
-            "principalType": "ROLE",
-            "principalId": "$everyone",
-            "permission": "ALLOW"
-        },
-        {
-            "property": "findOne",
-            "accessType": "READ",
-            "principalType": "ROLE",
-            "principalId": "$everyone",
-            "permission": "ALLOW"
-        }
-    ]
+    "acls": [{
+        "accessType": "READ",
+        "principalType": "ROLE",
+        "principalId": "$everyone",
+        "permission": "ALLOW"
+    }]
 }
diff --git a/back/models/dms.js b/back/models/dms.js
index 8ecd10cb1..24c072f56 100644
--- a/back/models/dms.js
+++ b/back/models/dms.js
@@ -7,11 +7,11 @@ module.exports = Self => {
     require('../methods/dms/updateFile')(Self);
     require('../methods/dms/deleteTrashFiles')(Self);
 
-    Self.checkRole = async function(ctx, id, type) {
+    Self.checkRole = async function(ctx, id) {
         const models = Self.app.models;
         const dms = await Self.findById(id);
 
-        return await models.DmsType.checkRole(ctx, dms.dmsTypeFk, type);
+        return await models.DmsType.hasReadRole(ctx, dms.dmsTypeFk);
     };
 
     Self.getFile = async function(id) {
diff --git a/back/models/image-collection.js b/back/models/image-collection.js
new file mode 100644
index 000000000..2c4d274ee
--- /dev/null
+++ b/back/models/image-collection.js
@@ -0,0 +1,64 @@
+module.exports = Self => {
+    /**
+     * Checks if current user has
+     * read privileges over a collection
+     *
+     * @param {object} ctx - Request context
+     * @param {interger} name - Collection name
+     * @param {object} options - Query options
+     * @return {boolean} True for user with read privileges
+     */
+    Self.hasReadRole = async(ctx, name, options) => {
+        const collection = await Self.findOne({where: {name}}, {
+            include: {
+                relation: 'readRole'
+            }
+        }, options);
+
+        return await hasRole(ctx, collection, options);
+    };
+
+    /**
+     * Checks if current user has
+     * write privileges over a collection
+     *
+     * @param {object} ctx - Request context
+     * @param {string} name - Collection name
+     * @param {object} options - Query options
+     * @return {boolean} True for user with write privileges
+     */
+    Self.hasWriteRole = async(ctx, name, options) => {
+        const collection = await Self.findOne({
+            include: {
+                relation: 'writeRole'
+            },
+            where: {name}
+        }, options);
+
+        return await hasRole(ctx, collection, options);
+    };
+
+    /**
+     * Checks if current user has
+     * read or write privileges
+     * @param {Object} ctx - Context
+     * @param {Object} collection - Collection [read/write]
+     * @param {Object} options - Query options
+     */
+    async function hasRole(ctx, collection, options) {
+        const models = Self.app.models;
+        const myUserId = ctx.req.accessToken.userId;
+
+        const readRole = collection.readRole() && collection.readRole().name;
+        const writeRole = collection.writeRole() && collection.writeRole().name;
+        const requiredRole = readRole || writeRole;
+
+        const hasRequiredRole = await models.VnUser.hasRole(myUserId, requiredRole, options);
+        const isRoot = await models.VnUser.hasRole(myUserId, 'root', options);
+
+        if (isRoot || hasRequiredRole)
+            return true;
+
+        return false;
+    }
+};
diff --git a/db/changes/231601/00-modelsAcls.sql b/db/changes/231601/00-modelsAcls.sql
deleted file mode 100644
index 62f2b20d0..000000000
--- a/db/changes/231601/00-modelsAcls.sql
+++ /dev/null
@@ -1,28 +0,0 @@
--- DmsType model
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'DmsType', d.code, 'WRITE', 'ALLOW', 'ROLE', r.name
-        FROM `vn`.`dmsType` d
-            JOIN `account`.`role` r ON r.id = d.writeRoleFk;
-
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'DmsType', d.code, 'READ', 'ALLOW', 'ROLE', r.name
-        FROM `vn`.`dmsType` d
-            JOIN `account`.`role` r ON r.id = d.readRoleFk;
-
--- ImageCollection model
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'ImageCollection', i.name, 'WRITE', 'ALLOW', 'ROLE', r.name
-        FROM `hedera`.`imageCollection` i
-            JOIN `account`.`role` r ON r.id = i.writeRoleFk;
-
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'ImageCollection', i.name, 'READ', 'ALLOW', 'ROLE', r.name
-        FROM `hedera`.`imageCollection` i
-            JOIN `account`.`role` r ON r.id = i.readRoleFk;
-
--- ClaimState
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'ClaimState', c.code, 'WRITE', 'ALLOW', 'ROLE', r.name
-        FROM `vn`.`claimState` c
-            JOIN `account`.`role` r ON r.id = c.roleFk;
-
diff --git a/db/dump/fixtures.sql b/db/dump/fixtures.sql
index 8346cedbd..d28549c9d 100644
--- a/db/dump/fixtures.sql
+++ b/db/dump/fixtures.sql
@@ -1775,11 +1775,6 @@ INSERT INTO `vn`.`claimState`(`id`, `code`, `description`, `roleFk`, `priority`,
         ( 6, 'mana',        'Mana',        72,  4,  0),
         ( 7, 'lack',        'Faltas',      72,  2,  0);
 
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'ClaimState', c.code, 'WRITE', 'ALLOW', 'ROLE', r.name
-        FROM `vn`.`claimState` c
-            JOIN `account`.`role` r ON r.id = c.roleFk;
-
 INSERT INTO `vn`.`claim`(`id`, `ticketCreated`, `claimStateFk`, `clientFk`, `workerFk`, `responsibility`, `isChargedToMana`, `created`, `packages`, `rma`, `ticketFk`)
     VALUES
         (1, util.VN_CURDATE(), 1,   1101, 18, 3, 0, util.VN_CURDATE(), 0, '02676A049183', 11),
@@ -2326,36 +2321,26 @@ INSERT INTO `vn`.`workerTimeControl`(`userFk`, `timed`, `manual`, `direction`, `
 
 INSERT INTO `vn`.`dmsType`(`id`, `name`, `path`, `readRoleFk`, `writeRoleFk`, `code`)
     VALUES
-        (1,  'Facturas Recibidas',   'recibidas',       1,      1,          'invoiceIn'),
-        (2,  'Doc oficial',          'oficial',         1,      1,          'officialDoc'),
-        (3,  'Laboral',              'laboral',         37,     37,         'hhrrData'),
-        (4,  'Albaranes recibidos',  'entradas',        1,      1,          'deliveryNote'),
-        (5,  'Otros',                'otros',           1,      1,          'miscellaneous'),
-        (6,  'Pruebas',              'pruebas',         1,      1,          'tests'),
-        (7,  'IAE Clientes',         'IAE_Clientes',    1,      1,          'economicActivitiesTax'),
-        (8,  'Fiscal',               'fiscal',          1,      1,          'fiscal'),
-        (9,  'Vehiculos',            'vehiculos',       1,      1,          'vehicles'),
-        (10, 'Plantillas',           'plantillas',      1,      1,          'templates'),
-        (11, 'Contratos',            'contratos',       1,      1,          'contracts'),
-        (12, 'ley de pagos',         'ley pagos',       1,      1,          'paymentsLaw'),
-        (13, 'Basura',               'basura',          1,      1,          'trash'),
-        (14, 'Ticket',               'tickets',         1,      1,          'ticket'),
-        (15, 'Presupuestos',         'Presupuestos',    1,      1,          'budgets'),
-        (16, 'Logistica',            'logistica',       1,      1,          'logistics'),
-        (17, 'cmr',                  'cmr',             1,      1,          'cmr'),
-        (18, 'dua',                  'dua',             1,      1,          'dua'),
-        (19, 'inmovilizado',         'inmovilizado',    1,      1,          'fixedAssets'),
-        (20, 'Reclamación',          'reclamacion',     1,      1,          'claim');
-
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'DmsType', d.code, 'WRITE', 'ALLOW', 'ROLE', r.name
-        FROM `vn`.`dmsType` d
-            JOIN `account`.`role` r ON r.id = d.writeRoleFk;
-
-INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
-    SELECT 'DmsType', d.code, 'READ', 'ALLOW', 'ROLE', r.name
-        FROM `vn`.`dmsType` d
-            JOIN `account`.`role` r ON r.id = d.readRoleFk;
+        (1,  'Facturas Recibidas',   'recibidas',       NULL,   NULL,   'invoiceIn'),
+        (2,  'Doc oficial',          'oficial',         NULL,   NULL,   'officialDoc'),
+        (3,  'Laboral',              'laboral',         37,     37,     'hhrrData'),
+        (4,  'Albaranes recibidos',  'entradas',        NULL,   NULL,   'deliveryNote'),
+        (5,  'Otros',                'otros',           1,      1,      'miscellaneous'),
+        (6,  'Pruebas',              'pruebas',         NULL,   NULL,   'tests'),
+        (7,  'IAE Clientes',         'IAE_Clientes',    1,      1,      'economicActivitiesTax'),
+        (8,  'Fiscal',               'fiscal',          NULL,   NULL,   'fiscal'),
+        (9,  'Vehiculos',            'vehiculos',       NULL,   NULL,   'vehicles'),
+        (10, 'Plantillas',           'plantillas',      NULL,   NULL,   'templates'),
+        (11, 'Contratos',            'contratos',       NULL,   NULL,   'contracts'),
+        (12, 'ley de pagos',         'ley pagos',       1,      1,      'paymentsLaw'),
+        (13, 'Basura',               'basura',          1,      1,      'trash'),
+        (14, 'Ticket',               'tickets',         1,      1,      'ticket'),
+        (15, 'Presupuestos',         'Presupuestos',    NULL,   NULL,   'budgets'),
+        (16, 'Logistica',            'logistica',       NULL,   NULL,   'logistics'),
+        (17, 'cmr',                  'cmr',             NULL,   NULL,   'cmr'),
+        (18, 'dua',                  'dua',             NULL,   NULL,   'dua'),
+        (19, 'inmovilizado',         'inmovilizado',    NULL,   NULL,   'fixedAssets'),
+        (20, 'Reclamación',          'reclamacion',     1,      1,      'claim');
 
 INSERT INTO `vn`.`dms`(`id`, `dmsTypeFk`, `file`, `contentType`, `workerFk`, `warehouseFk`, `companyFk`, `hardCopyNumber`, `hasFile`, `reference`, `description`, `created`)
     VALUES
diff --git a/modules/claim/back/methods/claim-state/isEditable.js b/modules/claim/back/methods/claim-state/isEditable.js
index 73a8338da..641bc3b42 100644
--- a/modules/claim/back/methods/claim-state/isEditable.js
+++ b/modules/claim/back/methods/claim-state/isEditable.js
@@ -20,14 +20,19 @@ module.exports = Self => {
     });
 
     Self.isEditable = async(ctx, id, options) => {
+        const userId = ctx.req.accessToken.userId;
         const models = Self.app.models;
         const myOptions = {};
 
         if (typeof options == 'object')
             Object.assign(myOptions, options);
-        const state = await models.ClaimState.findById(id, {fields: ['code']}, myOptions);
-        if (!state) return false;
 
-        return await models.ACL.checkAccessAcl(ctx, 'ClaimState', state.code);
+        const state = await models.ClaimState.findById(id, {
+            include: {
+                relation: 'writeRole'
+            }
+        }, myOptions);
+        const roleWithGrants = state && state.writeRole().name;
+        return await models.VnUser.hasRole(userId, roleWithGrants, myOptions);
     };
 };
diff --git a/modules/claim/back/methods/claim/uploadFile.js b/modules/claim/back/methods/claim/uploadFile.js
index 14aa088a4..3d0737cf8 100644
--- a/modules/claim/back/methods/claim/uploadFile.js
+++ b/modules/claim/back/methods/claim/uploadFile.js
@@ -75,7 +75,7 @@ module.exports = Self => {
 
         let srcFile;
         try {
-            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE', myOptions);
+            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId, myOptions);
             if (!hasWriteRole)
                 throw new UserError(`You don't have enough privileges`);
 
diff --git a/modules/worker/back/methods/worker-dms/downloadFile.js b/modules/worker/back/methods/worker-dms/downloadFile.js
index d129814a2..cc8653e0e 100644
--- a/modules/worker/back/methods/worker-dms/downloadFile.js
+++ b/modules/worker/back/methods/worker-dms/downloadFile.js
@@ -33,7 +33,7 @@ module.exports = Self => {
     });
 
     Self.downloadFile = async function(ctx, id) {
-        if (!await Self.app.models.Dms.checkRole(ctx, id, 'READ') && !await Self.isMine(ctx, id))
+        if (!await Self.app.models.Dms.checkRole(ctx, id) && !await Self.isMine(ctx, id))
             throw new UserError(`You don't have enough privileges`);
         return await Self.app.models.Dms.getFile(id);
     };

From c3038a4d619e80ae3971179986559263e9e34fc1 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Fri, 28 Apr 2023 11:54:11 +0200
Subject: [PATCH 08/19] fix(imageCollection):

---
 back/models/image-collection.js |  5 +++--
 back/models/specs/dms.spec.js   |  4 ++--
 db/changes/231601/00-User.sql   | 21 ---------------------
 3 files changed, 5 insertions(+), 25 deletions(-)
 delete mode 100644 db/changes/231601/00-User.sql

diff --git a/back/models/image-collection.js b/back/models/image-collection.js
index 2c4d274ee..69905beca 100644
--- a/back/models/image-collection.js
+++ b/back/models/image-collection.js
@@ -9,10 +9,11 @@ module.exports = Self => {
      * @return {boolean} True for user with read privileges
      */
     Self.hasReadRole = async(ctx, name, options) => {
-        const collection = await Self.findOne({where: {name}}, {
+        const collection = await Self.findOne({
             include: {
                 relation: 'readRole'
-            }
+            },
+            where: {name}
         }, options);
 
         return await hasRole(ctx, collection, options);
diff --git a/back/models/specs/dms.spec.js b/back/models/specs/dms.spec.js
index e539387fb..3f13e88ff 100644
--- a/back/models/specs/dms.spec.js
+++ b/back/models/specs/dms.spec.js
@@ -37,14 +37,14 @@ describe('Dms', () => {
         const dmsId = 1;
         it('should return a true for an employee with permission', async() => {
             let ctx = {req: {accessToken: {userId: 1107}}};
-            const result = await Dms.checkRole(ctx, dmsId, 'READ');
+            const result = await Dms.checkRole(ctx, dmsId);
 
             expect(result).toBeTruthy();
         });
 
         it('should return false for an employee without permission', async() => {
             let ctx = {req: {accessToken: {userId: 1101}}};
-            const result = await Dms.checkRole(ctx, dmsId, 'READ');
+            const result = await Dms.checkRole(ctx, dmsId);
 
             expect(result).toBeFalsy();
         });
diff --git a/db/changes/231601/00-User.sql b/db/changes/231601/00-User.sql
deleted file mode 100644
index 8a7054403..000000000
--- a/db/changes/231601/00-User.sql
+++ /dev/null
@@ -1,21 +0,0 @@
-create or replace definer = root@localhost view `salix`.`User` as
-select `account`.`user`.`id`                AS `id`,
-       `account`.`user`.`realm`             AS `realm`,
-       `account`.`user`.`name`              AS `name`,
-       `account`.`user`.`nickname`          AS `nickname`,
-       `account`.`user`.`bcryptPassword`    AS `password`,
-       `account`.`user`.`role`              AS `role`,
-       `account`.`user`.`active`            AS `active`,
-       `account`.`user`.`email`             AS `email`,
-       `account`.`user`.`emailVerified`     AS `emailVerified`,
-       `account`.`user`.`verificationToken` AS `verificationToken`,
-       `account`.`user`.`lang`              AS `lang`,
-       `account`.`user`.`lastPassChange`    AS `lastPassChange`,
-       `account`.`user`.`created`           AS `created`,
-       `account`.`user`.`updated`           AS `updated`,
-       `account`.`user`.`image`             AS `image`,
-       `account`.`user`.`recoverPass`       AS `recoverPass`,
-       `account`.`user`.`sync`              AS `sync`,
-       `account`.`user`.`hasGrant`          AS `hasGrant`
-from `account`.`user`;
-

From 97da5e6e24ce18aabd2ac502dc9efdd16865b007 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Fri, 5 May 2023 13:58:11 +0200
Subject: [PATCH 09/19] refs #5488 feat(isRoleAdvanced): use Acl instead of
 method

---
 db/changes/231601/00-useSpecificsAcls.sql      |  8 ++++----
 .../methods/sale/specs/updateQuantity.spec.js  |  2 +-
 .../ticket/back/methods/sale/updateQuantity.js |  2 +-
 .../ticket/back/methods/ticket/isEditable.js   |  2 +-
 .../back/methods/ticket/isRoleAdvanced.js      | 18 ------------------
 modules/ticket/back/models/ticket-methods.js   |  1 -
 6 files changed, 7 insertions(+), 26 deletions(-)
 delete mode 100644 modules/ticket/back/methods/ticket/isRoleAdvanced.js

diff --git a/db/changes/231601/00-useSpecificsAcls.sql b/db/changes/231601/00-useSpecificsAcls.sql
index 01906d09c..7d8ebe40a 100644
--- a/db/changes/231601/00-useSpecificsAcls.sql
+++ b/db/changes/231601/00-useSpecificsAcls.sql
@@ -2,10 +2,10 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
     VALUES
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
         ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson'),
-        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'salesAssistant'),
-        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'deliveryBoss'),
-        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'buyer'),
-        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Ticket', 'isRoleAdvanced', '*', 'ALLOW', 'ROLE', 'salesAssistant'),
+        ('Ticket', 'isRoleAdvanced', '*', 'ALLOW', 'ROLE', 'deliveryBoss'),
+        ('Ticket', 'isRoleAdvanced', '*', 'ALLOW', 'ROLE', 'buyer'),
+        ('Ticket', 'isRoleAdvanced', '*', 'ALLOW', 'ROLE', 'claimManager'),
         ('Ticket', 'deleteTicketWithPartPrepared', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
         ('Ticket', 'editZone', 'WRITE', 'ALLOW', 'ROLE', 'deliveryBoss'),
         ('State', 'editableStates', 'READ', 'ALLOW', 'ROLE', 'employee'),
diff --git a/modules/ticket/back/methods/sale/specs/updateQuantity.spec.js b/modules/ticket/back/methods/sale/specs/updateQuantity.spec.js
index 4778f6b6d..80adb0bd1 100644
--- a/modules/ticket/back/methods/sale/specs/updateQuantity.spec.js
+++ b/modules/ticket/back/methods/sale/specs/updateQuantity.spec.js
@@ -64,7 +64,7 @@ describe('sale updateQuantity()', () => {
         try {
             const options = {transaction: tx};
 
-            const isRoleAdvanced = await models.Ticket.isRoleAdvanced(ctx, options);
+            const isRoleAdvanced = await models.ACL.checkAccessAcl(ctx, 'Ticket', 'isRoleAdvanced', '*');
 
             expect(isRoleAdvanced).toEqual(true);
 
diff --git a/modules/ticket/back/methods/sale/updateQuantity.js b/modules/ticket/back/methods/sale/updateQuantity.js
index d2927c65c..421c74702 100644
--- a/modules/ticket/back/methods/sale/updateQuantity.js
+++ b/modules/ticket/back/methods/sale/updateQuantity.js
@@ -64,7 +64,7 @@ module.exports = Self => {
 
             const sale = await models.Sale.findById(id, filter, myOptions);
 
-            const isRoleAdvanced = await models.Ticket.isRoleAdvanced(ctx, myOptions);
+            const isRoleAdvanced = await models.ACL.checkAccessAcl(ctx, 'Ticket', 'isRoleAdvanced', '*');
             if (newQuantity > sale.quantity && !isRoleAdvanced)
                 throw new UserError('The new quantity should be smaller than the old one');
 
diff --git a/modules/ticket/back/methods/ticket/isEditable.js b/modules/ticket/back/methods/ticket/isEditable.js
index d8fbb86ce..13bd4d57f 100644
--- a/modules/ticket/back/methods/ticket/isEditable.js
+++ b/modules/ticket/back/methods/ticket/isEditable.js
@@ -30,7 +30,7 @@ module.exports = Self => {
             where: {ticketFk: id}
         }, myOptions);
 
-        const isRoleAdvanced = await models.Ticket.isRoleAdvanced(ctx, myOptions);
+        const isRoleAdvanced = await models.ACL.checkAccessAcl(ctx, 'Ticket', 'isRoleAdvanced', '*');
 
         const alertLevel = state ? state.alertLevel : null;
         const ticket = await models.Ticket.findById(id, {
diff --git a/modules/ticket/back/methods/ticket/isRoleAdvanced.js b/modules/ticket/back/methods/ticket/isRoleAdvanced.js
deleted file mode 100644
index df6ef164c..000000000
--- a/modules/ticket/back/methods/ticket/isRoleAdvanced.js
+++ /dev/null
@@ -1,18 +0,0 @@
-module.exports = Self => {
-    Self.remoteMethodCtx('isRoleAdvanced', {
-        description: 'Check if a ticket is editable',
-        accessType: 'READ',
-        returns: {
-            type: 'boolean',
-            root: true
-        },
-        http: {
-            path: `/isRoleAdvanced`,
-            verb: 'GET'
-        }
-    });
-
-    Self.isRoleAdvanced = async ctx => {
-        return Self.app.models.ACL.checkAccessAcl(ctx, 'Ticket', 'hasRoleAdvanced', '*');
-    };
-};
diff --git a/modules/ticket/back/models/ticket-methods.js b/modules/ticket/back/models/ticket-methods.js
index 3992e7307..e5a8e8d94 100644
--- a/modules/ticket/back/models/ticket-methods.js
+++ b/modules/ticket/back/models/ticket-methods.js
@@ -36,7 +36,6 @@ module.exports = function(Self) {
     require('../methods/ticket/getTicketsFuture')(Self);
     require('../methods/ticket/merge')(Self);
     require('../methods/ticket/getTicketsAdvance')(Self);
-    require('../methods/ticket/isRoleAdvanced')(Self);
     require('../methods/ticket/collectionLabel')(Self);
     require('../methods/ticket/expeditionPalletLabel')(Self);
     require('../methods/ticket/saveSign')(Self);

From ca8373d7f752612d7ed27ce2bdb3a1426edd73c4 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Tue, 9 May 2023 14:04:39 +0200
Subject: [PATCH 10/19] feat(acl): add specifics acls to ticket, claim, state
 and worker

---
 db/changes/232001/00-useSpecificsAcls.sql | 60 +++++++++++++++++++++--
 1 file changed, 57 insertions(+), 3 deletions(-)

diff --git a/db/changes/232001/00-useSpecificsAcls.sql b/db/changes/232001/00-useSpecificsAcls.sql
index 7d8ebe40a..f8bd84c01 100644
--- a/db/changes/232001/00-useSpecificsAcls.sql
+++ b/db/changes/232001/00-useSpecificsAcls.sql
@@ -36,18 +36,63 @@ DELETE FROM `salix`.`ACL`
         AND property = '*'
         AND accessType = '*';
 
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    VALUES
+        ('Claim', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'getSummary', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'updateClaim', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'regularizeClaim', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),-- ?
+        ('Claim', 'updateClaimDestination', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),-- ?
+        ('Claim', 'downloadFile', 'READ', 'ALLOW', 'ROLE', 'claimManager'),-- ?
+        ('Claim', 'logs', 'READ', 'ALLOW', 'ROLE', 'claimManager');-- ?
+
 DELETE FROM `salix`.`ACL`
     WHERE
         model = 'Ticket'
         AND property = '*'
         AND accessType = '*';
 
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    VALUES
+        ('Ticket', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'getVolume', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'getTotalVolume', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'summary', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'priceDifference', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'componentUpdate', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'new', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'isEditable', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'setDeleted', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'restore', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'getSales', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'getSalesPersonMana', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'makeInvoice', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'updateEditableTicket', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'updateDiscount', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'transferSales', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'sendSms', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'isLocked', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'freightCost', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'getComponentsSum', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'deliveryNoteCsv', 'READ', 'ALLOW', 'ROLE', 'employee');
+
 DELETE FROM `salix`.`ACL`
     WHERE
         model = 'State'
         AND property = '*'
         AND accessType = 'READ';
 
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
+    VALUES
+        ('State', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('State', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('State', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee');
+
 DELETE FROM `salix`.`ACL`
     WHERE
         model = 'Worker'
@@ -56,6 +101,15 @@ DELETE FROM `salix`.`ACL`
 
 INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
     VALUES
-        ('State', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('State', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('State', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee');
+        ('Worker', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'getWorkedHours', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'active', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'activeWithRole', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'uploadFile', 'WRITE', 'ALLOW', 'ROLE', 'hr'), -- ?
+        ('Worker', 'contracts', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'holidays', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'activeContract', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
+        ('Worker', 'activeWithInheritedRole', 'READ', 'ALLOW', 'ROLE', 'employee'); --?

From a345265a89096b66ff8e7942e0fdaa24e87148b9 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Wed, 10 May 2023 14:09:06 +0200
Subject: [PATCH 11/19] refs #5488 specifics acls

---
 db/changes/232001/00-useSpecificsAcls.sql | 30 ++++++++++++-----------
 loopback/locale/en.json                   |  5 ++--
 2 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/db/changes/232001/00-useSpecificsAcls.sql b/db/changes/232001/00-useSpecificsAcls.sql
index f8bd84c01..d79c9d4d9 100644
--- a/db/changes/232001/00-useSpecificsAcls.sql
+++ b/db/changes/232001/00-useSpecificsAcls.sql
@@ -43,10 +43,11 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Claim', 'getSummary', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Claim', 'updateClaim', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
-        ('Claim', 'regularizeClaim', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),-- ?
-        ('Claim', 'updateClaimDestination', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),-- ?
-        ('Claim', 'downloadFile', 'READ', 'ALLOW', 'ROLE', 'claimManager'),-- ?
-        ('Claim', 'logs', 'READ', 'ALLOW', 'ROLE', 'claimManager');-- ?
+        ('Claim', 'regularizeClaim', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'updateClaimDestination', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'downloadFile', 'READ', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'deleteById', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'logs', 'READ', 'ALLOW', 'ROLE', 'claimManager');
 
 DELETE FROM `salix`.`ACL`
     WHERE
@@ -62,7 +63,7 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Ticket', 'getVolume', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'getTotalVolume', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'summary', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Ticket', 'priceDifference', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'priceDifference', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'componentUpdate', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'new', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'isEditable', 'READ', 'ALLOW', 'ROLE', 'employee'),
@@ -79,6 +80,7 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Ticket', 'isLocked', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'freightCost', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Ticket', 'getComponentsSum', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Ticket', 'updateAttributes', 'WRITE', 'ALLOW', 'ROLE', 'delivery'), -- Change Priority in Route tickets
         ('Ticket', 'deliveryNoteCsv', 'READ', 'ALLOW', 'ROLE', 'employee');
 
 DELETE FROM `salix`.`ACL`
@@ -104,12 +106,12 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Worker', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Worker', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Worker', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Worker', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'getWorkedHours', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'active', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'activeWithRole', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'uploadFile', 'WRITE', 'ALLOW', 'ROLE', 'hr'), -- ?
-        ('Worker', 'contracts', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'holidays', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'activeContract', 'READ', 'ALLOW', 'ROLE', 'employee'), -- ?
-        ('Worker', 'activeWithInheritedRole', 'READ', 'ALLOW', 'ROLE', 'employee'); --?
+        ('Worker', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'getWorkedHours', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'active', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'activeWithRole', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'uploadFile', 'WRITE', 'ALLOW', 'ROLE', 'hr'),
+        ('Worker', 'contracts', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'holidays', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'activeContract', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Worker', 'activeWithInheritedRole', 'READ', 'ALLOW', 'ROLE', 'employee');
diff --git a/loopback/locale/en.json b/loopback/locale/en.json
index cffedd891..a517a6183 100644
--- a/loopback/locale/en.json
+++ b/loopback/locale/en.json
@@ -171,5 +171,6 @@
 	"Added observation": "Added observation",
 	"Comment added to client": "Comment added to client",
 	"This ticket is already a refund": "This ticket is already a refund",
-	"A claim with that sale already exists": "A claim with that sale already exists"
-}
\ No newline at end of file
+	"A claim with that sale already exists": "A claim with that sale already exists",
+	"ASSIGN_ZONE_FIRST": "Assign zone first"
+}

From 08fcbebbaf96fc0b0cddcaf134de9ef787214dfb Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Mon, 15 May 2023 14:14:08 +0200
Subject: [PATCH 12/19] refs #5488 polish specifics acls

---
 db/changes/232001/00-useSpecificsAcls.sql          | 14 +++++++-------
 e2e/paths/06-claim/05_summary.spec.js              |  2 +-
 e2e/paths/06-claim/06_descriptor.spec.js           |  2 +-
 .../ticket/back/methods/ticket/transferSales.js    |  1 +
 .../worker/back/methods/worker/isSubordinate.js    | 10 ++--------
 modules/zone/back/methods/zone/includingExpired.js |  2 +-
 6 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/db/changes/232001/00-useSpecificsAcls.sql b/db/changes/232001/00-useSpecificsAcls.sql
index d79c9d4d9..2c12e064c 100644
--- a/db/changes/232001/00-useSpecificsAcls.sql
+++ b/db/changes/232001/00-useSpecificsAcls.sql
@@ -27,8 +27,7 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Supplier', 'editPayMethodCheck', 'WRITE', 'ALLOW', 'ROLE', 'financial'),
         ('Worker', 'isTeamBoss', 'WRITE', 'ALLOW', 'ROLE', 'teamBoss'),
         ('Worker', 'forceIsSubordinate', 'READ', 'ALLOW', 'ROLE', 'hr'),
-        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
-        ('Claim', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee');
+        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager');
 
 DELETE FROM `salix`.`ACL`
     WHERE
@@ -38,15 +37,16 @@ DELETE FROM `salix`.`ACL`
 
 INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
     VALUES
-        ('Claim', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Claim', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Claim', 'getSummary', 'READ', 'ALLOW', 'ROLE', 'employee'),
-        ('Claim', 'updateClaim', 'WRITE', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'find', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Claim', 'findById', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Claim', 'getSummary', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Claim', 'updateClaim', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson'),
         ('Claim', 'regularizeClaim', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
         ('Claim', 'updateClaimDestination', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
         ('Claim', 'downloadFile', 'READ', 'ALLOW', 'ROLE', 'claimManager'),
         ('Claim', 'deleteById', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'filter', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
         ('Claim', 'logs', 'READ', 'ALLOW', 'ROLE', 'claimManager');
 
 DELETE FROM `salix`.`ACL`
diff --git a/e2e/paths/06-claim/05_summary.spec.js b/e2e/paths/06-claim/05_summary.spec.js
index 758dc2ee3..9656ea656 100644
--- a/e2e/paths/06-claim/05_summary.spec.js
+++ b/e2e/paths/06-claim/05_summary.spec.js
@@ -17,7 +17,7 @@ describe('Claim summary path', () => {
     });
 
     it('should navigate to the target claim summary section', async() => {
-        await page.loginAndModule('employee', 'claim');
+        await page.loginAndModule('salesPerson', 'claim');
         await page.accessToSearchResult(claimId);
         await page.waitForState('claim.card.summary');
     });
diff --git a/e2e/paths/06-claim/06_descriptor.spec.js b/e2e/paths/06-claim/06_descriptor.spec.js
index 0826bad63..059bd68dd 100644
--- a/e2e/paths/06-claim/06_descriptor.spec.js
+++ b/e2e/paths/06-claim/06_descriptor.spec.js
@@ -16,7 +16,7 @@ describe('Claim descriptor path', () => {
     });
 
     it('should now navigate to the target claim summary section', async() => {
-        await page.loginAndModule('employee', 'claim');
+        await page.loginAndModule('salesPerson', 'claim');
         await page.accessToSearchResult(claimId);
         await page.waitForState('claim.card.summary');
     });
diff --git a/modules/ticket/back/methods/ticket/transferSales.js b/modules/ticket/back/methods/ticket/transferSales.js
index 48035648c..f1fc48d51 100644
--- a/modules/ticket/back/methods/ticket/transferSales.js
+++ b/modules/ticket/back/methods/ticket/transferSales.js
@@ -3,6 +3,7 @@ let UserError = require('vn-loopback/util/user-error');
 module.exports = Self => {
     Self.remoteMethodCtx('transferSales', {
         description: 'Transfer sales to a new or a given ticket',
+        accessType: 'WRITE',
         accepts: [{
             arg: 'id',
             type: 'number',
diff --git a/modules/worker/back/methods/worker/isSubordinate.js b/modules/worker/back/methods/worker/isSubordinate.js
index 9a1f1e683..53adc68b7 100644
--- a/modules/worker/back/methods/worker/isSubordinate.js
+++ b/modules/worker/back/methods/worker/isSubordinate.js
@@ -31,15 +31,9 @@ module.exports = Self => {
             Object.assign(myOptions, options);
 
         const mySubordinates = await Self.mySubordinates(ctx, myOptions);
-        const isSubordinate = mySubordinates.find(subordinate => {
-            return subordinate.workerFk == id;
-        });
-
+        const isSubordinate = mySubordinates.some(subordinate => subordinate.workerFk == id);
         const forceIsSubordinate = await models.ACL.checkAccessAcl(ctx, 'Worker', 'forceIsSubordinate', 'READ');
 
-        if (forceIsSubordinate || isSubordinate)
-            return true;
-
-        return false;
+        return forceIsSubordinate || isSubordinate;
     };
 };
diff --git a/modules/zone/back/methods/zone/includingExpired.js b/modules/zone/back/methods/zone/includingExpired.js
index 31678c83d..f9e7fd038 100644
--- a/modules/zone/back/methods/zone/includingExpired.js
+++ b/modules/zone/back/methods/zone/includingExpired.js
@@ -35,7 +35,7 @@ module.exports = Self => {
             && where.agencyModeFk && where.warehouseFk;
 
         if (filterByAvailability) {
-            const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'editDiscount');
+            const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'seeExpired');
             let showExpired = false;
             if (canSeeExpired.length) showExpired = true;
 

From 6300ee4be4179ad2ef650287a31b5e58f3f58953 Mon Sep 17 00:00:00 2001
From: vicent <vicent@verdnatura.es>
Date: Mon, 15 May 2023 14:24:31 +0200
Subject: [PATCH 13/19] refs #5600 foto de los trabajadores cuadrada

---
 front/salix/components/descriptor/style.scss | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/front/salix/components/descriptor/style.scss b/front/salix/components/descriptor/style.scss
index 27f482f26..b96e900c4 100644
--- a/front/salix/components/descriptor/style.scss
+++ b/front/salix/components/descriptor/style.scss
@@ -7,22 +7,24 @@ vn-descriptor-content {
 
     .photo {
         position: relative;
+        width: 100%;
+        text-align: center;
+        overflow: hidden;
 
         & > img[ng-src] {
             min-height: 16em;
             display: block;
-            max-width: 100%;
             height: 256px;
         }
 
         vn-float-button {
-            position: absolute; 
-            margin: 1em; 
-            bottom: 0; 
+            position: absolute;
+            margin: 1em;
+            bottom: 0;
             right: 0
         }
     }
- 
+
     & > vn-spinner {
         display: block;
         height: 40px;
@@ -39,7 +41,7 @@ vn-descriptor-content {
             align-items: stretch;
             color: $color-font-dark;
 
-            & > a, 
+            & > a,
             & > vn-icon-button {
                 display: flex;
                 min-width: 45px;
@@ -89,7 +91,7 @@ vn-descriptor-content {
                     display: flex;
                     align-items: center;
                     justify-content: center;
-            
+
                     & > vn-icon {
                         padding: $spacing-xs $spacing-sm;
                         font-size: 1.5rem;

From dc244b55674e64a1f39da22ca045aef743160af9 Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Tue, 23 May 2023 08:23:52 +0200
Subject: [PATCH 14/19] refs #5488 remove State_seeFilteredEditableStates

---
 db/changes/232201/00-useSpecificsAcls.sql | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/db/changes/232201/00-useSpecificsAcls.sql b/db/changes/232201/00-useSpecificsAcls.sql
index 2c12e064c..0d17ca948 100644
--- a/db/changes/232201/00-useSpecificsAcls.sql
+++ b/db/changes/232201/00-useSpecificsAcls.sql
@@ -11,7 +11,6 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('State', 'editableStates', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'administrative'),
         ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'production'),
-        ('State', 'seeFilteredEditableStates', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
         ('State', 'isSomeEditable', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
         ('State', 'isAllEditable', 'READ', 'ALLOW', 'ROLE', 'production'),
         ('State', 'isAllEditable', 'READ', 'ALLOW', 'ROLE', 'administrative'),
@@ -115,3 +114,8 @@ INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `pri
         ('Worker', 'holidays', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Worker', 'activeContract', 'READ', 'ALLOW', 'ROLE', 'employee'),
         ('Worker', 'activeWithInheritedRole', 'READ', 'ALLOW', 'ROLE', 'employee');
+
+DELETE FROM `salix`.`ACL`
+    WHERE model = 'Client'
+        AND property = 'updateUser'
+        AND accessType = '*';

From fa8fd8d5bcca3ab0c9e09e56ff3d6170ec7e8207 Mon Sep 17 00:00:00 2001
From: carlossa <carlossa@verdnatura.es>
Date: Thu, 25 May 2023 11:41:14 +0200
Subject: [PATCH 15/19] refs #5398 update from oldbranch

---
 modules/client/front/dms/edit/index.html                 | 7 ++++++-
 modules/entry/front/basic-data/index.html                | 9 +++++++--
 modules/item/front/descriptor/index.html                 | 9 ++++++++-
 modules/item/front/request-search-panel/index.html       | 9 ++++++++-
 modules/monitor/front/index/search-panel/index.html      | 7 ++++++-
 modules/route/front/agency-term-search-panel/index.html  | 5 +++++
 modules/route/front/search-panel/index.html              | 7 ++++++-
 modules/ticket/front/advance-search-panel/index.html     | 9 ++++++++-
 modules/ticket/front/basic-data/step-one/index.html      | 7 ++++++-
 modules/ticket/front/dms/edit/index.html                 | 7 ++++++-
 modules/ticket/front/future-search-panel/index.html      | 9 ++++++++-
 modules/ticket/front/search-panel/index.html             | 7 ++++++-
 .../travel/front/extra-community-search-panel/index.html | 9 +++++++--
 modules/worker/front/dms/create/index.html               | 5 +++++
 modules/worker/front/dms/create/index.spec.js            | 1 +
 modules/worker/front/dms/edit/index.html                 | 7 ++++++-
 16 files changed, 99 insertions(+), 15 deletions(-)

diff --git a/modules/client/front/dms/edit/index.html b/modules/client/front/dms/edit/index.html
index 87d69fdcd..58899df2b 100644
--- a/modules/client/front/dms/edit/index.html
+++ b/modules/client/front/dms/edit/index.html
@@ -2,6 +2,11 @@
     vn-id="watcher"
     data="$ctrl.dms">
 </vn-watcher>
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <form
     name="form"
     ng-submit="$ctrl.onSubmit()"
@@ -29,7 +34,7 @@
                 <vn-autocomplete vn-one required="true"
                     label="Warehouse"
                     ng-model="$ctrl.dms.warehouseId"
-                    url="Warehouses"
+                    data="Warehouses"
                     show-field="name"
                     value-field="id">
                 </vn-autocomplete>
diff --git a/modules/entry/front/basic-data/index.html b/modules/entry/front/basic-data/index.html
index 0b3537fac..888205320 100644
--- a/modules/entry/front/basic-data/index.html
+++ b/modules/entry/front/basic-data/index.html
@@ -5,6 +5,11 @@
     form="form"
     save="patch">
 </vn-watcher>
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <form name="form" ng-submit="watcher.submit()" class="vn-w-md">
     <vn-card class="vn-pa-lg">
         <vn-horizontal>
@@ -152,14 +157,14 @@
             <vn-autocomplete
                 label="Warehouse Out"
                 ng-model="$ctrl.travelFilterParams.warehouseOutFk"
-                url="Warehouses"
+                data="Warehouses"
                 show-field="name"
                 value-field="id">
             </vn-autocomplete>
             <vn-autocomplete
                 label="Warehouse In"
                 ng-model="$ctrl.travelFilterParams.warehouseInFk"
-                url="Warehouses"
+                data="Warehouses"
                 show-field="name"
                 value-field="id">
             </vn-autocomplete>
diff --git a/modules/item/front/descriptor/index.html b/modules/item/front/descriptor/index.html
index 8e85e043f..d98eabe3e 100644
--- a/modules/item/front/descriptor/index.html
+++ b/modules/item/front/descriptor/index.html
@@ -1,3 +1,8 @@
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <vn-descriptor-content
     module="item"
     description="$ctrl.item.name"
@@ -108,7 +113,9 @@
         <vn-autocomplete
             label="Warehouse"
             ng-model="$ctrl.warehouseFk"
-            url="Warehouses">
+            data="warehouses"
+            show-field="name"
+            value="id">>
         </vn-autocomplete>
     </tpl-body>
     <tpl-buttons>
diff --git a/modules/item/front/request-search-panel/index.html b/modules/item/front/request-search-panel/index.html
index dfafb02f3..a76684776 100644
--- a/modules/item/front/request-search-panel/index.html
+++ b/modules/item/front/request-search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-textfield
@@ -35,7 +40,9 @@
                 vn-one
                 label="Warehouse"
                 ng-model="filter.warehouseFk"
-                url="Warehouses">
+                data="warehouses"
+                show-field="name"
+                value-field="id">
             </vn-autocomplete>
         </vn-horizontal>
         <vn-horizontal class="vn-px-lg">
diff --git a/modules/monitor/front/index/search-panel/index.html b/modules/monitor/front/index/search-panel/index.html
index 5458202d2..822f84922 100644
--- a/modules/monitor/front/index/search-panel/index.html
+++ b/modules/monitor/front/index/search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-textfield
@@ -83,7 +88,7 @@
                 vn-one
                 label="Warehouse"
                 ng-model="filter.warehouseFk"
-                url="Warehouses">
+                data="Warehouses">
             </vn-autocomplete>
             <vn-autocomplete
                 vn-one
diff --git a/modules/route/front/agency-term-search-panel/index.html b/modules/route/front/agency-term-search-panel/index.html
index fec6bf5eb..8848744c6 100644
--- a/modules/route/front/agency-term-search-panel/index.html
+++ b/modules/route/front/agency-term-search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Agencies" 
+        data="agencies">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-textfield
diff --git a/modules/route/front/search-panel/index.html b/modules/route/front/search-panel/index.html
index 6e3d30d30..a5635766a 100644
--- a/modules/route/front/search-panel/index.html
+++ b/modules/route/front/search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-textfield
@@ -79,7 +84,7 @@
                 vn-one
                 label="Warehouse"
                 ng-model="filter.warehouseFk"
-                url="Warehouses"
+                data="Warehouses"
                 show-field="name"
                 value-field="id">
             </vn-autocomplete>
diff --git a/modules/ticket/front/advance-search-panel/index.html b/modules/ticket/front/advance-search-panel/index.html
index ee18c26f9..c2f5ecd8f 100644
--- a/modules/ticket/front/advance-search-panel/index.html
+++ b/modules/ticket/front/advance-search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-date-picker
@@ -49,7 +54,9 @@
                 vn-one
                 label="Warehouse"
                 ng-model="filter.warehouseFk"
-                url="Warehouses"
+                data="warehouses"
+                show-field="name"
+                value-field="id"
                 required="true">
             </vn-autocomplete>
         </vn-horizontal>
diff --git a/modules/ticket/front/basic-data/step-one/index.html b/modules/ticket/front/basic-data/step-one/index.html
index 498630b87..73df8c370 100644
--- a/modules/ticket/front/basic-data/step-one/index.html
+++ b/modules/ticket/front/basic-data/step-one/index.html
@@ -4,6 +4,11 @@
     order="name"
     auto-load="true">
 </vn-crud-model>
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <form name="form">
     <vn-card class="vn-w-md vn-pa-lg">
         <vn-horizontal>
@@ -25,7 +30,7 @@
             </vn-autocomplete>
             <vn-autocomplete vn-one
                 required="true"
-                url="Warehouses"
+                data="Warehouses"
                 label="Warehouse"
                 show-field="name"
                 value-field="id"
diff --git a/modules/ticket/front/dms/edit/index.html b/modules/ticket/front/dms/edit/index.html
index cf9af46d0..221c86e7e 100644
--- a/modules/ticket/front/dms/edit/index.html
+++ b/modules/ticket/front/dms/edit/index.html
@@ -2,6 +2,11 @@
     vn-id="watcher"
     data="$ctrl.dms">
 </vn-watcher>
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <form
     name="form"
     ng-submit="$ctrl.onSubmit()"
@@ -29,7 +34,7 @@
                 <vn-autocomplete vn-one required="true"
                     label="Warehouse"
                     ng-model="$ctrl.dms.warehouseId"
-                    url="Warehouses"
+                    data="Warehouses"
                     show-field="name"
                     value-field="id">
                 </vn-autocomplete>
diff --git a/modules/ticket/front/future-search-panel/index.html b/modules/ticket/front/future-search-panel/index.html
index 18b574f2a..d873fbc37 100644
--- a/modules/ticket/front/future-search-panel/index.html
+++ b/modules/ticket/front/future-search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-date-picker
@@ -83,7 +88,9 @@
                 vn-one
                 label="Warehouse"
                 ng-model="filter.warehouseFk"
-                url="Warehouses"
+                data="warehouses"
+                show-field="name"
+                value-field="id"
                 required="true">
             </vn-autocomplete>
         </vn-horizontal>
diff --git a/modules/ticket/front/search-panel/index.html b/modules/ticket/front/search-panel/index.html
index 7002f3dd6..d22b06a46 100644
--- a/modules/ticket/front/search-panel/index.html
+++ b/modules/ticket/front/search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form id="manifold-form" ng-submit="$ctrl.onSearch()">
         <vn-horizontal class="vn-px-lg vn-pt-lg">
             <vn-textfield
@@ -102,7 +107,7 @@
                 vn-one
                 label="Warehouse"
                 ng-model="filter.warehouseFk"
-                url="Warehouses">
+                data="Warehouses">
             </vn-autocomplete>
             <vn-autocomplete
                 vn-one
diff --git a/modules/travel/front/extra-community-search-panel/index.html b/modules/travel/front/extra-community-search-panel/index.html
index 09fbb8949..6c9e39f27 100644
--- a/modules/travel/front/extra-community-search-panel/index.html
+++ b/modules/travel/front/extra-community-search-panel/index.html
@@ -1,4 +1,9 @@
 <div class="search-panel">
+    <vn-crud-model
+        auto-load="true" 
+        url="Warehouses" 
+        data="warehouses">
+    </vn-crud-model>
     <form ng-submit="$ctrl.onSearch()">
         <vn-horizontal>
             <vn-textfield
@@ -52,14 +57,14 @@
             <vn-autocomplete vn-one
                 label="Warehouse Out"
                 ng-model="filter.warehouseOutFk"
-                url="Warehouses"
+                data="Warehouses"
                 show-field="name"
                 value-field="id">
             </vn-autocomplete>
             <vn-autocomplete vn-one
                 label="Warehouse In"
                 ng-model="filter.warehouseInFk"
-                url="Warehouses"
+                data="Warehouses"
                 show-field="name"
                 value-field="id">
             </vn-autocomplete>
diff --git a/modules/worker/front/dms/create/index.html b/modules/worker/front/dms/create/index.html
index 3495bf260..96f39ea6b 100644
--- a/modules/worker/front/dms/create/index.html
+++ b/modules/worker/front/dms/create/index.html
@@ -3,6 +3,11 @@
     vn-id="watcher"
     data="$ctrl.dms">
 </vn-watcher>
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <form
     name="form"
     ng-submit="$ctrl.onSubmit()"
diff --git a/modules/worker/front/dms/create/index.spec.js b/modules/worker/front/dms/create/index.spec.js
index b1c803854..08a2a5981 100644
--- a/modules/worker/front/dms/create/index.spec.js
+++ b/modules/worker/front/dms/create/index.spec.js
@@ -17,6 +17,7 @@ describe('Client', () => {
             $element = $compile(`<vn-worker-dms-create></vn-worker-dms-create>`)($rootScope);
             controller = $element.controller('vnWorkerDmsCreate');
             controller._worker = {id: 1101, name: 'Bruce wayne'};
+            $httpBackend.whenRoute('GET', `Warehouses?filter=%7B%7D`).respond([{$oldData: {}}]);
         }));
 
         describe('worker() setter', () => {
diff --git a/modules/worker/front/dms/edit/index.html b/modules/worker/front/dms/edit/index.html
index 2ac96851c..e4939b4ea 100644
--- a/modules/worker/front/dms/edit/index.html
+++ b/modules/worker/front/dms/edit/index.html
@@ -2,6 +2,11 @@
     vn-id="watcher"
     data="$ctrl.dms">
 </vn-watcher>
+<vn-crud-model
+    auto-load="true" 
+    url="Warehouses" 
+    data="warehouses">
+</vn-crud-model>
 <form
     name="form"
     ng-submit="$ctrl.onSubmit()"
@@ -29,7 +34,7 @@
                 <vn-autocomplete vn-one required="true"
                     label="Warehouse"
                     ng-model="$ctrl.dms.warehouseId"
-                    url="Warehouses"
+                    data="Warehouses"
                     show-field="name"
                     value-field="id">
                 </vn-autocomplete>

From f37d93b469a59b1790a6d7ea2afa7914d31419ab Mon Sep 17 00:00:00 2001
From: alexm <alexm@verdnatura.es>
Date: Fri, 26 May 2023 14:04:00 +0200
Subject: [PATCH 16/19] refs #5488 correct folder

---
 db/changes/{232201 => 232401}/00-useSpecificsAcls.sql | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename db/changes/{232201 => 232401}/00-useSpecificsAcls.sql (100%)

diff --git a/db/changes/232201/00-useSpecificsAcls.sql b/db/changes/232401/00-useSpecificsAcls.sql
similarity index 100%
rename from db/changes/232201/00-useSpecificsAcls.sql
rename to db/changes/232401/00-useSpecificsAcls.sql

From 95c438b73a67d676755b070f7b726886734a8089 Mon Sep 17 00:00:00 2001
From: carlossa <carlossa@verdnatura.es>
Date: Fri, 26 May 2023 14:52:47 +0200
Subject: [PATCH 17/19] refs #5648 move claimSure

---
 modules/ticket/front/sale/index.html | 4 ++--
 modules/ticket/front/sale/index.js   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/ticket/front/sale/index.html b/modules/ticket/front/sale/index.html
index b2c0db18d..f7b3c161d 100644
--- a/modules/ticket/front/sale/index.html
+++ b/modules/ticket/front/sale/index.html
@@ -491,7 +491,7 @@
 <vn-confirm
     vn-id="claimSure"
     message="Do you want to create a claim?"
-    on-accept="$ctrl.createClaim()">
+    on-accept="$ctrl.onCreateClaimAccepted()">
 </vn-confirm>
 
 <vn-menu vn-id="moreOptions">
@@ -513,7 +513,7 @@
     </vn-item>
     <vn-item translate
         name="claim"
-        ng-click="claimSure.show()"
+        ng-click="$ctrl.createClaim()"
         ng-if="$ctrl.isClaimable">
         Add claim 
     </vn-item>
diff --git a/modules/ticket/front/sale/index.js b/modules/ticket/front/sale/index.js
index be5f22154..ebf74fb9d 100644
--- a/modules/ticket/front/sale/index.js
+++ b/modules/ticket/front/sale/index.js
@@ -203,7 +203,7 @@ class Controller extends Section {
         if (pastDays >= this.ticketConfig[0].daysForWarningClaim)
             this.$.claimConfirm.show();
         else
-            this.onCreateClaimAccepted();
+            this.$.claimSure.show();
     }
 
     onCreateClaimAccepted() {

From 138d158f4f69331feb1b43b9f3e32d45aea5517d Mon Sep 17 00:00:00 2001
From: carlossa <carlossa@verdnatura.es>
Date: Mon, 29 May 2023 09:11:41 +0200
Subject: [PATCH 18/19] #refs 5684 remove and mod selectors

---
 e2e/helpers/selectors.js                         | 1 +
 e2e/paths/05-ticket/01-sale/02_edit_sale.spec.js | 1 -
 loopback/locale/en.json                          | 6 ++++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/e2e/helpers/selectors.js b/e2e/helpers/selectors.js
index 086909ebf..dcd9211f9 100644
--- a/e2e/helpers/selectors.js
+++ b/e2e/helpers/selectors.js
@@ -625,6 +625,7 @@ export default {
         selectAllSalesCheckbox: 'vn-ticket-sale vn-thead vn-check',
         secondSaleCheckbox: 'vn-ticket-sale vn-tr:nth-child(2) vn-check[ng-model="sale.checked"]',
         thirdSaleCheckbox: 'vn-ticket-sale vn-tr:nth-child(3) vn-check[ng-model="sale.checked"]',
+        fourthSaleCheckbox: 'vn-ticket-sale vn-tr:nth-child(4) vn-check[ng-model="sale.checked"]',
         deleteSaleButton: 'vn-ticket-sale vn-tool-bar > vn-button[icon="delete"]',
         transferSaleButton: 'vn-ticket-sale vn-tool-bar > vn-button[icon="call_split"]',
         moveToTicketInput: 'form vn-input-number[ng-model="$ctrl.transfer.ticketId"] input',
diff --git a/e2e/paths/05-ticket/01-sale/02_edit_sale.spec.js b/e2e/paths/05-ticket/01-sale/02_edit_sale.spec.js
index 2158eec8b..2c9646708 100644
--- a/e2e/paths/05-ticket/01-sale/02_edit_sale.spec.js
+++ b/e2e/paths/05-ticket/01-sale/02_edit_sale.spec.js
@@ -251,7 +251,6 @@ describe('Ticket Edit sale path', () => {
         await page.waitToClick(selectors.ticketSales.moreMenu);
         await page.waitToClick(selectors.ticketSales.moreMenuCreateClaim);
         await page.waitToClick(selectors.globalItems.acceptButton);
-        await page.waitToClick(selectors.globalItems.acceptButton);
         await page.waitForState('claim.card.basicData');
     });
 
diff --git a/loopback/locale/en.json b/loopback/locale/en.json
index e950b981b..b8e97412c 100644
--- a/loopback/locale/en.json
+++ b/loopback/locale/en.json
@@ -171,5 +171,7 @@
 	"Added observation": "Added observation",
 	"Comment added to client": "Comment added to client",
 	"This ticket is already a refund": "This ticket is already a refund",
-	"A claim with that sale already exists": "A claim with that sale already exists"
-}
+	"A claim with that sale already exists": "A claim with that sale already exists",
+	"Can't transfer claimed sales": "Can't transfer claimed sales",
+	"Invalid quantity": "Invalid quantity"
+}
\ No newline at end of file

From 41b1b2fb3fb3a1bde8fdbda6ac4b549838bdd04f Mon Sep 17 00:00:00 2001
From: carlossa <carlossa@verdnatura.es>
Date: Mon, 29 May 2023 10:02:21 +0200
Subject: [PATCH 19/19] fix >

---
 modules/item/front/descriptor/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/item/front/descriptor/index.html b/modules/item/front/descriptor/index.html
index d98eabe3e..7c442d364 100644
--- a/modules/item/front/descriptor/index.html
+++ b/modules/item/front/descriptor/index.html
@@ -115,7 +115,7 @@
             ng-model="$ctrl.warehouseFk"
             data="warehouses"
             show-field="name"
-            value="id">>
+            value="id">
         </vn-autocomplete>
     </tpl-body>
     <tpl-buttons>