refs #5488 removes 'role =='

@@ -0,0 +1,28 @@
+-- DmsType model

@@ -0,0 +54,4 @@
+        AND property = '*'
+        AND accessType = 'READ';
+
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)

@@ -133,2 +133,3 @@
         try {
-            const isSalesAssistant = await models.VnUser.hasRole(userId, 'salesAssistant', myOptions);
+            const canEditNotTaxDataChecked =
+                await models.ACL.checkAccessAcl(ctx, 'Client', 'editFiscalDataWithoutTaxDataCheck', 'WRITE');

@@ -72,3 +72,3 @@
 
         try {
-            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId);
+            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE');

@@ -67,3 +67,3 @@
         let srcFile;
         try {
-            const hasWriteRole = await models.DmsType.hasWriteRole(ctx, args.dmsTypeId, myOptions);
+            const hasWriteRole = await models.DmsType.checkRole(ctx, args.dmsTypeId, 'WRITE');

@@ -1,65 +1,18 @@
 module.exports = Self => {
-    /**

@@ -48,0 +47,4 @@
+            "permission": "ALLOW"
+        },
+        {
+            "property": "findById",

@@ -0,0 +10,4 @@
+            JOIN `account`.`role` r ON r.id = d.readRoleFk;
+
+-- ImageCollection model
+INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)

@@ -68,3 +68,3 @@
         if (!image) return false;
 
-        const hasReadRole = models.ImageCollection.hasReadRole(ctx, collection);
+        const hasReadRole = await models.ImageCollection.hasReadRole(ctx, collection);

@@ -9,10 +9,11 @@ module.exports = Self => {
      * @return {boolean} True for user with read privileges
      */
     Self.hasReadRole = async(ctx, name, options) => {
-        const collection = await Self.findOne({where: {name}}, {

@@ -48,3 +48,1 @@
-            const isSalesPerson = await models.VnUser.hasRole(userId, 'salesPerson', myOptions);
-
-            if (!isSalesPerson)
+            const canEdit = await models.ACL.checkAccessAcl(ctx, 'Client', 'updateUser', 'WRITE');

@@ -28,3 +15,1 @@
-        const isRoleAdvanced = isSalesAssistant || isDeliveryBoss || isBuyer || isClaimManager;
-
-        return isRoleAdvanced;
+    Self.isRoleAdvanced = async ctx => {

@@ -0,0 +29,4 @@
+        ('Worker', 'forceIsSubordinate', 'READ', 'ALLOW', 'ROLE', 'hr'),
+        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee');
+

@@ -41,1 +38,3 @@
-        if (isHr || isSubordinate)
+        const forceIsSubordinate = await models.ACL.checkAccessAcl(ctx, 'Worker', 'forceIsSubordinate', 'READ');
+
+        if (forceIsSubordinate || isSubordinate)

@@ -40,3 +38,1 @@
-            const canSeeExpired = roles.filter(role =>
-                role == 'productionBoss' || role == 'administrative'
-            );
+            const canSeeExpired = await models.ACL.checkAccessAcl(ctx, 'Agency', 'editDiscount');

@@ -0,0 +41,4 @@
+        ('Claim', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'getSummary', 'READ', 'ALLOW', 'ROLE', 'employee'),

@@ -0,0 +42,4 @@
+        ('Claim', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'getSummary', 'READ', 'ALLOW', 'ROLE', 'employee'),
+        ('Claim', 'updateClaim', 'WRITE', 'ALLOW', 'ROLE', 'employee'),

@@ -0,0 +28,4 @@
+        ('Worker', 'isTeamBoss', 'WRITE', 'ALLOW', 'ROLE', 'teamBoss'),
+        ('Worker', 'forceIsSubordinate', 'READ', 'ALLOW', 'ROLE', 'hr'),
+        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
+        ('Claim', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee');

@@ -0,0 +39,4 @@
+    VALUES
+        ('Claim', 'find', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Claim', 'findById', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
+        ('Claim', 'findOne', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),