ehoandClaude Opus 4.8
446ea9474b
Admin-only overview of all cases across owners + an admin delete, gated by a new
`cases:manage` capability (Authz role→cap + CanManageCases + CasesAdmin gate;
FE capability + guard + nav + role.interceptor prefix — the org-template/stamdata
recipe). Backend adds ApplicationStore.ListAll()/DeleteAny() and GET /admin/cases +
DELETE /admin/cases/{id}; admin delete removes ANY case incl. submitted. Page lives
in registratie/ui (owns the Aanvraag aggregate; reuses aanvraag-view + parse),
routed /beheer/zaken; delete guarded by a native confirm, optimistic with rollback.
Typed client regenerated (documents the new endpoints + owner field).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
24 lines
959 B
TypeScript
24 lines
959 B
TypeScript
import { HttpInterceptorFn } from '@angular/common/http';
|
|
import { currentRole } from './role';
|
|
|
|
/**
|
|
* Dev-only: stamps role-aware requests with the current `?role=` as an `X-Role`
|
|
* header so the backend can enforce the drafter/approver/admin rules. Only the
|
|
* brief, org-template, stamdata and /me endpoints carry it (WP-23 widened the set —
|
|
* /me must see the role or `AccessStore` could never learn a capability; WP-29 added
|
|
* /stamdata, whose admin-only reads 403 without it); everything else is untouched.
|
|
* A new admin-gated endpoint MUST be added here or its page silently 403s.
|
|
*/
|
|
const ROLE_AWARE = [
|
|
'/api/v1/brief',
|
|
'/api/v1/admin/org-template',
|
|
'/api/v1/admin/cases',
|
|
'/api/v1/stamdata',
|
|
'/api/v1/me',
|
|
];
|
|
|
|
export const roleInterceptor: HttpInterceptorFn = (req, next) => {
|
|
if (!ROLE_AWARE.some((prefix) => req.url.includes(prefix))) return next(req);
|
|
return next(req.clone({ setHeaders: { 'X-Role': currentRole() } }));
|
|
};
|