Matt 32b57354ad fix(clients): archiving is edit-level, not delete (unblocks Sales/Director) ...

Every client-archive route gated on clients:delete, which only super_admin
holds, so Sales Agent/Manager and Director users (clients.delete=false) got
403 on archive — the button was shown but never worked. Archiving is
reversible, so gate it on clients:edit instead; permanent deletion stays the
separate admin:permanently_delete_clients permission.

- New single source of truth CLIENT_ARCHIVE_ACTION='edit' (permissions.ts).
- All 5 archive routes use it: [id] DELETE, archive, archive-dossier,
  bulk-archive-preflight, bulk POST.
- UI affordances gate on clients:edit (detail-header archive/restore, bulk
  archive, per-row list + mobile-card archive) so view-only users don't see a
  button that 403s.
- permission-matrix regression test locks the policy (Sales/Director/Agent can
  archive; Viewer cannot).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L2qc3xZTfif7N4Wq3QDa8X

2026-06-28 18:16:09 +02:00

..

e2e

fix(ui): mobile cutoff polish — onboarding banner + yacht owner truncate (R1/R2)

2026-06-22 16:23:56 +02:00

helpers

feat(users): per-user signing-email override (login ≠ signing identity)

2026-06-26 15:08:44 +02:00

integration

fix(clients): archiving is edit-level, not delete (unblocks Sales/Director)

2026-06-28 18:16:09 +02:00

unit

feat(users): per-user signing-email override (login ≠ signing identity)

2026-06-26 15:08:44 +02:00

global-setup.ts

feat(inquiries): list/get/triage/convert service + API routes (find-or-create client)

2026-06-17 18:09:59 +02:00