fixed permission

public/userarea/sales_orders_deliveries.php

@@ -10,8 +10,10 @@ $db = DBHandlerSelect::getInstance();
 $pdo = $db->getConnection();
 $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
 
-// --- Permessi: pagina visibile solo con 'sales.stats.view' ---
+// --- Permessi: pagina visibile solo con 'sales.deliveries.view' ---
-if (!userCan('sales.stats.view')) {
+$canStats      = userCan('sales.stats.view');      // per i tab e il link al dettaglio ordine
+$canDeliveries = userCan('sales.deliveries.view');
+if (!$canDeliveries) {
     if (isset($_GET['action']) || isset($_POST['action'])) {
         MagoSalesStats::jsonOut(['success' => false, 'ok' => false, 'message' => 'Non hai i permessi per questa pagina']);
     }
@@ -603,8 +605,10 @@ if ($action === 'data') {
                     <div class="card-body pt-0">
 
                         <div class="stats-tabs">
-                            <a href="sales_orders_stats.php"><i class="fa-solid fa-list-check me-1"></i> Andamento ordini</a>
+                            <?php if ($canStats) : ?>
-                            <a href="sales_orders_years.php"><i class="fa-solid fa-chart-column me-1"></i> Confronto anni</a>
+                                <a href="sales_orders_stats.php"><i class="fa-solid fa-list-check me-1"></i> Andamento ordini</a>
+                                <a href="sales_orders_years.php"><i class="fa-solid fa-chart-column me-1"></i> Confronto anni</a>
+                            <?php endif; ?>
                             <a href="sales_orders_deliveries.php" class="active"><i class="fa-solid fa-truck-fast me-1"></i> Consegne</a>
                         </div>
 
@@ -722,7 +726,7 @@ if ($action === 'data') {
                             <div class="chart-card">
                                 <div class="d-flex justify-content-between align-items-center mb-2 flex-wrap gap-2">
                                     <div class="chart-title">Righe da consegnare <span class="text-muted fw-normal" id="rowsInfo"></span></div>
-                                    <div class="chart-hint">Ordinate per scadenza · clicca il numero ordine per aprirlo</div>
+                                    <div class="chart-hint">Ordinate per scadenza<?= $canStats ? ' · clicca il numero ordine per aprirlo' : '' ?></div>
                                 </div>
                                 <div class="table-responsive">
                                     <table id="linesTable" class="table table-striped align-middle w-100">
@@ -769,6 +773,7 @@ if ($action === 'data') {
     <script>
         (function() {
             const STORE_KEY = 'zibo_sales_deliveries_filters_v1';
+            const CAN_STATS = <?= $canStats ? 'true' : 'false' ?>; // il link al dettaglio ordine porta alle statistiche
             const charts = {};
             let table = null;
             let metric = 'value';
@@ -1108,7 +1113,9 @@ if ($action === 'data') {
                     const late = +r.late_days > 0;
                     const left = r.days_left !== null && r.days_left !== undefined ? +r.days_left : null;
                     return [
-                        `<a class="order-link" href="sales_orders_stats.php?q=${encodeURIComponent(r.internal_ord_no)}" target="_blank">${esc(r.internal_ord_no)}</a><div class="small text-muted">${fmtDate(r.order_date)}</div>`,
+                        (CAN_STATS ?
+                            `<a class="order-link" href="sales_orders_stats.php?q=${encodeURIComponent(r.internal_ord_no)}" target="_blank">${esc(r.internal_ord_no)}</a>` :
+                            `<b>${esc(r.internal_ord_no)}</b>`) + `<div class="small text-muted">${fmtDate(r.order_date)}</div>`,
                         `<div class="fw-semibold">${esc(r.company_name)}</div><div class="small text-muted">${esc(r.customer)}</div>`,
                         `<b>${esc(r.item)}</b><div class="small text-muted" style="white-space:normal;max-width:300px;">${esc(r.description)}</div>`,
                         `<span data-order="${+r.residual_qty}" class="amount"><b>${fmtQty(r.residual_qty)}</b> ${esc(r.uom)}</span><div class="small text-muted">di ${fmtQty(r.qty)}</div>`,

public/userarea/sales_orders_stats.php

@@ -883,7 +883,9 @@ if ($action === 'order') {
                         <div class="stats-tabs">
                             <a href="sales_orders_stats.php" class="active"><i class="fa-solid fa-list-check me-1"></i> Andamento ordini</a>
                             <a href="sales_orders_years.php"><i class="fa-solid fa-chart-column me-1"></i> Confronto anni</a>
-                            <a href="sales_orders_deliveries.php"><i class="fa-solid fa-truck-fast me-1"></i> Consegne</a>
+                            <?php if (userCan('sales.deliveries.view')) : ?>
+                                <a href="sales_orders_deliveries.php"><i class="fa-solid fa-truck-fast me-1"></i> Consegne</a>
+                            <?php endif; ?>
                         </div>
 
                         <!-- FILTRI -->

public/userarea/sales_orders_years.php

@@ -584,7 +584,9 @@ if ($action === 'data') {
                         <div class="stats-tabs">
                             <a href="sales_orders_stats.php"><i class="fa-solid fa-list-check me-1"></i> Andamento ordini</a>
                             <a href="sales_orders_years.php" class="active"><i class="fa-solid fa-chart-column me-1"></i> Confronto anni</a>
-                            <a href="sales_orders_deliveries.php"><i class="fa-solid fa-truck-fast me-1"></i> Consegne</a>
+                            <?php if (userCan('sales.deliveries.view')) : ?>
+                                <a href="sales_orders_deliveries.php"><i class="fa-solid fa-truck-fast me-1"></i> Consegne</a>
+                            <?php endif; ?>
                         </div>
 
                         <!-- FILTRI -->