Repository navigation
bug(rbac): Plan Authors role: 'Add Purchase' button visible in Plans (user can schedule purchases without permission) #1406
Description
Repro
- Log in as a user in the Plan Authors group only.
- Navigate to Plans.
- Observe the action buttons for existing plans.
- Click the 'Add Purchase' button.
Expected
The 'Add Purchase' button should not be visible for Plan Authors. This role has permissions: view: recommendations, plans, purchases, history, accounts; create/update/delete: plans. It does NOT have create: purchases permission.
Actual
The 'Add Purchase' button is visible and clickable. A Plan Authors user was able to successfully schedule a purchase from an existing plan despite lacking create: purchases permission.
Sheet reference
Plan Authors User Role tab, row 4.2.
Activity
cristim commentedon Jul 17, 2026
Resolved by #1426 (merged): the action-button RBAC audit gated the 'Add Purchases' button on canAccess('update','purchases') and changed the createPlannedPurchases backend gate to update:purchases, so Plan Authors (who hold update:plans but not update:purchases) no longer see or can use it. This is the exact scenario #1406 reports; closing as a duplicate/overlap of #1418. QA sheet row (Plan Authors 4.2) flipped to Ready to Test.