Refactor inscription management permissions to enhance control over sensitive actions, specifically excluding refunds from general edit permissions. Update version code to 4.72.817 to reflect these changes.

php/inc_fx_inscriptions_gestion.php

@@ -80,8 +80,13 @@ function fxInscrGestionCanDo($intComId, $intEveId, $strActionPerm) {
         return true;
     }
 
-    /* Kit inscriptions complet (desktop) inclut les actions de gestion. */
-    if (fxEveAccesHasPermission(intval($intComId), intval($intEveId), 'inscriptions.edit')) {
+    // MSIN-4401 — Héritage kit desktop « inscriptions.edit » : actions de gestion courantes,
+    // PAS les actions sensibles (remboursement, etc.) — celles-ci exigent le droit explicite.
+    $tabNoInheritFromInscrEdit = array(
+        'inscriptions_gestion.refund' => true,
+    );
+    if (empty($tabNoInheritFromInscrEdit[$strActionPerm])
+        && fxEveAccesHasPermission(intval($intComId), intval($intEveId), 'inscriptions.edit')) {
         return true;
     }
 

php/inc_settings.php

@@ -7,7 +7,7 @@
  * Constantes *
  *
  **************/
-define('_VERSION_CODE', '4.72.816');
+define('_VERSION_CODE', '4.72.817');
 define('_DATE_CODE', '2026-07-13');
 //MSIN-4290
 define('QR_SECRET_KEY', 'ms1_qr_2026_cle_secrete_longue_et_fixe');

sql/MSIN-4401-inscr-gestion-actions-perm.sql

@@ -36,7 +36,10 @@ ON DUPLICATE KEY UPDATE
   `perm_actif` = 1,
   `perm_tri` = VALUES(`perm_tri`);
 
-/* Kits terrain : ops = les 3 ; readonly = lecture facture+transaction */
+/* Kits terrain :
+   - gestion_ops = facture + transaction + renvoi
+   - gestion_readonly = facture + transaction (consultation)
+   - gestion_statut = aucun de ces 3 (kit trop étroit) */
 INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
 SELECT r.role_id, p.perm_key
 FROM inscriptions_eve_roles r
@@ -55,5 +58,21 @@ CROSS JOIN (
   SELECT 'inscriptions_gestion.invoice' AS perm_key
   UNION ALL SELECT 'inscriptions_gestion.transaction'
 ) p
-WHERE r.role_code IN ('gestion_readonly', 'gestion_statut')
+WHERE r.role_code = 'gestion_readonly'
 ON DUPLICATE KEY UPDATE perm_key = VALUES(perm_key);
+
+/* Retire si une version précédente du script les avait collés sur gestion_statut */
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'gestion_statut'
+  AND erp.perm_key IN (
+    'inscriptions_gestion.invoice',
+    'inscriptions_gestion.transaction',
+    'inscriptions_gestion.renvoi'
+  );
+
+/* Retire le refund des kits terrain (droit explicite ou grants_all seulement). */
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code IN ('gestion_ops', 'gestion_readonly', 'gestion_statut')
+  AND erp.perm_key = 'inscriptions_gestion.refund';