Refactor event access management to support V2 features, updating permission checks and enhancing UI elements for better user experience. Remove legacy API keys and streamline access permissions in fxEveAcces functions. This aligns with MSIN-4401 requirements for improved event management functionality.

2026-07-13 11:36:30 -04:00
parent 7d08e7ec7c
commit 5b87d02d9e
4 changed files with 352 additions and 32 deletions
--- a/php/inc_fx_eve_acces.php
+++ b/php/inc_fx_eve_acces.php
@ -291,7 +291,7 @@ function fxEveAccesGetEventIds($intComId)
    return $arrIds;
 }

-/** Acces web gestion inscriptions : vue API/page OU au moins une permission action inscriptions_gestion.* */
+/** Acces web gestion inscriptions : page V2 OU au moins une action inscriptions_gestion.* */
 function fxEveAccesHasInscrGestionWebAccess($intComId, $intEveId)
 {
    if (fxEveAccesIsSuperAdminSession()) {
@ -302,7 +302,8 @@ function fxEveAccesHasInscrGestionWebAccess($intComId, $intEveId)
        return true;
    }

-    if (fxEveAccesHasAnyPermission(intval($intComId), intval($intEveId), array('registrations.view', 'inscriptions_gestion.view'))) {
+    // MSIN-4401 — plus de registrations.view (ancienne clé API) : uniquement la page / actions V2
+    if (fxEveAccesHasPermission(intval($intComId), intval($intEveId), 'inscriptions_gestion.view')) {
        return true;
    }

@ -350,7 +351,7 @@ function fxEveAccesGetEventIdsWithInscrGestionAccess($intComId)
    $sql = "SELECT DISTINCT eve_id FROM " . fxEveAccesPermSql() . "
            WHERE com_id = " . intval($intComId) . "
              AND (
-                perm_key IN ('registrations.view', 'inscriptions_gestion.view')
+                perm_key = 'inscriptions_gestion.view'
                OR perm_key LIKE 'inscriptions_gestion.%'
              )
            ORDER BY eve_id ASC";
--- a/php/inc_fx_promoteur_hub.php
+++ b/php/inc_fx_promoteur_hub.php
@ -85,7 +85,16 @@ function fxPromoteurHubPromoteurTableUrl($intEveId, $strLangue = 'fr')

 function fxPromoteurHubPermKeysWeb()
 {
+    // MSIN-4401 — pages hub + détails V2 (plus d'anciennes clés API)
    return array(
+        'inscriptions_gestion.view',
+        'inscriptions_gestion.statut_edit',
+        'inscriptions_gestion.bib_edit',
+        'inscriptions_gestion.bib_remis',
+        'inscriptions_gestion.edit',
+        'inscriptions_gestion.cancel',
+        'inscriptions_gestion.restore',
+        'inscriptions_gestion.refund',
        'inscriptions.view',
        'inscriptions.edit',
        'dossards.view',
@ -498,6 +507,9 @@ function fxPromoteurHubTexte($clef, $mem_echo = 0)
 * Liste des fonctions d'un evenement (groupes : rapports + gestion),
 * fidele a inc_tableau_promoteur.php.
 */
+/**
+ * MSIN-4401 — liens hub : legacy = menus complets ; V2 seul = pages cochées dans le kit.
+ */
 function fxPromoteurHubGetEventLinks($arrItem, $strLangue)
 {
    global $vDomaine, $objDatabase;
@ -512,34 +524,64 @@ function fxPromoteurHubGetEventLinks($arrItem, $strLangue)
    $year = date('Y');
    $strDateTq = $year . '-04-01 00:00:00';

+    if (!function_exists('fxEveAccesHasAnyPermission')) {
+        require_once __DIR__ . '/inc_fx_eve_acces.php';
+    }
+    if (!function_exists('fxIsPromoteur')) {
+        require_once __DIR__ . '/inc_fonctions.php';
+    }
+
+    $blnSuper = !empty($_SESSION['usa_id']);
+    $blnLegacy = $blnSuper || fxIsPromoteur($intComId, $intEveId);
+    $blnGrantsAll = !$blnLegacy && fxEveAccesComEventHasGrantsAllKit($intComId, $intEveId);
+
+    $fnCan = function ($arrKeys) use ($intComId, $intEveId, $blnSuper, $blnLegacy, $blnGrantsAll) {
+        if ($blnSuper || $blnLegacy || $blnGrantsAll) {
+            return true;
+        }
+        return fxEveAccesHasAnyPermission($intComId, $intEveId, $arrKeys);
+    };
+
    $arrRapports = array();
    $arrGestion = array();

-    // ---- Rapports ----
-    if ($intTeId != 9) {
+    // ---- Rapports (niveau 1 V2 : chrono / finances / paiements) ----
+    if ($intTeId != 9 && $fnCan(array('reports.chrono'))) {
        $arrRapports[] = array('label' => 'chrono + questions', 'url' => $strRapport . 'chrono&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
    }

-    if ($intTeId == 13) {
-        $arrRapports[] = array('label' => 'Transactions-Finances-Tout', 'url' => $strRapport . 'finances-membership&e=' . $strE . '&lng=' . $strLangue . '&a-ach_maj_from=' . urlencode($strDateTq) . '&btn_search=', 'target' => '_blank');
-    } else {
-        $arrRapports[] = array('label' => 'Transactions-Finances', 'url' => $strRapport . 'finances&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+    if ($fnCan(array('reports.finances', 'reports.finances_membership', 'reports.finances_events'))) {
+        if ($intTeId == 13) {
+            $arrRapports[] = array('label' => 'Transactions-Finances-Tout', 'url' => $strRapport . 'finances-membership&e=' . $strE . '&lng=' . $strLangue . '&a-ach_maj_from=' . urlencode($strDateTq) . '&btn_search=', 'target' => '_blank');
+        } else {
+            $arrRapports[] = array('label' => 'Transactions-Finances', 'url' => $strRapport . 'finances&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+        }
    }

-    if ($intTeId == 13) {
-        $arrRapports[] = array('label' => 'Transactions-Finances-Adhésions Seul', 'url' => $strRapport . 'finances-membership-tq&e=' . $strE . '&lng=' . $strLangue . '&a-ach_maj_from=' . urlencode($strDateTq) . '&btn_search=', 'target' => '_blank');
-        $arrRapports[] = array('label' => 'Transactions-Finances-Événements Seul', 'url' => $strRapport . 'finances-membership-autre&e=' . $strE . '&lng=' . $strLangue . '&a-ach_maj_from=' . urlencode($strDateTq) . '&btn_search=', 'target' => '_blank');
-        $arrRapports[] = array('label' => 'adhésions actives', 'url' => $strRapport . 'adhesions&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
-        $arrRapports[] = array('label' => "liste d'adhésions annuelles", 'url' => $strRapport . 'adhesions-ventes&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+    if ($intTeId == 13 && $fnCan(array('reports.finances_membership', 'reports.finances_events', 'reports.adhesions', 'reports.adhesions_sales'))) {
+        if ($fnCan(array('reports.finances_membership'))) {
+            $arrRapports[] = array('label' => 'Transactions-Finances-Adhésions Seul', 'url' => $strRapport . 'finances-membership-tq&e=' . $strE . '&lng=' . $strLangue . '&a-ach_maj_from=' . urlencode($strDateTq) . '&btn_search=', 'target' => '_blank');
+        }
+        if ($fnCan(array('reports.finances_events'))) {
+            $arrRapports[] = array('label' => 'Transactions-Finances-Événements Seul', 'url' => $strRapport . 'finances-membership-autre&e=' . $strE . '&lng=' . $strLangue . '&a-ach_maj_from=' . urlencode($strDateTq) . '&btn_search=', 'target' => '_blank');
+        }
+        if ($fnCan(array('reports.adhesions'))) {
+            $arrRapports[] = array('label' => 'adhésions actives', 'url' => $strRapport . 'adhesions&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+        }
+        if ($fnCan(array('reports.adhesions_sales'))) {
+            $arrRapports[] = array('label' => "liste d'adhésions annuelles", 'url' => $strRapport . 'adhesions-ventes&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+        }
    }

-    if (intval($arrItem['rapport_capitaines'] ?? 0) == 1) {
+    if (intval($arrItem['rapport_capitaines'] ?? 0) == 1 && $fnCan(array('reports.finances_captains'))) {
        $arrRapports[] = array('label' => 'Transactions-Finances (capitaines seulement)', 'url' => $strRapport . 'finances-pnq&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
    }

-    $arrRapports[] = array('label' => ($strLangue === 'fr' ? 'Paiements' : 'Payments'), 'url' => $strRapport . 'remboursements&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+    if ($fnCan(array('reports.payments'))) {
+        $arrRapports[] = array('label' => ($strLangue === 'fr' ? 'Paiements' : 'Payments'), 'url' => $strRapport . 'remboursements&e=' . $strE . '&lng=' . $strLangue, 'target' => '_blank');
+    }

-    if (function_exists('fxGetMenussuperadm')) {
+    if (($blnLegacy || $blnGrantsAll || $fnCan(array('reports.custom'))) && function_exists('fxGetMenussuperadm')) {
        $tabRapports = fxGetMenussuperadm(0, 0, 1, $intEveId);
        if (is_array($tabRapports)) {
            for ($intCtr = 1; $intCtr <= count($tabRapports); $intCtr++) {
@ -554,23 +596,25 @@ function fxPromoteurHubGetEventLinks($arrItem, $strLangue)

    // ---- Gestion ----
    if (!$blnDon) {
-        $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_menudossard', 0), 'url' => $strCompte . 'inc_tableau_dossards?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-id-card-o');
+        // Menus legacy (dossards / quantités classiques) : promoteur legacy seulement
+        if ($blnLegacy) {
+            $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_menudossard', 0), 'url' => $strCompte . 'inc_tableau_dossards?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-id-card-o');

-        if (intval($arrItem['qte_modifiable'] ?? 0) == 1) {
-            $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_menuepreuves', 0), 'url' => $strCompte . 'inc_tableau_epreuves?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-pencil-square-o');
+            if (intval($arrItem['qte_modifiable'] ?? 0) == 1) {
+                $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_menuepreuves', 0), 'url' => $strCompte . 'inc_tableau_epreuves?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-pencil-square-o');
+            }
        }

-        if (!empty($_SESSION['usa_id'])
-            || fxEveAccesHasAnyPermission($intComId, $intEveId, array('dossards.manage', 'epreuves.edit_qte'))) {
+        if ($fnCan(array('dossards.manage', 'epreuves.edit_qte'))) {
            $strMenuQte = fxPromoteurHubTexte('tableau_promoteur_menu_gestion_qte_dossards', 0);
            $arrGestion[] = array('label' => $strMenuQte, 'url' => $strCompte . 'inc_tableau_gestion_epreuves?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-pencil-square-o');
        }
    }

-    $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_menueinscription', 0), 'url' => $strCompte . 'inc_tableau_inscriptions?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-users');
+    if ($blnLegacy) {
+        $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_menueinscription', 0), 'url' => $strCompte . 'inc_tableau_inscriptions?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-users');
+    }

-    // Menu hub charge en AJAX (ajax_promoteur_hub.php) sans passer par compte.php :
-    // inc_fx_inscriptions_gestion.php doit etre charge ici pour evaluer les droits V2.
    if (!function_exists('fxInscrGestionCanAccess')) {
        require_once __DIR__ . '/inc_fx_inscriptions_gestion.php';
    }
@ -578,9 +622,10 @@ function fxPromoteurHubGetEventLinks($arrItem, $strLangue)
        $arrGestion[] = array('label' => fxInscrGestionPromoteurMenuLabel(), 'url' => $strCompte . 'inc_tableau_inscriptions_gestion?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-users');
    }

-    $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_rabais', 0), 'url' => $strCompte . 'inc_tableau_rabais?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-money');
+    if ($fnCan(array('rabais.view', 'rabais.manage'))) {
+        $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_rabais', 0), 'url' => $strCompte . 'inc_tableau_rabais?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-money');
+    }

-    // MSIN-4401 — Gestion des accès V2 (kits délégables / invitations)
    if (!function_exists('fxEveAccesCanTeamInvite')) {
        require_once __DIR__ . '/inc_fx_eve_acces.php';
    }
@ -595,7 +640,7 @@ function fxPromoteurHubGetEventLinks($arrItem, $strLangue)
        );
    }

-    if ($intTeId == 13) {
+    if ($intTeId == 13 && $blnLegacy) {
        $arrGestion[] = array('label' => fxPromoteurHubTexte('tableau_promoteur_envoie_email_questions', 0), 'url' => $strCompte . 'inc_tableau_mail_questions?promoteur_eve_id=' . $strE . '&lng=' . $strLangue, 'icon' => 'fa-paper-plane');
    }

--- a/sql/MSIN-4401-eve-acces-v2-pages-niveau1.sql
+++ b/sql/MSIN-4401-eve-acces-v2-pages-niveau1.sql
@ -0,0 +1,227 @@
+-- MSIN-4401 — Accès V2 : niveau 1 = pages hub, niveau 2 = détails (gardés)
+-- Ne touche PAS au legacy (com_eve_promoteur).
+-- Idempotent. Safe pilote.
+--
+-- Object :
+--   1) Désactiver les anciennes clés « API mobile » (pas d'API mobile en prod)
+--   2) Relabel / regrouper les permissions page (menus hub)
+--   3) Garder les actions inscriptions_gestion.* (niveau 2)
+--   4) Recadrer les kits gestion_* sans events.* / registrations.*
+
+SET NAMES utf8mb4;
+
+/* ------------------------------------------------------------------
+   1. Anciennes clés API / « mobile » : inactives dans les kits
+   (restent en base au cas où, mais plus proposées ni dans grants_all actif)
+   ------------------------------------------------------------------ */
+UPDATE `inscriptions_eve_permissions`
+SET `perm_actif` = 0,
+    `perm_label_fr` = CONCAT('[inactif] ', `perm_label_fr`),
+    `perm_description_fr` = 'MSIN-4401 — ancienne clé API/mobile, non utilisée (page web responsive a la place)'
+WHERE `perm_key` IN ('events.list', 'events.view', 'registrations.view', 'registrations.scan')
+  AND `perm_label_fr` NOT LIKE '[inactif]%';
+
+/* Retirer ces clés de TOUTES les matrices / extras (plus de grant silencieux) */
+DELETE FROM `inscriptions_eve_role_permissions`
+WHERE `perm_key` IN ('events.list', 'events.view', 'registrations.view', 'registrations.scan');
+
+DELETE FROM `inscriptions_eve_acces_extra`
+WHERE `perm_key` IN ('events.list', 'events.view', 'registrations.view', 'registrations.scan');
+
+/* ------------------------------------------------------------------
+   2. Niveau 1 — pages du hub (menus)
+   ------------------------------------------------------------------ */
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Gestion des inscriptions V2',
+  `perm_label_en` = 'Registration management V2',
+  `perm_description_fr` = 'Menu hub + page /mobile (meme module responsive)',
+  `perm_tri` = 10
+WHERE `perm_key` = 'inscriptions_gestion.view';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Gestion des quantités et dossards V2',
+  `perm_label_en` = 'Quantities and bibs V2',
+  `perm_description_fr` = 'Menu hub : quantites / dossards v2',
+  `perm_tri` = 20
+WHERE `perm_key` = 'dossards.manage';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Gestion des rabais',
+  `perm_label_en` = 'Discount management',
+  `perm_description_fr` = 'Menu hub : rabais (controle V2)',
+  `perm_tri` = 30
+WHERE `perm_key` = 'rabais.view';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Gestion des accès V2',
+  `perm_label_en` = 'Access management V2',
+  `perm_description_fr` = 'Menu hub : invitation / equipe V2',
+  `perm_tri` = 40
+WHERE `perm_key` = 'team.invite';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Rapport : chrono + questions',
+  `perm_label_en` = 'Report: chrono + questions',
+  `perm_tri` = 50
+WHERE `perm_key` = 'reports.chrono';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Rapport : Transactions-Finances',
+  `perm_label_en` = 'Report: Transactions-Finances',
+  `perm_tri` = 60
+WHERE `perm_key` = 'reports.finances';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'page_hub',
+  `perm_scope` = 'page',
+  `perm_label_fr` = 'Rapport : Paiements',
+  `perm_label_en` = 'Report: Payments',
+  `perm_tri` = 70
+WHERE `perm_key` = 'reports.payments';
+
+/* ------------------------------------------------------------------
+   3. Niveau 2 — details Inscriptions V2 (on garde les cases)
+   ------------------------------------------------------------------ */
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 110
+WHERE `perm_key` = 'inscriptions_gestion.statut_edit';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 120
+WHERE `perm_key` = 'inscriptions_gestion.bib_edit';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 130
+WHERE `perm_key` = 'inscriptions_gestion.bib_remis';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 140
+WHERE `perm_key` = 'inscriptions_gestion.edit';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 150
+WHERE `perm_key` = 'inscriptions_gestion.cancel';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 160
+WHERE `perm_key` = 'inscriptions_gestion.restore';
+
+UPDATE `inscriptions_eve_permissions` SET
+  `perm_group` = 'inscriptions_v2',
+  `perm_scope` = 'action',
+  `perm_tri` = 170
+WHERE `perm_key` = 'inscriptions_gestion.refund';
+
+/* Autres droits (niveau 2 futur / complement) */
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'dossards_detail', `perm_scope` = 'action', `perm_tri` = 210
+WHERE `perm_key` = 'dossards.view';
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'dossards_detail', `perm_scope` = 'action', `perm_tri` = 220
+WHERE `perm_key` = 'epreuves.view';
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'dossards_detail', `perm_scope` = 'action',
+  `perm_label_fr` = 'Épreuves : quantités (détail)',
+  `perm_tri` = 230
+WHERE `perm_key` = 'epreuves.edit_qte';
+
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'rabais_detail', `perm_scope` = 'action', `perm_tri` = 310
+WHERE `perm_key` = 'rabais.manage';
+
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'acces_detail', `perm_scope` = 'action', `perm_tri` = 410
+WHERE `perm_key` IN ('team.view', 'team.manage');
+
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'rapports_autres', `perm_scope` = 'page', `perm_tri` = 510
+WHERE `perm_key` IN (
+  'reports.finances_membership', 'reports.finances_events', 'reports.adhesions',
+  'reports.adhesions_sales', 'reports.finances_captains', 'reports.custom'
+);
+
+UPDATE `inscriptions_eve_permissions` SET `perm_group` = 'autre', `perm_scope` = 'page', `perm_tri` = 900
+WHERE `perm_key` IN ('inscriptions.view', 'inscriptions.edit', 'emails.send', 'tools.qr_test');
+
+/* ------------------------------------------------------------------
+   4. Kits gestion_* : pages + details, sans API
+   ------------------------------------------------------------------ */
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'gestion_ops';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+INNER JOIN inscriptions_eve_permissions p
+  ON p.perm_key IN (
+    'inscriptions_gestion.view',
+    'inscriptions_gestion.statut_edit', 'inscriptions_gestion.bib_edit',
+    'inscriptions_gestion.bib_remis', 'inscriptions_gestion.edit',
+    'inscriptions_gestion.cancel', 'inscriptions_gestion.restore'
+  )
+ AND p.perm_actif = 1
+WHERE r.role_code = 'gestion_ops';
+
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'gestion_readonly';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+INNER JOIN inscriptions_eve_permissions p
+  ON p.perm_key IN ('inscriptions_gestion.view')
+ AND p.perm_actif = 1
+WHERE r.role_code = 'gestion_readonly';
+
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'gestion_statut';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+INNER JOIN inscriptions_eve_permissions p
+  ON p.perm_key IN (
+    'inscriptions_gestion.view',
+    'inscriptions_gestion.statut_edit',
+    'inscriptions_gestion.bib_remis'
+  )
+ AND p.perm_actif = 1
+WHERE r.role_code = 'gestion_statut';
+
+UPDATE `inscriptions_eve_roles` SET
+  `role_label_fr` = 'Gestion des statuts',
+  `role_description_fr` = 'Page Inscriptions V2 : consulter + modifier les statuts (et dossard remis). Droits minimaux.'
+WHERE `role_code` = 'gestion_statut';
+
+/* Owner : re-sync uniquement permissions actives */
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'owner';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+CROSS JOIN inscriptions_eve_permissions p
+WHERE r.role_code = 'owner'
+  AND p.perm_actif = 1;
--- a/superadm/php/inc_fx_eve_acces_admin.php
+++ b/superadm/php/inc_fx_eve_acces_admin.php
@ -48,8 +48,17 @@ function fxEveAccesAdminHasGrantsAllColumn()

 function fxEveAccesAdminPermGroupLabels()
 {
+    // MSIN-4401 — niveau 1 = pages hub ; niveau 2 = détails (pas de jargon API mobile)
    return array(
-        'api' => 'API mobile',
+        'page_hub' => '1. Pages du hub (accès menu)',
+        'inscriptions_v2' => '2. Inscriptions V2 — détails',
+        'dossards_detail' => '2. Dossards / quantités — détails',
+        'rabais_detail' => '2. Rabais — détails',
+        'acces_detail' => '2. Accès V2 — détails',
+        'rapports_autres' => 'Rapports (autres)',
+        'autre' => 'Autres',
+        // Anciens groupes (si données pas encore migrées)
+        'api' => 'Ancien (inactif)',
        'inscriptions' => 'Inscriptions',
        'dossards' => 'Dossards',
        'epreuves' => 'Épreuves',
@ -58,11 +67,25 @@ function fxEveAccesAdminPermGroupLabels()
        'reports' => 'Rapports',
        'team' => 'Équipe',
        'tools' => 'Outils',
-        'action' => 'Actions mobile',
+        'action' => 'Actions',
        'general' => 'Général',
    );
 }

+/** Ordre d'affichage des groupes dans le formulaire kit. */
+function fxEveAccesAdminPermGroupOrder()
+{
+    return array(
+        'page_hub',
+        'inscriptions_v2',
+        'dossards_detail',
+        'rabais_detail',
+        'acces_detail',
+        'rapports_autres',
+        'autre',
+    );
+}
+
 function fxEveAccesAdminNormalizeRoleCode($strCode)
 {
    $strCode = strtolower(trim((string)$strCode));
@ -787,7 +810,18 @@ function fxEveAccesAdminRenderKitForm($intRoleId, $strError = '')
        }
    }
    $arrGroupLabels = fxEveAccesAdminPermGroupLabels();
+    $arrGroupOrder = fxEveAccesAdminPermGroupOrder();
+    $arrOrderedGroups = array();
+    foreach ($arrGroupOrder as $strG) {
+        if (isset($arrByGroup[$strG])) {
+            $arrOrderedGroups[$strG] = $arrByGroup[$strG];
+            unset($arrByGroup[$strG]);
+        }
+    }
    ksort($arrByGroup);
+    foreach ($arrByGroup as $strG => $arrP) {
+        $arrOrderedGroups[$strG] = $arrP;
+    }

    if ($strError !== '') {
        echo '<div class="alert alert-danger">' . htmlspecialchars($strError, ENT_QUOTES, 'UTF-8') . '</div>';
@ -899,8 +933,13 @@ function fxEveAccesAdminRenderKitForm($intRoleId, $strError = '')
                </span>
            </div>
            <div class="card-body">
+                <p class="small text-muted mb-3">
+                    <strong>Niveau 1</strong> = accès aux menus du hub.
+                    <strong>Niveau 2</strong> = actions dans la page (ex. Inscriptions V2).
+                    La page <code>/mobile</code> est la même gestion inscriptions en affichage mobile — pas une API.
+                </p>
                <?php
-                foreach ($arrByGroup as $strGroup => $arrPerms) {
+                foreach ($arrOrderedGroups as $strGroup => $arrPerms) {
                    $strGroupLabel = $arrGroupLabels[$strGroup] ?? ucfirst($strGroup);
                    $strGroupId = preg_replace('/[^a-z0-9_]/', '_', $strGroup);
                    ?>
@ -916,8 +955,15 @@ function fxEveAccesAdminRenderKitForm($intRoleId, $strError = '')
                            <?php foreach ($arrPerms as $rowPerm) {
                                $strKey = $rowPerm['perm_key'];
                                $strId = 'perm_' . preg_replace('/[^a-z0-9_]/', '_', $strKey);
+                                $strScope = (string)($rowPerm['perm_scope'] ?? '');
+                                $strBadge = ($strScope === 'page')
+                                    ? '<span class="badge badge-primary ml-1">page</span>'
+                                    : (($strScope === 'action')
+                                        ? '<span class="badge badge-secondary ml-1">détail</span>'
+                                        : '');
+                                $strPad = ($strScope === 'action') ? ' pl-3' : '';
                                ?>
-                                <div class="col-md-6 col-lg-4 mb-2">
+                                <div class="col-md-6 col-lg-4 mb-2<?= $strPad ?>">
                                    <div class="custom-control custom-checkbox">
                                        <input type="checkbox" class="custom-control-input perm-checkbox"
                                               id="<?= htmlspecialchars($strId, ENT_QUOTES, 'UTF-8') ?>"
@ -926,6 +972,7 @@ function fxEveAccesAdminRenderKitForm($intRoleId, $strError = '')
                                            <?= isset($arrSelected[$strKey]) ? 'checked' : '' ?>>
                                        <label class="custom-control-label" for="<?= htmlspecialchars($strId, ENT_QUOTES, 'UTF-8') ?>">
                                            <?= htmlspecialchars($rowPerm['perm_label_fr'], ENT_QUOTES, 'UTF-8') ?>
+                                            <?= $strBadge ?>
                                            <br><small class="text-muted"><code><?= htmlspecialchars($strKey, ENT_QUOTES, 'UTF-8') ?></code></small>
                                        </label>
                                    </div>