From bc8bc86b7422d68340b5f20e8eace38b029ea5ee Mon Sep 17 00:00:00 2001
From: stephan <stephan@progiweb.ca>
Date: Tue, 23 Jun 2026 12:36:56 -0400
Subject: [PATCH] Refactor access control and UI elements for event management

This commit updates the event management access control logic in `inc_fx_eve_acces.php` to ensure proper permission checks for managing bibs. It also simplifies the UI in `inc_tableau_promoteur.php` by removing conditional rendering for the management link, ensuring it is always displayed. Additionally, the comment in `inc_tableau_gestion_epreuves.php` is updated for clarity.
---
 inc_tableau_gestion_epreuves.php |  5 +++--
 inc_tableau_promoteur.php        | 30 ++++++++++++++----------------
 php/inc_fx_eve_acces.php         | 17 ++++++++++++++++-
 3 files changed, 33 insertions(+), 19 deletions(-)

diff --git a/inc_tableau_gestion_epreuves.php b/inc_tableau_gestion_epreuves.php
index da2ce48..b45c033 100644
--- a/inc_tableau_gestion_epreuves.php
+++ b/inc_tableau_gestion_epreuves.php
@@ -1,6 +1,6 @@
 <?php
 
-// MSIN-4379 — Gestion quantités + dossards v4 (droits v2 ou super admin)
+// MSIN-4379 — Gestion quantités + dossards v4
 include_once("php/inc_fx_modifierinscriptions.php");
 include_once("php/inc_fx_memberships.php");
 include_once("php/inc_fx_promoteur.php");
@@ -28,7 +28,8 @@ if (isset($_GET['promoteur_eve_id'])) {
     $intEveId = base64_decode(urldecode($_GET['promoteur_eve_id']));
 }
 
-if ($intEveId <= 0 || (empty($_SESSION['com_id']) && empty($_SESSION['usa_id'])) || !fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
+if ($intEveId <= 0 || (empty($_SESSION['com_id']) && empty($_SESSION['usa_id']))
+    || !fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
     $strRedirect = $vDomaine . '/compte/inc_tableau_promoteur';
     if (!empty($_GET['promoteur_eve_id'])) {
         $strRedirect .= '?promoteur_eve_id=' . urlencode($_GET['promoteur_eve_id']);
diff --git a/inc_tableau_promoteur.php b/inc_tableau_promoteur.php
index d0b9027..d64b04a 100644
--- a/inc_tableau_promoteur.php
+++ b/inc_tableau_promoteur.php
@@ -234,22 +234,20 @@ if ($intEveId != 0) {
             </li><?php
         }
 
-        if (fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
-            ?>
-            <li class="nav-item">
-                <a class="nav-list"
-                   href="<?php echo $vDomaine; ?>/compte/inc_tableau_gestion_epreuves?promoteur_eve_id=<?php echo urlencode(base64_encode($intEveId)); ?>  &lng=<?php echo $strLangue; ?>">
-                    <i class="fa fa-pencil-square-o" aria-hidden="true"></i>
-                    <?php
-                    $strMenuGestionQteDossards = afficheTexte('tableau_promoteur_menu_gestion_qte_dossards', 0, 0);
-                    echo (strpos($strMenuGestionQteDossards, '*tableau_promoteur_menu_gestion_qte_dossards*') !== false)
-                        ? 'Gestion des quantités et dossards'
-                        : $strMenuGestionQteDossards;
-                    ?>
-                </a>
-            </li>
-            <?php
-        }
+        ?>
+        <li class="nav-item">
+            <a class="nav-list"
+               href="<?php echo $vDomaine; ?>/compte/inc_tableau_gestion_epreuves?promoteur_eve_id=<?php echo urlencode(base64_encode($intEveId)); ?>  &lng=<?php echo $strLangue; ?>">
+                <i class="fa fa-pencil-square-o" aria-hidden="true"></i>
+                <?php
+                $strMenuGestionQteDossards = afficheTexte('tableau_promoteur_menu_gestion_qte_dossards', 0, 0);
+                echo (strpos($strMenuGestionQteDossards, '*tableau_promoteur_menu_gestion_qte_dossards*') !== false)
+                    ? 'Gestion des quantités et dossards'
+                    : $strMenuGestionQteDossards;
+                ?>
+            </a>
+        </li>
+        <?php
     }
 
 
diff --git a/php/inc_fx_eve_acces.php b/php/inc_fx_eve_acces.php
index 805999d..41c34b4 100644
--- a/php/inc_fx_eve_acces.php
+++ b/php/inc_fx_eve_acces.php
@@ -247,13 +247,28 @@ function fxEveAccesBibV4PermKeys()
     return array('dossards.manage', 'epreuves.edit_qte');
 }
 
+/** Gate unique bib v4 — menu, page, AJAX. Pilote : promoteur legacy OU droits v2. */
 function fxEveAccesCanManageBibV4($intComId, $intEveId)
 {
     if (fxEveAccesIsSuperAdminSession()) {
         return true;
     }
 
-    return fxEveAccesHasAnyPermission(intval($intComId), intval($intEveId), fxEveAccesBibV4PermKeys());
+    $intComId = intval($intComId);
+    $intEveId = intval($intEveId);
+    if ($intComId <= 0 || $intEveId <= 0) {
+        return false;
+    }
+
+    // Pilote prod : promoteur legacy (com_eve_promoteur) = acces bib v4 comme avant v2.
+    if (!function_exists('fxIsPromoteur')) {
+        require_once __DIR__ . '/inc_fonctions.php';
+    }
+    if (fxIsPromoteur($intComId, $intEveId)) {
+        return true;
+    }
+
+    return fxEveAccesHasAnyPermission($intComId, $intEveId, fxEveAccesBibV4PermKeys());
 }
 
 /** Outil debug QR — permission v2 tools.qr_test uniquement (pas de bypass super admin). */