From 326cabb54497e544378a8d85db3832d09600ccaf Mon Sep 17 00:00:00 2001 From: behrinml Date: Wed, 20 May 2026 19:24:27 +0200 Subject: [PATCH] fix: updated route permissions from Read-All to Modify --- backend/app/api/routes/finance.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/app/api/routes/finance.py b/backend/app/api/routes/finance.py index 5f7fca1fb..8981f4edb 100644 --- a/backend/app/api/routes/finance.py +++ b/backend/app/api/routes/finance.py @@ -551,7 +551,7 @@ async def _rebuild_wallet_ledger_for_user(db: AsyncSession, user_id: int) -> Non async def delete_transaction( transaction_id: int, db: AsyncSession = Depends(get_db), - current_user: User | None = RequirePermissionIfAuthEnabled(Permission.COST_CENTERS_READ_ALL), + current_user: User | None = RequirePermissionIfAuthEnabled(Permission.COST_CENTERS_MODIFY), ): """Delete a wallet transaction and rebuild the user's ledger to keep balances consistent.""" await _require_authenticated_user(current_user) @@ -583,7 +583,7 @@ async def edit_transaction( transaction_id: int, request: TransactionEditRequest, db: AsyncSession = Depends(get_db), - current_user: User | None = RequirePermissionIfAuthEnabled(Permission.COST_CENTERS_READ_ALL), + current_user: User | None = RequirePermissionIfAuthEnabled(Permission.COST_CENTERS_MODIFY), ): """Edit a wallet transaction (user_id, cost_center_id, amount, description) and rebuild ledger.""" await _require_authenticated_user(current_user) @@ -625,7 +625,7 @@ async def edit_transaction( async def create_manual_print( request: ManualPrintRequest, db: AsyncSession = Depends(get_db), - current_user: User | None = RequirePermissionIfAuthEnabled(Permission.COST_CENTERS_READ_ALL), + current_user: User | None = RequirePermissionIfAuthEnabled(Permission.COST_CENTERS_MODIFY), ): """Create a manual print charge transaction (for admin purposes).""" await _require_authenticated_user(current_user)