From 18468fad648c8eaa55c76e6ec2fe71413b00819c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=98=D0=B3=D0=BE=D1=80=D1=8C=20=D0=9D=D0=B0=D0=B4=D0=B5?=
 =?UTF-8?q?=D0=B8=D0=BD?= <igor_26reg@mail.ru>
Date: Mon, 8 Dec 2025 14:24:40 +0300
Subject: [PATCH] fix: add permission checks for create buttons in employee
 module templates

Changes:
1. employees_list.html - 'Create Profile' button now only visible to staff/superuser
   API requires staff/superuser for POST /employees/ (explicit check in create method)

2. department_list.html - Simplified permission check for 'Create Department' button
   Changed from: can_create_departments OR perms.employees.add_department OR is_staff
   To: is_staff OR is_superuser OR perms.employees.add_department
   API uses AdminOrActionOrModelPerms which checks employees.add_department

3. skill_list.html - 'Add Skill' button now requires authentication
   API allows any authenticated user to create skills (IsAuthenticated only)

Before:
- Department creation check was redundant with can_create_departments variable
- Skill creation had no check

After:
- All create buttons properly check permissions matching API requirements
- Consistent with feed and documents modules permission patterns
---
 backend/templates/employees/department_list.html | 3 ++-
 backend/templates/employees/employees_list.html  | 7 ++++++-
 backend/templates/employees/skill_list.html      | 8 +++++---
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/backend/templates/employees/department_list.html b/backend/templates/employees/department_list.html
index ce901bf9..d30eef8d 100644
--- a/backend/templates/employees/department_list.html
+++ b/backend/templates/employees/department_list.html
@@ -16,7 +16,8 @@
       <div class="col-12">
 
       {# ===== НОВАЯ ШАПКА С КОМПОНЕНТОМ ===== #}
-      {% if can_create_departments or perms.employees.add_department or request.user.is_staff or request.user.is_superuser %}
+      {# Кнопка создания отдела: staff/superuser ИЛИ право add_department #}
+      {% if user.is_staff or user.is_superuser or perms.employees.add_department %}
         {% include "includes/components/page_header.html" with icon="bi-diagram-3" title="Отделы" count=departments|length count_label="Всего:" search_id="deptFilter" search_placeholder="Поиск по названию или руководителю" create_as_card=True create_modal="createDepartmentModal" create_text="Создать отдел" %}
       {% else %}
         {% include "includes/components/page_header.html" with icon="bi-diagram-3" title="Отделы" count=departments|length count_label="Всего:" search_id="deptFilter" search_placeholder="Поиск по названию или руководителю" %}
diff --git a/backend/templates/employees/employees_list.html b/backend/templates/employees/employees_list.html
index f8a9219d..d25c62fe 100644
--- a/backend/templates/employees/employees_list.html
+++ b/backend/templates/employees/employees_list.html
@@ -18,7 +18,12 @@
     <div class="col-12">
 
       {# ===== НОВАЯ ШАПКА С КОМПОНЕНТОМ ===== #}
-      {% include "includes/components/page_header.html" with icon="bi-people" title="Сотрудники" count=employees|length count_label=count_label search_id="empFilter" search_placeholder="Поиск по ФИО, должности или отделу" has_filters=True filters_target="empFilters" filters_template="employees/_filters.html" create_as_card=True create_modal="createEmployeeModal" create_text="Создать профиль" %}
+      {# Кнопка создания профиля доступна только staff/superuser #}
+      {% if user.is_staff or user.is_superuser %}
+        {% include "includes/components/page_header.html" with icon="bi-people" title="Сотрудники" count=employees|length count_label=count_label search_id="empFilter" search_placeholder="Поиск по ФИО, должности или отделу" has_filters=True filters_target="empFilters" filters_template="employees/_filters.html" create_as_card=True create_modal="createEmployeeModal" create_text="Создать профиль" %}
+      {% else %}
+        {% include "includes/components/page_header.html" with icon="bi-people" title="Сотрудники" count=employees|length count_label=count_label search_id="empFilter" search_placeholder="Поиск по ФИО, должности или отделу" has_filters=True filters_target="empFilters" filters_template="employees/_filters.html" %}
+      {% endif %}
       
       <div class="card mb-3">
         <div id="empList" class="list-view card-list">
diff --git a/backend/templates/employees/skill_list.html b/backend/templates/employees/skill_list.html
index 324d5352..0769ae13 100644
--- a/backend/templates/employees/skill_list.html
+++ b/backend/templates/employees/skill_list.html
@@ -6,9 +6,11 @@
 <div class="container">
   <div class="d-flex justify-content-between align-items-center mb-3">
     <h3 class="mb-0">Навыки</h3>
-    <a href="{% url 'employees:skill_add' %}" class="btn btn-primary">
-      <i class="bi-plus-circle"></i> Добавить
-    </a>
+    {% if user.is_authenticated %}
+      <a href="{% url 'employees:skill_add' %}" class="btn btn-primary">
+        <i class="bi-plus-circle"></i> Добавить
+      </a>
+    {% endif %}
   </div>
 
   {% if skills %}