more granular ACLs for posting check vs. cash payments, processing credit card vs echecks, RT#7887

2 files changed, 47 insertions, 5 deletions

diff --git a/FS/FS/AccessRight.pm b/FS/FS/AccessRight.pm
index 6c06ec2f3..e7d77b57b 100644
--- a/FS/FS/AccessRight.pm
+++ b/FS/FS/AccessRight.pm
@@ -183,15 +183,16 @@ tie my %rights, 'Tie::IxHash',
   # customer payment rights
   ###
   'Customer payment rights' => [
-    'Post payment',
+    { rightname=>'Post payment', desc=>'Make check or cash payments.' },
+    'Post check payment',
+    'Post cash payment',
     'Post payment batch',
     'Apply payment', #NEWNEW
     { rightname=>'Unapply payment', desc=>'Enable "unapplication" of unclosed payments from specific invoices.' }, #aka. unapplypayments
-    'Process payment',
-    { rightname=>'Refund payment', desc=>'Enable refund of existing customer payments.' },
-
+    { rightname=>'Process payment', desc=>'Process credit card or e-check payments' },
+    'Process credit card payment',
+    'Process Echeck payment',
     { rightname=>'Delete payment', desc=>'Enable deletion of unclosed payments. Be very careful!  Only delete payments that were data-entry errors, not adjustments.' }, #aka. deletepayments Optionally specify one or more comma-separated email addresses to be notified when a payment is deleted.
-  
   ],
   
   ###
@@ -203,7 +204,12 @@ tie my %rights, 'Tie::IxHash',
     { rightname=>'Unapply credit', desc=>'Enable "unapplication" of unclosed credits.' }, #aka unapplycredits
     { rightname=>'Delete credit', desc=>'Enable deletion of unclosed credits. Be very careful!  Only delete credits that were data-entry errors, not adjustments.' }, #aka. deletecredits Optionally specify one or more comma-separated email addresses to be notified when a credit is deleted.
     { rightname=>'Post refund', desc=>'Enable posting of check and cash refunds.' },
+    'Post check refund',
+    'Post cash refund',
 #    { rightname=>'Process refund', desc=>'Enable processing of generic credit card/ACH refunds (i.e. not associated with a specific prior payment).' },
+    { rightname=>'Refund payment', desc=>'Enable refund of existing customer credit card or e-check payments.' },
+    'Refund credit card payment',
+    'Refund Echeck payment',
     'Delete refund', #NEW
     'Add on-the-fly credit reason', #NEW
   ],
@@ -348,6 +354,7 @@ sub default_superuser_rights {
     'Raw SQL',
     'Configuration download',
     'View customers of all agents',
+    'View/link unlinked services',
   );
 
   no warnings 'uninitialized';
diff --git a/FS/FS/access_right.pm b/FS/FS/access_right.pm
index bc6dd5d84..ef8cc6cd8 100644
--- a/FS/FS/access_right.pm
+++ b/FS/FS/access_right.pm
@@ -145,6 +145,41 @@ sub _upgrade_data { # class method
       if $error;
   }
 
+  my %migrate = (
+    'Post payment'    => [ 'Post check payment', 'Post cash payment' ],
+    'Process payment' => [ 'Process credit card payment', 'Process Echeck payment' ],
+    'Post refund'     => [ 'Post check refund', 'Post cash refund' ],
+    'Refund payment'  => [ 'Refund credit card payment', 'Refund Echeck payment' ],
+  );
+
+  foreach my $oldright (keys %migrate) {
+    my @old = qsearch('access_right', { 'righttype'=>'FS::access_group',
+                                        'rightname'=>$oldright,
+                                      }
+                     );
+
+    foreach my $old ( @old ) {
+
+      foreach my $newright ( @{ $migrate{$oldright} } ) {
+        my %hash = (
+          'righttype'   => 'FS::access_group',
+          'rightobjnum' => $old->rightobjnum,
+          'rightname'   => $newright,
+        );
+        next if qsearchs('access_right', \%hash);
+        my $access_right = new FS::access_right \%hash;
+        my $error = $access_right->insert;
+        die $error if $error;
+      }
+
+      #after the WEST stuff is sorted, etc.
+      #my $error = $old->delete;
+      #die $error if $error;
+
+    }
+
+  }
+
   '';
 
 }