Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/lib/permissions.ts
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
'marketing:*',
'coupons:*',
'support:*',
'checkout:*',
],

/**
Expand Down Expand Up @@ -105,6 +106,7 @@ export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
'marketing:*',
'coupons:*',
'support:*',
'checkout:*',
],

/**
Expand Down Expand Up @@ -164,6 +166,7 @@ export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
'subscriptions:read',
'webhooks:*',
'integrations:*',
'checkout:*',
],

/**
Expand Down Expand Up @@ -277,6 +280,8 @@ export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
'reviews:delete:own',
'support:create',
'support:read:own',
'checkout:shipping',
'checkout:validate',
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CUSTOMER role only gains checkout:shipping and checkout:validate, but the checkout UI also calls other checkout endpoints that are protected by different permissions (e.g. /api/checkout/complete requires checkout:complete and /api/checkout/payment-intent requires checkout:payment). As-is, authenticated customers will still hit 403s when placing the order / creating payment intents. Add the missing checkout permissions to the CUSTOMER role (or use an appropriate checkout:*/more granular set) so the full checkout flow can proceed.

Suggested change
'checkout:validate',
'checkout:validate',
'checkout:complete',
'checkout:payment',

Copilot uses AI. Check for mistakes.
],
};

Expand Down
Loading