From f71243e388e12da840aa70193b4907af2866c039 Mon Sep 17 00:00:00 2001
From: Luca <102960244+Luca-Timo@users.noreply.github.com>
Date: Sun, 7 Jun 2026 00:10:07 +0200
Subject: [PATCH] fix(projects): use real events.edit permission for project
 writes

The project create/update/assign routes required 'events.manage', which is
not a real permission (the event perms are view/create/edit/delete/archive).
Since it's absent from the permissions table, even super_admin's all-perms
set excluded it, so every write 403'd with 'Insufficient permissions'.
Switched the write routes to the existing 'events.edit'. (Reads keep
events.view; cockpit doc gating + email actions already use real keys.)
---
 backend/src/routes/adminProjects.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/src/routes/adminProjects.js b/backend/src/routes/adminProjects.js
index b5ae2dee..66943423 100644
--- a/backend/src/routes/adminProjects.js
+++ b/backend/src/routes/adminProjects.js
@@ -49,7 +49,7 @@ router.get('/', requirePermission('events.view'), handleAsync(async (req, res) =
 
 // Create
 router.post('/',
-  requirePermission('events.manage'),
+  requirePermission('events.edit'),
   [body('name').isString().trim().isLength({ min: 1, max: 255 }), body('customerAccountId').optional({ values: 'falsy' }).isInt({ min: 1 })],
   handleAsync(async (req, res) => {
     validateRequest(req);
@@ -71,7 +71,7 @@ router.get('/:id', requirePermission('events.view'), [param('id').isInt({ min: 1
 
 // Update
 router.put('/:id',
-  requirePermission('events.manage'),
+  requirePermission('events.edit'),
   [
     param('id').isInt({ min: 1 }),
     body('name').optional().isString().trim().isLength({ min: 1, max: 255 }),
@@ -91,7 +91,7 @@ router.put('/:id',
 
 // Attach an event to the project
 router.post('/:id/events',
-  requirePermission('events.manage'),
+  requirePermission('events.edit'),
   [param('id').isInt({ min: 1 }), body('eventId').isInt({ min: 1 })],
   handleAsync(async (req, res) => {
     validateRequest(req);
@@ -102,7 +102,7 @@ router.post('/:id/events',
 
 // Attach a quote to the project (quotes carry no event_id — migration 121).
 router.post('/:id/quotes',
-  requirePermission('events.manage'),
+  requirePermission('events.edit'),
   [param('id').isInt({ min: 1 }), body('quoteId').isInt({ min: 1 })],
   handleAsync(async (req, res) => {
     validateRequest(req);
@@ -113,7 +113,7 @@ router.post('/:id/quotes',
 
 // Attach a contract to the project.
 router.post('/:id/contracts',
-  requirePermission('events.manage'),
+  requirePermission('events.edit'),
   [param('id').isInt({ min: 1 }), body('contractId').isInt({ min: 1 })],
   handleAsync(async (req, res) => {
     validateRequest(req);