From 6ef7306e10fac440d581b006011d1761031f9fca Mon Sep 17 00:00:00 2001
From: Soni Jay <jaygsoni14@gmail.com>
Date: Mon, 15 Dec 2025 01:47:02 +0530
Subject: [PATCH] WEB-106 Do not offer functionality to a user that is not
 within her/his rights (#2900)

---
 .../core/shell/toolbar/toolbar.component.html | 29 ++++++++++++++++---
 .../core/shell/toolbar/toolbar.component.ts   |  3 ++
 src/app/navigation/navigation.component.html  | 10 +++----
 3 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/src/app/core/shell/toolbar/toolbar.component.html b/src/app/core/shell/toolbar/toolbar.component.html
index da623a272..369e5918a 100644
--- a/src/app/core/shell/toolbar/toolbar.component.html
+++ b/src/app/core/shell/toolbar/toolbar.component.html
@@ -34,25 +34,46 @@
       [matMenuTriggerFor]="institutionMenu"
       #institutionMenuTrigger="matMenuTrigger"
       tabindex="0"
+      *mifosxHasPermission="'READ_INSTITUTION'"
     >
       <fa-icon class="mr-05" icon="university" size="lg"></fa-icon>
       {{ 'labels.menus.Institution' | translate }}
     </a>
 
     <span class="hide-lt-md">
-      <a #accounting class="tab-link accounting-link" [routerLink]="['/accounting']" tabindex="0">
+      <a
+        #accounting
+        class="tab-link accounting-link"
+        [routerLink]="['/accounting']"
+        tabindex="0"
+        *mifosxHasPermission="'READ_ACCOUNTING'"
+      >
         <fa-icon class="mr-05" icon="money-bill-alt" size="lg"></fa-icon>
         {{ 'labels.menus.Accounting' | translate }}
       </a>
-      <a #reports class="tab-link" [matMenuTriggerFor]="reportsMenu" #reportsMenuTrigger="matMenuTrigger" tabindex="0">
+      <a
+        #reports
+        class="tab-link"
+        [matMenuTriggerFor]="reportsMenu"
+        #reportsMenuTrigger="matMenuTrigger"
+        tabindex="0"
+        *mifosxHasPermission="'READ_REPORTS'"
+      >
         <fa-icon class="mr-05" icon="chart-bar" size="lg"></fa-icon>
         {{ 'labels.menus.Reports' | translate }}
       </a>
-      <a #admin class="tab-link" [matMenuTriggerFor]="adminMenu" #adminMenuTrigger="matMenuTrigger" tabindex="0">
+      <a
+        #admin
+        class="tab-link"
+        [matMenuTriggerFor]="adminMenu"
+        #adminMenuTrigger="matMenuTrigger"
+        tabindex="0"
+        *mifosxHasPermission="'READ_ADMIN'"
+      >
         <fa-icon class="mr-05" icon="shield-alt" size="lg"></fa-icon>
         {{ 'labels.menus.Admin' | translate }}
       </a>
-      <a #configWizard class="tab-link" (click)="openDialog()" tabindex="0">
+      <a #configWizard class="tab-link" (click)="openDialog()" tabindex="0" *mifosxHasPermission="'READ_CONFIG_WIZARD'">
         <fa-icon class="mr-05" icon="info" size="lg"></fa-icon>
         {{ 'labels.menus.Configuration Wizard' | translate }}
       </a>
diff --git a/src/app/core/shell/toolbar/toolbar.component.ts b/src/app/core/shell/toolbar/toolbar.component.ts
index d36ccd9f9..b599651a7 100644
--- a/src/app/core/shell/toolbar/toolbar.component.ts
+++ b/src/app/core/shell/toolbar/toolbar.component.ts
@@ -157,6 +157,9 @@ export class ToolbarComponent implements OnInit, AfterViewInit, AfterContentChec
    * @param backdrop Boolean.
    */
   showPopover(template: TemplateRef<any>, target: ElementRef<any> | HTMLElement): void {
+    if (!target) {
+      return;
+    }
     setTimeout(() => this.popoverService.open(template, target, 'bottom', true, {}), 200);
   }
 
diff --git a/src/app/navigation/navigation.component.html b/src/app/navigation/navigation.component.html
index a69c24a23..0dd825264 100644
--- a/src/app/navigation/navigation.component.html
+++ b/src/app/navigation/navigation.component.html
@@ -4,7 +4,7 @@
       <mat-card class="layout-column">
         <mat-card-content class="layout-column">
           @if (!(officeData === undefined || officeData === null)) {
-            <mat-form-field>
+            <mat-form-field *mifosxHasPermission="'READ_OFFICES'">
               <mat-label>{{ 'labels.inputs.Office' | translate }}</mat-label>
               <mat-select [formControl]="officeSelector">
                 @for (office of officeData; track office) {
@@ -17,7 +17,7 @@
           }
 
           @if (!(employeeData === undefined || employeeData === null)) {
-            <mat-form-field>
+            <mat-form-field *mifosxHasPermission="'READ_STAFF'">
               <mat-label>{{ employeeData.length ? 'Officer' : 'No Associated Officers' }}</mat-label>
               <mat-select [formControl]="employeeSelector">
                 @for (employee of employeeData; track employee) {
@@ -30,7 +30,7 @@
           }
 
           @if (!(centerData === undefined || centerData === null)) {
-            <mat-form-field>
+            <mat-form-field *mifosxHasPermission="'READ_CENTERS'">
               <mat-label>{{ centerData.length ? 'Center' : 'No Associated Centers' }}</mat-label>
               <mat-select [formControl]="centerSelector">
                 @for (center of centerData; track center) {
@@ -43,7 +43,7 @@
           }
 
           @if (!(groupData === undefined || groupData === null)) {
-            <mat-form-field>
+            <mat-form-field *mifosxHasPermission="'READ_GROUPS'">
               <mat-label>{{ groupData.length ? 'Group' : 'No Associated Groups' }}</mat-label>
               <mat-select [formControl]="groupSelector">
                 @for (group of groupData; track group) {
@@ -56,7 +56,7 @@
           }
 
           @if (!(clientData === undefined || clientData === null)) {
-            <mat-form-field>
+            <mat-form-field *mifosxHasPermission="'READ_CLIENTS'">
               <mat-label>{{ clientData.length ? 'Client' : 'No Associated Clients' }}</mat-label>
               <mat-select [formControl]="clientSelector">
                 @for (client of clientData; track client) {