Merge remote-tracking branch 'origin/master'

ui/src/layouts/MainLayout.vue

@@ -135,13 +135,6 @@ import { Dialog } from 'quasar'
 
 import { useAuthStore } from 'stores/authStore'
 import { usePermissionStore } from 'stores/permissionStore'
-import { usePermission } from 'src/composables/usePermission'
-
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
 
 
 /* ================= STORES ================= */

ui/src/pages/ActivityLogs.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page class="act-page with-bg">
+  <q-page v-if="canReadUser" class="act-page with-bg">
 
     <!-- =======================================================
          🔍 FILTER BAR
@@ -83,6 +83,7 @@
 
           <!-- ✅ YENİ -->
           <q-btn
+            v-if="canUpdateUser"
             outline
             color="secondary"
             label="Rol Değişimleri"
@@ -206,6 +207,12 @@
     </q-table>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 
@@ -217,11 +224,9 @@ import { useActivityLogStore } from 'src/stores/activityLogStore'
 import { useAuthStore } from 'stores/authStore.js'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canUpdate } = usePermission()
+const canReadUser = canRead('user')
+const canUpdateUser = canUpdate('user')
 
 const diffDialog = ref(false)
 

ui/src/pages/ChangePassword.vue

@@ -1,5 +1,5 @@
 <template>
-<q-page class="flex flex-center">
+<q-page v-if="canUpdateSystem" class="flex flex-center">
 
 <q-card style="width:420px; max-width:90vw">
 <q-card-section>
@@ -45,6 +45,7 @@ class="bg-red-1 text-red q-mt-md"
 
 <q-card-actions align="right">
 <q-btn
+v-if="canUpdateSystem"
 label="GÜNCELLE"
 color="primary"
 :loading="loading"
@@ -54,6 +55,11 @@ color="primary"
 </q-card-actions>
 </q-card>
 
+</q-page>
+<q-page v-else class="q-pa-md flex flex-center">
+<div class="text-negative text-subtitle1">
+Bu module erisim yetkiniz yok.
+</div>
 </q-page>
 </template>
 
@@ -64,11 +70,8 @@ import api from 'src/services/api'
 import { useAuthStore } from 'stores/authStore.js'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canUpdate } = usePermission()
+const canUpdateSystem = canUpdate('system')
 
 const $q = useQuasar()
 const auth = useAuthStore()
@@ -117,4 +120,3 @@ async function submit () {
   }
 }
 </script>
-

ui/src/pages/Dashboard.vue

@@ -1,9 +1,17 @@
 <template>
-  <q-page class="flex flex-center">
+  <q-page v-if="canReadSystem" class="flex flex-center">
     <p>DashBoard</p>
   </q-page>
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
-// buraya JS kodların gelecek
+import { usePermission } from 'src/composables/usePermission'
+
+const { canRead } = usePermission()
+const canReadSystem = canRead('system')
 </script>

ui/src/pages/FirstPasswordChange.vue

@@ -59,13 +59,6 @@ import { ref } from 'vue'
 import { useRouter } from 'vue-router'
 import api from 'src/services/api'
 import { useAuthStore } from 'stores/authStore.js'
-import { usePermission } from 'src/composables/usePermission'
-
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
 
 const router = useRouter()
 const auth = useAuthStore()
@@ -117,4 +110,3 @@ async function submit () {
 
 
 
-

ui/src/pages/MainPage.vue

@@ -123,13 +123,6 @@ import { useRouter } from 'vue-router'
 import { useAuthStore } from 'stores/authStore'
 import { useQuasar } from 'quasar'
 import api from 'src/services/api'
-import { usePermission } from 'src/composables/usePermission'
-
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
 
 const router = useRouter()
 const auth = useAuthStore()

ui/src/pages/MePassword.vue

@@ -60,13 +60,6 @@
 import { ref, computed } from 'vue'
 import { useQuasar } from 'quasar'
 import { useMePasswordStore } from 'stores/mePasswordStore'
-import { usePermission } from 'src/composables/usePermission'
-
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
 
 const $q = useQuasar()
 const store = useMePasswordStore()

ui/src/pages/OrderEntry.vue

@@ -213,7 +213,7 @@
         <div class="text-subtitle2 text-weight-bold">Sipariş Formu</div>
         <div>
           <q-btn
-            v-if="isViewOnly && canReadOrder"
+            v-if="isViewOnly && canExportOrder"
             label="🖨 SİPARİŞİ YAZDIR"
             color="primary"
             icon="print"
@@ -766,11 +766,12 @@ import { useAuthStore } from 'src/stores/authStore'
 import { formatDateInput, formatDateDisplay } from 'src/utils/formatters'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
+const { canRead, canWrite, canUpdate, canExport } = usePermission()
 
 const canReadOrder   = canRead('order')
 const canWriteOrder  = canWrite('order')
 const canUpdateOrder = canUpdate('order')
+const canExportOrder = canExport('order')
 
 // script setup içinde
 const formatDate = formatDateDisplay
@@ -889,8 +890,8 @@ function hasRowMutationPermission() {
 }
 
 function onPrintOrder() {
-  if (!canReadOrder.value) {
-    notifyNoPermission('Siparisi goruntuleme yetkiniz yok')
+  if (!canExportOrder.value) {
+    notifyNoPermission('Siparisi yazdirma yetkiniz yok')
     return
   }
   orderStore.downloadOrderPdf()

ui/src/pages/OrderList.vue

@@ -1,12 +1,12 @@
 <template>
-  <q-page class="ol-page">
-    <!-- 🔍 Sticky Filter -->
+  <q-page v-if="canReadOrder" class="ol-page">
+    <!-- 🔍 Sticky Filter -->
     <div class="ol-filter-bar">
 
-      <!-- 🔹 TEK SATIR FLEX -->
+      <!-- 🔹 TEK SATIR FLEX -->
       <div class="ol-filter-row">
 
-        <!-- 🔍 Arama -->
+        <!-- 🔍 Arama -->
         <q-input
           class="ol-filter-input ol-search"
           dense
@@ -21,7 +21,7 @@
           </template>
         </q-input>
 
-        <!-- 🧾 Cari Kodu -->
+        <!-- 🧾 Cari Kodu -->
         <q-input
           class="ol-filter-input"
           dense
@@ -31,7 +31,7 @@
           clearable
         />
 
-        <!-- 📅 Sipariş Tarihi -->
+        <!-- 📅 Sipariş Tarihi -->
         <q-input
           class="ol-filter-input"
           dense
@@ -41,10 +41,11 @@
           type="date"
         />
 
-        <!-- 🔘 Butonlar -->
+        <!-- 🔘 Butonlar -->
         <div class="ol-filter-actions">
 
           <q-btn
+            v-if="canReadOrder"
             label="Temizle"
             icon="clear"
             color="grey-7"
@@ -58,6 +59,7 @@
           </q-btn>
 
           <q-btn
+            v-if="canReadOrder"
             label="Yenile"
             color="primary"
             icon="refresh"
@@ -66,6 +68,7 @@
           />
 
           <q-btn
+            v-if="canExportOrder"
             label="Excel'e Aktar"
             icon="download"
             color="primary"
@@ -77,7 +80,7 @@
         </div>
 
 
-        <!-- 💰 Toplam -->
+        <!-- 💰 Toplam -->
         <div class="ol-filter-total">
           Toplam Görünen Sipariş Tutarı (USD):
           <strong>
@@ -91,7 +94,7 @@
     </div>
 
 
-    <!-- 📋 ORDER LIST TABLE -->
+    <!-- 📋 ORDER LIST TABLE -->
     <q-table
       title="Mevcut Siparişler"
       class="ol-table"
@@ -103,16 +106,18 @@
       :rows="store.filteredOrders"
       :columns="columns"
       :loading="store.loading"
+      :table-style="tableStyle"
       no-data-label="Sipariş bulunamadı"
       :rows-per-page-options="[0]"
       hide-bottom
     >
 
-      <!-- 📄 PDF + DURUM -->
+      <!-- 📄 PDF + DURUM -->
       <template #body-cell-IsCreditableConfirmed="props">
         <q-td :props="props" class="text-center q-gutter-sm">
 
           <q-btn
+            v-if="canExportOrder"
             icon="picture_as_pdf"
             color="red"
             flat
@@ -136,7 +141,7 @@
         </q-td>
       </template>
 
-      <!-- 📅 Tarih -->
+      <!-- 📅 Tarih -->
       <template #body-cell-OrderDate="props">
         <q-td :props="props" class="text-center">
           {{ formatDate(props.row.OrderDate) }}
@@ -149,7 +154,7 @@
         </q-td>
       </template>
 
-      <!-- 🧾 Cari Adı — 2 Satır -->
+      <!-- 🧾 Cari Adı — 2 Satır -->
       <template #body-cell-CurrAccDescription="props">
         <q-td :props="props" class="ol-col-cari ol-col-multiline">
           {{ props.value }}
@@ -159,7 +164,7 @@
         </q-td>
       </template>
 
-      <!-- 📝 Açıklama — 5 Satır -->
+      <!-- 📝 Açıklama — 5 Satır -->
       <template #body-cell-Description="props">
         <q-td :props="props" class="ol-col-desc ol-col-multiline">
           {{ props.value }}
@@ -169,10 +174,11 @@
         </q-td>
       </template>
 
-      <!-- 🔗 Aç -->
+      <!-- 🔗 aç -->
       <template #body-cell-select="props">
         <q-td :props="props" class="text-center">
           <q-btn
+            v-if="canUpdateOrder"
             icon="open_in_new"
             color="primary"
             flat
@@ -180,7 +186,7 @@
             dense
             @click="selectOrder(props.row)"
           >
-            <q-tooltip>Siparişi Aç</q-tooltip>
+            <q-tooltip>Siparişi aç</q-tooltip>
           </q-btn>
         </q-td>
       </template>
@@ -193,10 +199,16 @@
     </q-banner>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
-import { onMounted, watch } from 'vue'
+import { computed, onMounted, watch } from 'vue'
 import { useRouter } from 'vue-router'
 import { useQuasar } from 'quasar'
 
@@ -204,11 +216,12 @@ import { useOrderListStore } from 'src/stores/OrdernewListStore'
 import { useAuthStore } from 'src/stores/authStore'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
+const { canRead, canWrite, canUpdate, canExport } = usePermission()
 
 const canReadOrder   = canRead('order')
 const canWriteOrder  = canWrite('order')
 const canUpdateOrder = canUpdate('order')
+const canExportOrder = canExport('order')
 
 /* =========================
    INIT
@@ -217,9 +230,13 @@ const canUpdateOrder = canUpdate('order')
 const router = useRouter()
 const $q = useQuasar()
 
-// ⚠️ ÖNCE store tanımlanır
+// ⚠️ ÖNCE store tanımlanır
 const store = useOrderListStore()
 
+const tableStyle = computed(() => ({
+  minWidth: $q.screen.lt.lg ? '1280px' : '100%'
+}))
+
 /* =========================
    SEARCH DEBOUNCE
 ========================= */
@@ -241,14 +258,15 @@ watch(
    HELPERS
 ========================= */
 function exportExcel () {
+  if (!canExportOrder.value) {
+    $q.notify({ type: 'negative', message: 'Excel export yetkiniz yok', position: 'top-right' })
+    return
+  }
+
   const auth = useAuthStore()
 
   if (!auth?.token) {
-    $q.notify({
-      type: 'negative',
-      message: 'Oturum bulunamadı',
-      position: 'top-right'
-    })
+    $q.notify({ type: 'negative', message: 'Oturum bulunamadı', position: 'top-right' })
     return
   }
 
@@ -261,19 +279,43 @@ function exportExcel () {
   const url = `http://localhost:8080/api/orders/export?${params.toString()}`
 
   fetch(url, {
-    headers: {
-      Authorization: `Bearer ${auth.token}`
-    }
+    method: 'GET',
+    headers: { Authorization: `Bearer ${auth.token}` }
   })
-    .then(res => res.blob())
+    .then(async res => {
+      // ✅ 200 değilse EXCEL İNDİRME
+      if (!res.ok) {
+        const text = await res.text()
+        throw new Error(`HTTP ${res.status} - ${text}`)
+      }
+
+      // ✅ Content-Type kontrol (debug için)
+      const ct = res.headers.get('content-type') || ''
+      if (!ct.includes('spreadsheetml.sheet')) {
+        const text = await res.text()
+        throw new Error(`Beklenmeyen Content-Type: ${ct} | Body: ${text}`)
+      }
+
+      return res.blob()
+    })
     .then(blob => {
       const link = document.createElement('a')
       link.href = URL.createObjectURL(blob)
       link.download = 'siparis_listesi.xlsx'
       link.click()
     })
+    .catch(err => {
+      $q.notify({
+        type: 'negative',
+        message: 'Excel export hatası: ' + (err?.message || err),
+        position: 'top-right',
+        timeout: 8000
+      })
+      console.error(err)
+    })
 }
 
+
 function formatDate (s) {
   if (!s) return ''
   const [y, m, d] = s.split('-')
@@ -285,12 +327,18 @@ function formatDate (s) {
 ========================= */
 
 const columns = [
-  { name: 'select', label: '', field: 'select', align: 'center', sortable: false },
-
-  { name: 'OrderNumber', label: 'Sipariş No', field: 'OrderNumber', align: 'left', sortable: true },
-  { name: 'OrderDate', label: 'Tarih', field: 'OrderDate', align: 'center', sortable: true },
-
-  { name: 'CurrAccCode', label: 'Cari Kod', field: 'CurrAccCode', align: 'left', sortable: true },
+  {
+    name: 'select',
+    label: '',
+    field: 'select',
+    align: 'center',
+    sortable: false,
+    style: 'width:42px; min-width:42px; max-width:42px; padding:2px 4px;',
+    headerStyle: 'width:42px; min-width:42px; max-width:42px; padding:2px 4px;'
+  },
+  { name: 'OrderNumber', label: 'Sipariş No', field: 'OrderNumber', align: 'left', sortable: true, style: 'width:108px; min-width:108px;', headerStyle: 'width:108px; min-width:108px;' },
+  { name: 'OrderDate', label: 'Tarih', field: 'OrderDate', align: 'center', sortable: true, style: 'width:78px; min-width:78px;', headerStyle: 'width:78px; min-width:78px;' },
+  { name: 'CurrAccCode', label: 'Cari Kod', field: 'CurrAccCode', align: 'left', sortable: true, style: 'width:78px; min-width:78px;', headerStyle: 'width:78px; min-width:78px;' },
 
   {
     name: 'CurrAccDescription',
@@ -300,14 +348,13 @@ const columns = [
     sortable: true,
     classes: 'ol-col-cari',
     headerClasses: 'ol-col-cari',
-    style: 'max-width:200px'
+    style: 'width:130px; min-width:130px; max-width:130px;',
+    headerStyle: 'width:130px; min-width:130px; max-width:130px;'
   },
-
-  { name: 'MusteriTemsilcisi', label: 'Temsilci', field: 'MusteriTemsilcisi', align: 'left', sortable: true },
-  { name: 'Piyasa', label: 'Piyasa', field: 'Piyasa', align: 'left', sortable: true },
-
-  { name: 'CreditableConfirmedDate', label: 'Onay', field: 'CreditableConfirmedDate', align: 'center', sortable: true },
-  { name: 'DocCurrencyCode', label: 'PB', field: 'DocCurrencyCode', align: 'center', sortable: true },
+  { name: 'MusteriTemsilcisi', label: 'Temsilci', field: 'MusteriTemsilcisi', align: 'left', sortable: true, style: 'width:78px; min-width:78px;', headerStyle: 'width:78px; min-width:78px;' },
+  { name: 'Piyasa', label: 'Piyasa', field: 'Piyasa', align: 'left', sortable: true, style: 'width:74px; min-width:74px;', headerStyle: 'width:74px; min-width:74px;' },
+  { name: 'CreditableConfirmedDate', label: 'Onay', field: 'CreditableConfirmedDate', align: 'center', sortable: true, style: 'width:82px; min-width:82px;', headerStyle: 'width:82px; min-width:82px;' },
+  { name: 'DocCurrencyCode', label: 'PB', field: 'DocCurrencyCode', align: 'center', sortable: true, style: 'width:46px; min-width:46px;', headerStyle: 'width:46px; min-width:46px;' },
 
   {
     name: 'TotalAmount',
@@ -315,6 +362,8 @@ const columns = [
     field: 'TotalAmount',
     align: 'right',
     sortable: true,
+    style: 'width:94px; min-width:94px;',
+    headerStyle: 'width:94px; min-width:94px;',
     format: (val, row) =>
       Number(val || 0).toLocaleString('tr-TR', { minimumFractionDigits: 2 }) +
       ' ' + row.DocCurrencyCode
@@ -326,11 +375,49 @@ const columns = [
     field: 'TotalAmountUSD',
     align: 'right',
     sortable: true,
+    style: 'width:96px; min-width:96px;',
+    headerStyle: 'width:96px; min-width:96px;',
     format: val =>
       Number(val || 0).toLocaleString('tr-TR', { minimumFractionDigits: 2 }) + ' USD'
   },
 
-  { name: 'IsCreditableConfirmed', label: 'Durum', field: 'IsCreditableConfirmed', align: 'center', sortable: true },
+  {
+    name: 'PackedAmount',
+    label: 'Paket Tutar',
+    field: 'PackedAmount',
+    align: 'right',
+    sortable: true,
+    style: 'width:98px; min-width:98px;',
+    headerStyle: 'width:98px; min-width:98px;',
+    format: (val, row) =>
+      Number(val || 0).toLocaleString('tr-TR', { minimumFractionDigits: 2 }) +
+      ' ' + (row.DocCurrencyCode || '')
+  },
+
+  {
+    name: 'PackedUSD',
+    label: 'Paket USD',
+    field: 'PackedUSD',
+    align: 'right',
+    sortable: true,
+    style: 'width:96px; min-width:96px;',
+    headerStyle: 'width:96px; min-width:96px;',
+    format: val =>
+      Number(val || 0).toLocaleString('tr-TR', { minimumFractionDigits: 2 }) + ' USD'
+  },
+
+  {
+    name: 'PackedRatePct',
+    label: 'Paket %',
+    field: 'PackedRatePct',
+    align: 'right',
+    sortable: true,
+    style: 'width:72px; min-width:72px;',
+    headerStyle: 'width:72px; min-width:72px;',
+    format: val =>
+      Number(val || 0).toLocaleString('tr-TR', { minimumFractionDigits: 2 }) + ' %'
+  },
+  { name: 'IsCreditableConfirmed', label: 'Durum', field: 'IsCreditableConfirmed', align: 'center', sortable: true, style: 'width:66px; min-width:66px;', headerStyle: 'width:66px; min-width:66px;' },
 
   {
     name: 'Description',
@@ -340,10 +427,10 @@ const columns = [
     sortable: false,
     classes: 'ol-col-desc',
     headerClasses: 'ol-col-desc',
-    style: 'max-width:220px'
+    style: 'width:130px; min-width:130px; max-width:130px;',
+    headerStyle: 'width:130px; min-width:130px; max-width:130px;'
   },
-
-  { name: 'pdf', label: 'PDF', field: 'pdf', align: 'center', sortable: false }
+  { name: 'pdf', label: 'PDF', field: 'pdf', align: 'center', sortable: false, style: 'width:44px; min-width:44px;', headerStyle: 'width:44px; min-width:44px;' }
 ]
 
 /* =========================
@@ -351,6 +438,11 @@ const columns = [
 ========================= */
 
 function selectOrder (row) {
+  if (!canUpdateOrder.value) {
+    $q.notify({ type: 'negative', message: 'Siparis guncelleme yetkiniz yok' })
+    return
+  }
+
   if (!row?.OrderHeaderID) {
     $q.notify({ type: 'warning', message: 'OrderHeaderID bulunamadı' })
     return
@@ -364,6 +456,11 @@ function selectOrder (row) {
 }
 
 async function printPDF (row) {
+  if (!canExportOrder.value) {
+    $q.notify({ type: 'negative', message: 'PDF export yetkiniz yok' })
+    return
+  }
+
   if (!row?.OrderHeaderID) return
 
   const token = useAuthStore().token
@@ -402,7 +499,48 @@ function clearFilters () {
 ========================= */
 
 onMounted(() => {
-  store.fetchOrders()
+  if (canReadOrder.value) {
+    store.fetchOrders()
+  }
 })
 </script>
 
+
+<style scoped>
+.ol-page {
+  padding: 8px;
+}
+
+.ol-table :deep(.q-table thead th) {
+  font-size: 11px;
+  line-height: 1.1;
+  font-weight: 700;
+  padding: 3px 6px;
+  white-space: nowrap;
+}
+
+.ol-table :deep(.q-table tbody td) {
+  font-size: 11px;
+  line-height: 1.15;
+  padding: 2px 6px;
+  white-space: nowrap;
+}
+
+.ol-col-multiline {
+  white-space: normal !important;
+  word-break: break-word;
+  line-height: 1.1;
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+@media (max-width: 1600px) {
+  .ol-table :deep(.q-table thead th),
+  .ol-table :deep(.q-table tbody td) {
+    font-size: 10px;
+    padding: 2px 4px;
+  }
+}
+</style>

ui/src/pages/OrderPdf.vue

@@ -1 +1,122 @@
-<template></template>
+<template>
+  <q-page
+    v-if="canExportOrder"
+    class="q-pa-md"
+  >
+    <q-card flat bordered class="q-pa-md" style="max-width: 720px">
+      <q-card-section>
+        <div class="text-h6">Order PDF</div>
+        <div class="text-caption text-grey-7">Order ID: {{ orderId || '-' }}</div>
+      </q-card-section>
+
+      <q-card-actions align="right" class="q-gutter-sm">
+        <q-btn
+          v-if="canOpenPdf"
+          color="primary"
+          icon="picture_as_pdf"
+          label="PDF Ac"
+          :loading="loading"
+          :disable="loading || !orderId"
+          @click="openPdf"
+        />
+
+        <q-btn
+          v-if="canEditOrder"
+          flat
+          color="secondary"
+          label="Siparise Don"
+          :disable="!orderId"
+          @click="goToOrder"
+        />
+      </q-card-actions>
+    </q-card>
+  </q-page>
+
+  <q-page
+    v-else
+    class="q-pa-md flex flex-center"
+  >
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
+</template>
+
+<script setup>
+import { computed, ref } from 'vue'
+import { useQuasar } from 'quasar'
+import { useRoute, useRouter } from 'vue-router'
+import { usePermission } from 'src/composables/usePermission'
+import { useOrderEntryStore } from 'src/stores/orderentryStore'
+
+const { canWrite, canUpdate, canExport } = usePermission()
+
+const canExportOrder = canExport('order')
+const canWriteOrder = canWrite('order')
+const canUpdateOrder = canUpdate('order')
+
+const canEditOrder = computed(() => canWriteOrder.value || canUpdateOrder.value)
+const canOpenPdf = computed(() => canExportOrder.value)
+
+const $q = useQuasar()
+const route = useRoute()
+const router = useRouter()
+const orderStore = useOrderEntryStore()
+
+const loading = ref(false)
+const orderId = computed(() => String(route.params.id || '').trim())
+
+async function openPdf () {
+  if (!canOpenPdf.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'Siparis PDF export yetkiniz yok'
+    })
+    return
+  }
+
+  if (!orderId.value) {
+    $q.notify({
+      type: 'warning',
+      message: 'Order ID bulunamadi'
+    })
+    return
+  }
+
+  loading.value = true
+  try {
+    await orderStore.downloadOrderPdf(orderId.value)
+  } catch (err) {
+    $q.notify({
+      type: 'negative',
+      message: err?.message || 'PDF acilamadi'
+    })
+  } finally {
+    loading.value = false
+  }
+}
+
+function goToOrder () {
+  if (!canEditOrder.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'Siparis duzenleme yetkiniz yok'
+    })
+    return
+  }
+
+  if (!orderId.value) {
+    $q.notify({
+      type: 'warning',
+      message: 'Order ID bulunamadi'
+    })
+    return
+  }
+
+  const routeName = canUpdateOrder.value ? 'order-edit' : 'order-entry'
+  router.push({
+    name: routeName,
+    params: { orderHeaderID: orderId.value }
+  })
+}
+</script>

ui/src/pages/PermissionMatrix.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page padding>
+  <q-page v-if="canReadSystem" padding>
 
     <div class="text-h6 q-mb-md">
       Rol + Departman Yetkilendirme
@@ -76,6 +76,7 @@
     <div class="q-mt-md">
 
       <q-btn
+        v-if="canUpdateUser"
         color="primary"
         icon="save"
         label="Kaydet"
@@ -86,6 +87,12 @@
     </div>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 
@@ -96,11 +103,9 @@ import { Notify } from 'quasar'
 import api from 'src/services/api'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canUpdate } = usePermission()
+const canReadSystem = canRead('system')
+const canUpdateUser = canUpdate('user')
 
 
 /* ================= STATE ================= */

ui/src/pages/ProductionWorker.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page class="workorder-page with-bg">
+  <q-page v-if="canReadOrder" class="workorder-page with-bg">
 
     <!-- ===============================
          🔹 ÜST: İŞ EMRİ BİLGİLERİ
@@ -75,7 +75,7 @@
             </div>
 
             <q-btn
-              v-if="isCreateMode"
+              v-if="isCreateMode && canWriteOrder"
               label="Ana Görsel Seç"
               icon="image"
               class="q-mt-sm"
@@ -113,7 +113,7 @@
               </q-card>
             </div>
 
-            <div v-if="isCreateMode" class="col-12">
+            <div v-if="isCreateMode && canWriteOrder" class="col-12">
               <q-btn
                 label="Detay Görsel Ekle"
                 icon="add"
@@ -143,7 +143,7 @@
             </div>
 
             <q-btn
-              v-if="isCreateMode"
+              v-if="isCreateMode && canWriteOrder"
               label="Talimat Görseli Ekle"
               icon="add"
               flat
@@ -161,7 +161,7 @@
     =============================== -->
     <div class="row justify-end q-mt-md">
       <q-btn
-        v-if="isCreateMode"
+        v-if="isCreateMode && canWriteOrder"
         label="Kaydet"
         color="positive"
         icon="save"
@@ -169,7 +169,7 @@
       />
 
       <q-btn
-        v-if="isViewMode"
+        v-if="isViewMode && canExportOrder"
         label="PDF"
         color="primary"
         icon="picture_as_pdf"
@@ -178,17 +178,23 @@
     </div>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 <script setup>
 import { computed, ref } from 'vue'
 import { useRoute } from 'vue-router'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
+const { canRead, canWrite, canExport } = usePermission()
 
 const canReadOrder   = canRead('order')
 const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const canExportOrder = canExport('order')
 
 const route = useRoute()
 
@@ -209,11 +215,15 @@ const detailImages = ref([])
 const instructionImages = ref([])
 
 function openImagePicker(type) {
+  if (!canWriteOrder.value) return
+
   // Şimdilik stub
   console.log('Image picker:', type)
 }
 
 function saveWorkOrder() {
+  if (!canWriteOrder.value) return
+
   console.log('SAVE', {
     form: form.value,
     mainImage: mainImage.value,

ui/src/pages/ProductionWorkerGateway.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page class="q-pa-md">
+  <q-page v-if="canReadOrder" class="q-pa-md">
 
     <!-- =====================================================
          🔹 BAŞLIK + AKSİYONLAR
@@ -10,6 +10,7 @@
       </div>
 
       <q-btn
+        v-if="canWriteOrder"
         color="primary"
         icon="add"
         label="Yeni İş Emri"
@@ -83,6 +84,12 @@
     </q-table>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -90,11 +97,10 @@ import { ref, computed } from 'vue'
 import { useRouter } from 'vue-router'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
+const { canRead, canWrite } = usePermission()
 
 const canReadOrder   = canRead('order')
 const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
 
 const router = useRouter()
 
@@ -192,10 +198,12 @@ const filteredRows = computed(() => {
 // 🔹 AKSİYONLAR
 // =====================================================
 function goNew () {
+  if (!canWriteOrder.value) return
   router.push('/app/production-work-orders/new')
 }
 
 function goView (evt, row) {
+  if (!canReadOrder.value) return
   router.push(`/app/production-work-orders/view/${row.id}`)
 }
 

ui/src/pages/ResetPassword.vue

@@ -125,13 +125,6 @@ import { useQuasar } from 'quasar'
 
 import api, { post } from 'src/services/api'
 import { useAuthStore } from 'stores/authStore.js'
-import { usePermission } from 'src/composables/usePermission'
-
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
 
 /* -------------------------------------------------- */
 /* INIT */
@@ -261,4 +254,3 @@ async function submit () {
   }
 }
 </script>
-

ui/src/pages/RoleDepartmentPermissionPage.vue

@@ -1,5 +1,5 @@
 <template>
-  <div v-if="!lookupsLoaded" class="q-pa-xl flex flex-center">
+  <div v-if="canUpdateUser && !lookupsLoaded" class="q-pa-xl flex flex-center">
 
     <q-spinner
       color="primary"
@@ -8,7 +8,7 @@
 
   </div>
 
-  <q-page class="permissions-page">
+  <q-page v-if="canUpdateUser" class="permissions-page">
 
     <!-- ================= STICKY STACK ================= -->
     <div class="sticky-stack">
@@ -69,6 +69,7 @@
         </div>
 
         <q-btn
+          v-if="canUpdateUser"
           color="primary"
           icon="save"
           label="Kaydet"
@@ -165,6 +166,12 @@
     </div>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 
@@ -175,11 +182,8 @@ import { Notify } from 'quasar'
 import api from 'src/services/api'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canUpdate } = usePermission()
+const canUpdateUser = canUpdate('user')
 
 
 /* ================= STATE ================= */
@@ -432,4 +436,3 @@ watch(deptCode, v => console.log('DEPT >>>', v))
 
 
 
-

ui/src/pages/StatementHeaderReport.vue

@@ -1,10 +1,11 @@
 <!-- src/pages/StatementHeaderReport.vue -->
 <template>
-  <q-page class="q-pa-md page-col">
+  <q-page v-if="canReadFinance" class="q-pa-md page-col">
     <!-- Başlık ve PDF butonu -->
     <div class="row justify-between items-center q-mb-md">
       <div class="text-h6">📄 Cari Hesap Raporu</div>
       <q-btn
+        v-if="canExportFinance"
         color="red"
         icon="picture_as_pdf"
         label="PDF Yazdır"
@@ -44,6 +45,12 @@
       </div>
     </q-card>
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -53,11 +60,9 @@ import { useDownloadstHeadStore } from 'src/stores/downloadstHeadStore'
 import dayjs from 'dayjs'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canExport } = usePermission()
+const canReadFinance = canRead('finance')
+const canExportFinance = canExport('finance')
 
 const $q = useQuasar()
 const downloadstHeadStore = useDownloadstHeadStore()
@@ -76,6 +81,15 @@ const selectedMonType = ref(monetaryTypeOptions[0].value)
 
 // indirme butonu
 async function handlestHeadDownload() {
+  if (!canExportFinance.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'PDF export yetkiniz yok',
+      position: 'top-right'
+    })
+    return
+  }
+
   console.log("▶️ [DEBUG] handlestHeadDownload:", accountCode.value, startDate.value, endDate.value, selectedMonType.value)
 
   if (!accountCode.value || !startDate.value || !endDate.value) {

ui/src/pages/StatementReport.vue

@@ -1,5 +1,5 @@
   <template>
-  <q-page class="q-pa-md page-col">
+  <q-page v-if="canReadFinance" class="q-pa-md page-col">
 
     <!-- 🔹 Cari Kod / İsim (sabit) -->
     <div class="filter-sticky">
@@ -135,6 +135,7 @@
 
           <!-- ✅ PDF Yazdır Dropdown -->
           <q-btn-dropdown
+            v-if="canExportFinance"
             flat
             color="red"
             icon="picture_as_pdf"
@@ -258,6 +259,12 @@
       </q-table>
     </div>
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -270,11 +277,9 @@ import { useDownloadstpdfStore } from 'src/stores/downloadstpdfStore'
 import dayjs from 'dayjs'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canExport } = usePermission()
+const canReadFinance = canRead('finance')
+const canExportFinance = canExport('finance')
 
 const $q = useQuasar()
 
@@ -436,6 +441,15 @@ function toggleLeftCols() {
 
 /* 🔹 PDF İndirme Butonuna bağla */
 async function handleDownload() {
+  if (!canExportFinance.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'PDF export yetkiniz yok',
+      position: 'top-right'
+    })
+    return
+  }
+
   console.log("▶️ [DEBUG] handleDownload:", selectedCari.value, dateFrom.value, dateTo.value)
 
   if (!selectedCari.value || !dateFrom.value || !dateTo.value) {
@@ -468,6 +482,15 @@ import { useDownloadstHeadStore } from 'src/stores/downloadstHeadStore'
 const downloadstHeadStore = useDownloadstHeadStore()
 
 async function CurrheadDownload() {
+  if (!canExportFinance.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'PDF export yetkiniz yok',
+      position: 'top-right'
+    })
+    return
+  }
+
   console.log("▶️ [DEBUG] CurrheadDownload:", selectedCari.value, dateFrom.value, dateTo.value)
 
   if (!selectedCari.value || !dateFrom.value || !dateTo.value) {

ui/src/pages/TestMail.vue

@@ -1,6 +1,8 @@
 <template>
-  <q-page class="q-pa-md">
-
+  <q-page
+    v-if="canSendTestMail"
+    class="q-pa-md"
+  >
     <q-card flat bordered class="q-pa-md" style="max-width: 500px">
       <q-card-section>
         <div class="text-h6">SMTP Test Mail</div>
@@ -9,7 +11,7 @@
       <q-card-section>
         <q-input
           v-model="to"
-          label="Gönderilecek mail"
+          label="Gonderilecek mail"
           filled
           dense
         />
@@ -17,28 +19,36 @@
 
       <q-card-actions align="right">
         <q-btn
+          v-if="canSendTestMail"
           color="primary"
-          label="Test Mail Gönder"
+          label="Test Mail Gonder"
           :loading="store.loading"
+          :disable="!canSendTestMail"
           @click="send"
         />
       </q-card-actions>
     </q-card>
+  </q-page>
 
+  <q-page
+    v-else
+    class="q-pa-md flex flex-center"
+  >
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
   </q-page>
 </template>
 
 <script setup>
-import { ref } from 'vue'
+import { computed, ref } from 'vue'
 import { useQuasar } from 'quasar'
 import { useMailTestStore } from 'src/stores/mailTestStore'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canWrite } = usePermission()
+const canWriteUser = canWrite('user')
+const canSendTestMail = computed(() => canWriteUser.value)
 
 const $q = useQuasar()
 const store = useMailTestStore()
@@ -46,17 +56,25 @@ const store = useMailTestStore()
 const to = ref('mehmet.kececi@baggi.com.tr')
 
 async function send () {
+  if (!canSendTestMail.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'Test mail gonderme yetkiniz yok'
+    })
+    return
+  }
+
   try {
     await store.sendTestMail(to.value)
 
     $q.notify({
       type: 'positive',
-      message: 'Test mail gönderildi'
+      message: 'Test mail gonderildi'
     })
   } catch (err) {
     $q.notify({
       type: 'negative',
-      message: err?.message || 'Mail gönderilemedi'
+      message: err?.message || 'Mail gonderilemedi'
     })
   }
 }

ui/src/pages/UserDetail.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page class="user-detail-page">
+  <q-page v-if="canAccessPage" class="user-detail-page">
 
     <!-- LOADING -->
     <q-inner-loading :showing="loading">
@@ -39,6 +39,7 @@
 
         <div>
           <q-btn
+            v-if="canSaveUser"
             :label="saveLabel"
             color="primary"
             icon="save"
@@ -46,6 +47,7 @@
             @click="onSave"
           />
           <q-btn
+            v-if="canReadUser"
             label="LİSTEYE DÖN"
             flat
             icon="arrow_back"
@@ -80,6 +82,7 @@
 
           <div class="row items-center">
             <q-btn
+              v-if="canUpdateUser"
               label="PAROLA MAİLİ GÖNDER"
               color="primary"
               icon="mail"
@@ -240,6 +243,12 @@
     </div>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -251,10 +260,9 @@ import { useUserDetailStore } from 'src/stores/UserDetailStore'
 import { usePermission } from 'src/composables/usePermission'
 
 const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const canReadUser = canRead('user')
+const canWriteUser = canWrite('user')
+const canUpdateUser = canUpdate('user')
 
 const $q = useQuasar()
 const route = useRoute()
@@ -280,6 +288,12 @@ const mode = computed(() => route.meta.mode || 'edit')
 const isNew = computed(() => mode.value === 'new')
 const isEdit = computed(() => mode.value === 'edit')
 const isView = computed(() => mode.value === 'view')
+const canAccessPage = computed(() => {
+  if (isNew.value) return canWriteUser.value
+  if (isEdit.value) return canUpdateUser.value
+  return canReadUser.value
+})
+const canSaveUser = computed(() => isNew.value ? canWriteUser.value : canUpdateUser.value)
 
 const userId = computed(() => (isEdit.value || isView.value) ? Number(route.params.id) : null)
 
@@ -306,6 +320,8 @@ const canSendPasswordMail = computed(() => {
 watch(
   () => userId.value,
   async (id) => {
+    if (!canAccessPage.value) return
+
     await store.fetchLookups()
 
     if (!id) {
@@ -320,6 +336,11 @@ watch(
 
 /* ================= ACTIONS ================= */
 async function onSave () {
+  if (!canSaveUser.value) {
+    $q.notify({ type: 'negative', message: 'Kaydetme yetkiniz yok' })
+    return
+  }
+
   try {
     console.log('🟢 onSave() START', { mode: mode.value })
 

ui/src/pages/UserGateway.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page class="user-gateway-page flex flex-center">
+  <q-page v-if="canReadUser" class="user-gateway-page flex flex-center">
 
     <div class="gateway-container">
 
@@ -14,6 +14,7 @@
 
         <!-- ➕ YENİ KULLANICI -->
         <q-card
+          v-if="canWriteUser"
           class="gateway-card cursor-pointer"
           flat
           bordered
@@ -30,6 +31,7 @@
 
         <!-- 👥 MEVCUT KULLANICILAR -->
         <q-card
+          v-if="canReadUser"
           class="gateway-card cursor-pointer"
           flat
           bordered
@@ -49,21 +51,27 @@
     </div>
 
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
 import { useRouter } from 'vue-router'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canWrite } = usePermission()
+const canReadUser = canRead('user')
+const canWriteUser = canWrite('user')
 
 const router = useRouter()
 
 function goCreate () {
+  if (!canWriteUser.value) return
+
   router.push({
     path: '/app/users/new',
     query: { mode: 'new' }
@@ -72,6 +80,7 @@ function goCreate () {
 
 
 function goList () {
+  if (!canReadUser.value) return
   router.push({ name: 'user-list' })
 }
 </script>

ui/src/pages/UserList.vue

@@ -1,5 +1,8 @@
 <template>
-  <q-page class="ol-page with-bg">
+  <q-page
+    v-if="canReadUser"
+    class="ol-page with-bg"
+  >
 
     <!-- 🔍 Sticky Filter -->
     <div class="ol-filter-bar">
@@ -27,14 +30,17 @@
 
         <div class="ol-filter-actions">
           <q-btn
+            v-if="canReadUser"
             label="Yenile"
             icon="refresh"
             color="primary"
             :loading="store.loading"
+            :disable="!canReadUser"
             @click="store.fetchUsers"
           />
 
           <q-btn
+            v-if="canWriteUser"
             label="Yeni Kullanıcı"
             icon="person_add"
             color="primary"
@@ -68,6 +74,7 @@
       <template #body-cell-open="props">
         <q-td class="text-center">
           <q-btn
+            v-if="canReadUser"
             icon="open_in_new"
             color="primary"
             flat
@@ -149,6 +156,15 @@
     </q-banner>
 
   </q-page>
+
+  <q-page
+    v-else
+    class="q-pa-md flex flex-center"
+  >
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -159,9 +175,9 @@ import { usePermission } from 'src/composables/usePermission'
 
 const { canRead, canWrite, canUpdate } = usePermission()
 
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const canReadUser = canRead('user')
+const canWriteUser = canWrite('user')
+const canUpdateUser = canUpdate('user')
 
 const router = useRouter()
 const store = useUserListStore()
@@ -247,14 +263,17 @@ function splitNames(val) {
 }
 
 function openDetail(id) {
+  const routeName = canUpdateUser.value ? 'user-edit' : 'user-view'
   router.push({
-    path: `/app/users/edit/${id}`
+    name: routeName,
+    params: { id: String(id) }
   })
 }
 
 
 
 function goCreate() {
+  if (!canWriteUser.value) return
   router.push({ name: 'user-new' })
 }
 
@@ -268,5 +287,9 @@ function splitPiyasalar (val) {
 }
 
 
-onMounted(store.fetchUsers)
+onMounted(() => {
+  if (canReadUser.value) {
+    store.fetchUsers()
+  }
+})
 </script>

ui/src/pages/UserPermissionPage.vue

@@ -1,10 +1,10 @@
 <template>
 
-  <div v-if="!lookupsLoaded" class="q-pa-xl flex flex-center">
+  <div v-if="canUpdateUser && !lookupsLoaded" class="q-pa-xl flex flex-center">
     <q-spinner color="primary" size="48px" />
   </div>
 
-  <q-page class="permissions-page">
+  <q-page v-if="canUpdateUser" class="permissions-page">
 
     <div class="sticky-stack">
 
@@ -36,6 +36,7 @@
         </div>
 
         <q-btn
+          v-if="canUpdateUser"
           color="primary"
           icon="save"
           label="Kaydet"
@@ -115,6 +116,12 @@
 
   </q-page>
 
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
+
 </template>
 <script setup>
 
@@ -123,11 +130,8 @@ import { Notify } from 'quasar'
 import api from 'src/services/api'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canUpdate } = usePermission()
+const canUpdateUser = canUpdate('user')
 
 
 /* ================= STATE ================= */

ui/src/pages/UserSync.vue

@@ -1,13 +1,18 @@
 <template>
-  <q-page class="q-pa-md user-sync-page">
+  <q-page
+    v-if="canReadUser"
+    class="q-pa-md user-sync-page"
+  >
 
     <div class="row items-center justify-between q-mb-md">
       <div class="text-h6 text-primary">👤 Kullanıcı Yönetimi</div>
       <q-btn
+        v-if="canUpdateUser"
         color="primary"
         icon="sync"
         label="Sync Now"
         :loading="store.loading"
+        :disable="store.loading || !canUpdateUser"
         @click="store.syncNow"
       />
     </div>
@@ -46,18 +51,20 @@
             <template v-slot:body-cell-actions="props">
               <q-td :props="props">
                 <q-btn
+                  v-if="canUpdateUser"
                   dense flat icon="link"
                   color="primary"
                   size="sm"
                   @click="openMapDialog(props.row)"
-                  :disable="store.loading"
+                  :disable="store.loading || !canUpdateUser"
                 />
                 <q-btn
+                  v-if="canUpdateUser"
                   dense flat icon="link_off"
                   color="negative"
                   size="sm"
                   @click="store.unmap(props.row.id)"
-                  :disable="!props.row.mssql_username"
+                  :disable="store.loading || !props.row.mssql_username || !canUpdateUser"
                 />
               </q-td>
             </template>
@@ -97,6 +104,15 @@
       </div>
     </div>
   </q-page>
+
+  <q-page
+    v-else
+    class="q-pa-md flex flex-center"
+  >
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -105,11 +121,9 @@ import { useUserSyncStore } from 'src/stores/userSyncStore'
 import { Dialog } from 'quasar'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canUpdate } = usePermission()
+const canReadUser = canRead('user')
+const canUpdateUser = canUpdate('user')
 
 const store = useUserSyncStore()
 
@@ -142,6 +156,10 @@ function statusColor(status) {
 }
 
 function openMapDialog(pgUser) {
+  if (!canUpdateUser.value) {
+    return
+  }
+
   Dialog.create({
     title: 'Kullanıcı Eşleme',
     message: 'Bu PostgreSQL kullanıcısını hangi MSSQL kullanıcısına bağlamak istiyorsunuz?',
@@ -158,7 +176,9 @@ function openMapDialog(pgUser) {
 }
 
 onMounted(() => {
-  store.loadDummy()
+  if (canReadUser.value) {
+    store.loadDummy()
+  }
 })
 </script>
 

ui/src/pages/statementofaccount.vue

@@ -1,5 +1,5 @@
 <template>
-  <q-page class="q-pa-md page-col">
+  <q-page v-if="canReadFinance" class="q-pa-md page-col">
 
     <!-- 🔹 Cari Kod / İsim (sabit) -->
     <div class="filter-sticky">
@@ -135,6 +135,7 @@
 
           <!-- ✅ PDF Yazdır Dropdown -->
           <q-btn-dropdown
+            v-if="canExportFinance"
             flat
             color="red"
             icon="picture_as_pdf"
@@ -258,6 +259,12 @@
       </q-table>
     </div>
   </q-page>
+
+  <q-page v-else class="q-pa-md flex flex-center">
+    <div class="text-negative text-subtitle1">
+      Bu module erisim yetkiniz yok.
+    </div>
+  </q-page>
 </template>
 
 <script setup>
@@ -270,11 +277,9 @@ import { useDownloadstpdfStore } from 'src/stores/downloadstpdfStore'
 import dayjs from 'dayjs'
 import { usePermission } from 'src/composables/usePermission'
 
-const { canRead, canWrite, canUpdate } = usePermission()
-
-const canReadOrder   = canRead('order')
-const canWriteOrder  = canWrite('order')
-const canUpdateOrder = canUpdate('order')
+const { canRead, canExport } = usePermission()
+const canReadFinance = canRead('finance')
+const canExportFinance = canExport('finance')
 
 const $q = useQuasar()
 
@@ -458,6 +463,15 @@ function toggleLeftCols() {
 
 /* 🔹 PDF İndirme Butonuna bağla */
 async function handleDownload() {
+  if (!canExportFinance.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'PDF export yetkiniz yok',
+      position: 'top-right'
+    })
+    return
+  }
+
   console.log("▶️ [DEBUG] handleDownload:", selectedCari.value, dateFrom.value, dateTo.value)
 
   if (!selectedCari.value || !dateFrom.value || !dateTo.value) {
@@ -490,6 +504,15 @@ import { useDownloadstHeadStore } from 'src/stores/downloadstHeadStore'
 const downloadstHeadStore = useDownloadstHeadStore()
 
 async function CurrheadDownload() {
+  if (!canExportFinance.value) {
+    $q.notify({
+      type: 'negative',
+      message: 'PDF export yetkiniz yok',
+      position: 'top-right'
+    })
+    return
+  }
+
   console.log("▶️ [DEBUG] CurrheadDownload:", selectedCari.value, dateFrom.value, dateTo.value)
 
   if (!selectedCari.value || !dateFrom.value || !dateTo.value) {

ui/src/stores/orderentryStore.js

@@ -2557,6 +2557,52 @@ export const useOrderEntryStore = defineStore('orderentry', {
         // =======================================================
         this.debugOrderPayload?.(header, lines, 'PRE-VALIDATE')
 
+        // =======================================================
+        // 🧩 DUMMY CURRENCY PAYLOAD (model genişletmeden)
+        // - trOrderLineCurrency için gerekli alanları satıra basar
+        // - örnek satırdaki gibi: PriceVI/AmountVI = KDV dahil, Price/Amount = KDV hariç
+        // =======================================================
+        const r2 = (n) => Number((Number(n) || 0).toFixed(2))
+        const r4 = (n) => Number((Number(n) || 0).toFixed(4))
+
+        for (const ln of lines) {
+          const qty = Number(ln?.Qty1 || 0)
+          const unitBase = Number(ln?.Price || 0) // KDV hariç birim
+          const vatRate = Number(ln?.VatRate || 0)
+          const exRate = Number(ln?.PriceExchangeRate || header?.ExchangeRate || 1) || 1
+
+          const taxBase = r2(unitBase * qty)                    // Amount
+          const vat = r2((taxBase * vatRate) / 100)             // Vat
+          const net = r2(taxBase + vat)                         // AmountVI / NetAmount
+          const unitWithVat = qty > 0 ? r4(net / qty) : r4(unitBase * (1 + vatRate / 100))
+
+          const docCurrency = String(ln?.DocCurrencyCode || header?.DocCurrencyCode || 'TRY').trim() || 'TRY'
+
+          // Backend model alanları
+          ln.RelationCurrencyCode = docCurrency
+          ln.DocPrice = unitWithVat
+          ln.DocAmount = net
+          ln.LocalPrice = unitBase
+          ln.LocalAmount = taxBase
+          ln.LineDiscount = Number(ln?.LineDiscount || 0)
+          ln.TotalDiscount = Number(ln?.TotalDiscount || 0)
+          ln.TaxBase = taxBase
+          ln.Pct = Number(ln?.Pct || 0)
+          ln.VatAmount = vat
+          ln.VatDeducation = 0
+          ln.NetAmount = net
+
+          // SQL kolonu isimleriyle dummy alias (decoder ignore etse de payload'da görünür)
+          ln.CurrencyCode = docCurrency
+          ln.ExchangeRate = exRate
+          ln.PriceVI = unitWithVat
+          ln.AmountVI = net
+          ln.Amount = taxBase
+          ln.LDiscount1 = Number(ln?.LDiscount1 || 0)
+          ln.TDiscount1 = Number(ln?.TDiscount1 || 0)
+          ln.Vat = vat
+        }
+
         // =======================================================
         // 🧪 PRE-VALIDATE — prItemVariant ön kontrol
         //   - invalid varsa CREATE/UPDATE ÇALIŞMAZ
@@ -3337,4 +3383,3 @@ export const sharedOrderEntryRefs = {
 
 
 }
-