uprawnienia do stacji i usuwanie firm

app/api.py

@@ -148,8 +148,11 @@ def create_fuel_entry():
     try:
         odo=int(d['odometer']); fueled_at=datetime.fromisoformat(d['fueled_at']); station_company=db.session.get(FuelStationCompany,int(d['station_company_id'])) if d.get('station_company_id') else None
         settings=vehicle.company or current_user.company or CompanySettings.query.first()
-        if station_company and settings.allowed_stations and station_company not in settings.allowed_stations:
+        access_mode=settings.station_access_mode or 'all_prefer_favorites'
+        if station_company and access_mode=='allowed_only' and station_company not in settings.allowed_stations:
             return fail('Ta stacja nie jest dozwolona przez politykę firmy',403)
+        if station_company and access_mode=='favorites_allowed_only' and station_company not in settings.allowed_stations and station_company not in settings.favorite_stations:
+            return fail('Ta stacja nie jest ulubiona ani dozwolona przez politykę firmy',403)
         wholesale=source=None; region=(station_company.selected_region if station_company else None) or settings.region
         try:
             p=fetch_orlen_price(d['fuel_type'],fueled_at.date(),region);wholesale=p['price_per_liter'];source=p['source']
@@ -391,7 +394,7 @@ def companies_list():
 def companies_create():
     d=payload()
     try:
-        c=CompanySettings(name=(d.get('name') or '').strip(),entity_type=d.get('entity_type','JDG'),vat_rate=Decimal(d.get('vat_rate') or 23),vat_deduction_percent=Decimal(d.get('vat_deduction_percent') or 50),region=(d.get('region') or 'mazowieckie').lower(),invoice_split_day=int(d.get('invoice_split_day') or 15),active=True)
+        c=CompanySettings(name=(d.get('name') or '').strip(),entity_type=d.get('entity_type','JDG'),vat_rate=Decimal(d.get('vat_rate') or 23),vat_deduction_percent=Decimal(d.get('vat_deduction_percent') or 50),region=(d.get('region') or 'mazowieckie').lower(),invoice_split_day=int(d.get('invoice_split_day') or 15),active=True,station_access_mode='all_prefer_favorites')
         if not c.name: raise ValueError('Nazwa firmy jest wymagana')
         db.session.add(c);db.session.commit();return response({'id':c.id,'redirect':url_for('main.admin_companies',company_id=c.id)},'Dodano firmę',201)
     except Exception as exc:db.session.rollback();return fail(str(exc))
@@ -445,6 +448,19 @@ def company_favorites(company_id):
     c.favorite_stations=FuelStationCompany.query.filter(FuelStationCompany.id.in_(ids),FuelStationCompany.active.is_(True)).all() if ids else []
     db.session.commit();socketio.emit('app_changed',{'resource':'company_favorites','company_id':c.id});return response(message='Zapisano ulubione stacje firmy')
 
+
+@api.put('/companies/<int:company_id>/station-access')
+@role_required('boss','admin')
+def company_station_access(company_id):
+    company=CompanySettings.query.get_or_404(company_id)
+    if current_user.role=='boss' and current_user.company_id!=company.id:return fail('Brak uprawnień',403)
+    d=payload();mode=(d.get('station_access_mode') or '').strip()
+    modes={'all_prefer_favorites','all','allowed_only','favorites_allowed_only'}
+    if mode not in modes:return fail('Nieprawidłowy tryb dostępu do stacji')
+    company.station_access_mode=mode
+    db.session.commit();socketio.emit('app_changed',{'resource':'station_access','company_id':company.id})
+    return response({'station_access_mode':mode},'Zapisano politykę dostępu do stacji')
+
 @api.put('/companies/<int:company_id>/allowed-stations')
 @role_required('boss','admin')
 def company_allowed_stations(company_id):