Enhance route permission checks across management and inventory modules

This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.

src/routes/finance/invoices.js

@@ -64,7 +64,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('invoice', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -74,11 +74,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listInvoicesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('invoice', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getInvoicePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('invoice', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchInvoicesRouteHandler(req, res, search);
 });

src/routes/finance/payments.js

@@ -55,7 +55,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPaymentsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('payment', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -65,11 +65,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPaymentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('payment', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPaymentPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('payment', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPaymentsRouteHandler(req, res, search);
 });

src/routes/finance/taxrecords.js

@@ -40,7 +40,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listTaxRecordsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('taxRecord', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -50,11 +50,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listTaxRecordsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('taxRecord', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getTaxRecordPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('taxRecord', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchTaxRecordsRouteHandler(req, res, search);
 });

src/routes/inventory/filamentstocks.js

@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilamentStocksRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filamentStock', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -60,11 +60,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentStocksByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filamentStock', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentStockPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filamentStock', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilamentStocksRouteHandler(req, res, search);
 });

src/routes/inventory/orderitems.js

@@ -64,7 +64,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('orderItem', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -74,11 +74,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listOrderItemsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('orderItem', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getOrderItemPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('orderItem', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchOrderItemsRouteHandler(req, res, search);
 });

src/routes/inventory/partstocks.js

@@ -42,7 +42,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPartStocksRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('partStock', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -52,11 +52,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPartStocksByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('partStock', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPartStockPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('partStock', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPartStocksRouteHandler(req, res, search);
 });

src/routes/inventory/productstocks.js

@@ -41,7 +41,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductStocksRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('productStock', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -51,11 +51,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductStocksByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('productStock', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductStockPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('productStock', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductStocksRouteHandler(req, res, search);
 });

src/routes/inventory/purchaseorders.js

@@ -68,7 +68,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPurchaseOrdersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('purchaseOrder', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -78,11 +78,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPurchaseOrdersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('purchaseOrder', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPurchaseOrderPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('purchaseOrder', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPurchaseOrdersRouteHandler(req, res, search);
 });

src/routes/inventory/shipments.js

@@ -69,7 +69,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('shipment', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -83,11 +83,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listShipmentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('shipment', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getShipmentPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('shipment', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchShipmentsRouteHandler(req, res, search);
 });

src/routes/inventory/stockaudits.js

@@ -51,7 +51,7 @@ router.post('/', isAuthenticated, checkPermissions('stockAudit', 'new'), async (
 });
 
 // get stock audit stats
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockAudit', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockAuditsRouteHandler(req, res, search);
 });

src/routes/inventory/stockevents.js

@@ -31,7 +31,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listStockEventsRouteHandler(req, res, page, limit, filter, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('stockEvent', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -41,11 +41,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listStockEventsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('stockEvent', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getStockEventPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockEvent', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockEventsRouteHandler(req, res, search);
 });

src/routes/inventory/stocklocations.js

@@ -30,7 +30,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listStockLocationsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('stockLocation', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -40,11 +40,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listStockLocationsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('stockLocation', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getStockLocationPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockLocation', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockLocationsRouteHandler(req, res, search);
 });

src/routes/inventory/stocktransfers.js

@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listStockTransfersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('stockTransfer', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listStockTransfersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('stockTransfer', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getStockTransferPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockTransfer', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockTransfersRouteHandler(req, res, search);
 });

src/routes/management/apppasswords.js

@@ -39,19 +39,19 @@ router.get('/', isAuthenticated, async (req, res) => {
   listAppPasswordsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('appPassword', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   const masterFilter = req.query.masterFilter ? JSON.parse(req.query.masterFilter) : {};
   listAppPasswordsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('appPassword', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getAppPasswordPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('appPassword', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchAppPasswordsRouteHandler(req, res, search);
 });

src/routes/management/auditlogs.js

@@ -1,5 +1,6 @@
 import express from 'express';
 import { isAuthenticated } from '../../keycloak.js';
+import { checkPermissions } from '../../database/permissions.js';
 import {
   listAuditLogsRouteHandler,
   getAuditLogRouteHandler,
@@ -35,7 +36,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('auditLog', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchAuditLogsRouteHandler(req, res, search);
 });

src/routes/management/courier.js

@@ -40,7 +40,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listCouriersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('courier', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -50,12 +50,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listCouriersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('courier', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getCourierPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('courier', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchCouriersRouteHandler(req, res, search);
 });

src/routes/management/courierservice.js

@@ -64,7 +64,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listCourierServicesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('courierService', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -74,12 +74,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listCourierServicesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('courierService', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getCourierServicePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('courierService', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchCourierServicesRouteHandler(req, res, search);
 });

src/routes/management/documentjobs.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentJobsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentJob', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentJobsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentJob', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentJobPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentJob', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentJobsRouteHandler(req, res, search);
 });

src/routes/management/documentprinters.js

@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentPrintersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentPrinter', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,12 +49,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentPrintersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentPrinter', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentPrinterPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentPrinter', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentPrintersRouteHandler(req, res, search);
 });

src/routes/management/documentsizes.js

@@ -30,7 +30,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentSizesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentSize', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -40,12 +40,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentSizesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentSize', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentSizePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentSize', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentSizesRouteHandler(req, res, search);
 });

src/routes/management/documenttemplates.js

@@ -54,7 +54,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentTemplatesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -64,12 +64,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentTemplatesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentTemplatePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentTemplatesRouteHandler(req, res, search);
 });

src/routes/management/filaments.js

@@ -60,7 +60,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilamentsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -70,12 +70,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilamentsRouteHandler(req, res, search);
 });

src/routes/management/filamentskus.js

@@ -49,7 +49,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilamentSkusRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filamentSku', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   let masterFilter = {};
@@ -59,11 +59,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentSkusByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filamentSku', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentSkuPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filamentSku', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilamentSkusRouteHandler(req, res, search);
 });

src/routes/management/files.js

@@ -42,7 +42,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('file', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -52,12 +52,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('file', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('file', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilesRouteHandler(req, res, search);
 });

src/routes/management/hosts.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listHostsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('host', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listHostsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('host', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getHostPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('host', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchHostsRouteHandler(req, res, search);
 });

src/routes/management/materials.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listMaterialsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('material', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listMaterialsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('material', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getMaterialPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('material', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchMaterialsRouteHandler(req, res, search);
 });

src/routes/management/notetypes.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listNoteTypesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('noteType', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,11 +48,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listNoteTypesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('noteType', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getNoteTypePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('noteType', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchNoteTypesRouteHandler(req, res, search);
 });

src/routes/management/parts.js

@@ -49,7 +49,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('part', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -59,12 +59,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPartsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('part', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPartPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('part', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPartsRouteHandler(req, res, search);
 });

src/routes/management/partskus.js

@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPartSkusRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('partSku', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   let masterFilter = {};
@@ -60,11 +60,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPartSkusByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('partSku', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPartSkuPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('partSku', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPartSkusRouteHandler(req, res, search);
 });

src/routes/management/permissionsetting.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('permissionSetting', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPermissionSettingsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('permissionSetting', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPermissionSettingsPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('permissionSetting', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPermissionSettingsRouteHandler(req, res, search);
 });

src/routes/management/productcategories.js

@@ -29,7 +29,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductCategoriesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('productCategory', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -39,12 +39,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductCategoriesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('productCategory', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductCategoryPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('productCategory', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductCategoriesRouteHandler(req, res, search);
 });

src/routes/management/products.js

@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('product', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -60,12 +60,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('product', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('product', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductsRouteHandler(req, res, search);
 });

src/routes/management/productskus.js

@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductSkusRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('productSku', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   let masterFilter = {};
@@ -60,11 +60,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductSkusByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('productSku', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductSkuPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('productSku', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductSkusRouteHandler(req, res, search);
 });

src/routes/management/taxrates.js

@@ -48,7 +48,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listTaxRatesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('taxRate', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -58,12 +58,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listTaxRatesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('taxRate', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getTaxRatePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('taxRate', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchTaxRatesRouteHandler(req, res, search);
 });

src/routes/management/usergroups.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('userGroup', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listUserGroupsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('userGroup', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getUserGroupPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('userGroup', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchUserGroupsRouteHandler(req, res, search);
 });

src/routes/management/users.js

@@ -40,7 +40,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listUsersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('user', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -50,11 +50,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listUsersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('user', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getUserPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('user', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchUsersRouteHandler(req, res, search);
 });

src/routes/management/vendors.js

@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listVendorsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('vendor', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listVendorsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('vendor', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getVendorPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('vendor', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchVendorsRouteHandler(req, res, search);
 });

src/routes/production/filamentprofiles.js

@@ -36,7 +36,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filamentProfile', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -46,12 +46,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentProfilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filamentProfile', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentProfilePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filamentProfile', 'list'), isAuthenticated, async (req, res) => {
   searchFilamentProfilesRouteHandler(req, res, req.query.search);
 });
 

src/routes/production/gcodefiles.js

@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listGCodeFilesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('gcodeFile', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listGCodeFilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('gcodeFile', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getGCodeFilePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('gcodeFile', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchGCodeFilesRouteHandler(req, res, search);
 });

src/routes/production/jobs.js

@@ -48,7 +48,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listJobsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('job', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -58,11 +58,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listJobsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('job', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getJobPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('job', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchJobsRouteHandler(req, res, search);
 });

src/routes/production/printerprofiles.js

@@ -35,7 +35,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPrinterProfilesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('printerProfile', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -45,12 +45,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPrinterProfilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('printerProfile', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPrinterProfilePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('printerProfile', 'list'), isAuthenticated, async (req, res) => {
   searchPrinterProfilesRouteHandler(req, res, req.query.search);
 });
 

src/routes/production/printers.js

@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPrintersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('printer', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPrintersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('printer', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPrinterPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('printer', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPrintersRouteHandler(req, res, search);
 });

src/routes/production/subjobs.js

@@ -46,7 +46,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listSubJobsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('subJob', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -56,11 +56,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listSubJobsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('subJob', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getSubJobPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('subJob', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchSubJobsRouteHandler(req, res, search);
 });

src/routes/sales/clients.js

@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listClientsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('client', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listClientsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('client', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getClientPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('client', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchClientsRouteHandler(req, res, search);
 });

src/routes/sales/listings.js

@@ -65,7 +65,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listListingsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('listing', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -75,11 +75,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listListingsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('listing', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getListingPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('listing', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchListingsRouteHandler(req, res, search);
 });

src/routes/sales/listingvarients.js

@@ -52,7 +52,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listListingVarientsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('listingVarient', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -62,11 +62,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listListingVarientsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('listingVarient', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getListingVarientPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('listingVarient', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchListingVarientsRouteHandler(req, res, search);
 });

src/routes/sales/marketplaces.js

@@ -54,7 +54,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listMarketplacesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('marketplace', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -64,11 +64,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listMarketplacesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('marketplace', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getMarketplacePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('marketplace', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchMarketplacesRouteHandler(req, res, search);
 });

src/routes/sales/salesorders.js

@@ -41,7 +41,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listSalesOrdersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -51,11 +51,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listSalesOrdersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getSalesOrderPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchSalesOrdersRouteHandler(req, res, search);
 });