# WP6 — Permissions for the new approval actions

## Goal
Apply the hard-won lesson from the permissions feature: **a permission that exists must actually be enforced, and the button it gates must be the button it actually governs.**

## Scope
1. **Every new action gets its permission, and it is enforced.** The new `submit` endpoints and the engine approve/reject paths on: inventory adjustments, issues, receipts, GRN, delivery notes.
   - The generic engine approve/reject already runs on **`core.approval-logs.act`** (that's what the shared `approval-actions` component gates on) — verify, don't duplicate.
   - The per-document `submit` should ride the document's existing approve/manage permission (check each controller's `middleware()` — **the middleware is the source of truth for what a button calls; never derive the permission from the button's name**).
2. **Fix the wrong gate (in scope, approved):** the Opening Balance **approve** button is gated on `inventory.opening.create` — the *create* permission. Gate it on the correct one (check `OpeningBalanceController::middleware()`; if no approve permission exists, say so and recommend rather than inventing one).
3. **Verify zero dead gates:** every `*appCan` string added in WP2–WP5 must exist in `Modules/Core/database/seeders/RolePermissionSeeder.php`. Prove it with a `comm -23` of extracted-gates vs extracted-catalog → must be EMPTY.
   ⚠️ **Tooling trap (learned the hard way):** the naive BE-side regex `'[a-z0-9_]+\.[a-z0-9_.]+'` **excludes hyphens** and produces ~170 false positives (`core.unit-groups.create`). Include `-` in the character class.
4. **Renamed buttons keep their real permission.** Renaming "اعتماد"→"ترحيل" is a label change only — the permission behind it must stay the one the BE middleware actually requires.

## Acceptance criteria
- [ ] Every new action has a permission that the BE actually enforces.
- [ ] Zero dead gates (proven by the comm diff, with the hyphen-safe regex).
- [ ] Opening-balance approve no longer rides the create permission (or: a clear report of why it can't be fixed without inventing a permission).
- [ ] `ng build` green; BE tests green vs baseline.

## Flags
[FIN] — no (permission plumbing). Migration — no (seeder only, if a permission is added).

## Out of scope
Do not invent permissions that have no enforcement site. Do not re-do the previous permissions feature.