Skip to main content

How to add a product field to the access rules

When adding a product form field, update the shared policy and its tests so the client and server continue to agree.

Steps​

  1. Classify the field: ordinary edit, catalog logistics, vendor post-stock lock, catalog-required, or name component.
  2. Update apps/web/utils/products/product-access.ts in the corresponding field set (DETAILS_FIELDS, VENDOR_LOCKED_FIELDS, or CATALOG_REQUIRED_FIELDS / NAME_FIELDS). Keep form field enumeration aligned where applicable.
  3. If it is a PATCH logistics key, also update apps/web/utils/products/logistics.ts so key presence invokes the server's requireLogisticsEdit guard and inaccessible DTOs omit it.
  4. Update DTO mapping/validation and server persistence only as required by the field's contract. Do not assume UI read-only state is authorization.
  5. Add or update unit tests for partner/vendor, catalog on/off, create/edit, and omitted versus explicit null/false cases.
  6. Update the relevant field access reference and permission reference.