[scottcarlton]

Summary

• New mayCreateReturn() in create-return.ts: admin, owner, member and sales may create a return on either side; buyers stay pinned to their own account; guests are refused.
• initialReturnStatus() now takes the actor's role. Only an admin, owner or member of the issuing org creates a return already approved. Brand-org sales (BLSR) open it as requested for an approver.
• Gate applied to the /returns/new load (403) and action, the "New return" button on /returns, and resolveReturnEntry() (order menu item). The menu label follows the status the row would start at.
• Migration 20261030000001_returns_request_role_gate.sql:
  • Rep INSERT arm on return_authorizations now requires admin/owner/member/sales (it checked membership only).
  • Brand INSERT arm admits sales at requested.
  • return_lines INSERT names its initiators explicitly. Before, any guest who could read an open request could add lines to it.
• Permissions map updated (return table contract and a new /returns/new row).

Why

A guest in a rep org could log a return, and the order menu offered "Request return" to guests on delivered orders. Roles & Access makes guest read-only. Brand sales should be able to create returns but not approve them.

Verification

• bun run lint passes
• bun run check passes (0 errors)
• bun run test:run passes (2101)
• bun run test:rls passes (522), with new cases for rep guest, brand guest, rep sales, and brand sales (requested allowed, approved refused, lines). The three guest cases were confirmed to fail against the old policies.
• Migration applied to local Supabase and policies inspected in pg_policies
• Browser check not done: the Chrome extension blocked localhost by policy

Test plan

• As a rep-org or brand-org guest: /returns shows the list without "New return"; /returns/new returns 403; a delivered order has no return item in its menu.
• As brand-org sales: create a return from a delivered order; it lands as Requested, and an admin can approve it.
• As brand admin: "Log return" still creates the return already approved.
• As rep sales: "Request return" still works.

Closes SCO-213

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
threadline	Ready	Preview	Oct 30, 2026 2:52pm UTC