OBJSIS v2.7.1

Release Notes — OBJSIS v2.7.1

Release Date: 2026-06-28

---

🆕 New Features

Role Permission Editor (admin/roles.php)

• Full CRUD page for managing roles
• Per-role page-access control — admins choose exactly which menu sections a role can open
• Granular permission tags + page-group checkboxes (Dashboard, Kitchen, Orders, Inventory, etc.)
• 4 new API endpoints in api/admin_actions.php:
  • add_role
  • edit_role
  • delete_role
  • update_role_permissions
• Admin role is locked from edits/delete; deleting a role warns and disassociates users first

---

🐛 Bug Fixes

Kitchen KDS — "Run Kitchen" Button Unresponsive

• Button was completely dead due to missing CSRF token in the updateStatus() AJAX payload
• PHP handler was reading undefined $new_status / $order_id variables, so SQL always failed
• Both issues fixed in admin/kitchen.php — "Run Kitchen" and "Done / Ready" now work reliably

Role Permissions Modal — Selection Did Nothing

• openPermModal() and savePermissions() parsed permission IDs from fragile onclick attribute strings which no longer existed after the button-CSS rewrite
• Rewrote JS to use reliable data-permid attributes embedded directly by PHP
• savePermissions() now correctly updates the card preview without full page reload

Duplicate Role Name Crash

• add_role handler would let the DB throw a PDO Integrity constraint violation (duplicate name key), which dumped raw HTML into the JSON response and broke every fetch().json() on the admin panel (including kitchen.php polling)
• Now returns a proper { success: false, message: ... } JSON error before attempting the INSERT

---

🔧 Changes

• Bumped version constant to 2.7.1 (config/version.php)
• Added employees.php to project architecture docs (it is referenced in sidebar but missing from tree)

---

📦 Files Changed

File	Change
admin/roles.php	New — Role management page
api/admin_actions.php	New — add_role, edit_role, delete_role, update_role_permissions
admin/kitchen.php	CSRF token added + PHP variable assignment fixed
config/version.php	2.6.1 → 2.7.1
README.md	Version badge, features table, roadmap, release notes updated

---

⬆️ Upgrading

1. Pull/replace the changed files above
2. No database migration required — roles, permissions, and role_permissions tables already exist from the base install
3. Users with the admin role in $_SESSION['user_role'] automatically gain access to the new page (reload session if needed)

---

⚠️ Notes

• This is still a beta version, so some bugs may still be present
• Expect instability in certain edge cases
• Feedback is highly appreciated during testing phase

🛣️ Roadmap

• Full release v3.0.0 planned for end of next month
• Focus on stability, security improvements, and UI polish