fix permissions

app/Http/Controllers/UserController.php

@@ -266,6 +266,8 @@ class UserController extends Controller
             return redirect()->route('login')->with(['danger' => 'Не удалось вернуться к исходному пользователю.']);
         }
 
+        abort_unless($impersonator->resolvedRoleSlug() === Role::ADMIN, 403);
+
         Auth::login($impersonator);
         $request->session()->forget('impersonator_id');
         $request->session()->regenerate();

app/Http/Middleware/EnsureRoutePermission.php

@@ -18,9 +18,7 @@ class EnsureRoutePermission
         $user = $request->user();
         $routeName = $request->route()?->getName();
 
-        $routePermission = $routeName === 'import.create' && $request->input('type') === 'catalog'
-            ? 'catalog.import'
-            : $this->accessService->routePermission($routeName);
+        $routePermission = $this->accessService->routePermission($routeName);
 
         if (!$user || !$routeName || !$routePermission) {
             return $next($request);

app/Http/Middleware/EnsureUserHasRole.php

@@ -26,9 +26,7 @@ class EnsureUserHasRole
         $user = $request->user();
 
         $routeName = $request->route()?->getName();
-        $hasRoutePermission = $user && $routeName === 'import.create' && $request->input('type') === 'catalog'
-            ? $this->accessService->can($user, 'catalog.import')
-            : ($user && $this->accessService->canAccessRoute($user, $routeName));
+        $hasRoutePermission = $user && $this->accessService->canAccessRoute($user, $routeName);
 
         if ($user?->hasRole($roles) || $hasRoutePermission) {
             return $next($request);

config/access_routes.php

@@ -83,7 +83,7 @@ return [
         'import.' => [
             'index' => 'import.view',
             'show' => 'import.view',
-            'create' => 'import.create',
+            'create' => ['import.create', 'catalog.import'],
         ],
         'maf_order.' => [
             'index' => 'maf_orders.view',
@@ -170,6 +170,11 @@ return [
             'generate-photos-before-pack' => 'reclamations.documents.generate',
             'generate-photos-after-pack' => 'reclamations.documents.generate',
         ],
+        'reclamation.' => [
+            'generate-reclamation-payment-pack' => 'reclamations.documents.generate',
+            'generate-photos-before-pack' => 'reclamations.documents.generate',
+            'generate-photos-after-pack' => 'reclamations.documents.generate',
+        ],
         'reports.' => [
             '*' => 'reports.view',
         ],

database/seeders/RbacSeeder.php

@@ -143,7 +143,6 @@ class RbacSeeder extends Seeder
             'reclamations.act.delete',
             'reclamations.spare_parts.manage',
             'catalog.view',
-            'catalog.import',
             'maf.view',
             'maf.update',
             'maf.passports.upload',

tests/Feature/UserControllerTest.php

@@ -251,4 +251,26 @@ class UserControllerTest extends TestCase
         $response->assertRedirect(route('home'));
         $response->assertSessionHas('impersonator_id', $this->adminUser->id);
     }
+
+    public function test_impersonated_session_can_leave_only_to_admin(): void
+    {
+        $targetUser = User::factory()->create(['role' => Role::MANAGER]);
+
+        $response = $this->actingAs($targetUser)
+            ->withSession(['impersonator_id' => $this->adminUser->id])
+            ->post(route('user.impersonate.leave'));
+
+        $response->assertRedirect(route('user.index'));
+    }
+
+    public function test_impersonated_session_cannot_leave_to_non_admin(): void
+    {
+        $targetUser = User::factory()->create(['role' => Role::BRIGADIER]);
+
+        $response = $this->actingAs($targetUser)
+            ->withSession(['impersonator_id' => $this->managerUser->id])
+            ->post(route('user.impersonate.leave'));
+
+        $response->assertForbidden();
+    }
 }

tests/Unit/Services/AccessServiceTest.php

@@ -46,6 +46,7 @@ class AccessServiceTest extends TestCase
 
         $this->assertTrue(app(AccessService::class)->can($manager, 'catalog.view'));
         $this->assertTrue(app(AccessService::class)->can($manager, 'catalog.fields.product_price.view'));
+        $this->assertFalse(app(AccessService::class)->can($manager, 'catalog.import'));
         $this->assertFalse(app(AccessService::class)->can($manager, 'catalog.update'));
     }