From 9d529b82b244ea1964f4a9f4a28aee11db793130 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Fri, 11 Sep 2026 12:28:42 -0400
Subject: [PATCH] fix(central-ui): nest Flow Debugger inside the Deployment nav
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Flow Debugger link sat as a lone top-level item after the Deployment
section because its policy (RequireFlowDebugger: Deployer + Administrator +
Viewer) is wider than the section's RequireDeployment (Deployer only), so it
did not expand/collapse with the group. The section is now gated on
RequireFlowDebugger — a superset of RequireDeployment — with the three
Deployer-only pages gated per item inside it, so every Deployer sees the
same section as before and a Viewer/Administrator without Deployer gets a
Deployment section holding only Flow Debugger.

Claude-Session: https://claude.ai/code/session_01Y5ef34iUUMjmwnMpL9xgmB
---
 .../Components/Layout/NavMenu.razor           | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor b/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor
index 3e71e43a..88b0d264 100644
--- a/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor
+++ b/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor
@@ -40,23 +40,28 @@
             </Authorized>
         </AuthorizeView>
 
-        @* Deployment section — Deployer role *@
-        <AuthorizeView Policy="@AuthorizationPolicies.RequireDeployment">
+        @* Deployment section. The section is gated on RequireFlowDebugger,
+           which is a superset of RequireDeployment (Deployer + the
+           OperationalAudit roles), so every Deployer still sees it and a
+           Viewer/Administrator without Deployer gets a section holding only
+           Flow Debugger. The three Deployer-only pages are gated per item, so
+           Flow Debugger expands/collapses with the group instead of sitting
+           outside it as a lone top-level link. *@
+        <AuthorizeView Policy="@AuthorizationPolicies.RequireFlowDebugger">
             <Authorized Context="deploymentContext">
                 <NavRailSection Title="Deployment" Key="deployment">
-                    <NavRailItem Href="/deployment/topology" Text="Topology" />
-                    <NavRailItem Href="/deployment/deployments" Text="Deployments" />
-                    <NavRailItem Href="/deployment/debug-view" Text="Debug View" />
+                    <AuthorizeView Policy="@AuthorizationPolicies.RequireDeployment">
+                        <Authorized Context="deployerContext">
+                            <NavRailItem Href="/deployment/topology" Text="Topology" />
+                            <NavRailItem Href="/deployment/deployments" Text="Deployments" />
+                            <NavRailItem Href="/deployment/debug-view" Text="Debug View" />
+                        </Authorized>
+                    </AuthorizeView>
+                    <NavRailItem Href="/deployment/flow-debugger" Text="Flow Debugger" />
                 </NavRailSection>
             </Authorized>
         </AuthorizeView>
 
-        <AuthorizeView Policy="@AuthorizationPolicies.RequireFlowDebugger">
-            <Authorized Context="flowContext">
-                <NavRailItem Href="/deployment/flow-debugger" Text="Flow Debugger" />
-            </Authorized>
-        </AuthorizeView>
-
         @if (context.User.Claims.Any(c => c.Type == JwtTokenService.RoleClaimType && (c.Value == Roles.Administrator || c.Value == Roles.Designer || c.Value == Roles.Deployer)))
         {
             <NavRailSection Title="Notifications" Key="notifications">