Updated the URL used to obtain the SPA session and hid the Manage Time icon for SALES_REP users

tests/manageTime.test.cjs

@@ -591,3 +591,19 @@ for (const family of ["chrome", "firefox"]) test(`${family}: resource response i
   assert.equal(calls[1].options.headers.Authorization, "Session");
   await restarted.dispatch({ ...message, emailAddress: "other@example.invalid" }); assert.equal(calls.length, 3);
 });
+
+
+test("restricted profile cannot display or open Manage Time even if session is ready", () => {
+  const source = fs.readFileSync("src/features/manage-time/view.js", "utf8");
+  const factory = vm.runInNewContext(source + "\ncreateManageTime");
+  const element = () => ({ setAttribute() {}, append() {}, addEventListener() {} });
+  const app = factory({ allowsManageTime: () => false, environment: { document: {
+    createElement: element, createElementNS: element,
+    getElementById() { assert.fail("restricted profile must not open a modal"); }
+  } }, requestWeek() { assert.fail("restricted profile must not request weeks"); } });
+  const button = app.createButton();
+  app.setReady(true);
+  assert.equal(button.hidden, true);
+  assert.equal(button.disabled, true);
+  app.open();
+});