denis_ireri
83ec5ecd36
Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().
- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
find/update/delete/count/distinct, or an aggregate whose first stage is
not a $match, that does not pin exactly one businessId throws
TenantScopeError before reaching the database ($in, $exists and other
operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
queries that must span businesses - login's email lookup, refresh and
invite-token lookups, the M-Pesa callback, the platform console and the
maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
restricted to the business.
- Every flagged query site now names the business (or is exempted with a
reason).
- Tests: a check that every model with a businessId field carries the
guard; the guard refusing unscoped queries of every kind; and a route
sweep where business A sends business B's ids to every read route
(nothing of B's comes back) and every write route (all refused, B's
data unchanged). Test-side database inspections go through db(), an
explicit test exemption. Removing one route's business filter makes the
suite fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.7 KiB
TypeScript
44 lines
1.7 KiB
TypeScript
import { tenantGuard } from "@/lib/server/tenantGuard";
|
|
import { Schema, model, models, Model, Types, Document } from "mongoose";
|
|
|
|
export interface IStockTransfer extends Document {
|
|
_id: Types.ObjectId;
|
|
businessId: Types.ObjectId;
|
|
fromBranchId: Types.ObjectId;
|
|
toBranchId: Types.ObjectId;
|
|
productId: Types.ObjectId;
|
|
quantity: number;
|
|
clientUuid: string; // idempotency key from the form, so a double-submit moves stock once
|
|
note: string | null;
|
|
recordedBy: Types.ObjectId;
|
|
createdAt: Date;
|
|
}
|
|
|
|
/**
|
|
* An inter-branch stock transfer. The stock itself moves through two
|
|
* StockMovement rows (TRANSFER_OUT at the source, TRANSFER_IN at the
|
|
* destination) whose refId is this transfer's id.
|
|
*/
|
|
const stockTransferSchema = new Schema<IStockTransfer>(
|
|
{
|
|
businessId: { type: Schema.Types.ObjectId, ref: "Business", required: true },
|
|
fromBranchId: { type: Schema.Types.ObjectId, ref: "Branch", required: true },
|
|
toBranchId: { type: Schema.Types.ObjectId, ref: "Branch", required: true },
|
|
productId: { type: Schema.Types.ObjectId, ref: "Product", required: true },
|
|
quantity: { type: Number, required: true, min: 1 },
|
|
clientUuid: { type: String, required: true },
|
|
note: { type: String, default: null, trim: true },
|
|
recordedBy: { type: Schema.Types.ObjectId, ref: "User", required: true },
|
|
},
|
|
{ timestamps: { createdAt: true, updatedAt: false } }
|
|
);
|
|
|
|
stockTransferSchema.index({ businessId: 1, clientUuid: 1 }, { unique: true });
|
|
stockTransferSchema.index({ businessId: 1, createdAt: -1 });
|
|
|
|
stockTransferSchema.plugin(tenantGuard);
|
|
|
|
export const StockTransfer =
|
|
(models.StockTransfer as Model<IStockTransfer>) ||
|
|
model<IStockTransfer>("StockTransfer", stockTransferSchema);
|