denis_ireri
83ec5ecd36
Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().
- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
find/update/delete/count/distinct, or an aggregate whose first stage is
not a $match, that does not pin exactly one businessId throws
TenantScopeError before reaching the database ($in, $exists and other
operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
queries that must span businesses - login's email lookup, refresh and
invite-token lookups, the M-Pesa callback, the platform console and the
maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
restricted to the business.
- Every flagged query site now names the business (or is exempted with a
reason).
- Tests: a check that every model with a businessId field carries the
guard; the guard refusing unscoped queries of every kind; and a route
sweep where business A sends business B's ids to every read route
(nothing of B's comes back) and every write route (all refused, B's
data unchanged). Test-side database inspections go through db(), an
explicit test exemption. Removing one route's business filter makes the
suite fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
2.0 KiB
TypeScript
48 lines
2.0 KiB
TypeScript
import { tenantGuard } from "@/lib/server/tenantGuard";
|
|
import { Schema, model, models, Model, Types, Document } from "mongoose";
|
|
|
|
// A recorded stock purchase from a supplier. Completing a purchase is what
|
|
// increases branch stock. Price fields are snapshotted onto the record so
|
|
// historical purchases never change when a product's price changes later.
|
|
export interface IPurchase extends Document {
|
|
_id: Types.ObjectId;
|
|
businessId: Types.ObjectId; // tenant this purchase belongs to
|
|
branchId: Types.ObjectId;
|
|
supplierName: string;
|
|
productId: Types.ObjectId | null;
|
|
productLabel: string; // snapshot of the product name at purchase time
|
|
quantity: number;
|
|
unitCost: number; // buying price, snapshotted
|
|
totalCost: number; // quantity * unitCost, snapshotted
|
|
reference: string | null;
|
|
notes: string | null;
|
|
recordedBy: Types.ObjectId;
|
|
createdAt: Date; // authoritative — server clock
|
|
updatedAt: Date;
|
|
}
|
|
|
|
const purchaseSchema = new Schema<IPurchase>(
|
|
{
|
|
businessId: { type: Schema.Types.ObjectId, ref: "Business", required: true, index: true },
|
|
branchId: { type: Schema.Types.ObjectId, ref: "Branch", required: true },
|
|
supplierName: { type: String, required: true, trim: true },
|
|
productId: { type: Schema.Types.ObjectId, ref: "Product", default: null },
|
|
productLabel: { type: String, required: true, trim: true },
|
|
quantity: { type: Number, required: true, min: 1 },
|
|
unitCost: { type: Number, required: true, min: 0 },
|
|
totalCost: { type: Number, required: true, min: 0 },
|
|
reference: { type: String, default: null, trim: true },
|
|
notes: { type: String, default: null, trim: true },
|
|
recordedBy: { type: Schema.Types.ObjectId, ref: "User", required: true },
|
|
},
|
|
{ timestamps: true }
|
|
);
|
|
|
|
purchaseSchema.index({ branchId: 1, createdAt: -1 });
|
|
purchaseSchema.index({ productId: 1 });
|
|
|
|
purchaseSchema.plugin(tenantGuard);
|
|
|
|
export const Purchase =
|
|
(models.Purchase as Model<IPurchase>) || model<IPurchase>("Purchase", purchaseSchema);
|