denis_ireri
83ec5ecd36
Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().
- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
find/update/delete/count/distinct, or an aggregate whose first stage is
not a $match, that does not pin exactly one businessId throws
TenantScopeError before reaching the database ($in, $exists and other
operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
queries that must span businesses - login's email lookup, refresh and
invite-token lookups, the M-Pesa callback, the platform console and the
maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
restricted to the business.
- Every flagged query site now names the business (or is exempted with a
reason).
- Tests: a check that every model with a businessId field carries the
guard; the guard refusing unscoped queries of every kind; and a route
sweep where business A sends business B's ids to every read route
(nothing of B's comes back) and every write route (all refused, B's
data unchanged). Test-side database inspections go through db(), an
explicit test exemption. Removing one route's business filter makes the
suite fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.3 KiB
TypeScript
33 lines
1.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { connectDb } from "@/lib/server/db";
|
|
import { StockMovement } from "@/lib/server/models/StockMovement";
|
|
import { authorize, branchParam, MANAGERS } from "@/lib/server/auth";
|
|
import { scopedPopulate } from "@/lib/server/tenantGuard";
|
|
|
|
export const runtime = "nodejs";
|
|
export const dynamic = "force-dynamic";
|
|
|
|
// GET /api/stock/movements?branchId=&limit= — recent ledger entries, newest first.
|
|
export async function GET(req: NextRequest) {
|
|
await connectDb();
|
|
const gate = authorize(req, MANAGERS);
|
|
if (!gate.ok) return gate.response;
|
|
const auth = gate.auth;
|
|
|
|
const scope = branchParam(auth, req.nextUrl.searchParams.get("branchId"));
|
|
if (!scope.ok) return scope.response;
|
|
const limit = Math.min(Number(req.nextUrl.searchParams.get("limit")) || 50, 200);
|
|
|
|
const filter: Record<string, unknown> = { businessId: auth.businessId };
|
|
if (scope.branchId) filter.branchId = scope.branchId;
|
|
|
|
const movements = await StockMovement.find(filter)
|
|
.sort({ createdAt: -1 })
|
|
.limit(limit)
|
|
.populate(scopedPopulate("branchId", "branchName", auth.businessId))
|
|
.populate(scopedPopulate("productId", "label unit", auth.businessId))
|
|
.populate(scopedPopulate("recordedBy", "name", auth.businessId))
|
|
.lean();
|
|
return NextResponse.json({ movements });
|
|
}
|