denis_ireri
83ec5ecd36
Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().
- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
find/update/delete/count/distinct, or an aggregate whose first stage is
not a $match, that does not pin exactly one businessId throws
TenantScopeError before reaching the database ($in, $exists and other
operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
queries that must span businesses - login's email lookup, refresh and
invite-token lookups, the M-Pesa callback, the platform console and the
maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
restricted to the business.
- Every flagged query site now names the business (or is exempted with a
reason).
- Tests: a check that every model with a businessId field carries the
guard; the guard refusing unscoped queries of every kind; and a route
sweep where business A sends business B's ids to every read route
(nothing of B's comes back) and every write route (all refused, B's
data unchanged). Test-side database inspections go through db(), an
explicit test exemption. Removing one route's business filter makes the
suite fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
1.9 KiB
TypeScript
54 lines
1.9 KiB
TypeScript
import { tenantGuard } from "@/lib/server/tenantGuard";
|
|
import { Schema, model, models, Model, Types, Document } from "mongoose";
|
|
|
|
// Business expense categories. Kept as a constrained string set so the UI
|
|
// can offer a dropdown while the owner can still extend later via code.
|
|
export const EXPENSE_CATEGORIES = [
|
|
"Transport",
|
|
"Electricity",
|
|
"Rent",
|
|
"Salaries",
|
|
"Repairs",
|
|
"Packaging",
|
|
"Other",
|
|
] as const;
|
|
export type ExpenseCategory = (typeof EXPENSE_CATEGORIES)[number];
|
|
|
|
export interface IExpense extends Document {
|
|
_id: Types.ObjectId;
|
|
businessId: Types.ObjectId; // tenant this expense belongs to
|
|
branchId: Types.ObjectId;
|
|
category: ExpenseCategory;
|
|
amount: number;
|
|
description: string;
|
|
reference: string | null;
|
|
notes: string | null;
|
|
recordedBy: Types.ObjectId;
|
|
createdAt: Date; // authoritative — server clock
|
|
updatedAt: Date;
|
|
}
|
|
|
|
const expenseSchema = new Schema<IExpense>(
|
|
{
|
|
businessId: { type: Schema.Types.ObjectId, ref: "Business", required: true, index: true },
|
|
branchId: { type: Schema.Types.ObjectId, ref: "Branch", required: true },
|
|
category: { type: String, enum: EXPENSE_CATEGORIES, required: true },
|
|
amount: { type: Number, required: true, min: 0 },
|
|
description: { type: String, required: true, trim: true },
|
|
reference: { type: String, default: null, trim: true },
|
|
notes: { type: String, default: null, trim: true },
|
|
recordedBy: { type: Schema.Types.ObjectId, ref: "User", required: true },
|
|
},
|
|
{ timestamps: true } // createdAt/updatedAt from the server clock, never client input
|
|
);
|
|
|
|
expenseSchema.index({ branchId: 1, createdAt: -1 });
|
|
expenseSchema.index({ category: 1 });
|
|
|
|
// `models.Expense` guard avoids OverwriteModelError on serverless warm
|
|
// re-invocations where the module is evaluated more than once.
|
|
expenseSchema.plugin(tenantGuard);
|
|
|
|
export const Expense =
|
|
(models.Expense as Model<IExpense>) || model<IExpense>("Expense", expenseSchema);
|