denis_ireri
83ec5ecd36
Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().
- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
find/update/delete/count/distinct, or an aggregate whose first stage is
not a $match, that does not pin exactly one businessId throws
TenantScopeError before reaching the database ($in, $exists and other
operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
queries that must span businesses - login's email lookup, refresh and
invite-token lookups, the M-Pesa callback, the platform console and the
maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
restricted to the business.
- Every flagged query site now names the business (or is exempted with a
reason).
- Tests: a check that every model with a businessId field carries the
guard; the guard refusing unscoped queries of every kind; and a route
sweep where business A sends business B's ids to every read route
(nothing of B's comes back) and every write route (all refused, B's
data unchanged). Test-side database inspections go through db(), an
explicit test exemption. Removing one route's business filter makes the
suite fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
88 lines
3.9 KiB
TypeScript
88 lines
3.9 KiB
TypeScript
import { tenantGuard } from "@/lib/server/tenantGuard";
|
|
import { Schema, model, models, Model, Types, Document } from "mongoose";
|
|
import bcrypt from "bcryptjs";
|
|
|
|
export type UserRole = "DELIVERY" | "BRANCH_MANAGER" | "SUPER_ADMIN";
|
|
export const USER_ROLES: UserRole[] = ["DELIVERY", "BRANCH_MANAGER", "SUPER_ADMIN"];
|
|
|
|
export interface IUser extends Document {
|
|
_id: Types.ObjectId;
|
|
businessId: Types.ObjectId; // tenant this user belongs to
|
|
name: string;
|
|
role: UserRole;
|
|
branchId: Types.ObjectId | null; // null only valid for SUPER_ADMIN (business owner)
|
|
// Email and phone are unique WITHIN a business, not across the platform,
|
|
// so one person can work for two businesses (each account has its own
|
|
// password and role). Login asks which business when the same email and
|
|
// password match accounts in more than one.
|
|
phoneNumber: string; // E.164-ish normalized Kenyan format — kept for contact/M-Pesa reference, not used for login
|
|
email: string; // login identifier for every role, via the single /login page
|
|
// Platform operator (cross-tenant console). Only set by `npm run seed` or
|
|
// the identity migration, never through the app, and only honoured while
|
|
// the email is also listed in PLATFORM_ADMIN_EMAILS.
|
|
platformAdmin: boolean;
|
|
passwordHash: string;
|
|
isActive: boolean;
|
|
failedLoginAttempts: number;
|
|
lockedUntil: Date | null;
|
|
// Pending invite: the person sets their own password through a one-time
|
|
// link. Only the SHA-256 of the token is stored. Until they accept, the
|
|
// account has a random unknown password, so it cannot be signed into.
|
|
inviteTokenHash: string | null;
|
|
inviteExpiresAt: Date | null;
|
|
createdAt: Date;
|
|
updatedAt: Date;
|
|
|
|
comparePassword(password: string): Promise<boolean>;
|
|
}
|
|
|
|
const userSchema = new Schema<IUser>(
|
|
{
|
|
businessId: { type: Schema.Types.ObjectId, ref: "Business", required: true, index: true },
|
|
name: { type: String, required: true, trim: true },
|
|
role: { type: String, enum: USER_ROLES, required: true, default: "DELIVERY" },
|
|
branchId: { type: Schema.Types.ObjectId, ref: "Branch", default: null },
|
|
phoneNumber: { type: String, required: true },
|
|
email: { type: String, required: true, lowercase: true, trim: true },
|
|
platformAdmin: { type: Boolean, default: false },
|
|
passwordHash: { type: String, required: true, select: false },
|
|
isActive: { type: Boolean, default: true },
|
|
failedLoginAttempts: { type: Number, default: 0 },
|
|
lockedUntil: { type: Date, default: null },
|
|
inviteTokenHash: { type: String, default: null, index: { sparse: true } },
|
|
inviteExpiresAt: { type: Date, default: null },
|
|
},
|
|
{ timestamps: true }
|
|
);
|
|
|
|
userSchema.index({ businessId: 1, email: 1 }, { unique: true });
|
|
userSchema.index({ businessId: 1, phoneNumber: 1 }, { unique: true });
|
|
// Login looks an email up across businesses. Named so it never clashes with
|
|
// the old platform-wide unique `email_1` index, which the identity
|
|
// migration (npm run migrate:identity) drops.
|
|
userSchema.index({ email: 1 }, { name: "email_lookup" });
|
|
|
|
// Enforce role/branch invariants at the model layer — belt-and-braces
|
|
// alongside API-level validation. Every role authenticates the same way
|
|
// now (email + password on the single /login page), so there is no
|
|
// per-role credential branching left here — just the branch scoping rule.
|
|
userSchema.pre("validate", function (next) {
|
|
if (this.role !== "SUPER_ADMIN" && !this.branchId) {
|
|
return next(new Error("branchId is required for all roles except SUPER_ADMIN"));
|
|
}
|
|
if (this.role === "SUPER_ADMIN" && this.branchId) {
|
|
return next(new Error("SUPER_ADMIN accounts must not be scoped to a single branchId"));
|
|
}
|
|
next();
|
|
});
|
|
|
|
userSchema.methods.comparePassword = async function (password: string): Promise<boolean> {
|
|
if (!this.passwordHash) return false;
|
|
return bcrypt.compare(password, this.passwordHash);
|
|
};
|
|
|
|
userSchema.plugin(tenantGuard);
|
|
|
|
export const User =
|
|
(models.User as Model<IUser>) || model<IUser>("User", userSchema);
|