fix(access): honor finance sections and team-member data scope

Role treasury keys now open the first allowed finance page, and team-member ownership limits lists, dashboard, and reports instead of the whole organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/auth/auth.service.ts

@@ -19,6 +19,10 @@ import type {
   StorageUsageDto,
   SubscriptionSummaryDto,
 } from '@mento/shared';
+import {
+  parseUserTreasuryAccess,
+  permissionsWithTreasuryOverride,
+} from '@mento/shared';
 import { Prisma } from '@prisma/client';
 /** Ensures Express.Multer.File augmentation is loaded for saveAvatar. */
 import type {} from 'multer';
@@ -848,6 +852,9 @@ export class AuthService {
       },
     });
     const role = membership?.role ?? user.role;
+    const rolePermissions = Array.isArray(membership?.orgRole?.permissions)
+      ? membership.orgRole.permissions.filter((item) => typeof item === 'string')
+      : [];
     const orgName = membership?.organization.name;
     const sub =
       subscription ??
@@ -879,9 +886,10 @@ export class AuthService {
       storage,
       isOrgOwner: role === 'owner',
       priorArchive: this.priorArchiveFor(membership),
-      permissions: (Array.isArray(membership?.orgRole?.permissions)
-        ? membership.orgRole.permissions.filter((item) => typeof item === 'string')
-        : []) as AuthUserDto['permissions'],
+      permissions: permissionsWithTreasuryOverride(
+        rolePermissions,
+        parseUserTreasuryAccess(membership?.treasuryAccessOverride),
+      ) as AuthUserDto['permissions'],
       ...(viewAs ? { viewAs } : {}),
     });
   }

apps/api/src/auth/jwt.strategy.ts

@@ -195,6 +195,10 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     const peers = await this.prisma.teamMember.findMany({
       where: {
         teamId: { in: memberships.map((m) => m.teamId) },
+        team: { organizationId },
+        user: {
+          memberships: { some: { organizationId, isActive: true } },
+        },
       },
       select: { userId: true },
     });

apps/api/src/common/record-scope.ts

@@ -5,7 +5,7 @@ import type {
   SectionDataAccess,
   UserRole,
 } from '@mento/shared';
-import { DATA_SCOPES, canViewAllRecords } from '@mento/shared';
+import { DATA_SCOPES, canViewAllRecords, sectionHasDataAccessLimits } from '@mento/shared';
 import type { Prisma } from '@prisma/client';
 import {
   activitiesDeepWhere,
@@ -13,6 +13,7 @@ import {
   notesDeepWhere,
   projectsDeepWhere,
   routinesDeepWhere,
+  sectionOwnerIdUnion,
   ticketsDeepWhere,
 } from './data-access';
 
@@ -60,6 +61,65 @@ export type Actor = {
 
 export type ScopedActor = Pick<Actor, 'userId' | 'role' | 'dataVisibility' | 'visibleUserIds' | 'scopes'>;
 
+type DeepAccessActor = ScopedActor &
+  Partial<
+    Pick<
+      Actor,
+      | 'customersAccess'
+      | 'leadsAccess'
+      | 'salesAccess'
+      | 'activitiesAccess'
+      | 'notesAccess'
+      | 'routinesAccess'
+      | 'projectsAccess'
+      | 'ticketsAccess'
+      | 'teamPeerIds'
+    >
+  >;
+
+function sectionForScope(actor: DeepAccessActor, scope: DataScope): SectionDataAccess | undefined {
+  switch (scope) {
+    case 'contacts':
+      return actor.customersAccess;
+    case 'leads':
+      return actor.leadsAccess;
+    case 'deals':
+      return actor.salesAccess;
+    case 'activities':
+      return actor.activitiesAccess;
+    case 'notes':
+      return actor.notesAccess;
+    case 'routines':
+      return actor.routinesAccess;
+    case 'projects':
+      return actor.projectsAccess;
+    case 'tickets':
+      return actor.ticketsAccess;
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * شناسه‌های مالک از قانون عمق داده.
+ * legacy = بخش عمیق روی این Actor نیست.
+ * open = محدودیت مالکی ندارد (همه، یا فقط فیلترهای غیرمالک).
+ */
+function deepOwnerIds(
+  actor: DeepAccessActor,
+  scope: DataScope,
+): { kind: 'legacy' } | { kind: 'open' } | { kind: 'ids'; ids: string[] } {
+  const section = sectionForScope(actor, scope);
+  if (!section) return { kind: 'legacy' };
+  if (!sectionHasDataAccessLimits(section)) return { kind: 'open' };
+  const ids = sectionOwnerIdUnion(section, {
+    userId: actor.userId,
+    teamPeerIds: actor.teamPeerIds ?? null,
+  });
+  if (ids === null) return { kind: 'open' };
+  return { kind: 'ids', ids };
+}
+
 /** Actor با سطح دید مخصوص یک بخش (اگر تنظیم شده باشد). */
 export function forScope<T extends ScopedActor>(actor: T, scope: DataScope): T {
   const s = actor.scopes?.[scope];
@@ -109,9 +169,16 @@ export function scopedOwnerIds(
 
 /** فیلتر مالکیت؛ پیش‌فرض بخش «مشتریان» (Person / Company). برای فاکتور/پیش‌فاکتور scope=finance. */
 export function ownerWhere(
-  actor: ScopedActor,
+  actor: DeepAccessActor,
   scope: DataScope = 'contacts',
 ): { ownerId: string } | { ownerId: { in: string[] } } | Record<string, never> {
+  const deep = deepOwnerIds(actor, scope);
+  if (deep.kind === 'open') return {};
+  if (deep.kind === 'ids') {
+    if (deep.ids.length === 1) return { ownerId: deep.ids[0]! };
+    if (!deep.ids.length) return { ownerId: '__no_access__' };
+    return { ownerId: { in: deep.ids } };
+  }
   const ids = scopedOwnerIds(actor, scope);
   if (!ids) return {};
   if (ids.length === 1) return { ownerId: ids[0]! };
@@ -153,11 +220,16 @@ export function projectCardAccessWhere(
 }
 
 /** فعالیت‌ها بر اساس مسئول اصلی یا مسئولان مشترک */
-export function assigneeWhere(
-  actor: ScopedActor,
-): Prisma.ActivityWhereInput {
-  const ids = scopedOwnerIds(actor, 'activities');
+export function assigneeWhere(actor: DeepAccessActor): Prisma.ActivityWhereInput {
+  const deep = deepOwnerIds(actor, 'activities');
+  const ids =
+    deep.kind === 'open'
+      ? null
+      : deep.kind === 'ids'
+        ? deep.ids
+        : scopedOwnerIds(actor, 'activities');
   if (!ids) return {};
+  if (!ids.length) return { assigneeId: '__no_access__' };
   return {
     OR: [
       { assigneeId: { in: ids } },

apps/api/src/contacts/companies.service.ts

@@ -112,9 +112,13 @@ export class CompaniesService {
       ...(groupIds.length ? [{ groupLinks: { some: { groupId: { in: groupIds } } } }] : []),
     ];
     const where: Prisma.CompanyWhereInput = {
-      organizationId: actor.organizationId,
-      ...customersCompanyWhere(actor),
-      ...(and.length ? { AND: and } : {}),
+      AND: [
+        {
+          organizationId: actor.organizationId,
+          ...customersCompanyWhere(actor),
+        },
+        ...and,
+      ],
     };
 
     const [rows, total] = await this.prisma.$transaction([

apps/api/src/contacts/people.service.ts

@@ -218,11 +218,15 @@ export class PeopleService implements OnModuleInit {
     if (disc) and.push(disc);
     if (groupIds.length) and.push({ groupLinks: { some: { groupId: { in: groupIds } } } });
     return {
-      organizationId: actor.organizationId,
-      ...customersPersonWhere(actor),
-      ...(moods.length ? { mood: { in: moods } } : {}),
-      ...(sources.length ? { importSource: { in: sources } } : {}),
-      ...(and.length ? { AND: and } : {}),
+      AND: [
+        {
+          organizationId: actor.organizationId,
+          ...customersPersonWhere(actor),
+        },
+        ...(moods.length ? [{ mood: { in: moods } }] : []),
+        ...(sources.length ? [{ importSource: { in: sources } }] : []),
+        ...and,
+      ],
     };
   }
 

apps/api/src/leads/leads.service.ts

@@ -176,22 +176,26 @@ export class LeadsService {
     const createdRange = this.createdAtWhere(opts.createdFrom, opts.createdTo);
     if (createdRange) and.push(createdRange);
     return {
-      organizationId: actor.organizationId,
-      ...leadAccessWhere(actor),
-      archivedAt: opts.archived ? { not: null } : null,
-      ...(opts.converted ? { convertedPersonId: { not: null } } : {}),
-      ...(opts.stageId ? { stageId: opts.stageId } : {}),
-      ...(opts.assigneeId ? { assigneeId: opts.assigneeId } : {}),
-      ...(opts.unassigned ? { assigneeId: null } : {}),
-      ...(opts.city ? { city: { contains: opts.city, mode: 'insensitive' } } : {}),
-      ...(opts.region
-        ? { region: { contains: opts.region, mode: 'insensitive' } }
-        : {}),
-      ...(opts.trade ? { trade: { contains: opts.trade, mode: 'insensitive' } } : {}),
-      ...(opts.source
-        ? { source: { contains: opts.source, mode: 'insensitive' } }
-        : {}),
-      ...(and.length ? { AND: and } : {}),
+      AND: [
+        {
+          organizationId: actor.organizationId,
+          ...leadAccessWhere(actor),
+          archivedAt: opts.archived ? { not: null } : null,
+          ...(opts.converted ? { convertedPersonId: { not: null } } : {}),
+          ...(opts.stageId ? { stageId: opts.stageId } : {}),
+          ...(opts.city ? { city: { contains: opts.city, mode: 'insensitive' } } : {}),
+          ...(opts.region
+            ? { region: { contains: opts.region, mode: 'insensitive' } }
+            : {}),
+          ...(opts.trade ? { trade: { contains: opts.trade, mode: 'insensitive' } } : {}),
+          ...(opts.source
+            ? { source: { contains: opts.source, mode: 'insensitive' } }
+            : {}),
+        },
+        ...(opts.unassigned ? [{ assigneeId: null }] : []),
+        ...(opts.assigneeId && !opts.unassigned ? [{ assigneeId: opts.assigneeId }] : []),
+        ...and,
+      ],
     };
   }
 
@@ -1185,7 +1189,7 @@ export class LeadsService {
       newStage
         ? this.prisma.lead.count({ where: { ...base, stageId: newStage.id } })
         : Promise.resolve(0),
-      this.prisma.lead.count({ where: { ...base, assigneeId: null } }),
+      this.prisma.lead.count({ where: { AND: [base, { assigneeId: null }] } }),
       convertedIds.length
         ? this.prisma.lead.count({
             where: { ...base, stageId: { in: convertedIds } },

apps/api/src/reports/reports.service.ts

@@ -18,6 +18,7 @@ import {
 } from '@mento/shared';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
+import { customersPersonWhere } from '../common/data-access';
 import {
   type Actor,
   assigneeWhere,
@@ -54,7 +55,7 @@ export class ReportsService {
     const invoiceScope = ownerWhere(actor, 'finance');
     const activityScope = assigneeWhere(actor);
     const ticketScope = ticketAccessWhere(actor);
-    const personScope = elevated(actor.role) ? {} : { ownerId: actor.userId };
+    const personScope = customersPersonWhere(actor);
 
     const durationMs = end.getTime() - start.getTime();
     const prevEnd = new Date(start.getTime() - 1);
@@ -1534,7 +1535,7 @@ export class ReportsService {
     const orgId = actor.organizationId;
     const dealScope = ownerWhere(actor, 'deals');
     const activityScope = assigneeWhere(actor);
-    const personScope = elevated(actor.role) ? {} : { ownerId: actor.userId };
+    const personScope = customersPersonWhere(actor);
     const rates = await loadOrgRates(this.prisma, orgId);
     const now = new Date();
     const { jy, jm } = dateToJalali(now);

apps/api/src/treasury/treasury-access.guard.ts

@@ -1,6 +1,7 @@
 import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
 import {
   parseUserTreasuryAccess,
+  permissionsWithTreasuryOverride,
   treasurySectionAllowed,
   type TreasurySectionKey,
 } from '@mento/shared';
@@ -16,7 +17,12 @@ export class TreasuryAccessGuard implements CanActivate {
   constructor(private readonly prisma: PrismaService) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const req = context.switchToHttp().getRequest<{ user?: Actor; originalUrl?: string; url?: string }>();
+    const req = context.switchToHttp().getRequest<{
+      user?: Actor;
+      method?: string;
+      originalUrl?: string;
+      url?: string;
+    }>();
     const actor = req.user;
     if (!actor) throw new ForbiddenException('دسترسی مالی مجاز نیست.');
     if (actor.role === 'owner' || actor.role === 'admin') return true;
@@ -30,11 +36,18 @@ export class TreasuryAccessGuard implements CanActivate {
     const rolePermissions = Array.isArray(membership?.orgRole?.permissions)
       ? membership.orgRole.permissions.map(String)
       : [];
-    const permissions = permissionsForTreasury(
+    const permissions = permissionsWithTreasuryOverride(
       rolePermissions,
       parseUserTreasuryAccess(membership?.treasuryAccessOverride),
     );
+    const method = (req.method || 'GET').toUpperCase();
     const url = req.originalUrl || req.url || '';
+    if (
+      isLookupForDocuments(method, url) &&
+      treasurySectionAllowed(actor.role, permissions, 'treasury_documents')
+    ) {
+      return true;
+    }
     if (!treasurySectionAllowed(actor.role, permissions, sectionForUrl(url))) {
       throw new ForbiddenException('به این بخش مدیریت مالی دسترسی ندارید.');
     }
@@ -42,14 +55,11 @@ export class TreasuryAccessGuard implements CanActivate {
   }
 }
 
-function permissionsForTreasury(
-  rolePermissions: string[],
-  override: ReturnType<typeof parseUserTreasuryAccess>,
-): string[] {
-  if (!override) return rolePermissions;
-  const rest = rolePermissions.filter((key) => key !== 'treasury' && !key.startsWith('treasury_'));
-  if (!override.enabled) return rest;
-  return ['treasury', ...override.sections, ...rest];
+/** فهرست حساب و دسته برای ثبت سند لازم است؛ صفحهٔ مدیریت‌شان جدا می‌ماند. */
+function isLookupForDocuments(method: string, url: string): boolean {
+  if (method !== 'GET' && method !== 'HEAD') return false;
+  const path = (url.split('?')[0] || '').replace(/\/+$/, '');
+  return path.endsWith('/treasury/accounts') || path.endsWith('/treasury/categories');
 }
 
 function sectionForUrl(url: string): TreasurySectionKey | 'treasury_documents' {