fix(access): honor finance sections and team-member data scope

Role treasury keys now open the first allowed finance page, and team-member ownership limits lists, dashboard, and reports instead of the whole organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/treasury/treasury-access.guard.ts

@@ -1,6 +1,7 @@
 import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
 import {
   parseUserTreasuryAccess,
+  permissionsWithTreasuryOverride,
   treasurySectionAllowed,
   type TreasurySectionKey,
 } from '@mento/shared';
@@ -16,7 +17,12 @@ export class TreasuryAccessGuard implements CanActivate {
   constructor(private readonly prisma: PrismaService) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const req = context.switchToHttp().getRequest<{ user?: Actor; originalUrl?: string; url?: string }>();
+    const req = context.switchToHttp().getRequest<{
+      user?: Actor;
+      method?: string;
+      originalUrl?: string;
+      url?: string;
+    }>();
     const actor = req.user;
     if (!actor) throw new ForbiddenException('دسترسی مالی مجاز نیست.');
     if (actor.role === 'owner' || actor.role === 'admin') return true;
@@ -30,11 +36,18 @@ export class TreasuryAccessGuard implements CanActivate {
     const rolePermissions = Array.isArray(membership?.orgRole?.permissions)
       ? membership.orgRole.permissions.map(String)
       : [];
-    const permissions = permissionsForTreasury(
+    const permissions = permissionsWithTreasuryOverride(
       rolePermissions,
       parseUserTreasuryAccess(membership?.treasuryAccessOverride),
     );
+    const method = (req.method || 'GET').toUpperCase();
     const url = req.originalUrl || req.url || '';
+    if (
+      isLookupForDocuments(method, url) &&
+      treasurySectionAllowed(actor.role, permissions, 'treasury_documents')
+    ) {
+      return true;
+    }
     if (!treasurySectionAllowed(actor.role, permissions, sectionForUrl(url))) {
       throw new ForbiddenException('به این بخش مدیریت مالی دسترسی ندارید.');
     }
@@ -42,14 +55,11 @@ export class TreasuryAccessGuard implements CanActivate {
   }
 }
 
-function permissionsForTreasury(
-  rolePermissions: string[],
-  override: ReturnType<typeof parseUserTreasuryAccess>,
-): string[] {
-  if (!override) return rolePermissions;
-  const rest = rolePermissions.filter((key) => key !== 'treasury' && !key.startsWith('treasury_'));
-  if (!override.enabled) return rest;
-  return ['treasury', ...override.sections, ...rest];
+/** فهرست حساب و دسته برای ثبت سند لازم است؛ صفحهٔ مدیریت‌شان جدا می‌ماند. */
+function isLookupForDocuments(method: string, url: string): boolean {
+  if (method !== 'GET' && method !== 'HEAD') return false;
+  const path = (url.split('?')[0] || '').replace(/\/+$/, '');
+  return path.endsWith('/treasury/accounts') || path.endsWith('/treasury/categories');
 }
 
 function sectionForUrl(url: string): TreasurySectionKey | 'treasury_documents' {