fix(treasury): scope finance access and hide it when the module is off

Accounts can be edited, including the opening balance, and finance sections and accounts can be granted on a role or on one user. The finance menu stays hidden when the organization module is disabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/treasury/treasury.service.ts

@@ -1,8 +1,10 @@
 import {
   BadRequestException,
+  ForbiddenException,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
+import { parseUserTreasuryAccess } from '@mento/shared';
 import { randomUUID } from 'node:crypto';
 import { Prisma } from '@prisma/client';
 import ExcelJS from 'exceljs';
@@ -129,8 +131,12 @@ export class TreasuryService {
     actor: Actor,
     range?: { from?: string; to?: string },
   ): Promise<FinancialAccountDto[]> {
+    const scope = await this.accountScope(actor);
     const accounts = await this.prisma.financialAccount.findMany({
-      where: { organizationId: actor.organizationId },
+      where: {
+        organizationId: actor.organizationId,
+        ...(scope ? { id: { in: scope } } : {}),
+      },
       orderBy: [{ isActive: 'desc' }, { name: 'asc' }],
     });
     return Promise.all(accounts.map((account) => this.toAccountDto(account, range)));
@@ -196,19 +202,89 @@ export class TreasuryService {
   async updateAccount(
     actor: Actor,
     id: string,
-    input: { name?: string; notes?: string | null; isActive?: boolean; responsibleName?: string | null },
+    input: {
+      name?: string;
+      type?: 'bank' | 'cash' | 'petty';
+      bankName?: string | null;
+      accountRef?: string | null;
+      notes?: string | null;
+      isActive?: boolean;
+      responsibleName?: string | null;
+      openingBalance?: string | number;
+      openingDate?: string;
+    },
   ): Promise<FinancialAccountDto> {
-    const existing = await this.requireAccount(actor.organizationId, id);
-    const row = await this.prisma.financialAccount.update({
-      where: { id: existing.id },
-      data: {
-        ...(input.name?.trim() ? { name: input.name.trim() } : {}),
-        ...(input.notes !== undefined ? { notes: input.notes?.trim() || null } : {}),
-        ...(input.responsibleName !== undefined
-          ? { responsibleName: input.responsibleName?.trim() || null }
-          : {}),
-        ...(input.isActive !== undefined ? { isActive: input.isActive } : {}),
-      },
+    const existing = await this.requireAccount(actor.organizationId, id, actor);
+    if (input.type && !['bank', 'cash', 'petty'].includes(input.type)) {
+      throw new BadRequestException('نوع حساب نامعتبر است.');
+    }
+    const opening = input.openingBalance !== undefined ? dec(input.openingBalance) : null;
+    if (opening?.isNegative()) {
+      throw new BadRequestException('موجودی اولیه نمی‌تواند منفی باشد.');
+    }
+    const openingDate =
+      input.openingDate !== undefined
+        ? (startOfDay(input.openingDate) ?? existing.openingDate)
+        : null;
+    const row = await this.prisma.$transaction(async (tx) => {
+      const updated = await tx.financialAccount.update({
+        where: { id: existing.id },
+        data: {
+          ...(input.name?.trim() ? { name: input.name.trim() } : {}),
+          ...(input.type ? { type: input.type } : {}),
+          ...(input.bankName !== undefined ? { bankName: input.bankName?.trim() || null } : {}),
+          ...(input.accountRef !== undefined ? { accountRef: input.accountRef?.trim() || null } : {}),
+          ...(input.notes !== undefined ? { notes: input.notes?.trim() || null } : {}),
+          ...(input.responsibleName !== undefined
+            ? { responsibleName: input.responsibleName?.trim() || null }
+            : {}),
+          ...(input.isActive !== undefined ? { isActive: input.isActive } : {}),
+          ...(opening ? { openingBalance: opening } : {}),
+          ...(openingDate ? { openingDate } : {}),
+        },
+      });
+      if (opening || openingDate) {
+        const nextAmount = opening ?? existing.openingBalance;
+        const nextDate = openingDate ?? existing.openingDate;
+        const openings = await tx.financialMovement.findMany({
+          where: { accountId: existing.id, kind: 'opening', voidedAt: null },
+          orderBy: { createdAt: 'asc' },
+        });
+        if (nextAmount.isZero()) {
+          if (openings.length) {
+            await tx.financialMovement.updateMany({
+              where: { id: { in: openings.map((row) => row.id) } },
+              data: { voidedAt: new Date() },
+            });
+          }
+        } else if (openings[0]) {
+          await tx.financialMovement.update({
+            where: { id: openings[0].id },
+            data: { amount: nextAmount, occurredAt: nextDate, direction: 'in' },
+          });
+          const extra = openings.slice(1).map((row) => row.id);
+          if (extra.length) {
+            await tx.financialMovement.updateMany({
+              where: { id: { in: extra } },
+              data: { voidedAt: new Date() },
+            });
+          }
+        } else {
+          await tx.financialMovement.create({
+            data: {
+              organizationId: actor.organizationId,
+              accountId: existing.id,
+              direction: 'in',
+              amount: nextAmount,
+              kind: 'opening',
+              occurredAt: nextDate,
+              memo: 'مانده افتتاحیه',
+              createdById: actor.userId,
+            },
+          });
+        }
+      }
+      return updated;
     });
     return this.toAccountDto(row);
   }
@@ -218,7 +294,7 @@ export class TreasuryService {
     accountId: string,
     range?: { from?: string; to?: string },
   ): Promise<{ account: FinancialAccountDto; items: FinancialMovementDto[] }> {
-    const account = await this.requireAccount(actor.organizationId, accountId);
+    const account = await this.requireAccount(actor.organizationId, accountId, actor);
     const from = startOfDay(range?.from);
     const to = startOfDay(range?.to);
     const rows = await this.prisma.financialMovement.findMany({
@@ -303,8 +379,8 @@ export class TreasuryService {
       if (dup) throw new BadRequestException('این انتقال قبلاً ثبت شده است.');
     }
     const [source, target] = await Promise.all([
-      this.requireAccount(actor.organizationId, input.fromAccountId),
-      this.requireAccount(actor.organizationId, input.toAccountId),
+      this.requireAccount(actor.organizationId, input.fromAccountId, actor),
+      this.requireAccount(actor.organizationId, input.toAccountId, actor),
     ]);
     if (!source.isActive || !target.isActive) {
       throw new BadRequestException('حساب غیرفعال در انتقال قابل استفاده نیست.');
@@ -354,10 +430,12 @@ export class TreasuryService {
     kind: 'income' | 'expense',
     q?: string,
   ): Promise<FinancialDocumentDto[]> {
+    const scope = await this.accountScope(actor);
     const rows = await this.prisma.financialDocument.findMany({
       where: {
         organizationId: actor.organizationId,
         kind,
+        ...(scope ? { OR: [{ accountId: null }, { accountId: { in: scope } }] } : {}),
         ...(q?.trim()
           ? {
               OR: [
@@ -408,7 +486,7 @@ export class TreasuryService {
       throw new BadRequestException('برای ثبت وجه قطعی، حساب را انتخاب کنید.');
     }
     if (input.accountId) {
-      const account = await this.requireAccount(actor.organizationId, input.accountId);
+      const account = await this.requireAccount(actor.organizationId, input.accountId, actor);
       if (!account.isActive) throw new BadRequestException('حساب غیرفعال است.');
       if (input.kind === 'expense' && settle.greaterThan(0)) {
         const balance = await this.accountBalance(account.id);
@@ -482,7 +560,7 @@ export class TreasuryService {
     if (amount.greaterThan(remaining)) {
       throw new BadRequestException('مبلغ از مانده سند بیشتر است.');
     }
-    const account = await this.requireAccount(actor.organizationId, input.accountId);
+    const account = await this.requireAccount(actor.organizationId, input.accountId, actor);
     if (!account.isActive) throw new BadRequestException('حساب غیرفعال است.');
     if (doc.kind === 'expense') {
       const balance = await this.accountBalance(account.id);
@@ -644,9 +722,14 @@ export class TreasuryService {
   ): Promise<TreasuryDashboardDto> {
     const from = startOfDay(range?.from);
     const to = startOfDay(range?.to);
+    const scope = await this.accountScope(actor);
+    const accountFilter = scope
+      ? { OR: [{ accountId: null }, { accountId: { in: scope } }] }
+      : {};
     const bookedWhere = {
       organizationId: actor.organizationId,
       status: { not: 'void' },
+      ...accountFilter,
       ...(from || to
         ? { bookedAt: { ...(from ? { gte: from } : {}), ...(to ? { lte: to } : {}) } }
         : {}),
@@ -654,6 +737,7 @@ export class TreasuryService {
     const cashWhere = {
       organizationId: actor.organizationId,
       voidedAt: null,
+      ...(scope ? { accountId: { in: scope } } : {}),
       ...(from || to
         ? { occurredAt: { ...(from ? { gte: from } : {}), ...(to ? { lte: to } : {}) } }
         : {}),
@@ -680,12 +764,13 @@ export class TreasuryService {
         where: {
           organizationId: actor.organizationId,
           status: { in: ['open', 'partial'] },
+          ...accountFilter,
         },
         include: { movements: true },
       }),
       this.listAccounts(actor),
       this.prisma.financialDocument.findMany({
-        where: { organizationId: actor.organizationId },
+        where: { organizationId: actor.organizationId, ...accountFilter },
         include: { category: true, account: true, movements: true },
         orderBy: { createdAt: 'desc' },
         take: 8,
@@ -754,11 +839,50 @@ export class TreasuryService {
     );
   }
 
-  private async requireAccount(organizationId: string, id: string) {
+  private async accountScope(actor: Actor): Promise<string[] | null> {
+    if (actor.role === 'owner' || actor.role === 'admin') return null;
+    const membership = await this.prisma.membership.findFirst({
+      where: { userId: actor.userId, organizationId: actor.organizationId, isActive: true },
+      select: {
+        user: { select: { fullName: true } },
+        orgRole: { select: { treasuryAccountIds: true, treasuryOwnAccounts: true } },
+        treasuryAccessOverride: true,
+      },
+    });
+    const override = parseUserTreasuryAccess(membership?.treasuryAccessOverride);
+    if (override && !override.enabled) return [];
+    const extra = override
+      ? override.accountIds
+      : (membership?.orgRole?.treasuryAccountIds ?? []);
+    const own = override
+      ? override.ownAccounts
+      : Boolean(membership?.orgRole?.treasuryOwnAccounts);
+    if (!own && extra.length === 0) return null;
+    const ids = new Set(extra);
+    const name = membership?.user.fullName?.trim();
+    if (own && name) {
+      const rows = await this.prisma.financialAccount.findMany({
+        where: { organizationId: actor.organizationId, responsibleName: { not: null } },
+        select: { id: true, responsibleName: true },
+      });
+      for (const row of rows) {
+        if (row.responsibleName?.trim() === name) ids.add(row.id);
+      }
+    }
+    return [...ids];
+  }
+
+  private async requireAccount(organizationId: string, id: string, actor?: Actor) {
     const row = await this.prisma.financialAccount.findFirst({
       where: { id, organizationId },
     });
     if (!row) throw new NotFoundException('حساب پیدا نشد.');
+    if (actor) {
+      const scope = await this.accountScope(actor);
+      if (scope && !scope.includes(row.id)) {
+        throw new ForbiddenException('به این حساب دسترسی ندارید.');
+      }
+    }
     return row;
   }