Initial Mento CRM: portal OTP, reports, SMS, and deploy for crm.montzar.ir.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/common/record-scope.ts

@@ -0,0 +1,70 @@
+import type { UserRole } from '@mento/shared';
+import { canViewAllRecords } from '@mento/shared';
+import type { Prisma } from '@prisma/client';
+
+export type Actor = {
+  userId: string;
+  role: string;
+  organizationId: string;
+};
+
+export function elevated(role: string | null | undefined): boolean {
+  return canViewAllRecords(role);
+}
+
+/** فیلتر مالکیت برای Deal / Quote / Invoice / Person / Company */
+export function ownerWhere(
+  actor: Pick<Actor, 'userId' | 'role'>,
+): { ownerId: string } | Record<string, never> {
+  if (elevated(actor.role)) return {};
+  return { ownerId: actor.userId };
+}
+
+/** فعالیت‌ها بر اساس مسئول */
+export function assigneeWhere(
+  actor: Pick<Actor, 'userId' | 'role'>,
+): { assigneeId: string } | Record<string, never> {
+  if (elevated(actor.role)) return {};
+  return { assigneeId: actor.userId };
+}
+
+/** یادداشت: نویسنده یا پرونده‌های تحت مالکیت */
+export function noteAccessWhere(
+  actor: Pick<Actor, 'userId' | 'role'>,
+): Prisma.NoteWhereInput {
+  if (elevated(actor.role)) return {};
+  return {
+    OR: [
+      { authorId: actor.userId },
+      { deal: { ownerId: actor.userId } },
+      { person: { ownerId: actor.userId } },
+      { company: { ownerId: actor.userId } },
+    ],
+  };
+}
+
+export function resolveOwnerId(
+  actor: Pick<Actor, 'userId' | 'role'>,
+  requested?: string | null,
+): string {
+  if (elevated(actor.role) && requested?.trim()) {
+    return requested.trim();
+  }
+  return actor.userId;
+}
+
+/** تیکت: مسئول یا ثبت‌کننده */
+export function ticketAccessWhere(
+  actor: Pick<Actor, 'userId' | 'role'>,
+): Prisma.TicketWhereInput {
+  if (elevated(actor.role)) return {};
+  return {
+    OR: [{ assigneeId: actor.userId }, { reporterId: actor.userId }],
+  };
+}
+
+export function canReassignOwner(role: string | null | undefined): boolean {
+  return elevated(role);
+}
+
+export type OrgRole = UserRole;