From 354367d4679ada14fcea7d429162424ca9a37d5c Mon Sep 17 00:00:00 2001 From: Goostaf Date: Wed, 14 Jan 2026 00:29:41 +0100 Subject: [PATCH 1/3] Properly filter for session --- .../[locale]/org/[orgId]/expenses/page.tsx | 2 +- .../[locale]/org/[orgId]/invoices/page.tsx | 4 +-- .../[locale]/org/[orgId]/name-lists/page.tsx | 4 +-- src/app/[locale]/org/[orgId]/page.tsx | 4 +-- .../org/[orgId]/zettle-sales/page.tsx | 4 +-- src/services/expenseService.ts | 12 ++++++--- src/services/invoiceService.ts | 27 ++++++++++++------- src/services/nameListService.ts | 22 ++++++++++----- src/services/sessionService.ts | 12 ++++++--- src/services/zettleSaleService.ts | 20 +++++++++----- 10 files changed, 72 insertions(+), 39 deletions(-) diff --git a/src/app/[locale]/org/[orgId]/expenses/page.tsx b/src/app/[locale]/org/[orgId]/expenses/page.tsx index 81d40aa..be4c5da 100644 --- a/src/app/[locale]/org/[orgId]/expenses/page.tsx +++ b/src/app/[locale]/org/[orgId]/expenses/page.tsx @@ -25,7 +25,7 @@ export default async function Page(props: { const expenses = await GammaService.includeUserInfo( await (divisionTreasurer ? ExpenseService.getAll(Number(orgId)) - : SessionService.getExpenses()) + : SessionService.getExpenses(Number(orgId))) ); return ( diff --git a/src/app/[locale]/org/[orgId]/invoices/page.tsx b/src/app/[locale]/org/[orgId]/invoices/page.tsx index bbd6bae..eb21d3c 100644 --- a/src/app/[locale]/org/[orgId]/invoices/page.tsx +++ b/src/app/[locale]/org/[orgId]/invoices/page.tsx @@ -25,8 +25,8 @@ export default async function Page(props: { const divisionTreasurer = await SessionService.isDivisionTreasurer(); const invoices = await GammaService.includeUserInfo( await (divisionTreasurer - ? InvoiceService.getAll() - : SessionService.getInvoices()) + ? InvoiceService.getAll(Number(orgId)) + : SessionService.getInvoices(Number(orgId))) ); return ( diff --git a/src/app/[locale]/org/[orgId]/name-lists/page.tsx b/src/app/[locale]/org/[orgId]/name-lists/page.tsx index 4f9e19f..67b3547 100644 --- a/src/app/[locale]/org/[orgId]/name-lists/page.tsx +++ b/src/app/[locale]/org/[orgId]/name-lists/page.tsx @@ -25,8 +25,8 @@ export default async function Page(props: { const divisionTreasurer = await SessionService.isDivisionTreasurer(); const lists = await GammaService.includeUserInfo( await (divisionTreasurer - ? NameListService.getAll() - : SessionService.getNameLists()) + ? NameListService.getAll(Number(orgId)) + : SessionService.getNameLists(Number(orgId))) ); return ( diff --git a/src/app/[locale]/org/[orgId]/page.tsx b/src/app/[locale]/org/[orgId]/page.tsx index dc53e2c..cb042da 100644 --- a/src/app/[locale]/org/[orgId]/page.tsx +++ b/src/app/[locale]/org/[orgId]/page.tsx @@ -39,10 +39,10 @@ export default async function Home(props: { const divisionTreasurer = await SessionService.isDivisionTreasurer(); const unpaid = await (divisionTreasurer ? ExpenseService.getUnpaid(organization.id) - : SessionService.getExpenses()); + : SessionService.getExpenses(organization.id)); const unsent = await (divisionTreasurer ? InvoiceService.getUnsent(organization.id) - : SessionService.getInvoices()); + : SessionService.getInvoices(organization.id)); const bankAccounts = divisionTreasurer ? await BankAccountService.getAll() diff --git a/src/app/[locale]/org/[orgId]/zettle-sales/page.tsx b/src/app/[locale]/org/[orgId]/zettle-sales/page.tsx index 401521c..e85ba3c 100644 --- a/src/app/[locale]/org/[orgId]/zettle-sales/page.tsx +++ b/src/app/[locale]/org/[orgId]/zettle-sales/page.tsx @@ -25,8 +25,8 @@ export default async function Page(props: { const divisionTreasurer = await SessionService.isDivisionTreasurer(); const sales = await GammaService.includeUserInfo( await (divisionTreasurer - ? ZettleSaleService.getAll() - : SessionService.getZettleSales()) + ? ZettleSaleService.getAll(Number(orgId)) + : SessionService.getZettleSales(Number(orgId))) ); return ( diff --git a/src/services/expenseService.ts b/src/services/expenseService.ts index 81ac7d9..e26a2cb 100644 --- a/src/services/expenseService.ts +++ b/src/services/expenseService.ts @@ -50,10 +50,11 @@ export default class ExpenseService { return expenses; } - static async getForGroup(gammaGroupId: string) { + static async getForGroup(orgId: number, gammaGroupId: string) { const expenses = await prisma.expense.findMany({ where: { - gammaGroupId + gammaGroupId, + organizationId: orgId }, include: { receipts: { @@ -78,12 +79,13 @@ export default class ExpenseService { return expense; } - static async getForUser(gammaUserId: string) { + static async getForUser(orgId: number, gammaUserId: string) { return await prisma.expense.findMany({ where: { gammaSuperGroupId: null, gammaGroupId: null, - gammaUserId + gammaUserId, + organizationId: orgId }, include: { receipts: { @@ -94,12 +96,14 @@ export default class ExpenseService { } static async getForUserWithGroups( + orgId: number, gammaUserId: string, groups: string[], superGroups: string[] ) { return await prisma.expense.findMany({ where: { + organizationId: orgId, OR: [ { gammaUserId diff --git a/src/services/invoiceService.ts b/src/services/invoiceService.ts index 1135912..e842eb5 100644 --- a/src/services/invoiceService.ts +++ b/src/services/invoiceService.ts @@ -2,19 +2,23 @@ import prisma from '@/prisma'; import { InvoiceItemVat, Prisma, RequestStatus } from '@prisma/client'; export default class InvoiceService { - static async getAll() { + static async getAll(orgId: number) { return await prisma.invoice.findMany({ + where: { + organizationId: orgId + }, include: { items: true } }); } - static async getUnsentCount(gammaGroupId?: string) { + static async getUnsentCount(orgId: number, gammaGroupId?: string) { return await prisma.invoice.count({ where: { gammaGroupId, - sentAt: null + sentAt: null, + organizationId: orgId } }); } @@ -30,10 +34,11 @@ export default class InvoiceService { }); } - static async getForSuperGroup(gammaSuperGroupId: string) { + static async getForSuperGroup(orgId: number, gammaSuperGroupId: string) { const expenses = await prisma.invoice.findMany({ where: { - gammaSuperGroupId + gammaSuperGroupId, + organizationId: orgId }, include: { items: true @@ -54,10 +59,11 @@ export default class InvoiceService { return expense; } - static async getForGroup(gammaGroupId: string) { + static async getForGroup(orgId: number, gammaGroupId: string) { const expenses = await prisma.invoice.findMany({ where: { - gammaGroupId + gammaGroupId, + organizationId: orgId }, include: { items: true @@ -66,12 +72,13 @@ export default class InvoiceService { return expenses; } - static async getForUser(gammaUserId: string) { + static async getForUser(orgId: number, gammaUserId: string) { return await prisma.invoice.findMany({ where: { gammaSuperGroupId: null, gammaGroupId: null, - gammaUserId + gammaUserId, + organizationId: orgId }, include: { items: true @@ -80,12 +87,14 @@ export default class InvoiceService { } static async getForUserWithGroups( + orgId: number, gammaUserId: string, groups: string[], superGroups: string[] ) { return await prisma.invoice.findMany({ where: { + organizationId: orgId, OR: [ { gammaUserId diff --git a/src/services/nameListService.ts b/src/services/nameListService.ts index ba76881..e35e6d7 100644 --- a/src/services/nameListService.ts +++ b/src/services/nameListService.ts @@ -3,8 +3,11 @@ import { NameListType, Prisma } from '@prisma/client'; import i18nService from './i18nService'; export default class NameListService { - static async getAll() { + static async getAll(orgId: number) { return await prisma.nameList.findMany({ + where: { + organizationId: orgId + }, include: { names: true, gammaNames: true @@ -12,10 +15,11 @@ export default class NameListService { }); } - static async getForSuperGroup(gammaSuperGroupId: string) { + static async getForSuperGroup(orgId: number, gammaSuperGroupId: string) { const expenses = await prisma.nameList.findMany({ where: { - gammaSuperGroupId + gammaSuperGroupId, + organizationId: orgId }, include: { names: true, @@ -38,10 +42,11 @@ export default class NameListService { return expense; } - static async getForGroup(gammaGroupId: string) { + static async getForGroup(orgId: number, gammaGroupId: string) { const expenses = await prisma.nameList.findMany({ where: { - gammaGroupId + gammaGroupId, + organizationId: orgId }, include: { names: true, @@ -51,12 +56,13 @@ export default class NameListService { return expenses; } - static async getForUser(gammaUserId: string) { + static async getForUser(orgId: number, gammaUserId: string) { return await prisma.nameList.findMany({ where: { gammaSuperGroupId: null, gammaGroupId: null, - gammaUserId + gammaUserId, + organizationId: orgId }, include: { names: true, @@ -66,12 +72,14 @@ export default class NameListService { } static async getForUserWithGroups( + orgId: number, gammaUserId: string, groups: string[], superGroups: string[] ) { return await prisma.nameList.findMany({ where: { + organizationId: orgId, OR: [ { gammaUserId diff --git a/src/services/sessionService.ts b/src/services/sessionService.ts index de72aa3..04ebe11 100644 --- a/src/services/sessionService.ts +++ b/src/services/sessionService.ts @@ -56,11 +56,12 @@ export default class SessionService { : []; } - static async getInvoices(s?: Session | null) { + static async getInvoices(orgId: number, s?: Session | null) { const session = s ?? (await SessionService.getSession()); const groupIds = (await this.getGroups(session)).map((g) => g.group.id); return session?.user?.id ? await InvoiceService.getForUserWithGroups( + orgId, session?.user?.id!, groupIds, [] @@ -68,11 +69,12 @@ export default class SessionService { : []; } - static async getExpenses(s?: Session | null) { + static async getExpenses(orgId: number, s?: Session | null) { const session = s ?? (await SessionService.getSession()); const groupIds = (await this.getGroups(session)).map((g) => g.group.id); return session?.user?.id ? await ExpenseService.getForUserWithGroups( + orgId, session?.user?.id!, groupIds, [] @@ -80,11 +82,12 @@ export default class SessionService { : []; } - static async getNameLists(s?: Session | null) { + static async getNameLists(orgId: number, s?: Session | null) { const session = s ?? (await SessionService.getSession()); const groupIds = (await this.getGroups(session)).map((g) => g.group.id); return session?.user?.id ? await NameListService.getForUserWithGroups( + orgId, session?.user?.id!, groupIds, [] @@ -92,11 +95,12 @@ export default class SessionService { : []; } - static async getZettleSales(s?: Session | null) { + static async getZettleSales(orgId: number, s?: Session | null) { const session = s ?? (await SessionService.getSession()); const groupIds = (await this.getGroups(session)).map((g) => g.group.id); return session?.user?.id ? await ZettleSaleService.getForUserWithGroups( + orgId, session?.user?.id!, groupIds, [] diff --git a/src/services/zettleSaleService.ts b/src/services/zettleSaleService.ts index bc0b431..42f5f3e 100644 --- a/src/services/zettleSaleService.ts +++ b/src/services/zettleSaleService.ts @@ -1,35 +1,43 @@ import prisma from '@/prisma'; export default class ZettleSaleService { - static async getAll() { - return await prisma.zettleSale.findMany(); + static async getAll(orgId: number) { + return await prisma.zettleSale.findMany({ + where: { + organizationId: orgId + } + }); } - static async getForSuperGroup(gammaSuperGroupId: string) { + static async getForSuperGroup(orgId: number, gammaSuperGroupId: string) { const expenses = await prisma.zettleSale.findMany({ where: { - gammaSuperGroupId + gammaSuperGroupId, + organizationId: orgId } }); return expenses; } - static async getForGroup(gammaGroupId: string) { + static async getForGroup(orgId: number, gammaGroupId: string) { const expenses = await prisma.zettleSale.findMany({ where: { - gammaGroupId + gammaGroupId, + organizationId: orgId } }); return expenses; } static async getForUserWithGroups( + orgId: number, gammaUserId: string, groupIds: string[], superGroupIds: string[] ) { const expenses = await prisma.zettleSale.findMany({ where: { + organizationId: orgId, OR: [ { gammaGroupId: { From efeec9c54311498bf039700386fc9557fa6e0b0f Mon Sep 17 00:00:00 2001 From: Goostaf Date: Sun, 18 Jan 2026 12:30:20 +0100 Subject: [PATCH 2/3] Add orgId to getExpensesForGroup --- src/actions/expenses.ts | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/actions/expenses.ts b/src/actions/expenses.ts index 1b3167f..6095c08 100644 --- a/src/actions/expenses.ts +++ b/src/actions/expenses.ts @@ -9,13 +9,16 @@ import SessionService from '@/services/sessionService'; import UserService from '@/services/userService'; import { ExpenseType, RequestStatus } from '@prisma/client'; -export async function getExpensesForGroup(gammaSuperGroupId: string) { +export async function getExpensesForGroup( + orgId: number, + gammaSuperGroupId: string +) { if (!SessionService.canEditGroup(gammaSuperGroupId)) { throw new Error( 'User does not have permission to view expenses for this group' ); } - return ExpenseService.getForGroup(gammaSuperGroupId); + return ExpenseService.getForGroup(orgId, gammaSuperGroupId); } export async function createExpenseForGroup( @@ -121,7 +124,9 @@ export async function editExpense( if (gammaGroupId !== null) { group = userGroups.find((g) => g.group.id === gammaGroupId)?.group; if (group === undefined) { - throw new Error('Group does not exist or user does not have access to it'); + throw new Error( + 'Group does not exist or user does not have access to it' + ); } } From 95a4b81fea9d2c16437496a88e972ee6008ebdc5 Mon Sep 17 00:00:00 2001 From: Goostaf Date: Sun, 18 Jan 2026 12:40:31 +0100 Subject: [PATCH 3/3] Add orgId to getInvoicesForGroup --- src/actions/invoices.ts | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/actions/invoices.ts b/src/actions/invoices.ts index 393804a..b0737c9 100644 --- a/src/actions/invoices.ts +++ b/src/actions/invoices.ts @@ -4,13 +4,16 @@ import InvoiceService from '@/services/invoiceService'; import SessionService from '@/services/sessionService'; import { Prisma, RequestStatus } from '@prisma/client'; -export async function getInvoicesForGroup(gammaSuperGroupId: string) { +export async function getInvoicesForGroup( + orgId: number, + gammaSuperGroupId: string +) { if (!SessionService.canEditGroup(gammaSuperGroupId)) { throw new Error( 'User does not have permission to view invoices for this group' ); } - return InvoiceService.getForGroup(gammaSuperGroupId); + return InvoiceService.getForGroup(orgId, gammaSuperGroupId); } export async function createInvoiceForGroup( @@ -106,7 +109,9 @@ export async function editInvoice( if (gammaGroupId !== null) { group = userGroups.find((g) => g.group.id === gammaGroupId)?.group; if (group === undefined) { - throw new Error('Group does not exist or user does not have access to it'); + throw new Error( + 'Group does not exist or user does not have access to it' + ); } }