fix: Don't let items bleed between orgs when not admin

src/actions/expenses.ts

@@ -9,13 +9,16 @@ import SessionService from '@/services/sessionService';
 import UserService from '@/services/userService';
 import { ExpenseType, RequestStatus } from '@prisma/client';
 
-export async function getExpensesForGroup(gammaSuperGroupId: string) {
+export async function getExpensesForGroup(
+  orgId: number,
+  gammaSuperGroupId: string
+) {
   if (!SessionService.canEditGroup(gammaSuperGroupId)) {
     throw new Error(
       'User does not have permission to view expenses for this group'
     );
   }
-  return ExpenseService.getForGroup(gammaSuperGroupId);
+  return ExpenseService.getForGroup(orgId, gammaSuperGroupId);
 }
 
 export async function createExpenseForGroup(
@@ -121,7 +124,9 @@ export async function editExpense(
   if (gammaGroupId !== null) {
     group = userGroups.find((g) => g.group.id === gammaGroupId)?.group;
     if (group === undefined) {
-      throw new Error('Group does not exist or user does not have access to it');
+      throw new Error(
+        'Group does not exist or user does not have access to it'
+      );
     }
   }
 

src/actions/invoices.ts

@@ -4,13 +4,16 @@ import InvoiceService from '@/services/invoiceService';
 import SessionService from '@/services/sessionService';
 import { Prisma, RequestStatus } from '@prisma/client';
 
-export async function getInvoicesForGroup(gammaSuperGroupId: string) {
+export async function getInvoicesForGroup(
+  orgId: number,
+  gammaSuperGroupId: string
+) {
   if (!SessionService.canEditGroup(gammaSuperGroupId)) {
     throw new Error(
       'User does not have permission to view invoices for this group'
     );
   }
-  return InvoiceService.getForGroup(gammaSuperGroupId);
+  return InvoiceService.getForGroup(orgId, gammaSuperGroupId);
 }
 
 export async function createInvoiceForGroup(
@@ -106,7 +109,9 @@ export async function editInvoice(
   if (gammaGroupId !== null) {
     group = userGroups.find((g) => g.group.id === gammaGroupId)?.group;
     if (group === undefined) {
-      throw new Error('Group does not exist or user does not have access to it');
+      throw new Error(
+        'Group does not exist or user does not have access to it'
+      );
     }
   }
 

src/app/[locale]/org/[orgId]/expenses/page.tsx

@@ -25,7 +25,7 @@ export default async function Page(props: {
   const expenses = await GammaService.includeUserInfo(
     await (divisionTreasurer
       ? ExpenseService.getAll(Number(orgId))
-      : SessionService.getExpenses())
+      : SessionService.getExpenses(Number(orgId)))
   );
 
   return (

src/app/[locale]/org/[orgId]/invoices/page.tsx

@@ -25,8 +25,8 @@ export default async function Page(props: {
   const divisionTreasurer = await SessionService.isDivisionTreasurer();
   const invoices = await GammaService.includeUserInfo(
     await (divisionTreasurer
-      ? InvoiceService.getAll()
-      : SessionService.getInvoices())
+      ? InvoiceService.getAll(Number(orgId))
+      : SessionService.getInvoices(Number(orgId)))
   );
 
   return (

src/app/[locale]/org/[orgId]/name-lists/page.tsx

@@ -25,8 +25,8 @@ export default async function Page(props: {
   const divisionTreasurer = await SessionService.isDivisionTreasurer();
   const lists = await GammaService.includeUserInfo(
     await (divisionTreasurer
-      ? NameListService.getAll()
-      : SessionService.getNameLists())
+      ? NameListService.getAll(Number(orgId))
+      : SessionService.getNameLists(Number(orgId)))
   );
 
   return (

src/app/[locale]/org/[orgId]/page.tsx

@@ -39,10 +39,10 @@ export default async function Home(props: {
   const divisionTreasurer = await SessionService.isDivisionTreasurer();
   const unpaid = await (divisionTreasurer
     ? ExpenseService.getUnpaid(organization.id)
-    : SessionService.getExpenses());
+    : SessionService.getExpenses(organization.id));
   const unsent = await (divisionTreasurer
     ? InvoiceService.getUnsent(organization.id)
-    : SessionService.getInvoices());
+    : SessionService.getInvoices(organization.id));
 
   const bankAccounts = divisionTreasurer
     ? await BankAccountService.getAll()

src/app/[locale]/org/[orgId]/zettle-sales/page.tsx

@@ -25,8 +25,8 @@ export default async function Page(props: {
   const divisionTreasurer = await SessionService.isDivisionTreasurer();
   const sales = await GammaService.includeUserInfo(
     await (divisionTreasurer
-      ? ZettleSaleService.getAll()
-      : SessionService.getZettleSales())
+      ? ZettleSaleService.getAll(Number(orgId))
+      : SessionService.getZettleSales(Number(orgId)))
   );
 
   return (

src/services/expenseService.ts

@@ -50,10 +50,11 @@ export default class ExpenseService {
     return expenses;
   }
 
-  static async getForGroup(gammaGroupId: string) {
+  static async getForGroup(orgId: number, gammaGroupId: string) {
     const expenses = await prisma.expense.findMany({
       where: {
-        gammaGroupId
+        gammaGroupId,
+        organizationId: orgId
       },
       include: {
         receipts: {
@@ -78,12 +79,13 @@ export default class ExpenseService {
     return expense;
   }
 
-  static async getForUser(gammaUserId: string) {
+  static async getForUser(orgId: number, gammaUserId: string) {
     return await prisma.expense.findMany({
       where: {
         gammaSuperGroupId: null,
         gammaGroupId: null,
-        gammaUserId
+        gammaUserId,
+        organizationId: orgId
       },
       include: {
         receipts: {
@@ -94,12 +96,14 @@ export default class ExpenseService {
   }
 
   static async getForUserWithGroups(
+    orgId: number,
     gammaUserId: string,
     groups: string[],
     superGroups: string[]
   ) {
     return await prisma.expense.findMany({
       where: {
+        organizationId: orgId,
         OR: [
           {
             gammaUserId

src/services/invoiceService.ts

@@ -2,19 +2,23 @@ import prisma from '@/prisma';
 import { InvoiceItemVat, Prisma, RequestStatus } from '@prisma/client';
 
 export default class InvoiceService {
-  static async getAll() {
+  static async getAll(orgId: number) {
     return await prisma.invoice.findMany({
+      where: {
+        organizationId: orgId
+      },
       include: {
         items: true
       }
     });
   }
 
-  static async getUnsentCount(gammaGroupId?: string) {
+  static async getUnsentCount(orgId: number, gammaGroupId?: string) {
     return await prisma.invoice.count({
       where: {
         gammaGroupId,
-        sentAt: null
+        sentAt: null,
+        organizationId: orgId
       }
     });
   }
@@ -30,10 +34,11 @@ export default class InvoiceService {
     });
   }
 
-  static async getForSuperGroup(gammaSuperGroupId: string) {
+  static async getForSuperGroup(orgId: number, gammaSuperGroupId: string) {
     const expenses = await prisma.invoice.findMany({
       where: {
-        gammaSuperGroupId
+        gammaSuperGroupId,
+        organizationId: orgId
       },
       include: {
         items: true
@@ -54,10 +59,11 @@ export default class InvoiceService {
     return expense;
   }
 
-  static async getForGroup(gammaGroupId: string) {
+  static async getForGroup(orgId: number, gammaGroupId: string) {
     const expenses = await prisma.invoice.findMany({
       where: {
-        gammaGroupId
+        gammaGroupId,
+        organizationId: orgId
       },
       include: {
         items: true
@@ -66,12 +72,13 @@ export default class InvoiceService {
     return expenses;
   }
 
-  static async getForUser(gammaUserId: string) {
+  static async getForUser(orgId: number, gammaUserId: string) {
     return await prisma.invoice.findMany({
       where: {
         gammaSuperGroupId: null,
         gammaGroupId: null,
-        gammaUserId
+        gammaUserId,
+        organizationId: orgId
       },
       include: {
         items: true
@@ -80,12 +87,14 @@ export default class InvoiceService {
   }
 
   static async getForUserWithGroups(
+    orgId: number,
     gammaUserId: string,
     groups: string[],
     superGroups: string[]
   ) {
     return await prisma.invoice.findMany({
       where: {
+        organizationId: orgId,
         OR: [
           {
             gammaUserId

src/services/nameListService.ts

@@ -3,19 +3,23 @@ import { NameListType, Prisma } from '@prisma/client';
 import i18nService from './i18nService';
 
 export default class NameListService {
-  static async getAll() {
+  static async getAll(orgId: number) {
     return await prisma.nameList.findMany({
+      where: {
+        organizationId: orgId
+      },
       include: {
         names: true,
         gammaNames: true
       }
     });
   }
 
-  static async getForSuperGroup(gammaSuperGroupId: string) {
+  static async getForSuperGroup(orgId: number, gammaSuperGroupId: string) {
     const expenses = await prisma.nameList.findMany({
       where: {
-        gammaSuperGroupId
+        gammaSuperGroupId,
+        organizationId: orgId
       },
       include: {
         names: true,
@@ -38,10 +42,11 @@ export default class NameListService {
     return expense;
   }
 
-  static async getForGroup(gammaGroupId: string) {
+  static async getForGroup(orgId: number, gammaGroupId: string) {
     const expenses = await prisma.nameList.findMany({
       where: {
-        gammaGroupId
+        gammaGroupId,
+        organizationId: orgId
       },
       include: {
         names: true,
@@ -51,12 +56,13 @@ export default class NameListService {
     return expenses;
   }
 
-  static async getForUser(gammaUserId: string) {
+  static async getForUser(orgId: number, gammaUserId: string) {
     return await prisma.nameList.findMany({
       where: {
         gammaSuperGroupId: null,
         gammaGroupId: null,
-        gammaUserId
+        gammaUserId,
+        organizationId: orgId
       },
       include: {
         names: true,
@@ -66,12 +72,14 @@ export default class NameListService {
   }
 
   static async getForUserWithGroups(
+    orgId: number,
     gammaUserId: string,
     groups: string[],
     superGroups: string[]
   ) {
     return await prisma.nameList.findMany({
       where: {
+        organizationId: orgId,
         OR: [
           {
             gammaUserId

src/services/sessionService.ts

@@ -56,47 +56,51 @@ export default class SessionService {
       : [];
   }
 
-  static async getInvoices(s?: Session | null) {
+  static async getInvoices(orgId: number, s?: Session | null) {
     const session = s ?? (await SessionService.getSession());
     const groupIds = (await this.getGroups(session)).map((g) => g.group.id);
     return session?.user?.id
       ? await InvoiceService.getForUserWithGroups(
+          orgId,
           session?.user?.id!,
           groupIds,
           []
         )
       : [];
   }
 
-  static async getExpenses(s?: Session | null) {
+  static async getExpenses(orgId: number, s?: Session | null) {
     const session = s ?? (await SessionService.getSession());
     const groupIds = (await this.getGroups(session)).map((g) => g.group.id);
     return session?.user?.id
       ? await ExpenseService.getForUserWithGroups(
+          orgId,
           session?.user?.id!,
           groupIds,
           []
         )
       : [];
   }
 
-  static async getNameLists(s?: Session | null) {
+  static async getNameLists(orgId: number, s?: Session | null) {
     const session = s ?? (await SessionService.getSession());
     const groupIds = (await this.getGroups(session)).map((g) => g.group.id);
     return session?.user?.id
       ? await NameListService.getForUserWithGroups(
+          orgId,
           session?.user?.id!,
           groupIds,
           []
         )
       : [];
   }
 
-  static async getZettleSales(s?: Session | null) {
+  static async getZettleSales(orgId: number, s?: Session | null) {
     const session = s ?? (await SessionService.getSession());
     const groupIds = (await this.getGroups(session)).map((g) => g.group.id);
     return session?.user?.id
       ? await ZettleSaleService.getForUserWithGroups(
+          orgId,
           session?.user?.id!,
           groupIds,
           []