kovakmedya
1f79abe404
User-level data privacy on finance entities. Bireysel = sadece sahibi
görür/düzenler/siler, Şirket = takım görür (mevcut davranış).
Schema additions (4 tables, all enum company|personal default 'company'):
- bank_accounts.scope
- bank_loans.scope
- credit_cards.scope
- finance_entries.scope
+ tenantId_scope index on each.
Inherited fields (no own scope, parent's used):
- loan_installments → from bank_loan
- credit_card_statements → from credit_card
Permissions (lib/appwrite/scope-permissions.ts):
- scopedRowPermissions(tenantId, createdBy, scope):
* company: Permission.read/update Role.team(tenantId), delete Role.team
owner|admin (current behavior)
* personal: read/update/delete Role.user(createdBy) only
- canAccessRow(row, userId): true if scope=company OR createdBy=userId.
Used as a defense-in-depth check inside actions because we use the
admin SDK (which bypasses row-level perms).
Action updates:
- bank-account-actions, loan-actions, credit-card-actions, finance-actions:
pickFormFields includes scope; create uses scopedRowPermissions; update
re-applies perms when scope changes; update/delete check canAccessRow
on top of the existing tenantId check.
- loan installment payment & credit card statement payment auto-create
finance entries that inherit the parent's scope, so a personal loan
installment doesn't create a company income/expense.
Query updates (all accept optional currentUserId):
- listBankAccounts, listLoans, listCreditCards, listFinanceEntries:
pull all tenant rows then in-JS filter via canAccessRow.
- getBankAccountBalances respects visible accounts only.
- listAllInstallments / listStatements: filter to only those whose
parent loan/card is visible.
UI:
- New shared component components/finance/scope-toggle.tsx with
ScopeToggle (form input) and ScopeBadge (visual marker).
- Bank, loan, card form sheets and the finance form sheet now include
a Şirket/Bireysel toggle at the top.
- Bank account cards display ScopeBadge for personal entries.
- Page-level queries everywhere now pass ctx.user.id so each user only
sees their personal rows + the team's company rows.
Reports & Dashboard:
- getDashboardData filters finance entries to scope=company only — so
team-level metrics never include any user's personal data.
- getFinancialReport (CFO view): bank accounts, loans, cards, finance
entries, installments and statements all filtered to company scope.
Personal entities never appear in reports anywhere.
Invoice → finance entry sync explicitly tags scope=company since invoices
are inherently company-scope.
37 lines
1.6 KiB
TypeScript
37 lines
1.6 KiB
TypeScript
import { z } from "zod";
|
||
|
||
export const bankLoanSchema = z.object({
|
||
bankAccountId: z.string().optional().transform((v) => (v ? v : undefined)),
|
||
bankName: z.string().trim().min(1, "Banka adı zorunlu.").max(100),
|
||
loanName: z.string().trim().min(1, "Kredi adı zorunlu.").max(150),
|
||
loanType: z
|
||
.enum(["consumer", "vehicle", "housing", "commercial", "kmh", "other"])
|
||
.optional()
|
||
.default("consumer"),
|
||
principal: z
|
||
.union([z.number(), z.string()])
|
||
.transform((v) => (typeof v === "string" ? Number(v.replace(",", ".")) : v))
|
||
.pipe(z.number().positive("Anapara 0'dan büyük olmalı.")),
|
||
interestRate: z
|
||
.union([z.number(), z.string()])
|
||
.transform((v) => (typeof v === "string" ? Number(v.replace(",", ".")) : v))
|
||
.pipe(z.number().min(0, "Negatif olamaz.").max(100, "100'den büyük olamaz.")),
|
||
termMonths: z
|
||
.union([z.number(), z.string()])
|
||
.transform((v) => (typeof v === "string" ? parseInt(v, 10) : v))
|
||
.pipe(z.number().int().positive("Vade pozitif olmalı.").max(480, "Çok uzun.")),
|
||
startDate: z.string().min(1, "Başlangıç tarihi zorunlu."),
|
||
paymentDay: z
|
||
.union([z.number(), z.string()])
|
||
.optional()
|
||
.transform((v) => {
|
||
if (v === undefined || v === "") return 1;
|
||
const n = typeof v === "string" ? parseInt(v, 10) : v;
|
||
return Number.isFinite(n) ? Math.min(28, Math.max(1, n)) : 1;
|
||
}),
|
||
notes: z.string().trim().max(1000).optional().transform((v) => (v ? v : undefined)),
|
||
scope: z.enum(["company", "personal"]).optional().default("company"),
|
||
});
|
||
|
||
export type BankLoanInput = z.infer<typeof bankLoanSchema>;
|