45 lines
1.3 KiB
TypeScript
45 lines
1.3 KiB
TypeScript
import { prisma } from './db'
|
|
import { UserPayload } from './auth'
|
|
|
|
/**
|
|
* Get the tenantId filter for data queries.
|
|
* - SERVER_ADMIN: no filter (sees everything)
|
|
* - All others: filter by their tenantId
|
|
*/
|
|
export function getTenantFilter(user: UserPayload): Record<string, any> {
|
|
if (user.role === 'SERVER_ADMIN') return {}
|
|
if (!user.tenantId) return { ownerId: user.id } // no tenant → only own projects
|
|
// Tenant user: see tenant projects + own legacy projects (tenantId=null)
|
|
return {
|
|
OR: [
|
|
{ tenantId: user.tenantId },
|
|
{ ownerId: user.id, tenantId: null },
|
|
],
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if a user has access to a specific project.
|
|
* Returns the project if access is granted, null otherwise.
|
|
*/
|
|
export async function getProjectWithTenantCheck(projectId: string, user: UserPayload) {
|
|
const project = await (prisma as any).project.findUnique({
|
|
where: { id: projectId },
|
|
})
|
|
if (!project) return null
|
|
|
|
// SERVER_ADMIN can access all projects
|
|
if (user.role === 'SERVER_ADMIN') return project
|
|
|
|
// Projects without tenantId (legacy): allow if user is the owner
|
|
if (!project.tenantId) {
|
|
if (project.ownerId === user.id) return project
|
|
return null
|
|
}
|
|
|
|
// All others: must belong to same tenant
|
|
if (project.tenantId !== user.tenantId) return null
|
|
|
|
return project
|
|
}
|