Doormile/doormile_backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: filter console reads by tenant, for clients and for Doormile staff

Browse Source 
Two halves of the same thing. A client login was already pinned to its own
tenant on most reads, but the roster, the B2C customer list and the dashboard
counters were not — a DailyGrubs login listed the whole network's riders.

The other half was missing entirely: Doormile's own staff had no way to look
at one client's slice. Reports accepted ?tenantid= but applied it only to the
consignment count, and bookings accepted it while milers, customers,
consignments and the dashboard ignored it.

effectiveTenantID(c) now resolves both cases in one place — the caller's own
tenant for a client login, the requested one for Doormile staff, 0 for the
whole network. A client asking for someone else's tenantid is refused rather
than silently handed their own data back under the wrong label.

Applied to: milers, customers, bookings, consignments, dashboard, reports and
the rider summary.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Suriya
2026-08-06 12:01:13 +05:30
parent d85d5571b8
commit 42f2a41ff6
2 changed files with 137 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
controllers/adminMilerOpsController.go
View File

@@ -53,16 +53,18 @@ func assertMilerAccess(c *fiber.Ctx, milerProfileID int) (*models.MilerProfile,
return &profile, nil
}
// visibleMilerUserIDs lists the appusers.userid of every rider the caller may
// see. Returns nil for Doormile staff, meaning "no restriction".
func visibleMilerUserIDs(c *fiber.Ctx) []int {
own := consoleTenantID(c)
if own == 0 {
return nil
// visibleMilerUserIDs lists the appusers.userid of every rider the request
// should cover — the caller's own fleet for a client login, or the tenant
// Doormile staff asked for with ?tenantid=. Returns nil for "no restriction".
func visibleMilerUserIDs(c *fiber.Ctx) ([]int, error) {
tenantID, err := effectiveTenantID(c)
if err != nil {
return nil, err
}
var ids []int
db.DB.Model(&models.AppUser{}).Where("tenantid = ? AND roleid = ?", own, 5).Pluck("userid", &ids)
return ids
if tenantID == 0 {
return nil, nil
}
return milerUserIDsForTenant(tenantID), nil
}
// milerSummaryRow is one line of the roster table — the shape the console's
@@ -113,7 +115,11 @@ func GetMilerSummary(c *fiber.Ctx) error {
if hubID := c.Query("hubid"); hubID != "" {
query = query.Where("hubid = ?", hubID)
}
if visible := visibleMilerUserIDs(c); visible != nil {
visible, verr := visibleMilerUserIDs(c)
if verr != nil {
return verr
}
if visible != nil {
if len(visible) == 0 {
return utils.List(c, []milerSummaryRow{}, 0)
}