- Add AccountType, NormalBalance, PeriodStatus enums to schema
- Add Account model with tenant scoping, code/name/type/normalBalance/parentId
- Add AccountingPeriod model with year/month/status/closedAt/closedById
- Create ISP_CHART_OF_ACCOUNTS with 28 accounts across all 5 types (1000-5000 ranges)
- Create accounting-period.ts with getOpenPeriod, closePeriod, isDateInClosedPeriod
- Extend TENANT_SCOPED_MODELS with account and accountingPeriod
- Add full query extension blocks for account and accountingPeriod in withTenantContext
- Run migration: 20260304144656_add_accounting_models
- withSuperAdmin() HOF: checks isSuperAdmin from session, returns 401/403
- GET /api/admin/tenants: lists all tenants with userCount, subscriberCount
- GET /api/admin/tenants/[id]: single tenant detail with users list
- POST /api/admin/tenants/[id]/suspend: suspend/activate with 7-day grace
- prisma/seed.ts: add Test ISP 2 tenant and admin2@demo.com for isolation tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create src/lib/middleware/authorize.ts with withPermission() HOF
- Returns 401 for unauthenticated, 403 for unauthorized access
- Passes ability + user to authorized handlers for fine-grained checks
- Add authorize() convenience alias for handler-first usage pattern
- Create src/lib/__tests__/rbac.test.ts with 66 unit tests covering:
- Admin full access to all subjects
- Office Staff: can manage billing, blocked from Chart of Accounts
- Collector: can record payments, blocked from invoice management
- Technician: blocked from billing/payments (critical security boundary)
- Client: scoped to own data only
- Multi-role additive union (TECHNICIAN+COLLECTOR gets both sets)
- Super-admin bypasses all permission checks
- Fix CASL MongoAbility type: use createMongoAbility throughout
- Fix condition casting for string-based subjects (no Prisma models yet)
- Fix ability merging: cannot() rules excluded for multi-role union
- Install @casl/ability for role-based access control
- Create src/lib/casl/types.ts with AppAbility, AppSubjects, AppActions types
- Create src/lib/casl/permissions.ts with permission matrix for all 5 roles
- Create src/lib/casl/ability.ts with defineAbilityFor() factory function
- Support multi-role users via additive union of permissions
- Super-admin bypasses all permission checks via can("manage", "all")
- Create src/lib/prisma-tenant.ts:
- withTenantContext(tenantId) / createTenantPrisma — Prisma $extends client
- Intercepts findMany, findFirst, findUnique, create, createMany, update,
updateMany, delete, deleteMany, upsert, count, aggregate, groupBy on User
- Auto-injects tenantId filter on all reads, writes, and deletes
- setTenantRLS() helper for explicit RLS enforcement in transactions
- TENANT_SCOPED_MODELS constant for future extensibility
- Create prisma/migrations/20260304104214_initial_schema — baseline migration
capturing schema created by initial db push
- Create prisma/migrations/20260304104245_add_rls_policies:
- ALTER TABLE User ENABLE ROW LEVEL SECURITY
- CREATE POLICY tenant_isolation_user USING app.current_tenant_id session var
- Defense-in-depth architecture comments explaining primary vs secondary enforcement
- Create src/lib/__tests__/tenant-isolation.test.ts (6 tests, all passing):
- Test 1: Tenant A context returns only Tenant A's users (zero from B)
- Test 2: Tenant B context returns only Tenant B's users (zero from A)
- Test 3: create() auto-sets tenantId, invisible to other tenant
- Test 4: findUnique by Tenant B's ID under Tenant A context returns null
- Additional: findFirst cross-tenant blocked, count() is tenant-scoped
