---
phase: 05-visibility-and-client-portal
plan: 06
type: execute
wave: 1
depends_on: []
files_modified:
- src/lib/prisma-tenant.ts
- src/lib/casl/types.ts
- src/lib/casl/permissions.ts
- src/app/api/collections/route.ts
- src/app/api/collections/[id]/route.ts
- src/app/api/collections/[id]/void/route.ts
- src/app/api/remittances/route.ts
- src/app/api/remittances/[id]/verify/route.ts
- src/app/api/reports/collections/route.ts
autonomous: true
gap_closure: true
must_haves:
truths:
- "All 6 missing models (expense, expenseCategory, inventoryItem, stockMovement, vendor, ticketComment) are registered in TENANT_SCOPED_MODELS and have $extends query blocks"
- "Collection and remittance API routes use dedicated CASL subjects instead of borrowing Subscriber"
artifacts:
- path: "src/lib/prisma-tenant.ts"
provides: "Tenant scoping for all 28 tenant-scoped models"
contains: "expense.*expenseCategory.*inventoryItem.*stockMovement.*vendor.*ticketComment"
- path: "src/lib/casl/types.ts"
provides: "Collection and Remittance subjects in AppSubjects"
contains: "Collection.*Remittance"
- path: "src/lib/casl/permissions.ts"
provides: "Collection and Remittance permission rules per role"
contains: "Collection.*Remittance"
key_links:
- from: "src/lib/prisma-tenant.ts"
to: "withTenantContext query extensions"
via: "TENANT_SCOPED_MODELS array + $extends blocks"
pattern: "expense.*expenseCategory.*inventoryItem.*stockMovement.*vendor.*ticketComment"
- from: "src/app/api/collections/route.ts"
to: "src/lib/casl/permissions.ts"
via: "withPermission HOF"
pattern: "withPermission.*Collection"
---
Fix the P0 tenant isolation security gap and correct CASL subject naming for collection/remittance routes.
Purpose: Close the critical multi-tenancy vulnerability where 6 models bypass application-layer tenant scoping, and improve permission precision by giving collection/remittance routes their own CASL subjects.
Output: Updated prisma-tenant.ts with all 6 missing models, updated CASL types and permissions, updated collection/remittance route handlers.
@C:\Users\KevinAsprec\.claude/get-shit-done/workflows/execute-plan.md
@C:\Users\KevinAsprec\.claude/get-shit-done/templates/summary.md
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/v1-MILESTONE-AUDIT.md
@src/lib/prisma-tenant.ts
@src/lib/casl/types.ts
@src/lib/casl/permissions.ts
Task 1: Add 6 missing models to tenant scoping
src/lib/prisma-tenant.ts
1. Add the 6 missing model names to the TENANT_SCOPED_MODELS array on line 33:
- "expense"
- "expenseCategory"
- "inventoryItem"
- "stockMovement"
- "vendor"
- "ticketComment"
2. Add $extends query blocks for each of the 6 models inside withTenantContext(), following the EXACT same pattern used by existing models (e.g., the `ticket` or `collection` blocks). Each model needs these query methods:
- findMany: inject tenantId into args.where
- findFirst: inject tenantId into args.where
- findFirstOrThrow: inject tenantId into args.where
- findUnique: route through findFirst with tenant guard (same pattern as existing models — check if "id" in args.where without tenantId, then use prisma.{model}.findFirst with tenantId)
- findUniqueOrThrow: same findFirst routing with throw on null
- create: strip nested tenant relation, inject tenantId into args.data
- createMany: handle array and single data, strip tenant, inject tenantId
- update: inject tenantId into args.where
- updateMany: inject tenantId into args.where
- delete: inject tenantId into args.where
- deleteMany: inject tenantId into args.where
- upsert: inject tenantId into args.where, strip tenant from args.create, inject tenantId
- count: inject tenantId into args.where
- aggregate: inject tenantId into args.where
Place the 6 new model blocks AFTER the existing `jobTypeRate` block (last current model at line ~1804) and BEFORE the closing of the $extends object.
IMPORTANT: Use the exact same eslint-disable comments as existing blocks for the tenant destructuring pattern. Copy the pattern from an existing block like `ticket` or `collection` verbatim — do NOT invent a new pattern.
1. Run: grep -c "expense\|expenseCategory\|inventoryItem\|stockMovement\|vendor\|ticketComment" src/lib/prisma-tenant.ts — should show multiple matches per model
2. Run: node -e "const t = require('./src/lib/prisma-tenant'); console.log(t.TENANT_SCOPED_MODELS)" — verify all 28 models listed (or use TypeScript compilation check)
3. Run: npx tsc --noEmit — no type errors
4. Run: npx jest --testPathPattern="tenant|rbac|e2e" --passWithNoTests — existing tests still pass
TENANT_SCOPED_MODELS contains all 28 models. Each of the 6 new models has a complete $extends query block matching the established pattern. TypeScript compiles. Existing tests pass.
Task 2: Add Collection and Remittance CASL subjects and update routes
src/lib/casl/types.ts, src/lib/casl/permissions.ts, src/app/api/collections/route.ts, src/app/api/collections/[id]/route.ts, src/app/api/collections/[id]/void/route.ts, src/app/api/remittances/route.ts, src/app/api/remittances/[id]/verify/route.ts, src/app/api/reports/collections/route.ts
1. In src/lib/casl/types.ts, add "Collection" and "Remittance" to the AppSubjects union type (after "Payment", before "Zone").
2. In src/lib/casl/permissions.ts, update permission rules:
- OFFICE_STAFF: Add `can("manage", "Collection")` and `can("manage", "Remittance")`
- COLLECTOR: Add `can("create", "Collection")`, `can("read", "Collection")`, `can("create", "Remittance")`, `can("read", "Remittance")`
- Do NOT change ADMIN (already has `can("manage", "all")`)
- Do NOT change TECHNICIAN or CLIENT (they should not access collections/remittances)
3. Update collection API routes to use "Collection" subject instead of "Subscriber":
- src/app/api/collections/route.ts: POST uses withPermission("create", "Collection"), GET uses withPermission("read", "Collection")
- src/app/api/collections/[id]/route.ts: GET uses withPermission("read", "Collection")
- src/app/api/collections/[id]/void/route.ts: uses withPermission("update", "Collection")
4. Update remittance API routes to use "Remittance" subject instead of "Subscriber":
- src/app/api/remittances/route.ts: POST uses withPermission("create", "Remittance"), GET uses withPermission("read", "Remittance")
- src/app/api/remittances/[id]/verify/route.ts: uses withPermission("update", "Remittance")
5. Update collection report route:
- src/app/api/reports/collections/route.ts: GET uses withPermission("read", "Collection") instead of withPermission("read", "Subscriber")
6. Update JSDoc comments in each route file to reflect the new subject name.
IMPORTANT: The RBAC integration tests in api-rbac.test.ts mock withPermission. After changing subjects, verify the RBAC tests still pass. If tests mock specific subjects, update them to match the new subjects.
1. Run: grep -rn "withPermission.*Subscriber" src/app/api/collections/ src/app/api/remittances/ src/app/api/reports/collections/ — should return ZERO matches
2. Run: grep -rn "withPermission.*Collection\|withPermission.*Remittance" src/app/api/ — should show all collection/remittance routes using correct subjects
3. Run: npx tsc --noEmit — no type errors
4. Run: npx jest --testPathPattern="rbac|e2e" — all tests pass
Collection and Remittance are proper CASL subjects. All collection/remittance routes use their dedicated subjects. RBAC tests pass. No route still uses "Subscriber" for collection/remittance operations.
1. TypeScript compilation passes: npx tsc --noEmit
2. All existing tests pass: npx jest
3. TENANT_SCOPED_MODELS has 28 entries (22 existing + 6 new)
4. Zero collection/remittance routes use "Subscriber" as CASL subject
5. grep for all 6 model names in prisma-tenant.ts $extends block confirms they exist
- The P0 tenant isolation gap is closed: all tenant-scoped Prisma models have automatic tenantId injection
- Collection and remittance routes use semantically correct CASL subjects
- All existing tests continue to pass
- TypeScript compiles without errors