From 95ef3f42628569368baea866dbdc7bfea34a69bd Mon Sep 17 00:00:00 2001 From: HafizMMoaz Date: Tue, 14 Jul 2026 05:44:44 +0500 Subject: [PATCH] Confine every Account query to the authenticated user's tenant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same cross-tenant IDOR as the other modules: mutations were authorised with a capability check alone, which every tenant's staff passes, so another company's id resolved fine and was then read, edited or deleted — here across the chart of accounts, invoices, payments, expenses and journal entries. The boundary now lives on the models via App\Models\Concerns\TenantScoped. 23 tables carry created_by; the four that do not (credit/debit note items, their taxes, vendor payment allocations) inherit it through their parent. 33 exists: rules are scoped by hand, since they go through the query builder and never see an Eloquent scope. Two of them point at sales_invoices and purchase_invoices, owned by another module — without scoping those, a payment could still be allocated against another company's invoice. AccountUtility provisions a NEW company's chart of accounts from someone else's session, so its five lookups opt out of the scope explicitly. --- src/Helpers/AccountUtility.php | 10 +++++----- src/Http/Controllers/CustomerPaymentController.php | 2 +- src/Http/Controllers/VendorPaymentController.php | 2 +- src/Http/Requests/StoreAccountTypeRequest.php | 2 +- src/Http/Requests/StoreBankAccountRequest.php | 2 +- src/Http/Requests/StoreBankTransferRequest.php | 4 ++-- src/Http/Requests/StoreChartOfAccountRequest.php | 4 ++-- src/Http/Requests/StoreCustomerPaymentRequest.php | 6 +++--- src/Http/Requests/StoreExpenseCategoriesRequest.php | 2 +- src/Http/Requests/StoreExpenseRequest.php | 6 +++--- src/Http/Requests/StoreRevenueCategoriesRequest.php | 2 +- src/Http/Requests/StoreRevenueRequest.php | 6 +++--- src/Http/Requests/StoreVendorPaymentRequest.php | 6 +++--- src/Http/Requests/UpdateBankAccountRequest.php | 2 +- src/Http/Requests/UpdateBankTransferRequest.php | 4 ++-- src/Http/Requests/UpdateChartOfAccountRequest.php | 4 ++-- src/Http/Requests/UpdateExpenseCategoriesRequest.php | 2 +- src/Http/Requests/UpdateExpenseRequest.php | 6 +++--- src/Http/Requests/UpdateRevenueCategoriesRequest.php | 2 +- src/Http/Requests/UpdateRevenueRequest.php | 6 +++--- src/Models/AccountCategory.php | 3 ++- src/Models/AccountType.php | 3 ++- src/Models/BankAccount.php | 3 ++- src/Models/BankTransaction.php | 3 +++ src/Models/BankTransfer.php | 3 ++- src/Models/ChartOfAccount.php | 3 ++- src/Models/CreditNote.php | 3 +++ src/Models/CreditNoteApplication.php | 3 +++ src/Models/CreditNoteItem.php | 6 ++++++ src/Models/CreditNoteItemTax.php | 6 ++++++ src/Models/Customer.php | 3 ++- src/Models/CustomerPayment.php | 3 +++ src/Models/CustomerPaymentAllocation.php | 3 +++ src/Models/DebitNote.php | 3 +++ src/Models/DebitNoteApplication.php | 3 +++ src/Models/DebitNoteItem.php | 3 +++ src/Models/DebitNoteItemTax.php | 6 ++++++ src/Models/Expense.php | 3 ++- src/Models/ExpenseCategories.php | 3 ++- src/Models/JournalEntry.php | 3 +++ src/Models/JournalEntryItem.php | 3 +++ src/Models/OpeningBalance.php | 3 ++- src/Models/Revenue.php | 3 ++- src/Models/RevenueCategories.php | 3 ++- src/Models/Vendor.php | 3 ++- src/Models/VendorPayment.php | 3 +++ src/Models/VendorPaymentAllocation.php | 6 ++++++ 47 files changed, 121 insertions(+), 52 deletions(-) diff --git a/src/Helpers/AccountUtility.php b/src/Helpers/AccountUtility.php index 3948d44..b082f79 100644 --- a/src/Helpers/AccountUtility.php +++ b/src/Helpers/AccountUtility.php @@ -20,7 +20,7 @@ public static function defaultdata($company_id = null) private static function createAccountCategories($company_id) { - $exist = AccountCategory::where('created_by', $company_id)->first(); + $exist = AccountCategory::withoutGlobalScope('tenant')->where('created_by', $company_id)->first(); if($exist) return; $categories = [ @@ -40,10 +40,10 @@ private static function createAccountCategories($company_id) private static function createAccountTypes($company_id) { - $exist = AccountType::where('created_by', $company_id)->first(); + $exist = AccountType::withoutGlobalScope('tenant')->where('created_by', $company_id)->first(); if($exist) return; - $categories = AccountCategory::where('created_by', $company_id)->get()->keyBy('code'); + $categories = AccountCategory::withoutGlobalScope('tenant')->where('created_by', $company_id)->get()->keyBy('code'); if(count($categories) == 0) return; $accountTypes = [ @@ -80,10 +80,10 @@ private static function createAccountTypes($company_id) private static function createChartOfAccounts($company_id) { - $exist = ChartOfAccount::where('created_by', $company_id)->first(); + $exist = ChartOfAccount::withoutGlobalScope('tenant')->where('created_by', $company_id)->first(); if($exist) return; - $accountTypes = AccountType::where('created_by', $company_id)->get()->keyBy('code'); + $accountTypes = AccountType::withoutGlobalScope('tenant')->where('created_by', $company_id)->get()->keyBy('code'); if(count($accountTypes) == 0) return; $chartOfAccounts = [ diff --git a/src/Http/Controllers/CustomerPaymentController.php b/src/Http/Controllers/CustomerPaymentController.php index cf59b4f..728e793 100644 --- a/src/Http/Controllers/CustomerPaymentController.php +++ b/src/Http/Controllers/CustomerPaymentController.php @@ -206,7 +206,7 @@ public function updateStatus(Request $request, CustomerPayment $customerPayment) $creditNoteApplication = CreditNoteApplication::where('payment_id', $customerPayment->id)->get(); foreach ($creditNoteApplication as $creditNote) { - $creditNoteModel = CreditNote::find($creditNote['credit_note_id']); + $creditNoteModel = CreditNote::findOrFail($creditNote['credit_note_id']); $creditNoteModel->applied_amount += $creditNote['applied_amount']; $creditNoteModel->balance_amount = $creditNoteModel->total_amount - $creditNoteModel->applied_amount; $creditNoteModel->status = $creditNoteModel->balance_amount <= 0 ? 'applied' : 'partial'; diff --git a/src/Http/Controllers/VendorPaymentController.php b/src/Http/Controllers/VendorPaymentController.php index 526c983..84a1846 100644 --- a/src/Http/Controllers/VendorPaymentController.php +++ b/src/Http/Controllers/VendorPaymentController.php @@ -204,7 +204,7 @@ public function updateStatus(Request $request, VendorPayment $vendorPayment) $debitNoteApplication = DebitNoteApplication::where('payment_id', $vendorPayment->id)->get(); foreach ($debitNoteApplication as $debitNote) { - $debitNoteModel = DebitNote::find($debitNote['debit_note_id']); + $debitNoteModel = DebitNote::findOrFail($debitNote['debit_note_id']); $debitNoteModel->applied_amount += $debitNote['applied_amount']; $debitNoteModel->balance_amount = $debitNoteModel->total_amount - $debitNoteModel->applied_amount; $debitNoteModel->status = $debitNoteModel->balance_amount <= 0 ? 'applied' : 'partial'; diff --git a/src/Http/Requests/StoreAccountTypeRequest.php b/src/Http/Requests/StoreAccountTypeRequest.php index c298cbd..2c5f4c7 100644 --- a/src/Http/Requests/StoreAccountTypeRequest.php +++ b/src/Http/Requests/StoreAccountTypeRequest.php @@ -14,7 +14,7 @@ public function authorize(): bool public function rules(): array { return [ - 'category_id' => 'required|exists:account_categories,id', + 'category_id' => 'required|exists:account_categories,id,created_by,' . creatorId(), 'name' => 'required|max:100|unique:account_types,name,NULL,id,created_by,' . creatorId(), 'code' => 'required|max:10|unique:account_types,code,NULL,id,created_by,' . creatorId(), 'normal_balance' => 'required', diff --git a/src/Http/Requests/StoreBankAccountRequest.php b/src/Http/Requests/StoreBankAccountRequest.php index d8b4c3e..4c17379 100644 --- a/src/Http/Requests/StoreBankAccountRequest.php +++ b/src/Http/Requests/StoreBankAccountRequest.php @@ -26,7 +26,7 @@ public function rules(): array 'swift_code' => 'nullable|string|max:11', 'routing_number' => 'nullable|string|max:20', 'is_active' => 'boolean', - 'gl_account_id' => 'required|exists:chart_of_accounts,id' + 'gl_account_id' => 'required|exists:chart_of_accounts,id,created_by,' . creatorId() ]; } } \ No newline at end of file diff --git a/src/Http/Requests/StoreBankTransferRequest.php b/src/Http/Requests/StoreBankTransferRequest.php index 15afd37..fae7c76 100644 --- a/src/Http/Requests/StoreBankTransferRequest.php +++ b/src/Http/Requests/StoreBankTransferRequest.php @@ -15,8 +15,8 @@ public function rules() { return [ 'transfer_date' => 'required|date', - 'from_account_id' => 'required|exists:bank_accounts,id', - 'to_account_id' => 'required|exists:bank_accounts,id|different:from_account_id', + 'from_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), + 'to_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId() . '|different:from_account_id', 'transfer_amount' => 'required|numeric|min:0.01', 'transfer_charges' => 'nullable|numeric|min:0', 'reference_number' => 'nullable|string|max:255', diff --git a/src/Http/Requests/StoreChartOfAccountRequest.php b/src/Http/Requests/StoreChartOfAccountRequest.php index d17e1d4..e8931cb 100644 --- a/src/Http/Requests/StoreChartOfAccountRequest.php +++ b/src/Http/Requests/StoreChartOfAccountRequest.php @@ -22,8 +22,8 @@ public function rules(): array 'current_balance' => 'nullable|numeric|min:0', 'is_active' => 'boolean', 'description' => 'nullable|string|max:1000', - 'account_type_id' => 'nullable|exists:account_types,id', - 'parent_account_id' => 'nullable|exists:chart_of_accounts,id' + 'account_type_id' => 'nullable|exists:account_types,id,created_by,' . creatorId(), + 'parent_account_id' => 'nullable|exists:chart_of_accounts,id,created_by,' . creatorId() ]; } } \ No newline at end of file diff --git a/src/Http/Requests/StoreCustomerPaymentRequest.php b/src/Http/Requests/StoreCustomerPaymentRequest.php index 56602d1..a84d6da 100644 --- a/src/Http/Requests/StoreCustomerPaymentRequest.php +++ b/src/Http/Requests/StoreCustomerPaymentRequest.php @@ -17,15 +17,15 @@ public function rules() return [ 'payment_date' => 'required|date|before_or_equal:today', 'customer_id' => 'required|exists:users,id', - 'bank_account_id' => 'required|exists:bank_accounts,id', + 'bank_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), 'reference_number' => 'nullable|string|max:100', 'payment_amount' => 'required|numeric|min:0', 'notes' => 'nullable|string', 'allocations' => 'nullable|array', - 'allocations.*.invoice_id' => 'required|exists:sales_invoices,id', + 'allocations.*.invoice_id' => 'required|exists:sales_invoices,id,created_by,' . creatorId(), 'allocations.*.amount' => 'required|numeric|min:0.01', 'credit_notes' => 'nullable|array', - 'credit_notes.*.credit_note_id' => 'required|exists:credit_notes,id', + 'credit_notes.*.credit_note_id' => 'required|exists:credit_notes,id,created_by,' . creatorId(), 'credit_notes.*.amount' => 'required|numeric|min:0.01' ]; } diff --git a/src/Http/Requests/StoreExpenseCategoriesRequest.php b/src/Http/Requests/StoreExpenseCategoriesRequest.php index b92eb6a..6a79c1c 100644 --- a/src/Http/Requests/StoreExpenseCategoriesRequest.php +++ b/src/Http/Requests/StoreExpenseCategoriesRequest.php @@ -16,7 +16,7 @@ public function rules(): array return [ 'category_name' => 'required', 'category_code' => 'required|unique:expense_categories,category_code', - 'gl_account_id' => 'nullable|exists:chart_of_accounts,id', + 'gl_account_id' => 'nullable|exists:chart_of_accounts,id,created_by,' . creatorId(), 'description' => 'nullable', 'is_active' => 'boolean' ]; diff --git a/src/Http/Requests/StoreExpenseRequest.php b/src/Http/Requests/StoreExpenseRequest.php index 00a661e..33e0d84 100644 --- a/src/Http/Requests/StoreExpenseRequest.php +++ b/src/Http/Requests/StoreExpenseRequest.php @@ -15,9 +15,9 @@ public function rules(): array { return [ 'expense_date' => 'required|date', - 'category_id' => 'required|exists:expense_categories,id', - 'bank_account_id' => 'required|exists:bank_accounts,id', - 'chart_of_account_id' => 'required|exists:chart_of_accounts,id', + 'category_id' => 'required|exists:expense_categories,id,created_by,' . creatorId(), + 'bank_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), + 'chart_of_account_id' => 'required|exists:chart_of_accounts,id,created_by,' . creatorId(), 'amount' => 'required|numeric|min:0', 'description' => 'nullable|string', 'reference_number' => 'nullable|string|max:255', diff --git a/src/Http/Requests/StoreRevenueCategoriesRequest.php b/src/Http/Requests/StoreRevenueCategoriesRequest.php index 2040885..8c178db 100644 --- a/src/Http/Requests/StoreRevenueCategoriesRequest.php +++ b/src/Http/Requests/StoreRevenueCategoriesRequest.php @@ -16,7 +16,7 @@ public function rules(): array return [ 'category_name' => 'required', 'category_code' => 'required|unique:revenue_categories,category_code', - 'gl_account_id' => 'nullable|exists:chart_of_accounts,id', + 'gl_account_id' => 'nullable|exists:chart_of_accounts,id,created_by,' . creatorId(), 'description' => 'nullable', 'is_active' => 'boolean' ]; diff --git a/src/Http/Requests/StoreRevenueRequest.php b/src/Http/Requests/StoreRevenueRequest.php index 7a32fb1..6917180 100644 --- a/src/Http/Requests/StoreRevenueRequest.php +++ b/src/Http/Requests/StoreRevenueRequest.php @@ -15,9 +15,9 @@ public function rules(): array { return [ 'revenue_date' => 'required|date', - 'category_id' => 'required|exists:revenue_categories,id', - 'bank_account_id' => 'required|exists:bank_accounts,id', - 'chart_of_account_id' => 'required|exists:chart_of_accounts,id', + 'category_id' => 'required|exists:revenue_categories,id,created_by,' . creatorId(), + 'bank_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), + 'chart_of_account_id' => 'required|exists:chart_of_accounts,id,created_by,' . creatorId(), 'amount' => 'required|numeric|min:0', 'description' => 'nullable|string', 'reference_number' => 'nullable|string|max:255', diff --git a/src/Http/Requests/StoreVendorPaymentRequest.php b/src/Http/Requests/StoreVendorPaymentRequest.php index a3d1d68..411ef12 100644 --- a/src/Http/Requests/StoreVendorPaymentRequest.php +++ b/src/Http/Requests/StoreVendorPaymentRequest.php @@ -17,15 +17,15 @@ public function rules() return [ 'payment_date' => 'required|date|before_or_equal:today', 'vendor_id' => 'required|exists:users,id', - 'bank_account_id' => 'required|exists:bank_accounts,id', + 'bank_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), 'reference_number' => 'nullable|string|max:100', 'payment_amount' => 'required|numeric|min:0', 'notes' => 'nullable|string', 'allocations' => 'nullable|array', - 'allocations.*.invoice_id' => 'required|exists:purchase_invoices,id', + 'allocations.*.invoice_id' => 'required|exists:purchase_invoices,id,created_by,' . creatorId(), 'allocations.*.amount' => 'required|numeric|min:0.01', 'debit_notes' => 'nullable|array', - 'debit_notes.*.debit_note_id' => 'required|exists:debit_notes,id', + 'debit_notes.*.debit_note_id' => 'required|exists:debit_notes,id,created_by,' . creatorId(), 'debit_notes.*.amount' => 'required|numeric|min:0.01' ]; } diff --git a/src/Http/Requests/UpdateBankAccountRequest.php b/src/Http/Requests/UpdateBankAccountRequest.php index 3bdfdd1..e7fe7ab 100644 --- a/src/Http/Requests/UpdateBankAccountRequest.php +++ b/src/Http/Requests/UpdateBankAccountRequest.php @@ -26,7 +26,7 @@ public function rules(): array 'swift_code' => 'nullable|string|max:11', 'routing_number' => 'nullable|string|max:20', 'is_active' => 'boolean', - 'gl_account_id' => 'required|exists:chart_of_accounts,id' + 'gl_account_id' => 'required|exists:chart_of_accounts,id,created_by,' . creatorId() ]; } } \ No newline at end of file diff --git a/src/Http/Requests/UpdateBankTransferRequest.php b/src/Http/Requests/UpdateBankTransferRequest.php index 2b10b97..119fb6c 100644 --- a/src/Http/Requests/UpdateBankTransferRequest.php +++ b/src/Http/Requests/UpdateBankTransferRequest.php @@ -15,8 +15,8 @@ public function rules() { return [ 'transfer_date' => 'required|date', - 'from_account_id' => 'required|exists:bank_accounts,id', - 'to_account_id' => 'required|exists:bank_accounts,id|different:from_account_id', + 'from_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), + 'to_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId() . '|different:from_account_id', 'transfer_amount' => 'required|numeric|min:0.01', 'transfer_charges' => 'nullable|numeric|min:0', 'reference_number' => 'nullable|string|max:255', diff --git a/src/Http/Requests/UpdateChartOfAccountRequest.php b/src/Http/Requests/UpdateChartOfAccountRequest.php index 88f75bd..bb6e44b 100644 --- a/src/Http/Requests/UpdateChartOfAccountRequest.php +++ b/src/Http/Requests/UpdateChartOfAccountRequest.php @@ -24,8 +24,8 @@ public function rules(): array 'current_balance' => 'nullable|numeric|min:0', 'is_active' => 'boolean', 'description' => 'nullable|string|max:1000', - 'account_type_id' => 'nullable|exists:account_types,id', - 'parent_account_id' => 'nullable|exists:chart_of_accounts,id' + 'account_type_id' => 'nullable|exists:account_types,id,created_by,' . creatorId(), + 'parent_account_id' => 'nullable|exists:chart_of_accounts,id,created_by,' . creatorId() ]; } } \ No newline at end of file diff --git a/src/Http/Requests/UpdateExpenseCategoriesRequest.php b/src/Http/Requests/UpdateExpenseCategoriesRequest.php index 9f613c1..2f7b657 100644 --- a/src/Http/Requests/UpdateExpenseCategoriesRequest.php +++ b/src/Http/Requests/UpdateExpenseCategoriesRequest.php @@ -16,7 +16,7 @@ public function rules(): array return [ 'category_name' => 'required', 'category_code' => 'required|unique:expense_categories,category_code,' . $this->route('expensecategories')->id, - 'gl_account_id' => 'nullable|exists:chart_of_accounts,id', + 'gl_account_id' => 'nullable|exists:chart_of_accounts,id,created_by,' . creatorId(), 'description' => 'nullable', 'is_active' => 'boolean' ]; diff --git a/src/Http/Requests/UpdateExpenseRequest.php b/src/Http/Requests/UpdateExpenseRequest.php index 220dd8a..e72e870 100644 --- a/src/Http/Requests/UpdateExpenseRequest.php +++ b/src/Http/Requests/UpdateExpenseRequest.php @@ -15,9 +15,9 @@ public function rules(): array { return [ 'expense_date' => 'required|date', - 'category_id' => 'required|exists:expense_categories,id', - 'bank_account_id' => 'required|exists:bank_accounts,id', - 'chart_of_account_id' => 'required|exists:chart_of_accounts,id', + 'category_id' => 'required|exists:expense_categories,id,created_by,' . creatorId(), + 'bank_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), + 'chart_of_account_id' => 'required|exists:chart_of_accounts,id,created_by,' . creatorId(), 'amount' => 'required|numeric|min:0', 'description' => 'nullable|string', 'reference_number' => 'nullable|string|max:255', diff --git a/src/Http/Requests/UpdateRevenueCategoriesRequest.php b/src/Http/Requests/UpdateRevenueCategoriesRequest.php index 12bde7d..9c7bc3c 100644 --- a/src/Http/Requests/UpdateRevenueCategoriesRequest.php +++ b/src/Http/Requests/UpdateRevenueCategoriesRequest.php @@ -16,7 +16,7 @@ public function rules(): array return [ 'category_name' => 'required', 'category_code' => 'required|unique:revenue_categories,category_code,' . $this->route('revenuecategories')->id, - 'gl_account_id' => 'nullable|exists:chart_of_accounts,id', + 'gl_account_id' => 'nullable|exists:chart_of_accounts,id,created_by,' . creatorId(), 'description' => 'nullable', 'is_active' => 'boolean' ]; diff --git a/src/Http/Requests/UpdateRevenueRequest.php b/src/Http/Requests/UpdateRevenueRequest.php index 2d47c6d..a126157 100644 --- a/src/Http/Requests/UpdateRevenueRequest.php +++ b/src/Http/Requests/UpdateRevenueRequest.php @@ -15,9 +15,9 @@ public function rules(): array { return [ 'revenue_date' => 'required|date', - 'category_id' => 'required|exists:revenue_categories,id', - 'bank_account_id' => 'required|exists:bank_accounts,id', - 'chart_of_account_id' => 'required|exists:chart_of_accounts,id', + 'category_id' => 'required|exists:revenue_categories,id,created_by,' . creatorId(), + 'bank_account_id' => 'required|exists:bank_accounts,id,created_by,' . creatorId(), + 'chart_of_account_id' => 'required|exists:chart_of_accounts,id,created_by,' . creatorId(), 'amount' => 'required|numeric|min:0', 'description' => 'nullable|string', 'reference_number' => 'nullable|string|max:255', diff --git a/src/Models/AccountCategory.php b/src/Models/AccountCategory.php index 0020501..bbc8640 100644 --- a/src/Models/AccountCategory.php +++ b/src/Models/AccountCategory.php @@ -2,12 +2,13 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; class AccountCategory extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'name', diff --git a/src/Models/AccountType.php b/src/Models/AccountType.php index 4282354..5fcc1a7 100644 --- a/src/Models/AccountType.php +++ b/src/Models/AccountType.php @@ -2,13 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; use Zerp\Account\Models\AccountCategory; class AccountType extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'category_id', diff --git a/src/Models/BankAccount.php b/src/Models/BankAccount.php index 89a0a04..0ed6199 100644 --- a/src/Models/BankAccount.php +++ b/src/Models/BankAccount.php @@ -2,13 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; use Zerp\Account\Models\ChartOfAccount; class BankAccount extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'account_number', diff --git a/src/Models/BankTransaction.php b/src/Models/BankTransaction.php index f046edc..3357332 100644 --- a/src/Models/BankTransaction.php +++ b/src/Models/BankTransaction.php @@ -2,12 +2,15 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; use App\Models\User; class BankTransaction extends Model { + use TenantScoped; + protected $fillable = [ 'bank_account_id', 'transaction_date', diff --git a/src/Models/BankTransfer.php b/src/Models/BankTransfer.php index 6f5ff02..3ac39bc 100644 --- a/src/Models/BankTransfer.php +++ b/src/Models/BankTransfer.php @@ -3,12 +3,13 @@ namespace Zerp\Account\Models; use Illuminate\Database\Eloquent\Factories\HasFactory; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Support\Facades\Auth; class BankTransfer extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'transfer_number', diff --git a/src/Models/ChartOfAccount.php b/src/Models/ChartOfAccount.php index dc31b5f..056c965 100644 --- a/src/Models/ChartOfAccount.php +++ b/src/Models/ChartOfAccount.php @@ -2,6 +2,7 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; use Illuminate\Database\Eloquent\Relations\HasMany; @@ -9,7 +10,7 @@ class ChartOfAccount extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'account_code', diff --git a/src/Models/CreditNote.php b/src/Models/CreditNote.php index 6a4e47f..9bfe9f5 100644 --- a/src/Models/CreditNote.php +++ b/src/Models/CreditNote.php @@ -2,6 +2,7 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany; use Illuminate\Database\Eloquent\Relations\BelongsTo; @@ -11,6 +12,8 @@ class CreditNote extends Model { + use TenantScoped; + protected $fillable = [ 'credit_note_number', 'credit_note_date', diff --git a/src/Models/CreditNoteApplication.php b/src/Models/CreditNoteApplication.php index 2391bde..1eb7f9f 100644 --- a/src/Models/CreditNoteApplication.php +++ b/src/Models/CreditNoteApplication.php @@ -2,11 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; class CreditNoteApplication extends Model { + use TenantScoped; + protected $fillable = [ 'credit_note_id', 'payment_id', diff --git a/src/Models/CreditNoteItem.php b/src/Models/CreditNoteItem.php index 6c1084a..256440d 100644 --- a/src/Models/CreditNoteItem.php +++ b/src/Models/CreditNoteItem.php @@ -2,12 +2,18 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany; use Illuminate\Database\Eloquent\Relations\BelongsTo; class CreditNoteItem extends Model { + use TenantScoped; + + /** No created_by column; the parent creditNote carries the tenant boundary. */ + public string $tenantParent = 'creditNote'; + protected $fillable = [ 'credit_note_id', 'product_id', diff --git a/src/Models/CreditNoteItemTax.php b/src/Models/CreditNoteItemTax.php index c4bdaa7..1dccc22 100644 --- a/src/Models/CreditNoteItemTax.php +++ b/src/Models/CreditNoteItemTax.php @@ -2,11 +2,17 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; class CreditNoteItemTax extends Model { + use TenantScoped; + + /** No created_by column; the parent item carries the tenant boundary. */ + public string $tenantParent = 'item'; + protected $fillable = [ 'item_id', 'tax_name', diff --git a/src/Models/Customer.php b/src/Models/Customer.php index 80e84c0..27e475d 100644 --- a/src/Models/Customer.php +++ b/src/Models/Customer.php @@ -3,12 +3,13 @@ namespace Zerp\Account\Models; use Illuminate\Database\Eloquent\Factories\HasFactory; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use App\Models\User; class Customer extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'user_id', diff --git a/src/Models/CustomerPayment.php b/src/Models/CustomerPayment.php index 66f727d..1193a6f 100644 --- a/src/Models/CustomerPayment.php +++ b/src/Models/CustomerPayment.php @@ -2,6 +2,7 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; use Illuminate\Database\Eloquent\Relations\HasMany; @@ -9,6 +10,8 @@ class CustomerPayment extends Model { + use TenantScoped; + protected $fillable = [ 'payment_number', 'payment_date', diff --git a/src/Models/CustomerPaymentAllocation.php b/src/Models/CustomerPaymentAllocation.php index bff3fde..19ea209 100644 --- a/src/Models/CustomerPaymentAllocation.php +++ b/src/Models/CustomerPaymentAllocation.php @@ -2,12 +2,15 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; use App\Models\SalesInvoice; class CustomerPaymentAllocation extends Model { + use TenantScoped; + protected $fillable = [ 'payment_id', 'invoice_id', diff --git a/src/Models/DebitNote.php b/src/Models/DebitNote.php index 8f216cd..00242c1 100644 --- a/src/Models/DebitNote.php +++ b/src/Models/DebitNote.php @@ -2,6 +2,7 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany; use Illuminate\Database\Eloquent\Relations\BelongsTo; @@ -11,6 +12,8 @@ class DebitNote extends Model { + use TenantScoped; + protected $fillable = [ 'debit_note_number', 'debit_note_date', diff --git a/src/Models/DebitNoteApplication.php b/src/Models/DebitNoteApplication.php index 73568c0..e1de65c 100644 --- a/src/Models/DebitNoteApplication.php +++ b/src/Models/DebitNoteApplication.php @@ -2,11 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; class DebitNoteApplication extends Model { + use TenantScoped; + protected $fillable = [ 'debit_note_id', 'payment_id', diff --git a/src/Models/DebitNoteItem.php b/src/Models/DebitNoteItem.php index 405a04f..9a90d5c 100644 --- a/src/Models/DebitNoteItem.php +++ b/src/Models/DebitNoteItem.php @@ -2,12 +2,15 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany; use Illuminate\Database\Eloquent\Relations\BelongsTo; class DebitNoteItem extends Model { + use TenantScoped; + protected $fillable = [ 'debit_note_id', 'product_id', diff --git a/src/Models/DebitNoteItemTax.php b/src/Models/DebitNoteItemTax.php index daef01b..b600bc8 100644 --- a/src/Models/DebitNoteItemTax.php +++ b/src/Models/DebitNoteItemTax.php @@ -2,11 +2,17 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; class DebitNoteItemTax extends Model { + use TenantScoped; + + /** No created_by column; the parent item carries the tenant boundary. */ + public string $tenantParent = 'item'; + protected $fillable = [ 'item_id', 'tax_name', diff --git a/src/Models/Expense.php b/src/Models/Expense.php index 7d35744..30d10cd 100644 --- a/src/Models/Expense.php +++ b/src/Models/Expense.php @@ -2,12 +2,13 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; class Expense extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'expense_number', diff --git a/src/Models/ExpenseCategories.php b/src/Models/ExpenseCategories.php index e7a1576..bc2d6c2 100644 --- a/src/Models/ExpenseCategories.php +++ b/src/Models/ExpenseCategories.php @@ -2,13 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; use Zerp\Account\Models\ChartOfAccount; class ExpenseCategories extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'category_name', diff --git a/src/Models/JournalEntry.php b/src/Models/JournalEntry.php index c18b621..49f7a33 100644 --- a/src/Models/JournalEntry.php +++ b/src/Models/JournalEntry.php @@ -2,6 +2,7 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany; use Illuminate\Database\Eloquent\Relations\BelongsTo; @@ -9,6 +10,8 @@ class JournalEntry extends Model { + use TenantScoped; + protected $fillable = [ 'journal_number', 'journal_date', diff --git a/src/Models/JournalEntryItem.php b/src/Models/JournalEntryItem.php index e309f16..01bbcca 100644 --- a/src/Models/JournalEntryItem.php +++ b/src/Models/JournalEntryItem.php @@ -2,12 +2,15 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; use App\Models\User; class JournalEntryItem extends Model { + use TenantScoped; + protected $fillable = [ 'journal_entry_id', 'account_id', diff --git a/src/Models/OpeningBalance.php b/src/Models/OpeningBalance.php index cd6182d..8523a13 100644 --- a/src/Models/OpeningBalance.php +++ b/src/Models/OpeningBalance.php @@ -2,12 +2,13 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; class OpeningBalance extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'account_id', diff --git a/src/Models/Revenue.php b/src/Models/Revenue.php index 3bf5edf..32e0e9f 100644 --- a/src/Models/Revenue.php +++ b/src/Models/Revenue.php @@ -2,12 +2,13 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; class Revenue extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'revenue_number', diff --git a/src/Models/RevenueCategories.php b/src/Models/RevenueCategories.php index d2ca54b..17cd923 100644 --- a/src/Models/RevenueCategories.php +++ b/src/Models/RevenueCategories.php @@ -2,13 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; use Zerp\Account\Models\ChartOfAccount; class RevenueCategories extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'category_name', diff --git a/src/Models/Vendor.php b/src/Models/Vendor.php index a42edb4..f15f4a9 100644 --- a/src/Models/Vendor.php +++ b/src/Models/Vendor.php @@ -2,13 +2,14 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Factories\HasFactory; use App\Models\User; class Vendor extends Model { - use HasFactory; + use HasFactory, TenantScoped; protected $fillable = [ 'user_id', diff --git a/src/Models/VendorPayment.php b/src/Models/VendorPayment.php index 22604c1..f2c017e 100644 --- a/src/Models/VendorPayment.php +++ b/src/Models/VendorPayment.php @@ -2,6 +2,7 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany; use Illuminate\Database\Eloquent\Relations\BelongsTo; @@ -9,6 +10,8 @@ class VendorPayment extends Model { + use TenantScoped; + protected $fillable = [ 'payment_number', 'payment_date', diff --git a/src/Models/VendorPaymentAllocation.php b/src/Models/VendorPaymentAllocation.php index 90184c2..c91754e 100644 --- a/src/Models/VendorPaymentAllocation.php +++ b/src/Models/VendorPaymentAllocation.php @@ -2,12 +2,18 @@ namespace Zerp\Account\Models; +use App\Models\Concerns\TenantScoped; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; use App\Models\PurchaseInvoice; class VendorPaymentAllocation extends Model { + use TenantScoped; + + /** No created_by column; the parent payment carries the tenant boundary. */ + public string $tenantParent = 'payment'; + protected $fillable = [ 'payment_id', 'invoice_id',