Leon SerfatyandClaude Opus 4.8
857b9a7811
Property Management Network — Next.js 16 (App Router), Better Auth, Drizzle ORM over PostgreSQL, Stripe, OpenAI, Resend. Includes: - Security hardening: access-control/IDOR fixes, TLS-by-default DB layer, constant-time cron auth, strict security headers, atomic AI quota gating, HTML/email output encoding, demo-backdoor disabled in production. - Superadmin dashboard at /admin (overview/MRR, server-paginated users with ban/impersonate/plan/delete, billing, platform activity + admin audit log, AI usage, system health) via the Better Auth admin plugin. - Seed/migration utility scripts under scripts/. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
32 lines
1.0 KiB
TypeScript
32 lines
1.0 KiB
TypeScript
import { and, eq } from "drizzle-orm"
|
|
import { db } from "@/lib/db"
|
|
import { properties, units, tenants } from "@/lib/db/schema"
|
|
|
|
/** True if the property belongs to the user. Null/undefined/empty id returns true (FK optional). */
|
|
export async function ownsProperty(userId: string, id?: string | null): Promise<boolean> {
|
|
if (!id) return true
|
|
const row = await db.query.properties.findFirst({
|
|
where: and(eq(properties.id, id), eq(properties.user_id, userId)),
|
|
columns: { id: true },
|
|
})
|
|
return !!row
|
|
}
|
|
|
|
export async function ownsUnit(userId: string, id?: string | null): Promise<boolean> {
|
|
if (!id) return true
|
|
const row = await db.query.units.findFirst({
|
|
where: and(eq(units.id, id), eq(units.user_id, userId)),
|
|
columns: { id: true },
|
|
})
|
|
return !!row
|
|
}
|
|
|
|
export async function ownsTenant(userId: string, id?: string | null): Promise<boolean> {
|
|
if (!id) return true
|
|
const row = await db.query.tenants.findFirst({
|
|
where: and(eq(tenants.id, id), eq(tenants.user_id, userId)),
|
|
columns: { id: true },
|
|
})
|
|
return !!row
|
|
}
|