From 7595727b0ae35cbcc5aaa48c691858aa3e2440dc Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Fri, 15 Aug 2025 14:07:25 +0000
Subject: [PATCH] Restrict task visibility based on user roles and group
 assignments

Update task retrieval logic to filter tasks based on user's assigned groups and roles. Admins can view all tasks or filter by store, while non-admins can only see tasks from their explicitly assigned groups, ensuring data segregation.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: a3de0820-9397-41b2-b000-7931ee9c29de
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/a3de0820-9397-41b2-b000-7931ee9c29de/b8xUC40
---
 server/routes.ts | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/server/routes.ts b/server/routes.ts
index 4ee8a17..de27dbd 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -1204,19 +1204,37 @@ export async function registerRoutes(app: Express): Promise<Server> {
       let groupIds: number[] | undefined;
       
       if (user.role === 'admin') {
+        // Admin can see all tasks or filter by specific store
         groupIds = storeId ? [parseInt(storeId as string)] : undefined;
       } else {
+        // Non-admin users can only see tasks from their assigned groups
         const userGroupIds = user.userGroups.map(ug => ug.groupId);
-        if (storeId && userGroupIds.includes(parseInt(storeId as string))) {
-          groupIds = [parseInt(storeId as string)];
+        
+        if (storeId) {
+          // If a specific store is requested, verify user has access to it
+          const requestedStoreId = parseInt(storeId as string);
+          if (userGroupIds.includes(requestedStoreId)) {
+            groupIds = [requestedStoreId];
+          } else {
+            // User doesn't have access to this store, return empty array
+            return res.json([]);
+          }
         } else {
+          // No specific store requested, return tasks from user's groups only
           groupIds = userGroupIds;
         }
       }
 
-      console.log('Tasks API called with:', { groupIds, userRole: user.role });
+      console.log('🔍 Tasks API called with:', { 
+        groupIds, 
+        userRole: user.role, 
+        userId: user.id,
+        requestedStoreId: storeId,
+        userGroups: user.role !== 'admin' ? user.userGroups.map(ug => ug.groupId) : 'all'
+      });
+      
       const tasks = await storage.getTasks(groupIds);
-      console.log('Tasks returned:', tasks.length, 'items');
+      console.log('📋 Tasks returned:', tasks.length, 'items for user:', user.id);
       res.json(tasks);
     } catch (error) {
       console.error("Error fetching tasks:", error);