[FIX/BE-US] feat adjustment location and area

internal/modules/master/employees/services/employees.service.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	entity "gitlab.com/mbugroup/lti-api.git/internal/entities"
+	m "gitlab.com/mbugroup/lti-api.git/internal/middleware"
 	repository "gitlab.com/mbugroup/lti-api.git/internal/modules/master/employees/repositories"
 	validation "gitlab.com/mbugroup/lti-api.git/internal/modules/master/employees/validations"
 	"gitlab.com/mbugroup/lti-api.git/internal/utils"
@@ -43,6 +44,61 @@ func (s employeesService) withRelations(db *gorm.DB) *gorm.DB {
 		Where("employees.deleted_at IS NULL")
 }
 
+func (s employeesService) ensureEmployeeAccess(c *fiber.Ctx, employeeID uint) error {
+	if employeeID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid employee id")
+	}
+
+	db := s.Repository.DB().WithContext(c.Context()).
+		Table("employees e").
+		Joins("JOIN employee_kandangs ek ON ek.employee_id = e.id").
+		Joins("JOIN kandangs k ON k.id = ek.kandang_id").
+		Joins("JOIN locations loc ON loc.id = k.location_id").
+		Joins("JOIN areas a ON a.id = loc.area_id").
+		Where("e.id = ?", employeeID).
+		Where("e.deleted_at IS NULL")
+
+	scopedDB, err := m.ApplyLocationAreaScope(c, db, "loc.id", "a.id")
+	if err != nil {
+		return err
+	}
+
+	var count int64
+	if err := scopedDB.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Employees not found")
+	}
+	return nil
+}
+
+func (s employeesService) ensureKandangIDsAccess(c *fiber.Ctx, kandangIDs []uint) error {
+	if len(kandangIDs) == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "kandang_ids must contain at least one valid id")
+	}
+
+	db := s.Repository.DB().WithContext(c.Context()).
+		Table("kandangs k").
+		Joins("JOIN locations loc ON loc.id = k.location_id").
+		Joins("JOIN areas a ON a.id = loc.area_id").
+		Where("k.id IN ?", kandangIDs)
+
+	scopedDB, err := m.ApplyLocationAreaScope(c, db, "loc.id", "a.id")
+	if err != nil {
+		return err
+	}
+
+	var count int64
+	if err := scopedDB.Count(&count).Error; err != nil {
+		return err
+	}
+	if count != int64(len(kandangIDs)) {
+		return fiber.NewError(fiber.StatusNotFound, "Kandang not found")
+	}
+	return nil
+}
+
 func (s employeesService) GetAll(c *fiber.Ctx, params *validation.Query) ([]entity.Employees, int64, error) {
 	if err := s.Validate.Struct(params); err != nil {
 		return nil, 0, err
@@ -52,17 +108,29 @@ func (s employeesService) GetAll(c *fiber.Ctx, params *validation.Query) ([]enti
 
 	employeess, total, err := s.Repository.GetAll(c.Context(), offset, params.Limit, func(db *gorm.DB) *gorm.DB {
 		db = s.withRelations(db)
+		db = db.Joins("JOIN employee_kandangs ek ON ek.employee_id = employees.id").
+			Joins("JOIN kandangs k ON k.id = ek.kandang_id").
+			Joins("JOIN locations loc ON loc.id = k.location_id").
+			Joins("JOIN areas a ON a.id = loc.area_id")
+		var scopeErr error
+		db, scopeErr = m.ApplyLocationAreaScope(c, db, "loc.id", "a.id")
+		if scopeErr != nil {
+			return db.Where("1 = 0")
+		}
 		if params.Search != "" {
 			db = db.Where("employees.name ILIKE ?", "%"+params.Search+"%")
 		}
 		if params.KandangId != nil {
-			db = db.Joins("JOIN employee_kandangs ek ON ek.employee_id = employees.id").
-				Where("ek.kandang_id = ?", *params.KandangId)
+			db = db.Where("ek.kandang_id = ?", *params.KandangId)
 		}
 		if params.IsActive != nil {
 			db = db.Where("employees.is_active = ?", *params.IsActive)
 		}
-		return db.Order("employees.created_at DESC").Order("employees.updated_at DESC")
+		return db.
+			Select("employees.id, employees.name, employees.is_active, employees.created_at, employees.updated_at").
+			Group("employees.id, employees.name, employees.is_active, employees.created_at, employees.updated_at").
+			Order("employees.created_at DESC").
+			Order("employees.updated_at DESC")
 	})
 
 	if err != nil {
@@ -73,6 +141,9 @@ func (s employeesService) GetAll(c *fiber.Ctx, params *validation.Query) ([]enti
 }
 
 func (s employeesService) GetOne(c *fiber.Ctx, id uint) (*entity.Employees, error) {
+	if err := s.ensureEmployeeAccess(c, id); err != nil {
+		return nil, err
+	}
 	employees, err := s.Repository.GetByID(c.Context(), id, s.withRelations)
 	if errors.Is(err, gorm.ErrRecordNotFound) {
 		return nil, fiber.NewError(fiber.StatusNotFound, "Employees not found")
@@ -98,6 +169,9 @@ func (s *employeesService) CreateOne(c *fiber.Ctx, req *validation.Create) (*ent
 	if len(kandangIDs) == 0 {
 		return nil, fiber.NewError(fiber.StatusBadRequest, "kandang_ids must contain at least one valid id")
 	}
+	if err := s.ensureKandangIDsAccess(c, kandangIDs); err != nil {
+		return nil, err
+	}
 
 	if _, err := s.Repository.First(c.Context(), func(db *gorm.DB) *gorm.DB {
 		return db.Where("LOWER(name) = ?", strings.ToLower(name))
@@ -147,6 +221,9 @@ func (s employeesService) UpdateOne(c *fiber.Ctx, req *validation.Update, id uin
 	if err := s.Validate.Struct(req); err != nil {
 		return nil, err
 	}
+	if err := s.ensureEmployeeAccess(c, id); err != nil {
+		return nil, err
+	}
 
 	updateBody := make(map[string]any)
 	var (
@@ -181,6 +258,9 @@ func (s employeesService) UpdateOne(c *fiber.Ctx, req *validation.Update, id uin
 		if len(ids) == 0 {
 			return nil, fiber.NewError(fiber.StatusBadRequest, "kandang_ids must contain at least one valid id")
 		}
+		if err := s.ensureKandangIDsAccess(c, ids); err != nil {
+			return nil, err
+		}
 
 		kandangIDs = ids
 		needKandangUpdate = true
@@ -234,6 +314,9 @@ func (s employeesService) UpdateOne(c *fiber.Ctx, req *validation.Update, id uin
 }
 
 func (s employeesService) DeleteOne(c *fiber.Ctx, id uint) error {
+	if err := s.ensureEmployeeAccess(c, id); err != nil {
+		return err
+	}
 	if err := s.Repository.DeleteOne(c.Context(), id); err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return fiber.NewError(fiber.StatusNotFound, "Employees not found")