Revert "Revert "[FIX/BE-US]add feature restrict by location and areas in roles""

This reverts commit 26bf7f165e.

internal/modules/expenses/repositories/expense_realization.repository.go

@@ -138,9 +138,28 @@ func (r *ExpenseRealizationRepositoryImpl) GetAllWithFilters(ctx context.Context
 	locationID := filters.LocationId
 	areaID := filters.AreaId
 
-	if locationID > 0 || areaID > 0 {
+	if filters.AllowedLocationIDs != nil || filters.AllowedAreaIDs != nil || locationID > 0 || areaID > 0 {
 		db = db.Joins("JOIN kandangs ON kandangs.id = expense_nonstocks.kandang_id")
+	}
 
+	if filters.AllowedLocationIDs != nil {
+		if len(filters.AllowedLocationIDs) == 0 {
+			db = db.Where("1 = 0")
+		} else {
+			db = db.Where("kandangs.location_id IN ?", filters.AllowedLocationIDs)
+		}
+	}
+
+	if filters.AllowedAreaIDs != nil {
+		if len(filters.AllowedAreaIDs) == 0 {
+			db = db.Where("1 = 0")
+		} else {
+			db = db.Joins("JOIN locations ON locations.id = kandangs.location_id").
+				Where("locations.area_id IN ?", filters.AllowedAreaIDs)
+		}
+	}
+
+	if locationID > 0 || areaID > 0 {
 		if locationID > 0 {
 			db = db.Where("kandangs.location_id = ?", uint(locationID))
 		}

internal/modules/expenses/services/expense.service.go

@@ -87,10 +87,16 @@ func (s expenseService) GetAll(c *fiber.Ctx, params *validation.Query) ([]expens
 		return nil, 0, err
 	}
 
+	scope, err := middleware.ResolveLocationScope(c, s.Repository.DB())
+	if err != nil {
+		return nil, 0, err
+	}
+
 	offset := (params.Page - 1) * params.Limit
 
 	expenses, total, err := s.Repository.GetAll(c.Context(), offset, params.Limit, func(db *gorm.DB) *gorm.DB {
 		db = s.withRelations(db)
+		db = middleware.ApplyScopeFilter(db, scope, "location_id")
 		if params.Search != "" {
 			return db.Where("category ILIKE ?", "%"+params.Search+"%")
 		}
@@ -117,7 +123,16 @@ func (s expenseService) GetAll(c *fiber.Ctx, params *validation.Query) ([]expens
 }
 
 func (s expenseService) GetOne(c *fiber.Ctx, id uint) (*expenseDto.ExpenseDetailDTO, error) {
-	expense, err := s.Repository.GetByID(c.Context(), id, s.withRelations)
+	scope, err := middleware.ResolveLocationScope(c, s.Repository.DB())
+	if err != nil {
+		return nil, err
+	}
+
+	expense, err := s.Repository.GetByID(c.Context(), id, func(db *gorm.DB) *gorm.DB {
+		db = s.withRelations(db)
+		db = middleware.ApplyScopeFilter(db, scope, "location_id")
+		return db
+	})
 	if err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {