u

src/index.js

@@ -6,6 +6,7 @@ import companyUpdate from './store/company/update.js';
 import companyDelete from './store/company/delete.js';
 import companyList from './store/company/list.js';
 import categoryGetTree from './store/category/getTree.js';
+import categoryGetTreeForCompany from './store/category/getTreeForCompany.js';
 import categoryCreate from './store/category/create.js';
 import categoryUpdateParentId from './store/category/updateParentId.js';
 import categoryDelete from './store/category/delete.js';
@@ -45,6 +46,7 @@ export default class LibDashStore {
 
     this.category = {
       getTree: categoryGetTree(pool),
+      getTreeForCompany: categoryGetTreeForCompany(pool),
       create: categoryCreate(pool),
       updateParentId: categoryUpdateParentId(pool),
       delete: categoryDelete(pool),

src/sql/companyuser.js

@@ -5,6 +5,16 @@ INNER JOIN google_auth ga ON ga.id = cu.google_auth_id
 WHERE ga.email = @email
 `;
 
+export const GET_COMPANY_ACCESS = `
+SELECT
+    c.root_category_id AS rootCategoryId,
+    cu.id AS companyuserId
+FROM company c
+LEFT JOIN companyuser cu
+    ON cu.company_id = c.id AND cu.google_auth_id = @authId
+WHERE c.id = @companyId
+`;
+
 export const ADD = `
 INSERT INTO companyuser (google_auth_id, company_id)
 OUTPUT INSERTED.id

src/store/category/getTreeForCompany.js

@@ -0,0 +1,17 @@
+import { GET_TREE } from '../../sql/category.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function getTreeForCompany(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (authId, companyId) => {
+    const { rootCategoryId } = await access(authId, companyId);
+
+    const result = await pool
+      .request()
+      .input('rootId', rootCategoryId)
+      .query(GET_TREE);
+
+    return result.recordset;
+  };
+}

src/store/companyuser/resolveCompanyAccess.js

@@ -0,0 +1,24 @@
+import { GET_COMPANY_ACCESS } from '../../sql/companyuser.js';
+
+export default function resolveCompanyAccess(pool) {
+  return async (authId, companyId) => {
+    const result = await pool
+      .request()
+      .input('authId', authId)
+      .input('companyId', companyId)
+      .query(GET_COMPANY_ACCESS);
+
+    const row = result.recordset[0];
+    if (!row) {
+      throw new Error('Company not found');
+    }
+    if (!row.companyuserId) {
+      throw new Error('Not authorized');
+    }
+    if (!row.rootCategoryId) {
+      throw new Error('Company not found');
+    }
+
+    return { rootCategoryId: row.rootCategoryId };
+  };
+}