u

src/store/category/getTreeForCompany.js

@@ -0,0 +1,17 @@
+import { GET_TREE } from '../../sql/category.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function getTreeForCompany(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (authId, companyId) => {
+    const { rootCategoryId } = await access(authId, companyId);
+
+    const result = await pool
+      .request()
+      .input('rootId', rootCategoryId)
+      .query(GET_TREE);
+
+    return result.recordset;
+  };
+}

src/store/companyuser/resolveCompanyAccess.js

@@ -0,0 +1,24 @@
+import { GET_COMPANY_ACCESS } from '../../sql/companyuser.js';
+
+export default function resolveCompanyAccess(pool) {
+  return async (authId, companyId) => {
+    const result = await pool
+      .request()
+      .input('authId', authId)
+      .input('companyId', companyId)
+      .query(GET_COMPANY_ACCESS);
+
+    const row = result.recordset[0];
+    if (!row) {
+      throw new Error('Company not found');
+    }
+    if (!row.companyuserId) {
+      throw new Error('Not authorized');
+    }
+    if (!row.rootCategoryId) {
+      throw new Error('Company not found');
+    }
+
+    return { rootCategoryId: row.rootCategoryId };
+  };
+}