go-crm improvements

apps/go-crm/internal/handlers/payments.go

@@ -11,6 +11,11 @@ import (
 )
 
 func ListPayments(w http.ResponseWriter, r *http.Request) {
+	accountID, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
 	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	clientID, _ := strconv.ParseInt(r.URL.Query().Get("client_id"), 10, 64)
@@ -24,13 +29,13 @@ func ListPayments(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	clients, err := db.ListClients(DB, limit, offset)
+	clients, err := db.ListClients(DB, accountID, limit, offset)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
 
-	customers, err := db.ListCustomers(DB, clientID, limit, offset)
+	customers, err := db.ListCustomers(DB, accountID, clientID, limit, offset)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -69,6 +74,11 @@ func ListPayments(w http.ResponseWriter, r *http.Request) {
 }
 
 func CreatePayment(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	r.ParseForm()
 	clientID, _ := strconv.ParseInt(r.FormValue("client_id"), 10, 64)
 	customerID, _ := strconv.ParseInt(r.FormValue("customer_id"), 10, 64)
@@ -96,6 +106,11 @@ func CreatePayment(w http.ResponseWriter, r *http.Request) {
 }
 
 func ViewPayment(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(r.URL.Query().Get("id"), 10, 64)
 	var p db.Payment
 	var hasPaid int
@@ -111,6 +126,11 @@ func ViewPayment(w http.ResponseWriter, r *http.Request) {
 }
 
 func UpdatePayment(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	r.ParseForm()
 	clientID, _ := strconv.ParseInt(r.FormValue("client_id"), 10, 64)
@@ -126,6 +146,11 @@ func UpdatePayment(w http.ResponseWriter, r *http.Request) {
 }
 
 func DeletePayment(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(r.URL.Query().Get("id"), 10, 64)
 	DB.Exec("DELETE FROM payments WHERE payment_id = ?", id)
 }