2026.03.30 front és garázs logika

backend/app/api/v1/endpoints/assets.py

@@ -30,34 +30,69 @@ async def get_user_vehicles(
     
     This endpoint returns a paginated list of vehicles that the authenticated user
     has access to (either as owner or through organization membership).
+    
+    Garage-centric logic: In corporate mode, only returns vehicles physically
+    parked in the active organization's garages (branches).
     """
-    # Query assets where user is owner or organization member
-    from sqlalchemy import or_
+    from sqlalchemy import or_, select
     
-    # First, get user's organization memberships
-    from app.models.marketplace.organization import OrganizationMember
-    org_stmt = select(OrganizationMember.organization_id).where(
-        OrganizationMember.user_id == current_user.id
-    )
-    org_result = await db.execute(org_stmt)
-    user_org_ids = [row[0] for row in org_result.all()]
-    
-    # Build query: assets owned by user OR assets in user's organizations
-    stmt = (
-        select(Asset)
-        .where(
-            or_(
-                Asset.owner_person_id == current_user.id,
-                Asset.owner_org_id.in_(user_org_ids) if user_org_ids else False,
-                Asset.operator_person_id == current_user.id,
-                Asset.operator_org_id.in_(user_org_ids) if user_org_ids else False
+    if current_user.scope_id is None:
+        # Personal mode: only show vehicles owned/operated personally (no organization)
+        stmt = (
+            select(Asset)
+            .where(
+                or_(
+                    Asset.owner_org_id.is_(None),
+                    Asset.operator_org_id.is_(None)
+                ),
+                or_(
+                    Asset.owner_person_id == current_user.person_id,
+                    Asset.operator_person_id == current_user.person_id
+                )
             )
+            .order_by(Asset.created_at.desc())
+            .offset(skip)
+            .limit(limit)
+            .options(selectinload(Asset.catalog))
+        )
+    else:
+        # Corporate mode: only show vehicles belonging to the active organization's garages
+        try:
+            scope_org_id = int(current_user.scope_id)
+        except (ValueError, TypeError):
+            # If scope_id is not a valid integer, treat as no organization
+            scope_org_id = None
+        
+        if scope_org_id is None:
+            # Fallback: no valid organization, return empty list
+            return []
+        
+        # First, get all branch IDs (garages) for this organization
+        from app.models.marketplace.organization import Branch
+        branch_stmt = select(Branch.id).where(
+            Branch.organization_id == scope_org_id,
+            Branch.is_deleted == False,
+            Branch.status == "active"
+        )
+        branch_result = await db.execute(branch_stmt)
+        branch_ids = [row[0] for row in branch_result.all()]
+        
+        if not branch_ids:
+            # Organization has no active garages, return empty list
+            return []
+        
+        # Query assets that are in any of the organization's garages
+        stmt = (
+            select(Asset)
+            .where(
+                Asset.branch_id.in_(branch_ids),
+                Asset.status == "active"
+            )
+            .order_by(Asset.created_at.desc())
+            .offset(skip)
+            .limit(limit)
+            .options(selectinload(Asset.catalog))
         )
-        .order_by(Asset.created_at.desc())
-        .offset(skip)
-        .limit(limit)
-        .options(selectinload(Asset.catalog))
-    )
     
     result = await db.execute(stmt)
     assets = result.scalars().all()
@@ -170,25 +205,16 @@ async def create_or_claim_vehicle(
     - XP jutalom adása a felhasználónak
     """
     try:
-        # Determine organization ID: use provided or default to user's first organization
-        org_id = payload.organization_id
-        if org_id is None:
-            # Get user's organization memberships
-            from app.models.marketplace.organization import OrganizationMember
-            org_stmt = select(OrganizationMember.organization_id).where(
-                OrganizationMember.user_id == current_user.id
-            ).limit(1)
-            org_result = await db.execute(org_stmt)
-            user_org = org_result.scalar_one_or_none()
-            
-            if user_org is None:
-                # User has no organization - create a personal organization or use default
-                # For now, raise an error (in future, we could create a personal org)
-                raise HTTPException(
-                    status_code=status.HTTP_400_BAD_REQUEST,
-                    detail="No organization found for user. Please specify an organization_id or join/create an organization first."
-                )
-            org_id = user_org
+        # Determine organization ID based on user's active scope (garage isolation)
+        # The owner_org_id MUST be set to the current_user.scope_id.
+        # If the scope is null, it stays null (personal).
+        org_id = None
+        if current_user.scope_id is not None:
+            try:
+                org_id = int(current_user.scope_id)
+            except (ValueError, TypeError):
+                # If scope_id is not a valid integer, treat as personal (no organization)
+                pass
         
         asset = await AssetService.create_or_claim_vehicle(
             db=db,