Scope GL posting account lookups by CompanyId; cap sales-tax remittance (audit O3, O4)

O3: defense-in-depth on the write/posting path. Finding #7 scoped the report (read) path; this scopes every GL posting-path account lookup that determines where money lands, so a SuperAdmin acting in a company context can never post to another tenant's account: - InvoicesController: all account-resolver helpers (checking, customer deposits, sales returns, customer credits, AR, bad debt, sales tax, sales discount, GC liability) plus the bank-account and write-off expense dropdowns - CreditMemosController: Create/Apply/Void GL lookups (scoped via the in-scope customer/invoice/memo) - GiftCertificatesController: Create/BulkCreate/Void GL lookups + GC liability helper - BillsController: AP/expense account resolution that pre-fills APAccountId DepositsController and JournalEntriesController.SalesTaxPayment were already scoped. O4: SalesTaxPayment now rejects a remittance greater than the outstanding Sales Tax Payable balance (0.005 rounding tolerance), so a typo can no longer drive 2200 into an abnormal debit balance. Remaining pure read-path dropdown lookups (app-wide, lower risk) are documented in docs/ACCOUNTING_AUDIT.md as a separate follow-up. All audit findings O1-O4 are now resolved. Build clean; 291 unit tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-19 19:48:53 -04:00
parent 517e452c64
commit 7576761b70
6 changed files with 65 additions and 49 deletions
@@ -202,14 +202,14 @@ public class BillsController : Controller
        }

        var apAccount = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.AccountSubType == AccountSubType.AccountsPayable);
+            a => a.CompanyId == po.CompanyId && a.AccountSubType == AccountSubType.AccountsPayable);

        // Vendor default expense account, fall back to first expense/COGS account
        int? defaultExpenseAccountId = po.Vendor?.DefaultExpenseAccountId;
        if (!defaultExpenseAccountId.HasValue)
        {
            var fallbackAccount = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                a => a.IsActive && (a.AccountType == AccountType.Expense || a.AccountType == AccountType.CostOfGoods));
+                a => a.CompanyId == po.CompanyId && a.IsActive && (a.AccountType == AccountType.Expense || a.AccountType == AccountType.CostOfGoods));
            defaultExpenseAccountId = fallbackAccount?.Id;
        }

@@ -272,8 +272,9 @@ public class BillsController : Controller
        };

        // Pre-fill AP account
+        var companyId = _tenantContext.GetCurrentCompanyId() ?? 0;
        var apAccount = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.AccountSubType == AccountSubType.AccountsPayable);
+            a => a.CompanyId == companyId && a.AccountSubType == AccountSubType.AccountsPayable);
        dto.APAccountId = apAccount?.Id ?? 0;

        // Pre-fill default expense account for vendor
@@ -179,8 +179,8 @@ public class CreditMemosController : Controller

        // GL: the credit is a liability owed to the customer — DR Sales Discounts (contra-revenue)
        // / CR Customer Credits (2350). Relieved when the memo is applied to an invoice.
-        var discountAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.AccountNumber == "4950" && a.IsActive);
-        var customerCreditsAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.AccountNumber == "2350" && a.IsActive);
+        var discountAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.CompanyId == customer.CompanyId && a.AccountNumber == "4950" && a.IsActive);
+        var customerCreditsAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.CompanyId == customer.CompanyId && a.AccountNumber == "2350" && a.IsActive);
        await _accountBalanceService.DebitAsync(discountAcct?.Id, vm.Amount);
        await _accountBalanceService.CreditAsync(customerCreditsAcct?.Id, vm.Amount);

@@ -263,9 +263,9 @@ public class CreditMemosController : Controller
                // The contra-revenue (Sales Discounts) was recognized when the credit was issued.
                // Keeps Account.CurrentBalance in sync for RecalculateAllAsync and direct readers.
                var arAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                    a => a.AccountSubType == AccountSubType.AccountsReceivable && a.IsActive);
+                    a => a.CompanyId == invoice.CompanyId && a.AccountSubType == AccountSubType.AccountsReceivable && a.IsActive);
                var customerCreditsAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                    a => a.AccountNumber == "2350" && a.IsActive);
+                    a => a.CompanyId == invoice.CompanyId && a.AccountNumber == "2350" && a.IsActive);
                await _accountBalanceService.DebitAsync(customerCreditsAcct?.Id, applyAmount);
                await _accountBalanceService.CreditAsync(arAcct?.Id, applyAmount);

@@ -314,8 +314,8 @@ public class CreditMemosController : Controller
        // GL: reverse the unapplied issuance — DR Customer Credits (2350) / CR Sales Discounts.
        if (remaining > 0)
        {
-            var ccAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.AccountNumber == "2350" && a.IsActive);
-            var sdAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.AccountNumber == "4950" && a.IsActive);
+            var ccAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.CompanyId == memo.CompanyId && a.AccountNumber == "2350" && a.IsActive);
+            var sdAcct = await _unitOfWork.Accounts.FirstOrDefaultAsync(a => a.CompanyId == memo.CompanyId && a.AccountNumber == "4950" && a.IsActive);
            await _accountBalanceService.DebitAsync(ccAcct?.Id, remaining);
            await _accountBalanceService.CreditAsync(sdAcct?.Id, remaining);
        }
@@ -254,14 +254,14 @@ public class GiftCertificatesController : Controller
            if (dto.IssuedReason == GiftCertificateIssuedReason.Sold)
            {
                var checkingAcctId = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                    a => a.IsActive && (a.AccountSubType == AccountSubTypeEnum.Checking
+                    a => a.CompanyId == companyId && a.IsActive && (a.AccountSubType == AccountSubTypeEnum.Checking
                                     || a.AccountSubType == AccountSubTypeEnum.Cash));
                await _accountBalanceService.DebitAsync(checkingAcctId?.Id, cert.OriginalAmount);
            }
            else
            {
                var discountAcctId = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                    a => a.IsActive && a.AccountNumber == "4950");
+                    a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "4950");
                await _accountBalanceService.DebitAsync(discountAcctId?.Id, cert.OriginalAmount);
            }

@@ -310,7 +310,7 @@ public class GiftCertificatesController : Controller
            var companyId   = currentUser?.CompanyId ?? 0;
            var gcLiabilityAcctId = await GetGcLiabilityAccountIdAsync(companyId);
            var otherIncomeAcctId = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                a => a.IsActive && a.AccountSubType == AccountSubTypeEnum.OtherIncome);
+                a => a.CompanyId == companyId && a.IsActive && a.AccountSubType == AccountSubTypeEnum.OtherIncome);
            await _accountBalanceService.DebitAsync(gcLiabilityAcctId, remaining);
            await _accountBalanceService.CreditAsync(otherIncomeAcctId?.Id, remaining);
        }
@@ -437,7 +437,7 @@ public class GiftCertificatesController : Controller
    private async Task<int?> GetGcLiabilityAccountIdAsync(int companyId)
    {
        var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.IsActive && a.AccountNumber == "2500");
+            a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "2500");
        return acct?.Id;
    }

@@ -477,14 +477,14 @@ public class GiftCertificatesController : Controller
            if (dto.IssuedReason == GiftCertificateIssuedReason.Sold)
            {
                var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                    a => a.IsActive && (a.AccountSubType == AccountSubTypeEnum.Checking
+                    a => a.CompanyId == companyId && a.IsActive && (a.AccountSubType == AccountSubTypeEnum.Checking
                                     || a.AccountSubType == AccountSubTypeEnum.Cash));
                checkingAcctId = acct?.Id;
            }
            else
            {
                var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-                    a => a.IsActive && a.AccountNumber == "4950");
+                    a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "4950");
                discountAcctId = acct?.Id;
            }

@@ -305,8 +305,9 @@ public class InvoicesController : Controller
                && company?.StripeConnectStatus == StripeConnectStatus.Active;

            // Expense accounts for the write-off bad-debt modal
+            var expenseCompanyId = _tenantContext.GetCurrentCompanyId() ?? 0;
            var expenseAccounts = await _unitOfWork.Accounts.FindAsync(
-                a => a.IsActive && a.AccountType == AccountType.Expense);
+                a => a.CompanyId == expenseCompanyId && a.IsActive && a.AccountType == AccountType.Expense);
            ViewBag.ExpenseAccounts = expenseAccounts
                .OrderBy(a => a.AccountNumber).ThenBy(a => a.Name)
                .Select(a => new SelectListItem($"{a.AccountNumber} – {a.Name}", a.Id.ToString()))
@@ -2458,7 +2459,8 @@ public class InvoicesController : Controller
    /// </summary>
    private async Task PopulateBankAccountsAsync()
    {
-        var accounts = await _unitOfWork.Accounts.FindAsync(a => a.IsActive
+        var companyId = _tenantContext.GetCurrentCompanyId() ?? 0;
+        var accounts = await _unitOfWork.Accounts.FindAsync(a => a.CompanyId == companyId && a.IsActive
            && (a.AccountSubType == AccountSubType.Cash ||
                a.AccountSubType == AccountSubType.Checking ||
                a.AccountSubType == AccountSubType.Savings));
@@ -2473,7 +2475,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetCheckingAccountIdAsync(int companyId)
    {
        var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.IsActive && (a.AccountSubType == AccountSubType.Checking
+            a => a.CompanyId == companyId && a.IsActive && (a.AccountSubType == AccountSubType.Checking
                             || a.AccountSubType == AccountSubType.Cash));
        return acct?.Id;
    }
@@ -2482,7 +2484,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetCustomerDepositsAccountIdAsync(int companyId)
    {
        var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.IsActive && a.AccountNumber == "2300");
+            a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "2300");
        return acct?.Id;
    }

@@ -2490,7 +2492,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetSalesReturnsAccountIdAsync(int companyId)
    {
        var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.IsActive && a.AccountNumber == "4960");
+            a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "4960");
        return acct?.Id;
    }

@@ -2498,7 +2500,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetCustomerCreditsAccountIdAsync(int companyId)
    {
        var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.IsActive && a.AccountNumber == "2350");
+            a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "2350");
        return acct?.Id;
    }

@@ -2506,7 +2508,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetArAccountIdAsync(int companyId)
    {
        var accounts = await _unitOfWork.Accounts.FindAsync(
-            a => a.IsActive && a.AccountSubType == AccountSubType.AccountsReceivable);
+            a => a.CompanyId == companyId && a.IsActive && a.AccountSubType == AccountSubType.AccountsReceivable);
        return accounts.FirstOrDefault()?.Id;
    }

@@ -2517,7 +2519,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetBadDebtAccountIdAsync(int companyId)
    {
        var expenses = await _unitOfWork.Accounts.FindAsync(
-            a => a.IsActive && a.AccountType == AccountType.Expense);
+            a => a.CompanyId == companyId && a.IsActive && a.AccountType == AccountType.Expense);
        return expenses.FirstOrDefault(a => a.Name.Contains("bad", StringComparison.OrdinalIgnoreCase)
                                         || a.Name.Contains("debt", StringComparison.OrdinalIgnoreCase))?.Id
            ?? expenses.FirstOrDefault()?.Id;
@@ -2548,9 +2550,9 @@ public class InvoicesController : Controller
    private async Task<int?> ResolveSalesTaxAccountIdAsync(int companyId)
    {
        var taxAccount = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.AccountNumber == "2200" && a.IsActive);
+            a => a.CompanyId == companyId && a.AccountNumber == "2200" && a.IsActive);
        taxAccount ??= await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.AccountType == AccountType.Liability && a.IsActive && a.Name.ToLower().Contains("tax"));
+            a => a.CompanyId == companyId && a.AccountType == AccountType.Liability && a.IsActive && a.Name.ToLower().Contains("tax"));
        return taxAccount?.Id;
    }

@@ -2562,9 +2564,9 @@ public class InvoicesController : Controller
    private async Task<int?> GetSalesDiscountAccountIdAsync(int companyId)
    {
        var discountAccount = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.AccountNumber == "4950" && a.IsActive);
+            a => a.CompanyId == companyId && a.AccountNumber == "4950" && a.IsActive);
        discountAccount ??= await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.AccountType == AccountType.Revenue && a.IsActive && a.Name.ToLower().Contains("discount"));
+            a => a.CompanyId == companyId && a.AccountType == AccountType.Revenue && a.IsActive && a.Name.ToLower().Contains("discount"));
        return discountAccount?.Id;
    }

@@ -2572,7 +2574,7 @@ public class InvoicesController : Controller
    private async Task<int?> GetGcLiabilityAccountIdAsync(int companyId)
    {
        var acct = await _unitOfWork.Accounts.FirstOrDefaultAsync(
-            a => a.IsActive && a.AccountNumber == "2500");
+            a => a.CompanyId == companyId && a.IsActive && a.AccountNumber == "2500");
        return acct?.Id;
    }

@@ -251,6 +251,14 @@ public class JournalEntriesController : Controller
            return RedirectToAction(nameof(SalesTaxPayment));
        }

+        // Don't let a remittance exceed the outstanding liability — overpaying would push Sales Tax
+        // Payable into an abnormal (debit) balance. The 0.005 tolerance absorbs decimal rounding.
+        if (amount > taxAcct.CurrentBalance + 0.005m)
+        {
+            TempData["Error"] = $"Payment of {amount:C} exceeds the Sales Tax Payable balance of {taxAcct.CurrentBalance:C}. Enter an amount up to the outstanding liability.";
+            return RedirectToAction(nameof(SalesTaxPayment));
+        }
+
        var bankAcct = await _unitOfWork.Accounts.GetByIdAsync(bankAccountId);
        if (bankAcct == null || bankAcct.CompanyId != companyId)
        {