Phase 1 fix auth redirect API handling and route issues

app/modules/billing/ui.py

@@ -68,7 +68,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:
@@ -195,7 +196,7 @@ def invoice_list(request: Request, q: str = ""):
             user,
             title="Billing - Invoices",
             q=q,
-            active_financial_year=financial_year,
+            active_financial_year=_active_financial_year(request),
             rows=rows,
             report_summary=report_summary,
             can_create=_has_perm(db, user, "billing.create"),
@@ -378,6 +379,7 @@ def billing_settings_submit(
         db.close()
 
 
+@router.get("/invoices/new")
 @router.get("/new")
 def invoice_create_page(request: Request):
     db = CommonSessionLocal()
@@ -397,7 +399,7 @@ def invoice_create_page(request: Request):
             db,
             user,
             title="Create Invoice",
-            active_financial_year=financial_year,
+            active_financial_year=_active_financial_year(request),
             default_billing_period_from=_period_start_for_fy(_active_financial_year(request)).isoformat(),
             default_billing_period_to=_period_end_for_fy(_active_financial_year(request)).isoformat(),
             clients=clients,
@@ -512,7 +514,7 @@ def fee_structure_list(request: Request, q: str = ""):
             user,
             title="Fee Structure",
             q=q,
-            active_financial_year=financial_year,
+            active_financial_year=_active_financial_year(request),
             rows=rows,
             can_import=_has_perm(db, user, "billing_fee_structure.import"),
         )
@@ -627,7 +629,7 @@ def generate_invoices_page(
             billing_period_to=period_to.isoformat(),
             auto_generate_only=auto_generate_only,
             q=q,
-            active_financial_year=financial_year,
+            active_financial_year=_active_financial_year(request),
             result=None,
         )
     finally:
@@ -706,7 +708,7 @@ def generate_invoices_submit(
             billing_period_to=(period_to or date.today()).isoformat(),
             auto_generate_only=auto_generate_only,
             q=q,
-            active_financial_year=financial_year,
+            active_financial_year=_active_financial_year(request),
             result=result,
         )
     except ValueError as exc:

app/modules/clients/ui.py

@@ -87,7 +87,8 @@ def _render(request, template, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm_factory(db, user):

app/modules/consultants/ui.py

@@ -103,7 +103,8 @@ def _render(request: Request, template_name: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/core/iam/ui.py

@@ -61,7 +61,8 @@ def _redirect_login():
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _flash_redirect(url: str) -> RedirectResponse:

app/modules/core/rbac/ui.py

@@ -22,7 +22,8 @@ def _redirect_login():
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _is_system_admin(db, current_user) -> bool:

app/modules/core/tenancy/api.py

@@ -1,15 +1,58 @@
-from fastapi import APIRouter, Depends
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from sqlalchemy import select
+
 from app.core.db.deps import get_common_db
+from app.core.security.session_auth import require_login
+from app.modules.core.iam.models import User
+from app.modules.core.rbac.deps import get_user_roles
 from app.modules.core.tenancy.models import Tenant, Branch
 
 router = APIRouter(prefix="/tenancy", tags=["tenancy"])
 
+
+def _require_tenancy_api_access(db: Session, user: User) -> None:
+    roles = set(get_user_roles(db, int(user.id)))
+    if not roles.intersection({"System Admin", "Firm Admin"}):
+        raise HTTPException(status_code=403, detail="Tenancy API access denied")
+
+
+def _tenant_payload(t: Tenant) -> dict:
+    return {
+        "id": t.id,
+        "code": getattr(t, "code", None),
+        "name": getattr(t, "name", None),
+        "is_active": getattr(t, "is_active", None),
+    }
+
+
+def _branch_payload(b: Branch) -> dict:
+    return {
+        "id": b.id,
+        "tenant_id": getattr(b, "tenant_id", None),
+        "code": getattr(b, "code", None),
+        "name": getattr(b, "name", None),
+        "is_active": getattr(b, "is_active", None),
+    }
+
+
 @router.get("/tenants")
-def list_tenants(db: Session = Depends(get_common_db)):
-    return db.execute(select(Tenant).order_by(Tenant.id)).scalars().all()
+def list_tenants(db: Session = Depends(get_common_db), current_user: User = Depends(require_login)):
+    _require_tenancy_api_access(db, current_user)
+    stmt = select(Tenant).order_by(Tenant.id)
+    roles = set(get_user_roles(db, int(current_user.id)))
+    if "System Admin" not in roles:
+        stmt = stmt.where(Tenant.id == current_user.tenant_id)
+    return [_tenant_payload(t) for t in db.execute(stmt).scalars().all()]
+
 
 @router.get("/branches")
-def list_branches(db: Session = Depends(get_common_db)):
-    return db.execute(select(Branch).order_by(Branch.id)).scalars().all()
+def list_branches(db: Session = Depends(get_common_db), current_user: User = Depends(require_login)):
+    _require_tenancy_api_access(db, current_user)
+    stmt = select(Branch).order_by(Branch.id)
+    roles = set(get_user_roles(db, int(current_user.id)))
+    if "System Admin" not in roles:
+        stmt = stmt.where(Branch.tenant_id == current_user.tenant_id)
+    return [_branch_payload(b) for b in db.execute(stmt).scalars().all()]

app/modules/documents/ui.py

@@ -106,7 +106,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _require_user(request: Request, db, permission_code: str):
@@ -382,10 +383,13 @@ def download_latest_document(request: Request, document_id: int):
             return response
         scope = build_document_scope(request, db, user)
         document = get_document(db, document_id)
+        if not document:
+            from app.core.http_responses import not_found_response
+            return not_found_response(request, "Document not found")
         active_fy = _active_financial_year(request)
         if active_fy and document and getattr(document, "financial_year", None) != active_fy:
             return RedirectResponse(url=f"/documents?financial_year={active_fy}&error=wrong_year", status_code=303)
-        if not document or not document.engagement or not user_can_view_engagement(db, user, document.engagement, scope):
+        if not document.engagement or not user_can_view_engagement(db, user, document.engagement, scope):
             return _redirect_denied()
         version = get_latest_version(document)
         if not version:
@@ -404,11 +408,14 @@ def download_document_version(request: Request, version_id: int):
             return response
         scope = build_document_scope(request, db, user)
         version = get_version(db, version_id)
-        document = version.document if version else None
+        if not version:
+            from app.core.http_responses import not_found_response
+            return not_found_response(request, "Document version not found")
+        document = version.document
         active_fy = _active_financial_year(request)
         if active_fy and document and getattr(document, "financial_year", None) != active_fy:
             return RedirectResponse(url=f"/documents?financial_year={active_fy}&error=wrong_year", status_code=303)
-        if not version or not document or not document.engagement or not user_can_view_engagement(db, user, document.engagement, scope):
+        if not document or not document.engagement or not user_can_view_engagement(db, user, document.engagement, scope):
             return _redirect_denied()
         return _download_or_queue_from_local_node(request, db, user, document, version, action="download_version")
     finally:
@@ -578,7 +585,10 @@ def download_latest_permanent_document(request: Request, document_id: int):
             return response
         scope = build_document_scope(request, db, user)
         document = get_permanent_document(db, document_id)
-        if not document or not document.client or not user_can_view_client_documents(db, user, document.client, scope):
+        if not document:
+            from app.core.http_responses import not_found_response
+            return not_found_response(request, "Permanent document not found")
+        if not document.client or not user_can_view_client_documents(db, user, document.client, scope):
             return _redirect_denied()
         version = get_latest_permanent_version(document)
         if not version:
@@ -597,8 +607,11 @@ def download_permanent_version(request: Request, version_id: int):
             return response
         scope = build_document_scope(request, db, user)
         version = get_permanent_version(db, version_id)
-        document = version.document if version else None
-        if not version or not document or not document.client or not user_can_view_client_documents(db, user, document.client, scope):
+        if not version:
+            from app.core.http_responses import not_found_response
+            return not_found_response(request, "Permanent document version not found")
+        document = version.document
+        if not document or not document.client or not user_can_view_client_documents(db, user, document.client, scope):
             return _redirect_denied()
         return _download_or_queue_permanent_from_local_node(request, db, user, document, version)
     finally:

app/modules/employees/ui.py

@@ -143,7 +143,8 @@ def _redirect_login():
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _base_ctx(request: Request, db, current_user, **ctx):
@@ -687,6 +688,7 @@ def employee_leave_balance_adjust(request: Request, employee_id: int = Form(...)
         db.close()
 
 
+@router.get("/leaves")
 @router.get("/leave")
 def employee_leave_requests(request: Request, employee_id: int | None = None, status: str = "pending"):
     db = CommonSessionLocal()
@@ -2379,6 +2381,7 @@ def employee_punch_out_submit(
         db.close()
 
 
+@portal_router.get("/leaves")
 @portal_router.get("/leave")
 def employee_self_leave(request: Request):
     db = CommonSessionLocal()

app/modules/managers/ui.py

@@ -30,7 +30,8 @@ def _redirect_login():
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/employee/dashboard", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _base_ctx(request: Request, db: Session, current_user, **ctx):

app/modules/marketplace/ui.py

@@ -161,7 +161,8 @@ def marketplace_public_request_service_submit(request: Request, csrf_token: str
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/notice_cases/ui.py

@@ -71,7 +71,8 @@ def _render(request: Request, template_name: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _require_user(request: Request, db, permission: str):

app/modules/partners/ui.py

@@ -38,7 +38,8 @@ def _redirect_login():
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/employee/dashboard", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _is_partner_user(db: Session, current_user) -> bool:

app/modules/platform_billing/ui.py

@@ -49,7 +49,8 @@ router = APIRouter(prefix="/platform-billing", tags=["platform-billing-ui"])
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/services/client_services_ui_old.py

@@ -43,7 +43,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/services/engagements_ui.py

@@ -52,7 +52,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/services/execution_ui_old.py

@@ -44,7 +44,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/services/ui.py

@@ -83,7 +83,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/services/work_tracker_ui.py

@@ -55,7 +55,8 @@ def _render(request: Request, template: str, db, user, **ctx):
 
 
 def _redirect_denied():
-    return RedirectResponse(url="/system-settings", status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _has_perm(db, user, code: str) -> bool:

app/modules/system_settings/ui.py

@@ -38,7 +38,8 @@ def _base_ctx(request: Request, user, db, **ctx):
 
 
 def _redirect_denied(default_url: str = "/system-settings"):
-    return RedirectResponse(url=default_url, status_code=303)
+    from app.core.http_responses import ui_access_denied
+    return ui_access_denied()
 
 
 def _render_with_user(request: Request, template: str, ctx: dict, status_code: int = 200):