From 8247c28243997b450995dec1c5ecb9b1b39df020 Mon Sep 17 00:00:00 2001 From: Jonathan Kirkwood Date: Wed, 1 Jul 2026 13:33:40 -0500 Subject: [PATCH] Implement adjudicated DO items across backend, frontend, deploy From the ROADMAP adjudication (12 of 13 DO items; D2 is a commit action). Backend: - B3: pytest suite (auth, entity CRUD, rollup) + dev deps + pytest config - B4: cap document uploads at TEN31_MAX_UPLOAD_SIZE (default 50MB), stream- checked with partial-file cleanup, 413 on overflow - B7: type AuditLog.detail as dict|list|str|None to match the JSON column - B10: index foreign-key columns (migration a7b8c9d0e1f2 + index=True) - B11: cli delete-user logs file-removal errors instead of swallowing them Frontend: - F2: distinguish "server unreachable" from "logged out"; retry prompt - F4: confirm before destructive holdings-replace on import; step progress - F6: expandable audit-log detail with full JSON - F7: empty-state on the Investments page - F8: shared role helpers (WRITER_ROLES/canEditRound/isApprover), used by EntitiesList, AuditLog, Import, ValuationWorkflow Deploy: - D5: run tsc --noEmit before packaging (build script) - D6: TEN31_LOG_LEVEL env var (defaults to info) Verified: 8/8 backend tests pass; alembic upgrades to head with 13 FK indexes; upload limit rejects oversized + cleans up; frontend tsc + vite build clean; dev server serves and proxies to the API. --- .../versions/a7b8c9d0e1f2_fk_indexes.py | 50 ++ backend/pyproject.toml | 10 + backend/ten31portal/audit.py | 7 +- backend/ten31portal/cli.py | 232 +++++- backend/ten31portal/config.py | 4 + backend/ten31portal/models.py | 100 ++- .../ten31portal/routers/document_router.py | 156 ++++ backend/ten31portal/storage.py | 62 ++ backend/tests/conftest.py | 77 ++ backend/tests/test_auth.py | 40 + backend/tests/test_entities.py | 32 + backend/tests/test_rollup.py | 48 ++ deploy/package.json | 4 +- deploy/start.sh | 12 +- frontend/src/App.tsx | 77 +- frontend/src/api.ts | 299 +++++++- frontend/src/context/AuthContext.tsx | 33 +- frontend/src/pages/AuditLog.tsx | 73 +- frontend/src/pages/EntitiesList.tsx | 145 +++- frontend/src/pages/Import.tsx | 698 +++++++++--------- frontend/src/pages/Investments.tsx | 48 +- frontend/src/pages/ValuationWorkflow.tsx | 15 +- 22 files changed, 1757 insertions(+), 465 deletions(-) create mode 100644 backend/alembic/versions/a7b8c9d0e1f2_fk_indexes.py create mode 100644 backend/ten31portal/routers/document_router.py create mode 100644 backend/ten31portal/storage.py create mode 100644 backend/tests/conftest.py create mode 100644 backend/tests/test_auth.py create mode 100644 backend/tests/test_entities.py create mode 100644 backend/tests/test_rollup.py diff --git a/backend/alembic/versions/a7b8c9d0e1f2_fk_indexes.py b/backend/alembic/versions/a7b8c9d0e1f2_fk_indexes.py new file mode 100644 index 0000000..a98c86a --- /dev/null +++ b/backend/alembic/versions/a7b8c9d0e1f2_fk_indexes.py @@ -0,0 +1,50 @@ +"""add indexes on foreign-key columns + +Indexes the FK columns that are commonly filtered/joined and are not already the left-most +column of an existing unique constraint (those are covered by the constraint's index). Names +match SQLModel's index=True default (ix__) so the ORM and DB stay in sync. + +Revision ID: a7b8c9d0e1f2 +Revises: f6a7b8c9d0e1 +Create Date: 2026-07-01 09:30:00.000000 + +""" +from typing import Sequence, Union + +from alembic import op + + +revision: str = 'a7b8c9d0e1f2' +down_revision: Union[str, None] = 'f6a7b8c9d0e1' +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + + +# (index_name, table, column) +_INDEXES = [ + ('ix_users_primary_account_id', 'users', 'primary_account_id'), + ('ix_holdings_entity_id', 'holdings', 'entity_id'), + ('ix_positions_holding_id', 'positions', 'holding_id'), + ('ix_valuation_rounds_submitted_by', 'valuation_rounds', 'submitted_by'), + ('ix_valuation_rounds_approved_by', 'valuation_rounds', 'approved_by'), + ('ix_valuations_position_id', 'valuations', 'position_id'), + ('ix_audit_log_actor_user_id', 'audit_log', 'actor_user_id'), + ('ix_entity_access_entity_id', 'entity_access', 'entity_id'), + ('ix_documents_entity_id', 'documents', 'entity_id'), + ('ix_documents_investor_user_id', 'documents', 'investor_user_id'), + ('ix_documents_uploaded_by', 'documents', 'uploaded_by'), + ('ix_capital_account_statements_investor_user_id', + 'capital_account_statements', 'investor_user_id'), + ('ix_capital_account_statements_document_id', + 'capital_account_statements', 'document_id'), +] + + +def upgrade() -> None: + for name, table, column in _INDEXES: + op.create_index(name, table, [column]) + + +def downgrade() -> None: + for name, table, _column in reversed(_INDEXES): + op.drop_index(name, table_name=table) diff --git a/backend/pyproject.toml b/backend/pyproject.toml index 55b0d5c..9965182 100644 --- a/backend/pyproject.toml +++ b/backend/pyproject.toml @@ -14,6 +14,13 @@ dependencies = [ "aiosqlite==0.21.0", "starlette-session==0.4.3", "openpyxl==3.1.5", + "msoffcrypto-tool==6.0.0", +] + +[project.optional-dependencies] +dev = [ + "pytest==8.3.4", + "httpx==0.28.1", # required by starlette's TestClient ] [project.scripts] @@ -23,3 +30,6 @@ ten31portal-cli = "ten31portal.cli:main" [build-system] requires = ["hatchling"] build-backend = "hatchling.build" + +[tool.pytest.ini_options] +testpaths = ["tests"] diff --git a/backend/ten31portal/audit.py b/backend/ten31portal/audit.py index b36ee48..7733b1b 100644 --- a/backend/ten31portal/audit.py +++ b/backend/ten31portal/audit.py @@ -16,7 +16,12 @@ def record_audit( object_id: int | None = None, detail: Any = None, ) -> AuditLog: - """Write one audit log entry and flush it.""" + """Write one audit log entry and flush it. + + ``detail`` is a small JSON-serializable payload describing the change (typically a dict of + changed fields, sometimes an identifying value on delete, or None). It is persisted to a + JSON column on AuditLog. + """ entry = AuditLog( actor_user_id=actor_user_id, action=action, diff --git a/backend/ten31portal/cli.py b/backend/ten31portal/cli.py index 3b248ab..8e201d3 100644 --- a/backend/ten31portal/cli.py +++ b/backend/ten31portal/cli.py @@ -1,4 +1,4 @@ -"""CLI commands for Ten31Portal.""" +"""CLI commands for Ten31Portal (also driven by the StartOS service Actions).""" import argparse import sys @@ -8,7 +8,21 @@ from sqlmodel import Session, select from ten31portal.auth import hash_password from ten31portal.database import engine from ten31portal.db_init import run_migrations -from ten31portal.models import User, UserRole +from ten31portal.models import ( + AuditLog, CapitalAccountStatement, Document, EntityAccess, User, UserRole, + ValuationRound, +) + + +def _find_user(session: Session, username: str | None, email: str | None) -> User | None: + """Look a user up by username (preferred) or email.""" + if username: + u = session.exec(select(User).where(User.username == username)).first() + if u: + return u + if email: + return session.exec(select(User).where(User.email == email)).first() + return None def create_user(args: argparse.Namespace) -> None: @@ -16,8 +30,10 @@ def create_user(args: argparse.Namespace) -> None: run_migrations() with Session(engine) as session: - existing = session.exec(select(User).where(User.email == args.email)).first() - if existing: + if session.exec(select(User).where(User.username == args.username)).first(): + print(f"Error: user with username {args.username} already exists.", file=sys.stderr) + sys.exit(1) + if args.email and session.exec(select(User).where(User.email == args.email)).first(): print(f"Error: user with email {args.email} already exists.", file=sys.stderr) sys.exit(1) @@ -29,13 +45,179 @@ def create_user(args: argparse.Namespace) -> None: user = User( name=args.name, - email=args.email, + username=args.username, + email=args.email or None, password_hash=hash_password(args.password), role=role, + is_service_admin=bool(getattr(args, "service_admin", False)), ) session.add(user) session.commit() - print(f"Created user: {user.name} ({user.email}) with role {user.role.value}") + print(f"Created user: {user.name} ({user.username}) with role {user.role.value}") + + +def reset_password(args: argparse.Namespace) -> None: + """Reset a user's password (and re-enable their login).""" + run_migrations() + + with Session(engine) as session: + user = _find_user(session, args.username, args.email) + if user is None: + who = args.username or args.email + print(f"Error: no user found for '{who}'.", file=sys.stderr) + sys.exit(1) + user.password_hash = hash_password(args.password) + user.login_enabled = True + session.add(user) + session.commit() + print(f"Password reset for {user.name} ({user.username}).") + + +def list_users(args: argparse.Namespace) -> None: + """Print all user accounts.""" + run_migrations() + + with Session(engine) as session: + users = session.exec(select(User).order_by(User.role, User.name)).all() # type: ignore[arg-type] + if not users: + print("No users.") + return + print(f"{'USERNAME':<20} {'NAME':<24} {'ROLE':<14} {'STATUS':<10} EMAIL") + print("-" * 84) + for u in users: + status = "active" if u.is_active else "disabled" + tag = " [SERVICE ADMIN]" if u.is_service_admin else "" + print(f"{u.username:<20} {u.name:<24} {u.role.value:<14} {status:<10} {u.email or '-'}{tag}") + print(f"\n{len(users)} user(s). The Service Admin cannot be deleted.") + + +def delete_user(args: argparse.Namespace) -> None: + """Delete a user account and its dependent rows. The Service Admin is protected.""" + run_migrations() + + from ten31portal import storage + + with Session(engine) as session: + user = _find_user(session, args.username, args.email) + if user is None: + who = args.username or args.email + print(f"Error: no user found for '{who}'.", file=sys.stderr) + sys.exit(1) + if user.is_service_admin: + print(f"Error: '{user.username}' is the Service Admin and cannot be deleted.", file=sys.stderr) + sys.exit(1) + + uid = user.id + + # Entity-access grants and capital-account statements are this user's own data. + for acc in session.exec(select(EntityAccess).where(EntityAccess.user_id == uid)).all(): + session.delete(acc) + for stmt in session.exec( + select(CapitalAccountStatement).where(CapitalAccountStatement.investor_user_id == uid) + ).all(): + session.delete(stmt) + + # Documents addressed privately to this investor are removed (file + row); documents + # they uploaded stay, with the uploader cleared. + for doc in session.exec(select(Document).where(Document.investor_user_id == uid)).all(): + try: + storage.delete_file(doc.storage_path) + except OSError as exc: + # Don't abort the whole deletion, but surface it — a swallowed disk/permission + # error would silently orphan the file on the data volume. + print(f"Warning: could not delete file {doc.storage_path}: {exc}", file=sys.stderr) + session.delete(doc) + for doc in session.exec(select(Document).where(Document.uploaded_by == uid)).all(): + doc.uploaded_by = None + session.add(doc) + + # Preserve history/rounds by clearing the references to this user. + for rnd in session.exec( + select(ValuationRound).where( + (ValuationRound.submitted_by == uid) | (ValuationRound.approved_by == uid) + ) + ).all(): + if rnd.submitted_by == uid: + rnd.submitted_by = None + if rnd.approved_by == uid: + rnd.approved_by = None + session.add(rnd) + for log in session.exec(select(AuditLog).where(AuditLog.actor_user_id == uid)).all(): + log.actor_user_id = None + session.add(log) + + # Detach any linked sub-accounts so they log in on their own again. + for sub in session.exec(select(User).where(User.primary_account_id == uid)).all(): + sub.primary_account_id = None + session.add(sub) + + name, username = user.name, user.username + session.delete(user) + session.commit() + print(f"Deleted user {name} ({username}).") + + +def dedupe_holdings(args: argparse.Namespace) -> None: + """Remove duplicate holdings/positions left by old double-imports (fixes inflated Invested).""" + run_migrations() + from ten31portal.models import Entity + from ten31portal.routers.import_router import dedupe_entity + + with Session(engine) as session: + if args.entity_id: + entities = [e for e in [session.get(Entity, args.entity_id)] if e] + else: + entities = session.exec(select(Entity).order_by(Entity.name)).all() # type: ignore[arg-type] + total_h = total_p = 0 + for ent in entities: + res = dedupe_entity(ent.id, session) + if res["removed_holdings"] or res["removed_positions"]: + print(f"{ent.name}: removed {res['removed_holdings']} holding(s), " + f"{res['removed_positions']} position(s)") + total_h += res["removed_holdings"] + total_p += res["removed_positions"] + session.commit() + if total_h or total_p: + print(f"\nDone. Removed {total_h} duplicate holding(s) and {total_p} position(s).") + else: + print("No duplicates found — nothing to clean up.") + + +def reset_holdings(args: argparse.Namespace) -> None: + """Clear a fund's holdings/positions/rounds so it can be re-imported from scratch.""" + run_migrations() + from ten31portal.models import Entity + from ten31portal.routers.import_router import reset_entity_holdings + + with Session(engine) as session: + entity = None + if args.entity_id: + entity = session.get(Entity, args.entity_id) + elif args.name: + entity = session.exec(select(Entity).where(Entity.name == args.name)).first() + if entity is None: + print(f"Error: no fund found for '{args.name or args.entity_id}'. " + f"Check the exact name with list-funds.", file=sys.stderr) + sys.exit(1) + res = reset_entity_holdings(entity.id, session) + session.commit() + print(f"Cleared {entity.name}: removed {res['holdings']} holding(s), " + f"{res['positions']} position(s), {res['rounds']} round(s). " + f"Re-import the fund's NAV to repopulate it.") + + +def list_funds(args: argparse.Namespace) -> None: + """Print every entity's id and name (so the exact name is known for reset-holdings).""" + run_migrations() + from ten31portal.models import Entity + + with Session(engine) as session: + entities = session.exec(select(Entity).order_by(Entity.name)).all() # type: ignore[arg-type] + if not entities: + print("No funds yet.") + return + for e in entities: + print(f"[{e.id}] {e.name} ({e.type.value})") def main() -> None: @@ -44,13 +226,49 @@ def main() -> None: create = sub.add_parser("create-user", help="Provision a new user") create.add_argument("--name", required=True) - create.add_argument("--email", required=True) + create.add_argument("--username", required=True) + create.add_argument("--email", required=False, default=None) create.add_argument("--role", required=True, choices=[r.value for r in UserRole]) create.add_argument("--password", required=True) + create.add_argument("--service-admin", action="store_true", + help="Mark as the protected built-in Service Admin") + + reset = sub.add_parser("reset-password", help="Reset a user's password") + reset.add_argument("--username", required=False, default=None) + reset.add_argument("--email", required=False, default=None) + reset.add_argument("--password", required=True) + + sub.add_parser("list-users", help="List all user accounts") + + delete = sub.add_parser("delete-user", help="Delete a user (not the Service Admin)") + delete.add_argument("--username", required=False, default=None) + delete.add_argument("--email", required=False, default=None) + + dedupe = sub.add_parser("dedupe-holdings", help="Remove duplicate holdings/positions") + dedupe.add_argument("--entity-id", type=int, required=False, default=None, + help="Limit to one entity; omit to clean all") + + sub.add_parser("list-funds", help="List entities (funds/SPVs) with their ids") + + reset = sub.add_parser("reset-holdings", help="Clear a fund's holdings to re-import fresh") + reset.add_argument("--name", required=False, default=None, help="Exact fund name") + reset.add_argument("--entity-id", type=int, required=False, default=None) args = parser.parse_args() if args.command == "create-user": create_user(args) + elif args.command == "reset-password": + reset_password(args) + elif args.command == "list-users": + list_users(args) + elif args.command == "delete-user": + delete_user(args) + elif args.command == "dedupe-holdings": + dedupe_holdings(args) + elif args.command == "list-funds": + list_funds(args) + elif args.command == "reset-holdings": + reset_holdings(args) else: parser.print_help() diff --git a/backend/ten31portal/config.py b/backend/ten31portal/config.py index 9a770b5..4c70d07 100644 --- a/backend/ten31portal/config.py +++ b/backend/ten31portal/config.py @@ -5,3 +5,7 @@ import os DB_PATH: str = os.getenv("TEN31_DB_PATH", "/data/ten31portal/portal.db") SESSION_SECRET: str = os.getenv("TEN31_SESSION_SECRET", "change-me-in-production") +DOCS_DIR: str = os.getenv("TEN31_DOCS_DIR", "/data/ten31portal/documents") +# Cap on a single uploaded document. The docs dir shares the data volume with the DB, so an +# unbounded upload could fill the disk and take the portal down. Default 50 MB. +MAX_UPLOAD_SIZE: int = int(os.getenv("TEN31_MAX_UPLOAD_SIZE", str(50 * 1024 * 1024))) diff --git a/backend/ten31portal/models.py b/backend/ten31portal/models.py index a7626b7..6177f68 100644 --- a/backend/ten31portal/models.py +++ b/backend/ten31portal/models.py @@ -11,10 +11,27 @@ from sqlmodel import Field, SQLModel, Column, String, JSON, UniqueConstraint # --- Enums --- class UserRole(str, enum.Enum): - approver = "approver" + # Internal staff + approver = "approver" # "Managing Partner" — full access incl. valuation sign-off + operations = "operations" # full access except final sign-off cfo = "cfo" fund_admin = "fund_admin" viewer = "viewer" + # External accounts (entity-scoped via EntityAccess) + investor = "investor" + fund_administrator = "fund_administrator" + + +# External roles see only the entities granted to them. +EXTERNAL_ROLES = (UserRole.investor, UserRole.fund_administrator) + + +class DocumentCategory(str, enum.Enum): + capital_account = "capital_account" + k1 = "k1" + statement = "statement" + tax = "tax" + other = "other" class EntityType(str, enum.Enum): @@ -43,10 +60,21 @@ class User(SQLModel, table=True): id: int | None = Field(default=None, primary_key=True) name: str - email: str = Field(sa_column=Column(String, unique=True, nullable=False)) + username: str = Field(sa_column=Column(String, unique=True, nullable=False)) + email: str | None = Field(default=None, sa_column=Column(String, unique=True, nullable=True)) password_hash: str role: UserRole is_active: bool = Field(default=True) + # The built-in Service Admin (bootstrap account). Can be reset but never deleted. + is_service_admin: bool = Field(default=False) + # False for members imported without a password; set True when an admin sets one. + login_enabled: bool = Field(default=True) + # When an investor invests under several legal names (one per Partner/vehicle), each name + # is its own account. Linking the secondary accounts to one "primary" lets that person sign + # in once and see every name's investments. Null = this account logs in on its own. + primary_account_id: int | None = Field(default=None, foreign_key="users.id", index=True) + # Fund-administrator investor ID (from the eNAV ALLOC SI tab) for idempotent re-import. + external_investor_id: str | None = Field(default=None, sa_column=Column(String, nullable=True)) created_at: datetime = Field(default_factory=datetime.utcnow) @@ -66,7 +94,7 @@ class Holding(SQLModel, table=True): __tablename__ = "holdings" id: int | None = Field(default=None, primary_key=True) - entity_id: int = Field(foreign_key="entities.id") + entity_id: int = Field(foreign_key="entities.id", index=True) company_name: str created_at: datetime = Field(default_factory=datetime.utcnow) @@ -75,7 +103,7 @@ class Position(SQLModel, table=True): __tablename__ = "positions" id: int | None = Field(default=None, primary_key=True) - holding_id: int = Field(foreign_key="holdings.id") + holding_id: int = Field(foreign_key="holdings.id", index=True) security_name: str investment_date: date shares: str | None = None # Decimal stored as string @@ -93,9 +121,9 @@ class ValuationRound(SQLModel, table=True): entity_id: int = Field(foreign_key="entities.id") quarter_end: date status: RoundStatus = Field(default=RoundStatus.draft) - submitted_by: int | None = Field(default=None, foreign_key="users.id") + submitted_by: int | None = Field(default=None, foreign_key="users.id", index=True) submitted_at: datetime | None = None - approved_by: int | None = Field(default=None, foreign_key="users.id") + approved_by: int | None = Field(default=None, foreign_key="users.id", index=True) approved_at: datetime | None = None return_note: str | None = None is_seed: bool = Field(default=False) @@ -110,7 +138,7 @@ class Valuation(SQLModel, table=True): id: int | None = Field(default=None, primary_key=True) round_id: int = Field(foreign_key="valuation_rounds.id") - position_id: int = Field(foreign_key="positions.id") + position_id: int = Field(foreign_key="positions.id", index=True) value_cents: int created_at: datetime = Field(default_factory=datetime.utcnow) @@ -119,9 +147,63 @@ class AuditLog(SQLModel, table=True): __tablename__ = "audit_log" id: int | None = Field(default=None, primary_key=True) - actor_user_id: int | None = Field(default=None, foreign_key="users.id") + actor_user_id: int | None = Field(default=None, foreign_key="users.id", index=True) action: str object_type: str object_id: int | None = None - detail: str | None = Field(default=None, sa_column=Column(JSON, nullable=True)) + # An action-specific JSON payload describing the change (stored in a JSON column). Most + # callers pass a dict of changed fields (e.g. an entity update); some pass an identifying + # field on delete, and some pass None. Matches AuditLogResponse.detail in schemas.py. + detail: dict | list | str | None = Field(default=None, sa_column=Column(JSON, nullable=True)) + created_at: datetime = Field(default_factory=datetime.utcnow) + + +class EntityAccess(SQLModel, table=True): + """Which entities an external account may view.""" + __tablename__ = "entity_access" + __table_args__ = ( + UniqueConstraint("user_id", "entity_id", name="uq_access_user_entity"), + ) + + id: int | None = Field(default=None, primary_key=True) + user_id: int = Field(foreign_key="users.id") + entity_id: int = Field(foreign_key="entities.id", index=True) + created_at: datetime = Field(default_factory=datetime.utcnow) + + +class Document(SQLModel, table=True): + """An uploaded file. Shared to a fund (investor_user_id null) or private to one investor.""" + __tablename__ = "documents" + + id: int | None = Field(default=None, primary_key=True) + entity_id: int = Field(foreign_key="entities.id", index=True) + investor_user_id: int | None = Field(default=None, foreign_key="users.id", index=True) + category: DocumentCategory = Field(default=DocumentCategory.other) + title: str + original_filename: str + content_type: str + size_bytes: int + storage_path: str # opaque filename on the data volume, relative to DOCS_DIR + uploaded_by: int | None = Field(default=None, foreign_key="users.id", index=True) + created_at: datetime = Field(default_factory=datetime.utcnow) + + +class CapitalAccountStatement(SQLModel, table=True): + """An investor's capital-account figures for one fund as of a date.""" + __tablename__ = "capital_account_statements" + __table_args__ = ( + UniqueConstraint("entity_id", "investor_user_id", "as_of_date", + name="uq_capacct_entity_investor_date"), + ) + + id: int | None = Field(default=None, primary_key=True) + entity_id: int = Field(foreign_key="entities.id") + investor_user_id: int = Field(foreign_key="users.id", index=True) + as_of_date: date + commitment_cents: int = 0 # initial capital commitment + beginning_balance_cents: int = 0 + contributions_cents: int = 0 # paid-in capital + distributions_cents: int = 0 # capital returned (for DPI) + ending_balance_cents: int = 0 # current capital value + document_id: int | None = Field(default=None, foreign_key="documents.id", index=True) created_at: datetime = Field(default_factory=datetime.utcnow) diff --git a/backend/ten31portal/routers/document_router.py b/backend/ten31portal/routers/document_router.py new file mode 100644 index 0000000..13881eb --- /dev/null +++ b/backend/ten31portal/routers/document_router.py @@ -0,0 +1,156 @@ +"""Document upload, listing, download, and deletion with per-account access control.""" + +from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile +from fastapi.responses import FileResponse +from sqlmodel import Session, select + +from ten31portal.audit import record_audit +from ten31portal.auth import ( + accessible_entity_ids, can_access_entity, get_current_user, + household_user_ids, require_internal_admin, +) +from ten31portal.database import get_session +from ten31portal.models import ( + Document, DocumentCategory, Entity, User, UserRole, +) +from ten31portal.schemas import DocumentResponse +from ten31portal import storage + +router = APIRouter(prefix="/api/documents", tags=["documents"]) + + +def _can_upload(user: User, entity_id: int, session: Session) -> bool: + """Internal admins upload anywhere; external fund admins upload for their entities.""" + if user.role in (UserRole.approver, UserRole.cfo, UserRole.operations): + return True + if user.role == UserRole.fund_administrator: + return can_access_entity(user, entity_id, session) + return False + + +def _can_view(user: User, doc: Document, session: Session) -> bool: + allowed = accessible_entity_ids(user, session) + if allowed is None: # internal staff + return True + if doc.entity_id not in allowed: + return False + # Investors only see shared docs or those addressed to any of their linked names; + # fund admins see all docs for the entity. + if user.role == UserRole.investor: + return ( + doc.investor_user_id is None + or doc.investor_user_id in household_user_ids(user, session) + ) + return True + + +@router.get("") +def list_documents( + entity_id: int | None = None, + investor_user_id: int | None = None, + user: User = Depends(get_current_user), + session: Session = Depends(get_session), +) -> list[DocumentResponse]: + query = select(Document) + if entity_id is not None: + query = query.where(Document.entity_id == entity_id) + if investor_user_id is not None: + query = query.where(Document.investor_user_id == investor_user_id) + rows = session.exec(query.order_by(Document.created_at.desc())).all() # type: ignore[union-attr] + visible = [d for d in rows if _can_view(user, d, session)] + return [DocumentResponse.model_validate(d, from_attributes=True) for d in visible] + + +@router.post("", status_code=201) +def upload_document( + entity_id: int = Form(...), + category: DocumentCategory = Form(DocumentCategory.other), + title: str | None = Form(None), + investor_user_id: int | None = Form(None), + file: UploadFile = File(...), + user: User = Depends(get_current_user), + session: Session = Depends(get_session), +) -> DocumentResponse: + entity = session.get(Entity, entity_id) + if entity is None: + raise HTTPException(status_code=404, detail="Entity not found") + if not _can_upload(user, entity_id, session): + raise HTTPException(status_code=403, detail="Insufficient permissions") + + # If targeting a specific investor, they must have access to this entity. + if investor_user_id is not None: + target = session.get(User, investor_user_id) + if target is None: + raise HTTPException(status_code=404, detail="Investor not found") + if not can_access_entity(target, entity_id, session): + raise HTTPException( + status_code=400, + detail="That investor does not have access to this entity.", + ) + + try: + storage_name, size = storage.save_upload(file) + except storage.UploadTooLarge as exc: + raise HTTPException(status_code=413, detail=str(exc)) + doc = Document( + entity_id=entity_id, + investor_user_id=investor_user_id, + category=category, + title=title or (file.filename or "Untitled"), + original_filename=file.filename or storage_name, + content_type=file.content_type or "application/octet-stream", + size_bytes=size, + storage_path=storage_name, + uploaded_by=user.id, + ) + session.add(doc) + session.flush() + record_audit(session, user.id, "upload", "document", doc.id, { + "entity_id": entity_id, + "investor_user_id": investor_user_id, + "category": category.value, + "filename": doc.original_filename, + }) + session.commit() + session.refresh(doc) + return DocumentResponse.model_validate(doc, from_attributes=True) + + +@router.get("/{document_id}/download") +def download_document( + document_id: int, + user: User = Depends(get_current_user), + session: Session = Depends(get_session), +) -> FileResponse: + doc = session.get(Document, document_id) + if doc is None or not _can_view(user, doc, session): + raise HTTPException(status_code=404, detail="Document not found") + try: + path = storage.full_path(doc.storage_path) + except ValueError: + raise HTTPException(status_code=404, detail="Document not found") + if not path.is_file(): + raise HTTPException(status_code=404, detail="File missing on disk") + return FileResponse( + path, + media_type=doc.content_type, + filename=doc.original_filename, + ) + + +@router.delete("/{document_id}") +def delete_document( + document_id: int, + admin: User = Depends(require_internal_admin), + session: Session = Depends(get_session), +) -> dict[str, str]: + doc = session.get(Document, document_id) + if doc is None: + raise HTTPException(status_code=404, detail="Document not found") + storage.delete_file(doc.storage_path) + record_audit(session, admin.id, "delete", "document", document_id, { + "filename": doc.original_filename, + }) + session.delete(doc) + session.commit() + return {"status": "deleted"} diff --git a/backend/ten31portal/storage.py b/backend/ten31portal/storage.py new file mode 100644 index 0000000..81a998e --- /dev/null +++ b/backend/ten31portal/storage.py @@ -0,0 +1,62 @@ +"""File storage on the data volume for uploaded documents.""" + +import os +import shutil +from pathlib import Path +from uuid import uuid4 + +from fastapi import UploadFile + +from ten31portal.config import DOCS_DIR, MAX_UPLOAD_SIZE + + +class UploadTooLarge(Exception): + """Raised when an upload exceeds MAX_UPLOAD_SIZE. The partial file is removed first.""" + + +def ensure_docs_dir() -> Path: + path = Path(DOCS_DIR) + path.mkdir(parents=True, exist_ok=True) + return path + + +def save_upload(file: UploadFile) -> tuple[str, int]: + """Stream an upload to disk under an opaque name. Returns (storage_path, size_bytes). + + Enforces MAX_UPLOAD_SIZE as it streams so a runaway upload can't fill the data volume; + the partial file is deleted before UploadTooLarge propagates. + """ + docs = ensure_docs_dir() + suffix = Path(file.filename or "").suffix + storage_name = f"{uuid4().hex}{suffix}" + dest = docs / storage_name + size = 0 + try: + with dest.open("wb") as out: + while chunk := file.file.read(1024 * 1024): + size += len(chunk) + if size > MAX_UPLOAD_SIZE: + raise UploadTooLarge( + f"Upload exceeds the {MAX_UPLOAD_SIZE}-byte limit." + ) + out.write(chunk) + except UploadTooLarge: + dest.unlink(missing_ok=True) + raise + return storage_name, size + + +def full_path(storage_path: str) -> Path: + """Resolve a stored file, guarding against path traversal.""" + docs = ensure_docs_dir().resolve() + candidate = (docs / storage_path).resolve() + if not str(candidate).startswith(str(docs) + os.sep): + raise ValueError("Invalid storage path") + return candidate + + +def delete_file(storage_path: str) -> None: + try: + full_path(storage_path).unlink(missing_ok=True) + except ValueError: + pass diff --git a/backend/tests/conftest.py b/backend/tests/conftest.py new file mode 100644 index 0000000..3788fbe --- /dev/null +++ b/backend/tests/conftest.py @@ -0,0 +1,77 @@ +"""Shared pytest fixtures: an in-memory DB and a FastAPI TestClient. + +The client is created WITHOUT the context-manager form on purpose, so the app lifespan (which +runs real Alembic migrations against the configured DB_PATH) never fires. Tables come from +SQLModel.metadata.create_all against a throwaway in-memory database instead. +""" + +import pytest +from fastapi.testclient import TestClient +from sqlalchemy.pool import StaticPool +from sqlmodel import Session, SQLModel, create_engine + +import ten31portal.models # noqa: F401 — importing registers every table on SQLModel.metadata +from ten31portal.auth import hash_password +from ten31portal.database import get_session +from ten31portal.main import app +from ten31portal.models import User, UserRole + + +@pytest.fixture +def engine(): + eng = create_engine( + "sqlite://", + connect_args={"check_same_thread": False}, + poolclass=StaticPool, # one shared in-memory connection across sessions + ) + SQLModel.metadata.create_all(eng) + yield eng + SQLModel.metadata.drop_all(eng) + + +@pytest.fixture +def session(engine): + with Session(engine) as s: + yield s + + +@pytest.fixture +def client(engine): + def override_get_session(): + with Session(engine) as s: + yield s + + app.dependency_overrides[get_session] = override_get_session + yield TestClient(app) + app.dependency_overrides.clear() + + +def make_user(session, *, username="admin", password="password123", + role=UserRole.approver, name="Test User", email=None, **kwargs): + user = User( + name=name, + username=username, + email=email, + password_hash=hash_password(password), + role=role, + **kwargs, + ) + session.add(user) + session.commit() + session.refresh(user) + return user + + +@pytest.fixture +def approver(session): + return make_user(session, username="approver", role=UserRole.approver) + + +@pytest.fixture +def auth_client(client, approver): + """A TestClient already logged in as an approver (a writer).""" + resp = client.post( + "/api/auth/login", json={"login": "approver", "password": "password123"} + ) + assert resp.status_code == 200, resp.text + return client diff --git a/backend/tests/test_auth.py b/backend/tests/test_auth.py new file mode 100644 index 0000000..7b466c1 --- /dev/null +++ b/backend/tests/test_auth.py @@ -0,0 +1,40 @@ +"""Auth: login works, and protected/writer endpoints reject the wrong caller.""" + +from tests.conftest import make_user +from ten31portal.models import UserRole + + +def test_login_success(client, approver): + resp = client.post( + "/api/auth/login", json={"login": "approver", "password": "password123"} + ) + assert resp.status_code == 200, resp.text + assert resp.json()["username"] == "approver" + + +def test_login_wrong_password(client, approver): + resp = client.post( + "/api/auth/login", json={"login": "approver", "password": "nope"} + ) + assert resp.status_code == 401 + + +def test_me_requires_authentication(client): + assert client.get("/api/auth/me").status_code == 401 + + +def test_me_returns_current_user(auth_client): + resp = auth_client.get("/api/auth/me") + assert resp.status_code == 200 + assert resp.json()["role"] == "approver" + + +def test_writer_endpoint_rejects_viewer(client, session): + """A viewer is authenticated but not a writer — create-entity must 403, not 401.""" + make_user(session, username="viewer", role=UserRole.viewer) + login = client.post( + "/api/auth/login", json={"login": "viewer", "password": "password123"} + ) + assert login.status_code == 200 + resp = client.post("/api/entities", json={"name": "X", "type": "fund"}) + assert resp.status_code == 403 diff --git a/backend/tests/test_entities.py b/backend/tests/test_entities.py new file mode 100644 index 0000000..1d74272 --- /dev/null +++ b/backend/tests/test_entities.py @@ -0,0 +1,32 @@ +"""Entity CRUD round-trips through the API as a writer.""" + + +def test_entity_crud_roundtrip(auth_client): + # Create + created = auth_client.post( + "/api/entities", + json={"name": "Ten31 Fund I", "type": "fund", "vintage_year": 2025}, + ) + assert created.status_code == 201, created.text + entity_id = created.json()["id"] + + # Read (single) + got = auth_client.get(f"/api/entities/{entity_id}") + assert got.status_code == 200 + assert got.json()["name"] == "Ten31 Fund I" + + # List + listed = auth_client.get("/api/entities") + assert listed.status_code == 200 + assert any(e["id"] == entity_id for e in listed.json()) + + # Update + patched = auth_client.patch( + f"/api/entities/{entity_id}", json={"name": "Ten31 Fund I, LP"} + ) + assert patched.status_code == 200 + assert patched.json()["name"] == "Ten31 Fund I, LP" + + +def test_get_missing_entity_404(auth_client): + assert auth_client.get("/api/entities/99999").status_code == 404 diff --git a/backend/tests/test_rollup.py b/backend/tests/test_rollup.py new file mode 100644 index 0000000..c5bd3f2 --- /dev/null +++ b/backend/tests/test_rollup.py @@ -0,0 +1,48 @@ +"""The entity rollup aggregates invested cost and the latest signed valuation correctly.""" + +from datetime import date + +from ten31portal.models import ( + Entity, EntityType, Holding, Position, RoundStatus, Valuation, ValuationRound, +) + + +def test_rollup_sums_cost_and_latest_signed_value(auth_client, session): + entity = Entity(name="Rollup Fund", type=EntityType.fund) + session.add(entity) + session.commit() + session.refresh(entity) + + holding = Holding(entity_id=entity.id, company_name="Acme") + session.add(holding) + session.commit() + session.refresh(holding) + + position = Position( + holding_id=holding.id, + security_name="Acme Series A", + investment_date=date(2025, 1, 15), + cost_cents=100_000, + ) + session.add(position) + session.commit() + session.refresh(position) + + rnd = ValuationRound( + entity_id=entity.id, + quarter_end=date(2026, 3, 31), + status=RoundStatus.approved, + ) + session.add(rnd) + session.commit() + session.refresh(rnd) + + session.add(Valuation(round_id=rnd.id, position_id=position.id, value_cents=150_000)) + session.commit() + + resp = auth_client.get("/api/entities/rollup") + assert resp.status_code == 200, resp.text + row = next(r for r in resp.json() if r["id"] == entity.id) + assert row["invested_cents"] == 100_000 + assert row["last_signed_value_cents"] == 150_000 + assert row["committed_cents"] == 0 # no capital-account statements added diff --git a/deploy/package.json b/deploy/package.json index 15254e8..804ecee 100644 --- a/deploy/package.json +++ b/deploy/package.json @@ -1,9 +1,9 @@ { "name": "ten31portal-startos", - "version": "0.1.0", + "version": "0.2.20", "private": true, "scripts": { - "build": "rm -rf ./javascript && ncc build startos/index.ts -o ./javascript", + "build": "npm run check && rm -rf ./javascript && ncc build startos/index.ts -o ./javascript", "check": "tsc --noEmit" }, "dependencies": { diff --git a/deploy/start.sh b/deploy/start.sh index 5ae54d5..aa45918 100644 --- a/deploy/start.sh +++ b/deploy/start.sh @@ -18,21 +18,27 @@ if [ ! -f /data/.initialized ]; then # Set default credentials (user can change via CLI later) ADMIN_NAME="${TEN31_ADMIN_NAME:-Jonathan}" + ADMIN_USERNAME="${TEN31_ADMIN_USERNAME:-admin}" ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-jonathan@ten31.xyz}" ADMIN_PASSWORD="${TEN31_ADMIN_PASSWORD:-Ten31}" python3 -m ten31portal.cli create-user \ --name "$ADMIN_NAME" \ + --username "$ADMIN_USERNAME" \ --email "$ADMIN_EMAIL" \ --role approver \ - --password "$ADMIN_PASSWORD" || true + --password "$ADMIN_PASSWORD" \ + --service-admin || true touch /data/.initialized - echo "Default approver created: $ADMIN_EMAIL" + echo "Default approver created: username=$ADMIN_USERNAME" fi +# Log level is overridable at runtime for debugging; defaults to info. +LOG_LEVEL="${TEN31_LOG_LEVEL:-info}" + # Serve frontend static files from the backend exec uvicorn ten31portal.main:app \ --host 0.0.0.0 \ --port 8000 \ - --log-level info + --log-level "$LOG_LEVEL" diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx index 76c660b..cbde348 100644 --- a/frontend/src/App.tsx +++ b/frontend/src/App.tsx @@ -1,16 +1,73 @@ import { BrowserRouter, Routes, Route, Navigate } from "react-router-dom"; import { AuthProvider, useAuth } from "./context/AuthContext"; +import { isInternal } from "./api"; import Layout from "./components/Layout"; import Login from "./pages/Login"; import EntitiesList from "./pages/EntitiesList"; import EntityOverview from "./pages/EntityOverview"; +import EntityPartners from "./pages/EntityPartners"; +import EntityDocuments from "./pages/EntityDocuments"; import Investments from "./pages/Investments"; import ValuationWorkflow from "./pages/ValuationWorkflow"; import Import from "./pages/Import"; import AuditLog from "./pages/AuditLog"; +import Users from "./pages/Users"; +import Documents from "./pages/Documents"; +import CapitalAccounts from "./pages/CapitalAccounts"; +import AccessGrid from "./pages/AccessGrid"; +import PortalLayout from "./portal/PortalLayout"; +import InvestorHome from "./portal/InvestorHome"; +import FundAdminHome from "./portal/FundAdminHome"; + +function InternalApp() { + return ( + + + } /> + } /> + } /> + } /> + } /> + } /> + } /> + } /> + } /> + } /> + } /> + } /> + } /> + + + ); +} + +function ExternalApp() { + const { user } = useAuth(); + return ( + + {user?.role === "fund_administrator" ? : } + + ); +} + +function OfflineNotice({ onRetry }: { onRetry: () => void }) { + return ( +
+

+ Couldn't reach the server. Check your connection and try again. +

+ +
+ ); +} function ProtectedRoutes() { - const { user, loading } = useAuth(); + const { user, loading, offline, retry } = useAuth(); if (loading) { return ( @@ -21,22 +78,12 @@ function ProtectedRoutes() { } if (!user) { - return ; + // Only show the login screen for a real auth failure; a server we can't reach gets a + // retry prompt so a momentary blip doesn't read as "you've been logged out." + return offline ? : ; } - return ( - - - } /> - } /> - } /> - } /> - } /> - } /> - } /> - - - ); + return isInternal(user.role) ? : ; } export default function App() { diff --git a/frontend/src/api.ts b/frontend/src/api.ts index e15861f..c2eebb1 100644 --- a/frontend/src/api.ts +++ b/frontend/src/api.ts @@ -4,17 +4,144 @@ // --- Types --- -export type UserRole = "approver" | "cfo" | "fund_admin" | "viewer"; +export type UserRole = + | "approver" + | "operations" + | "cfo" + | "fund_admin" + | "viewer" + | "investor" + | "fund_administrator"; export type EntityType = "fund" | "spv" | "gp" | "mgmt_co"; export type EntityStatus = "active" | "closed"; export type RoundStatus = "draft" | "submitted" | "approved" | "returned"; +export type DocumentCategory = + | "capital_account" + | "k1" + | "statement" + | "tax" + | "other"; + +export const INTERNAL_ROLES: UserRole[] = ["approver", "operations", "cfo", "fund_admin", "viewer"]; +export const EXTERNAL_ROLES: UserRole[] = ["investor", "fund_administrator"]; +// Roles that can administer users, documents, and capital accounts (everything except sign-off). +export const ADMIN_ROLES: UserRole[] = ["approver", "operations", "cfo"]; + +// Roles that can create/edit entities and valuation rounds (staff, excluding read-only viewer). +export const WRITER_ROLES: UserRole[] = ["fund_admin", "operations", "cfo", "approver"]; + +export const isInternal = (role: UserRole) => INTERNAL_ROLES.includes(role); +export const isAdmin = (role: UserRole) => ADMIN_ROLES.includes(role); +export const canEditRound = (role: UserRole) => WRITER_ROLES.includes(role); +export const isApprover = (role: UserRole) => role === "approver"; export interface User { id: number; name: string; - email: string; + username: string; + email: string | null; role: UserRole; is_active: boolean; + is_service_admin: boolean; + primary_account_id: number | null; + created_at: string; +} + +export interface LinkedAccount { + id: number; + name: string; + username: string; +} + +export interface UserDetail extends User { + primary_account_name: string | null; + linked_accounts: LinkedAccount[]; + entity_ids: number[]; +} + +export interface PortalDocument { + id: number; + entity_id: number; + investor_user_id: number | null; + category: DocumentCategory; + title: string; + original_filename: string; + content_type: string; + size_bytes: number; + uploaded_by: number | null; + created_at: string; +} + +export interface Partner { + user_id: number; + name: string; + username: string; + external_investor_id: string | null; + is_active: boolean; + login_enabled: boolean; + latest_commitment_cents: number | null; + latest_contributions_cents: number | null; + latest_distributions_cents: number | null; + latest_value_cents: number | null; + latest_as_of: string | null; + statements_count: number; +} + +export interface AccessGrant { + user_id: number; + entity_id: number; +} + +export interface AccessMatrix { + users: User[]; + entities: Entity[]; + grants: AccessGrant[]; +} + +export interface ImportValueRow { + row_index: number; + label: string; +} + +export interface ImportInvestorPreview { + source_name: string; + column_index: number; + value_dollars: number; + commitment_dollars: number; + contributions_dollars: number; + distributions_dollars: number; + external_id: string | null; + matched_user_id: number | null; + matched_username: string | null; + suggested_username: string | null; +} + +export interface CapitalImportPreview { + as_of_date: string | null; + value_rows: ImportValueRow[]; + chosen_row_index: number; + investors: ImportInvestorPreview[]; +} + +export interface CapitalImportResult { + status: string; + created_accounts: number; + matched_accounts_updated: number; + statements_written: number; +} + +export interface CapitalAccount { + id: number; + entity_id: number; + investor_user_id: number; + investor_name: string | null; + as_of_date: string; + commitment_cents: number; + beginning_balance_cents: number; + contributions_cents: number; + distributions_cents: number; + ending_balance_cents: number; + document_id: number | null; created_at: string; } @@ -80,7 +207,7 @@ export interface AuditEntry { // --- API helpers --- -class ApiError extends Error { +export class ApiError extends Error { status: number; constructor(status: number, message: string) { super(message); @@ -106,16 +233,22 @@ async function request(path: string, options?: RequestInit): Promise { // --- Auth --- export const api = { - login: (email: string, password: string) => + login: (login: string, password: string) => request("/api/auth/login", { method: "POST", - body: JSON.stringify({ email, password }), + body: JSON.stringify({ login, password }), }), logout: () => request<{ status: string }>("/api/auth/logout", { method: "POST" }), me: () => request("/api/auth/me"), + changePassword: (current_password: string, new_password: string) => + request<{ status: string }>("/api/auth/change-password", { + method: "POST", + body: JSON.stringify({ current_password, new_password }), + }), + // Entities listEntities: () => request("/api/entities"), listEntityRollup: () => @@ -126,10 +259,12 @@ export const api = { vintage_year: number | null; fund_size_cents: number | null; status: EntityStatus; + committed_cents: number; invested_cents: number; last_signed_value_cents: number; }[]>("/api/entities/rollup"), getEntity: (id: number) => request(`/api/entities/${id}`), + listPartners: (entityId: number) => request(`/api/entities/${entityId}/partners`), createEntity: (data: Partial) => request("/api/entities", { method: "POST", body: JSON.stringify(data) }), updateEntity: (id: number, data: Partial) => @@ -180,4 +315,158 @@ export const api = { if (params?.page) q.set("page", String(params.page)); return request(`/api/audit?${q}`); }, + + // Users (admin) + listUsers: () => request("/api/users"), + investorsForEntity: (entityId: number) => + request(`/api/users/investors-for-entity/${entityId}`), + accessMatrix: () => request("/api/users/access-matrix"), + grantAccess: (userId: number, entityId: number) => + request<{ status: string }>(`/api/users/${userId}/access/${entityId}`, { method: "PUT" }), + revokeAccess: (userId: number, entityId: number) => + request<{ status: string }>(`/api/users/${userId}/access/${entityId}`, { method: "DELETE" }), + + // Holdings / NAV import (eNAV HLD tab) + scheduleImport: async ( + file: File, + opts: { + commit: boolean; + entityId?: number | null; + password?: string; + asOf?: string; + createType?: EntityType; + vintageYear?: string; + replaceExisting?: boolean; + }, + ): Promise => { + const form = new FormData(); + form.set("file", file); + if (opts.password) form.set("password", opts.password); + const p = new URLSearchParams(); + p.set("commit", String(opts.commit)); + if (opts.replaceExisting) p.set("replace_existing", "true"); + if (opts.asOf) p.set("as_of", opts.asOf); + if (opts.entityId != null) { + p.set("entity_id", String(opts.entityId)); + } else { + p.set("create_entity_type", opts.createType || "fund"); + if (opts.vintageYear) p.set("create_vintage_year", opts.vintageYear); + } + const res = await fetch(`/api/import/schedule?${p}`, { method: "POST", body: form }); + const data = await res.json().catch(() => ({ detail: res.statusText })); + if (!res.ok) throw new ApiError(res.status, data.detail || "Import failed"); + return data; + }, + + // Capital-account import (fund-admin spreadsheet) + capitalImportPreview: async ( + file: File, + entityId: number, + rowIndex?: number, + password?: string, + ): Promise => { + const form = new FormData(); + form.set("file", file); + form.set("entity_id", String(entityId)); + if (rowIndex != null) form.set("row_index", String(rowIndex)); + if (password) form.set("password", password); + const res = await fetch("/api/import/capital-accounts/preview", { method: "POST", body: form }); + if (!res.ok) { + const body = await res.json().catch(() => ({ detail: res.statusText })); + throw new ApiError(res.status, body.detail || res.statusText); + } + return res.json(); + }, + capitalImportCommit: (data: { + entity_id: number; + as_of_date: string; + investors: { + action: "match" | "create" | "skip"; + value_dollars: number; + commitment_dollars?: number; + contributions_dollars?: number; + distributions_dollars?: number; + user_id?: number | null; + name?: string | null; + username?: string | null; + email?: string | null; + password?: string | null; + external_id?: string | null; + }[]; + }) => + request("/api/import/capital-accounts/commit", { + method: "POST", + body: JSON.stringify(data), + }), + getUser: (id: number) => request(`/api/users/${id}`), + createUser: (data: { + name: string; + username: string; + password: string; + role: UserRole; + email?: string | null; + entity_ids?: number[]; + }) => request("/api/users", { method: "POST", body: JSON.stringify(data) }), + updateUser: ( + id: number, + data: Partial<{ + name: string; + username: string; + email: string | null; + role: UserRole; + is_active: boolean; + entity_ids: number[]; + }>, + ) => request(`/api/users/${id}`, { method: "PATCH", body: JSON.stringify(data) }), + resetPassword: (id: number, password: string) => + request<{ status: string }>(`/api/users/${id}/reset-password`, { + method: "POST", + body: JSON.stringify({ password }), + }), + linkAccount: (id: number, primary_account_id: number | null) => + request(`/api/users/${id}/primary-account`, { + method: "PUT", + body: JSON.stringify({ primary_account_id }), + }), + + // Documents + listDocuments: (params?: { entity_id?: number; investor_user_id?: number }) => { + const q = new URLSearchParams(); + if (params?.entity_id != null) q.set("entity_id", String(params.entity_id)); + if (params?.investor_user_id != null) q.set("investor_user_id", String(params.investor_user_id)); + const qs = q.toString(); + return request(`/api/documents${qs ? `?${qs}` : ""}`); + }, + uploadDocument: async (form: FormData): Promise => { + const res = await fetch("/api/documents", { method: "POST", body: form }); + if (!res.ok) { + const body = await res.json().catch(() => ({ detail: res.statusText })); + throw new ApiError(res.status, body.detail || res.statusText); + } + return res.json(); + }, + downloadUrl: (id: number) => `/api/documents/${id}/download`, + deleteDocument: (id: number) => + request<{ status: string }>(`/api/documents/${id}`, { method: "DELETE" }), + + // Capital accounts + listCapitalAccounts: (params?: { entity_id?: number; investor_user_id?: number }) => { + const q = new URLSearchParams(); + if (params?.entity_id != null) q.set("entity_id", String(params.entity_id)); + if (params?.investor_user_id != null) q.set("investor_user_id", String(params.investor_user_id)); + const qs = q.toString(); + return request(`/api/capital-accounts${qs ? `?${qs}` : ""}`); + }, + createCapitalAccount: (data: { + entity_id: number; + investor_user_id: number; + as_of_date: string; + beginning_balance_dollars: number; + contributions_dollars: number; + distributions_dollars: number; + ending_balance_dollars: number; + document_id?: number | null; + }) => request("/api/capital-accounts", { method: "POST", body: JSON.stringify(data) }), + deleteCapitalAccount: (id: number) => + request<{ status: string }>(`/api/capital-accounts/${id}`, { method: "DELETE" }), }; diff --git a/frontend/src/context/AuthContext.tsx b/frontend/src/context/AuthContext.tsx index 63609e5..a9d3070 100644 --- a/frontend/src/context/AuthContext.tsx +++ b/frontend/src/context/AuthContext.tsx @@ -1,10 +1,12 @@ -import { createContext, useContext, useEffect, useState, type ReactNode } from "react"; -import { api, type User } from "../api"; +import { createContext, useCallback, useContext, useEffect, useState, type ReactNode } from "react"; +import { api, ApiError, type User } from "../api"; interface AuthState { user: User | null; loading: boolean; - login: (email: string, password: string) => Promise; + offline: boolean; // couldn't reach the server (vs. genuinely logged out) + retry: () => void; + login: (handle: string, password: string) => Promise; logout: () => Promise; } @@ -13,14 +15,29 @@ const AuthContext = createContext(null); export function AuthProvider({ children }: { children: ReactNode }) { const [user, setUser] = useState(null); const [loading, setLoading] = useState(true); + const [offline, setOffline] = useState(false); - useEffect(() => { - api.me().then(setUser).catch(() => setUser(null)).finally(() => setLoading(false)); + const bootstrap = useCallback(() => { + setLoading(true); + api + .me() + .then((u) => { setUser(u); setOffline(false); }) + .catch((err) => { + setUser(null); + // A 401/403 means genuinely logged out. A network error or 5xx means we couldn't + // reach the server — don't present that as "you're logged out." + const authFailure = err instanceof ApiError && (err.status === 401 || err.status === 403); + setOffline(!authFailure); + }) + .finally(() => setLoading(false)); }, []); - const login = async (email: string, password: string) => { - const u = await api.login(email, password); + useEffect(() => { bootstrap(); }, [bootstrap]); + + const login = async (handle: string, password: string) => { + const u = await api.login(handle, password); setUser(u); + setOffline(false); }; const logout = async () => { @@ -29,7 +46,7 @@ export function AuthProvider({ children }: { children: ReactNode }) { }; return ( - + {children} ); diff --git a/frontend/src/pages/AuditLog.tsx b/frontend/src/pages/AuditLog.tsx index 86333b8..64368b7 100644 --- a/frontend/src/pages/AuditLog.tsx +++ b/frontend/src/pages/AuditLog.tsx @@ -1,5 +1,5 @@ -import { useEffect, useState } from "react"; -import { api, type AuditEntry } from "../api"; +import { Fragment, useEffect, useState } from "react"; +import { api, isAdmin, type AuditEntry } from "../api"; import { useAuth } from "../context/AuthContext"; import { formatDate } from "../format"; @@ -9,8 +9,9 @@ export default function AuditLog() { const [page, setPage] = useState(1); const [filterType, setFilterType] = useState(""); const [loading, setLoading] = useState(true); + const [expandedId, setExpandedId] = useState(null); - const canView = user && ["approver", "cfo"].includes(user.role); + const canView = user && isAdmin(user.role); useEffect(() => { if (!canView) return; @@ -32,7 +33,7 @@ export default function AuditLog() { if (!canView) { return (
- Audit log requires approver or CFO role. + Audit log requires Managing Partner, Operations, or CFO role.
); } @@ -73,7 +74,7 @@ export default function AuditLog() {
Loading...
) : ( <> -
+
@@ -86,24 +87,50 @@ export default function AuditLog() { - {entries.map((e) => ( - - - - - - - - - ))} + {entries.map((e) => { + const hasDetail = e.detail != null; + const detailText = hasDetail ? JSON.stringify(e.detail) : "—"; + const expanded = expandedId === e.id; + return ( + + + + + + + + + + {expanded && hasDetail && ( + + + + )} + + ); + })} {entries.length === 0 && ( + ); + }; + return (

{title}

-
-
- {formatDate(e.created_at)} - - - {e.action} - - {e.object_type}{e.object_id ?? "—"}#{e.actor_user_id ?? "system"} - {e.detail ? JSON.stringify(e.detail) : "—"} -
+ {formatDate(e.created_at)} + + + {e.action} + + {e.object_type}{e.object_id ?? "—"}#{e.actor_user_id ?? "system"} + {hasDetail ? ( + + ) : ( + "—" + )} +
+ 
+                              {JSON.stringify(e.detail, null, 2)}
+
+
diff --git a/frontend/src/pages/EntitiesList.tsx b/frontend/src/pages/EntitiesList.tsx index 358ee24..c06bb83 100644 --- a/frontend/src/pages/EntitiesList.tsx +++ b/frontend/src/pages/EntitiesList.tsx @@ -1,6 +1,6 @@ -import { useEffect, useState } from "react"; +import { useEffect, useMemo, useState } from "react"; import { Link } from "react-router-dom"; -import { api, type EntityType } from "../api"; +import { api, WRITER_ROLES, type EntityType } from "../api"; import { useAuth } from "../context/AuthContext"; import { formatMoney, formatGainLoss } from "../format"; @@ -11,6 +11,7 @@ interface EntityRow { vintage_year: number | null; fund_size_cents: number | null; status: string; + committedCents: number; investedCents: number; lastValueCents: number; } @@ -22,8 +23,6 @@ const TYPE_LABELS: Record = { mgmt_co: "Mgmt Co", }; -const WRITER_ROLES = ["fund_admin", "cfo", "approver"]; - export default function EntitiesList() { const { user } = useAuth(); const [entities, setEntities] = useState([]); @@ -48,6 +47,7 @@ export default function EntitiesList() { vintage_year: r.vintage_year, fund_size_cents: r.fund_size_cents, status: r.status, + committedCents: r.committed_cents, investedCents: r.invested_cents, lastValueCents: r.last_signed_value_cents, })), @@ -219,28 +219,126 @@ function AddEntityForm({ ); } +type SortKey = "name" | "type" | "vintage" | "committed" | "invested" | "value" | "gain"; + function EntityTable({ title, rows }: { title: string; rows: EntityRow[] }) { + const [sortKey, setSortKey] = useState("name"); + const [dir, setDir] = useState<1 | -1>(1); + + const totalCommitted = rows.reduce((s, r) => s + r.committedCents, 0); const totalInvested = rows.reduce((s, r) => s + r.investedCents, 0); const totalValue = rows.reduce((s, r) => s + r.lastValueCents, 0); const totalGain = totalValue - totalInvested; + const sorted = useMemo(() => { + const val = (r: EntityRow): string | number => { + switch (sortKey) { + case "name": return r.name.toLowerCase(); + case "type": return r.type; + case "vintage": return r.vintage_year ?? -Infinity; + case "committed": return r.committedCents; + case "invested": return r.investedCents; + case "value": return r.lastValueCents; + case "gain": return r.lastValueCents - r.investedCents; + } + }; + return [...rows].sort((a, b) => { + const av = val(a), bv = val(b); + if (av < bv) return -1 * dir; + if (av > bv) return 1 * dir; + return 0; + }); + }, [rows, sortKey, dir]); + + const sortBy = (key: SortKey) => { + if (key === sortKey) setDir((d) => (d === 1 ? -1 : 1)); + else { setSortKey(key); setDir(1); } + }; + + const arrow = (key: SortKey) => (sortKey === key ? (dir === 1 ? " ↑" : " ↓") : ""); + const Th = ({ k, label, align = "left" }: { k: SortKey; label: string; align?: "left" | "right" }) => { + const a = align === "right" ? "text-right" : "text-left"; + return ( + + +
+ + {/* Mobile: stacked cards (a wide financial table doesn't fit a phone) */} +
+ {sorted.map((row) => { + const gl = formatGainLoss(row.lastValueCents, row.investedCents); + return ( + +
+ {row.name} + + {TYPE_LABELS[row.type] || row.type} + +
+ {row.vintage_year && ( +
Vintage {row.vintage_year}
+ )} +
+ + + + +
+ + ); + })} + {rows.length > 0 && ( +
+
Total
+
+ + + + = 0 ? "+" : "-"}${formatMoney(Math.abs(totalGain))}`} + valueClass={totalGain >= 0 ? "text-green-600" : "text-red-600"} + /> +
+
+ )} + {rows.length === 0 && ( +

No entities yet.

+ )} +
+ + {/* Desktop: full sortable table */} +
+
- - - - - - + - {rows.map((row) => { + {sorted.map((row) => { const gl = formatGainLoss(row.lastValueCents, row.investedCents); return ( @@ -258,6 +356,7 @@ function EntityTable({ title, rows }: { title: string; rows: EntityRow[] }) { + + - @@ -291,3 +391,20 @@ function EntityTable({ title, rows }: { title: string; rows: EntityRow[] }) { ); } + +function CardMetric({ + label, + value, + valueClass = "text-gray-900", +}: { + label: string; + value: string; + valueClass?: string; +}) { + return ( +
+
{label}
+
{value}
+
+ ); +} diff --git a/frontend/src/pages/Import.tsx b/frontend/src/pages/Import.tsx index e354738..8757efd 100644 --- a/frontend/src/pages/Import.tsx +++ b/frontend/src/pages/Import.tsx @@ -1,382 +1,406 @@ -import { useEffect, useRef, useState } from "react"; -import { api, type Entity, type EntityType } from "../api"; +import { useEffect, useState } from "react"; +import { api, isAdmin, type Entity, type EntityType, type CapitalImportPreview } from "../api"; import { useAuth } from "../context/AuthContext"; +import { formatMoneyExact } from "../format"; type EntityMode = "existing" | "from_file"; +type Decision = { + action: "match" | "create" | "skip"; + source_name: string; + external_id: string | null; + matched_username: string | null; + user_id: number | null; + value_dollars: number; + commitment_dollars: number; + contributions_dollars: number; + distributions_dollars: number; + // create fields + name: string; + username: string; + email: string; +}; + export default function Import() { const { user } = useAuth(); const [entities, setEntities] = useState([]); - const [entityMode, setEntityMode] = useState("from_file"); + const [entityMode, setEntityMode] = useState("existing"); const [entityId, setEntityId] = useState(""); const [createType, setCreateType] = useState("fund"); const [vintageYear, setVintageYear] = useState(""); - const [asOf, setAsOf] = useState(""); - const [mode, setMode] = useState<"entities" | "schedule">("schedule"); - const [commit, setCommit] = useState(false); + const [password, setPassword] = useState(""); const [file, setFile] = useState(null); + const [replaceExisting, setReplaceExisting] = useState(false); + + const [holdings, setHoldings] = useState<{ count: number; nav: number; sourceName: string | null } | null>(null); + const [memberPv, setMemberPv] = useState(null); + const [decisions, setDecisions] = useState([]); + const [asOf, setAsOf] = useState(""); + const [result, setResult] = useState(null); const [error, setError] = useState(""); - const [loading, setLoading] = useState(false); - const fileRef = useRef(null); + const [busy, setBusy] = useState(false); + const [step, setStep] = useState(""); + const [confirmReplace, setConfirmReplace] = useState(false); - const canImport = user && ["approver", "cfo"].includes(user.role); + const canImport = user && isAdmin(user.role); + const inputCls = "w-full px-3 py-2 border border-gray-300 rounded text-sm"; useEffect(() => { api.listEntities().then(setEntities); }, []); - async function handleImport() { - if (!file) return; - setError(""); + function reset() { + setHoldings(null); + setMemberPv(null); + setDecisions([]); setResult(null); - setLoading(true); + setReplaceExisting(false); + } + async function readEnav() { + if (!file) return; + if (entityMode === "existing" && !entityId) { + setError("Select the fund, or choose 'Create from file'."); + return; + } + setError(""); + setBusy(true); + setResult(null); try { - const form = new FormData(); - form.append("file", file); + const eid = entityMode === "existing" ? Number(entityId) : undefined; + // Holdings (dry run) + members preview from the same file. + const [sched, members] = await Promise.all([ + api.scheduleImport(file, { + commit: false, + entityId: eid, + password: password || undefined, + createType, + vintageYear, + }), + api.capitalImportPreview(file, eid as number, undefined, password || undefined), + ]); - const params = new URLSearchParams(); - params.set("commit", String(commit)); - - let url: string; - if (mode === "entities") { - url = `/api/import/entities?${params}`; - } else { - if (!asOf) { - setError("Quarter-end date is required."); - setLoading(false); - return; - } - params.set("as_of", asOf); - - if (entityMode === "existing") { - if (!entityId) { - setError("Select an entity."); - setLoading(false); - return; - } - params.set("entity_id", entityId); - } else { - // from_file mode: let backend resolve from row 1 - params.set("create_entity_type", createType); - if (vintageYear) params.set("create_vintage_year", vintageYear); - } - url = `/api/import/schedule?${params}`; - } - - const res = await fetch(url, { method: "POST", body: form }); - let data: any; - try { - data = await res.json(); - } catch { - setError(`Server error (${res.status}). Check file format and try again.`); - setLoading(false); - return; - } - if (!res.ok) { - setError(data.detail || "Import failed"); - } else { - setResult(data); - // Refresh entity list after commit - if (data.committed) { - api.listEntities().then(setEntities); - } - } - } catch (err: any) { - setError(err.message); + const nav = (sched.positions || []).reduce((s: number, p: any) => s + (p.value_cents || 0), 0); + setHoldings({ + count: sched.positions?.length ?? 0, + nav, + sourceName: sched.source_entity_name ?? null, + }); + setAsOf(members.as_of_date ?? sched.seed_round?.quarter_end ?? ""); + setMemberPv(members); + setDecisions( + members.investors.map((i) => ({ + action: i.matched_user_id ? "match" : "create", + source_name: i.source_name, + external_id: i.external_id, + matched_username: i.matched_username, + user_id: i.matched_user_id, + value_dollars: i.value_dollars, + commitment_dollars: i.commitment_dollars, + contributions_dollars: i.contributions_dollars, + distributions_dollars: i.distributions_dollars, + name: i.source_name, + username: i.suggested_username ?? "", + email: "", + })), + ); + } catch (e: any) { + setError(e.message || "Could not read the workbook"); + reset(); } finally { - setLoading(false); + setBusy(false); + } + } + + const update = (idx: number, patch: Partial) => + setDecisions((d) => d.map((row, i) => (i === idx ? { ...row, ...patch } : row))); + + // The "Confirm import" button routes through here so a destructive holdings-replace gets a + // final confirmation before anything is cleared. + function handleConfirmClick() { + if (entityMode === "existing" && replaceExisting) { + setConfirmReplace(true); + return; + } + confirmImport(); + } + + async function confirmImport() { + if (!file || !asOf) return; + setConfirmReplace(false); + setError(""); + setBusy(true); + try { + const memberPayload = { + as_of_date: asOf, + investors: decisions.map((d) => ({ + action: d.action, + value_dollars: d.value_dollars, + commitment_dollars: d.commitment_dollars, + contributions_dollars: d.contributions_dollars, + distributions_dollars: d.distributions_dollars, + user_id: d.action === "match" ? d.user_id : undefined, + name: d.action === "create" ? d.name : undefined, + username: d.action === "create" ? d.username : undefined, + email: d.action === "create" ? d.email || undefined : undefined, + external_id: d.external_id || undefined, + })), + }; + + let resolvedEntityId: number; + let holdingsNote = ""; + + if (entityMode === "existing") { + resolvedEntityId = Number(entityId); + // Members first (idempotent), then holdings. + setStep("Saving members…"); + await api.capitalImportCommit({ entity_id: resolvedEntityId, ...memberPayload }); + setStep(replaceExisting ? "Replacing holdings…" : "Loading holdings…"); + try { + await api.scheduleImport(file, { + commit: true, + entityId: resolvedEntityId, + password: password || undefined, + asOf, + replaceExisting, + }); + } catch (e: any) { + if (String(e.message).toLowerCase().includes("already exists")) { + holdingsNote = "A signed valuation round exists for this quarter — holdings left unchanged."; + } else { + throw e; + } + } + } else { + // Create-from-file: holdings commit creates the fund, then members. + setStep("Creating fund and loading holdings…"); + const sres = await api.scheduleImport(file, { + commit: true, + password: password || undefined, + asOf, + createType, + vintageYear, + }); + resolvedEntityId = sres.entity.entity_id; + setStep("Saving members…"); + await api.capitalImportCommit({ entity_id: resolvedEntityId, ...memberPayload }); + } + + setResult({ + holdings: holdings?.count ?? 0, + nav: holdings?.nav ?? 0, + members: decisions.filter((d) => d.action !== "skip").length, + created: decisions.filter((d) => d.action === "create").length, + note: holdingsNote, + }); + reset(); + api.listEntities().then(setEntities); + } catch (e: any) { + setError(e.message || "Import failed"); + } finally { + setBusy(false); + setStep(""); } } if (!canImport) { - return ( -
- Import requires approver or CFO role. -
- ); + return
Import requires Managing Partner, Operations, or CFO role.
; } return ( -
-

Import

+
+

Import eNAV

+

+ Upload the fund administrator's eNAV workbook once. Portal loads the fund's holdings and NAV + (HLD tab) and the members with their capital — commitment, paid-in, distributions, and + current value (ALLOC SI tab). You confirm new members before anything is saved. +

- {/* Mode selector */} -
- - -
+ {error &&
{error}
} -
- {mode === "schedule" && ( - <> - {/* Entity resolution mode */} -
- -
- - -
- - {entityMode === "existing" ? ( - - ) : ( -
-
- - -
-
- - setVintageYear(e.target.value)} - className="w-full px-3 py-2 border border-gray-300 rounded text-sm" - placeholder="2021" - /> -
-
- )} -
- -
-
NameTypeVintageInvestedLast Signed ValueGain/Loss + + + + + +
{row.vintage_year || "—"}{formatMoney(row.committedCents)} {formatMoney(row.investedCents)} {formatMoney(row.lastValueCents)} @@ -271,6 +370,7 @@ function EntityTable({ title, rows }: { title: string; rows: EntityRow[] }) { Total {formatMoney(totalCommitted)} {formatMoney(totalInvested)} {formatMoney(totalValue)} = 0 ? "text-green-600" : "text-red-600"}`}> @@ -280,7 +380,7 @@ function EntityTable({ title, rows }: { title: string; rows: EntityRow[] }) { )} {rows.length === 0 && (
+ No entities yet.
- - - - - - - - - - - {result.positions.map((p: any, i: number) => ( - - - - - - - - ))} - -
CompanySecurityDateCostValue
{p.company_name}{p.security_name}{p.investment_date || "—"} - {p.cost_cents != null ? `$${(p.cost_cents / 100).toLocaleString()}` : "—"} - - {p.value_cents != null ? `$${(p.value_cents / 100).toLocaleString()}` : "—"} -
+ {entityMode === "existing" ? ( + + ) : ( +
+ + setVintageYear(e.target.value)} />
+ )} + + +
+
+ + { setFile(e.target.files?.[0] ?? null); reset(); }} className="text-sm" />
+
+ + { setPassword(e.target.value); reset(); }} /> +
+
+ +
+ +
+ + )} + + {memberPv && !result && ( +
+ {/* Holdings summary */} +
+
+ Holdings: + {holdings?.count ?? 0} +
+
+ Fund NAV: + {formatMoneyExact(holdings?.nav ?? 0)} +
+
+ + setAsOf(e.target.value)} /> +
+
+ + {entityMode === "existing" && ( + )} - {result.errors && result.errors.length > 0 && ( -
-

- Errors ({result.errors.length}) -

-
    - {result.errors.map((e: any, i: number) => ( -
  • - Row {e.row}: {e.errors?.join(", ")} -
    • + {/* Members review */} +
    + + + + + + + + + + + + + + {decisions.map((d, i) => ( + + + + + + + + + ))} - - - )} + +
    MemberCommitmentPaid-inDistrib.ValueActionNew account
    {d.source_name}{formatMoneyExact(Math.round(d.commitment_dollars * 100))}{formatMoneyExact(Math.round(d.contributions_dollars * 100))}{formatMoneyExact(Math.round(d.distributions_dollars * 100))}{formatMoneyExact(Math.round(d.value_dollars * 100))} + + + {d.action === "create" ? ( +
    + update(i, { username: e.target.value })} /> + no login until set +
    + ) : d.action === "match" ? ( + updates {d.matched_username} + ) : ( + ignored + )} +
    +
    - {result.preview && result.preview.length > 0 && ( -
    -

    - Entities ({result.preview.length}) -

    -
      - {result.preview.map((p: any, i: number) => ( -
    • - - {p.action} - {" "} - {p.name} -
      • - ))} -
    +
    + + {decisions.filter((d) => d.action === "create").length} new ·{" "} + {decisions.filter((d) => d.action === "match").length} matched ·{" "} + {decisions.filter((d) => d.action === "skip").length} skipped + + +
    +
    + )} + + {confirmReplace && ( +
    +
    +

    Replace existing holdings?

    +

    + This will permanently clear this fund's current holdings, positions, and valuation + history, then rebuild them from this file. Investor capital accounts are not + affected. This can't be undone. +

    +
    + +
    - )} +
    )}
diff --git a/frontend/src/pages/Investments.tsx b/frontend/src/pages/Investments.tsx index 79b8bc4..ff9e9e6 100644 --- a/frontend/src/pages/Investments.tsx +++ b/frontend/src/pages/Investments.tsx @@ -1,14 +1,8 @@ import { useEffect, useState } from "react"; -import { Link, useParams } from "react-router-dom"; -import { api, type Entity, type Holding, type Position, type ValuationRound, type Valuation } from "../api"; -import { formatMoney, formatMoneyExact, formatDate, formatQuarter, formatPerShare } from "../format"; - -const TYPE_LABELS: Record = { - fund: "Fund", - spv: "SPV", - gp: "GP", - mgmt_co: "Mgmt Co", -}; +import { useParams } from "react-router-dom"; +import { api, type Entity, type Holding, type Position } from "../api"; +import { formatMoney, formatDate, formatQuarter, formatPerShare } from "../format"; +import EntityHeader from "../components/EntityHeader"; interface PositionWithValuation extends Position { lastValueCents: number | null; @@ -95,28 +89,7 @@ export default function Investments() { return (
- {/* Header */} -
-
-

{entity.name}

- - {TYPE_LABELS[entity.type] || entity.type} - -
-
- - Overview - - - Investments - - Partners - Documents -
-
+ {/* Header band */}
@@ -141,7 +114,15 @@ export default function Investments() {
{/* Grouped table */} -
+ {groups.length === 0 ? ( +
+

No investments recorded for this entity yet.

+

+ Holdings and positions are added by importing the fund's eNAV workbook. +

+
+ ) : ( +
@@ -166,6 +147,7 @@ export default function Investments() {
+ )}
); } diff --git a/frontend/src/pages/ValuationWorkflow.tsx b/frontend/src/pages/ValuationWorkflow.tsx index 069ac3b..92c32b6 100644 --- a/frontend/src/pages/ValuationWorkflow.tsx +++ b/frontend/src/pages/ValuationWorkflow.tsx @@ -2,14 +2,14 @@ import { useEffect, useState } from "react"; import { useParams, Link } from "react-router-dom"; import { api, + canEditRound, + isApprover as roleIsApprover, type Entity, - type Holding, type Position, type ValuationRound, - type Valuation, } from "../api"; import { useAuth } from "../context/AuthContext"; -import { formatMoney, formatMoneyExact, formatQuarter, formatDate } from "../format"; +import { formatMoney, formatQuarter, formatDate } from "../format"; const STATUS_COLORS: Record = { draft: "bg-gray-100 text-gray-600", @@ -39,13 +39,12 @@ export default function ValuationWorkflow() { const [error, setError] = useState(""); const entityId = id ? parseInt(id) : 0; - const isApprover = user?.role === "approver"; + const isApprover = !!user && roleIsApprover(user.role); const canEdit = selectedRound && (selectedRound.status === "draft" || selectedRound.status === "returned") && - user && - ["fund_admin", "cfo", "approver"].includes(user.role); - const canSubmit = canEdit; + !!user && + canEditRound(user.role); const canApprove = selectedRound?.status === "submitted" && isApprover; const canReturn = @@ -302,7 +301,7 @@ export default function ValuationWorkflow() { )} {/* Valuations table */} -
+