Harden demo access and restore clean checks

src/server/api/routers/expenses.ts

@@ -20,9 +20,15 @@ import {
   RECEIPT_MAX_BYTES,
 } from "~/lib/object-storage";
 import { parseReceiptText } from "~/lib/receipt-parse";
+import type { db } from "~/server/db";
 
 export { EXPENSE_CATEGORIES };
 
+type ExpenseContext = {
+  db: typeof db;
+  session: { user: { id: string } };
+};
+
 const createExpenseSchema = z.object({
   date: z.date(),
   description: z.string().min(1, "Description is required"),
@@ -43,7 +49,7 @@ const updateExpenseSchema = createExpenseSchema.partial().extend({
 });
 
 async function verifyClientAccess(
-  ctx: { db: typeof import("~/server/db").db; session: { user: { id: string } } },
+  ctx: ExpenseContext,
   clientId: string,
 ) {
   const client = await ctx.db.query.clients.findFirst({
@@ -62,7 +68,7 @@ async function verifyClientAccess(
 }
 
 async function verifyInvoiceAccess(
-  ctx: { db: typeof import("~/server/db").db; session: { user: { id: string } } },
+  ctx: ExpenseContext,
   invoiceId: string,
 ) {
   const invoice = await ctx.db.query.invoices.findFirst({
@@ -81,7 +87,7 @@ async function verifyInvoiceAccess(
 }
 
 async function resolveExpenseBusinessId(
-  ctx: { db: typeof import("~/server/db").db; session: { user: { id: string } } },
+  ctx: ExpenseContext,
   businessId: string | null,
   invoice?: { businessId: string | null } | null,
 ) {
@@ -98,7 +104,7 @@ async function resolveExpenseBusinessId(
 }
 
 async function getOwnedExpense(
-  ctx: { db: typeof import("~/server/db").db; session: { user: { id: string } } },
+  ctx: ExpenseContext,
   expenseId: string,
 ) {
   const expense = await ctx.db.query.expenses.findFirst({

src/server/api/routers/time-entries.ts

@@ -6,6 +6,7 @@ import { TRPCError } from "@trpc/server";
 import type { db } from "~/server/db";
 import {
   computeTrackedHours,
+  normalizeOptionalId,
   resolveBillingDescription,
   type ClockOutOutcome,
 } from "~/lib/time-clock";
@@ -242,7 +243,7 @@ export const timeEntriesRouter = createTRPCRouter({
         });
       }
 
-      const clientId = input.clientId?.trim() || null;
+      const clientId = normalizeOptionalId(input.clientId);
       let clientRecord: { defaultHourlyRate: number | null } | null = null;
       if (clientId) {
         const found = await ctx.db.query.clients.findFirst({
@@ -514,7 +515,7 @@ export const timeEntriesRouter = createTRPCRouter({
   create: protectedProcedure
     .input(createSchema)
     .mutation(async ({ ctx, input }) => {
-      const clientId = input.clientId?.trim() || null;
+      const clientId = normalizeOptionalId(input.clientId);
       if (clientId) {
         const client = await ctx.db.query.clients.findFirst({
           where: and(eq(clients.id, clientId), eq(clients.createdById, ctx.session.user.id)),