Add role-based filtering and imporve code

services/sales/app/api/analytics.py

@@ -11,6 +11,7 @@ import structlog
 
 from app.services.sales_service import SalesService
 from shared.routing import RouteBuilder
+from shared.auth.access_control import analytics_tier_required
 
 route_builder = RouteBuilder('sales')
 router = APIRouter(tags=["sales-analytics"])
@@ -25,13 +26,14 @@ def get_sales_service():
 @router.get(
     route_builder.build_analytics_route("summary")
 )
+@analytics_tier_required
 async def get_sales_analytics(
     tenant_id: UUID = Path(..., description="Tenant ID"),
     start_date: Optional[datetime] = Query(None, description="Start date filter"),
     end_date: Optional[datetime] = Query(None, description="End date filter"),
     sales_service: SalesService = Depends(get_sales_service)
 ):
-    """Get sales analytics summary for a tenant"""
+    """Get sales analytics summary for a tenant (Professional+ tier required)"""
     try:
         analytics = await sales_service.get_sales_analytics(tenant_id, start_date, end_date)
 

services/sales/app/api/sales_records.py

@@ -19,11 +19,15 @@ from app.services.sales_service import SalesService
 from shared.auth.decorators import get_current_user_dep
 from shared.auth.access_control import require_user_role
 from shared.routing import RouteBuilder
+from shared.security import create_audit_logger, AuditSeverity, AuditAction
 
 route_builder = RouteBuilder('sales')
 router = APIRouter(tags=["sales-records"])
 logger = structlog.get_logger()
 
+# Initialize audit logger
+audit_logger = create_audit_logger("sales-service")
+
 
 def get_sales_service():
     """Dependency injection for SalesService"""
@@ -169,24 +173,53 @@ async def update_sales_record(
 @router.delete(
     route_builder.build_resource_detail_route("sales", "record_id")
 )
+@require_user_role(['admin', 'owner'])
 async def delete_sales_record(
     tenant_id: UUID = Path(..., description="Tenant ID"),
     record_id: UUID = Path(..., description="Sales record ID"),
+    current_user: Dict[str, Any] = Depends(get_current_user_dep),
     sales_service: SalesService = Depends(get_sales_service)
 ):
-    """Delete a sales record"""
+    """Delete a sales record (Admin+ only)"""
     try:
+        # Get record details before deletion for audit log
+        record = await sales_service.get_sales_record(record_id, tenant_id)
+
         success = await sales_service.delete_sales_record(record_id, tenant_id)
 
         if not success:
             raise HTTPException(status_code=404, detail="Sales record not found")
 
+        # Log audit event for sales record deletion
+        try:
+            from app.core.database import get_db
+            db = next(get_db())
+            await audit_logger.log_deletion(
+                db_session=db,
+                tenant_id=str(tenant_id),
+                user_id=current_user["user_id"],
+                resource_type="sales_record",
+                resource_id=str(record_id),
+                resource_data={
+                    "product_name": record.product_name if record else None,
+                    "quantity_sold": record.quantity_sold if record else None,
+                    "sale_date": record.date.isoformat() if record and record.date else None
+                } if record else None,
+                description=f"Deleted sales record for {record.product_name if record else 'unknown product'}",
+                endpoint=f"/sales/{record_id}",
+                method="DELETE"
+            )
+        except Exception as audit_error:
+            logger.warning("Failed to log audit event", error=str(audit_error))
+
         logger.info("Deleted sales record", record_id=record_id, tenant_id=tenant_id)
         return {"message": "Sales record deleted successfully"}
 
     except ValueError as ve:
         logger.warning("Error deleting sales record", error=str(ve), record_id=record_id)
         raise HTTPException(status_code=400, detail=str(ve))
+    except HTTPException:
+        raise
     except Exception as e:
         logger.error("Failed to delete sales record", error=str(e), record_id=record_id, tenant_id=tenant_id)
         raise HTTPException(status_code=500, detail=f"Failed to delete sales record: {str(e)}")