added auditing.

src/clj/auto_ap/datomic.clj

@@ -2,6 +2,7 @@
   (:require [auto-ap.utils :refer [default-pagination-size]]
             [clj-time.coerce :as coerce]
             [datomic.api :as d]
+            [clojure.tools.logging :as log]
             [mount.core :as mount]))
 
 (def uri "datomic:sql://invoices?jdbc:postgresql://database:5432/datomic?user=datomic&password=datomic")
@@ -776,6 +777,7 @@
       (update-in [:args] into (get-in query-part-2 [:args]))))
 
 (defn add-sorter-fields [q sort-map args]
+  (log/info "sort-map" (pr-str sort-map))
   (reduce
    (fn [q {:keys [sort-key asc]}]
      (merge-query q
@@ -803,9 +805,33 @@
     (sort comparator results )))
 
 (defn apply-pagination [args results]
+  (log/info (take 4 results))
 
   {:ids  (->> results
               (drop (:start args 0))
               (take (:count args (or (:per-page args) default-pagination-size)))
               (map last))
    :count (count results)})
+
+(defn audit-transact-batch [txes id]
+  (let [batch-id (.toString (java.util.UUID/randomUUID))]
+    (reduce
+     (fn [full-tx batch]
+       (let [batch (conj batch {:db/id "datomic.tx"
+                                :audit/user (str (:user/role id) "-" (:user/name id))
+                                :audit/batch batch-id})
+             tx-result @(d/transact conn batch)]
+
+         (cond-> full-tx
+           (:tx-data full-tx) (update :tx-data #(into % (:tx-data tx-result)))
+           (not (:tx-data full-tx)) (assoc :tx-data (vec (:tx-data tx-result)))
+           (not (:db-before full-tx)) (assoc :db-before (:db-before tx-result))
+           true (assoc :db-after (:db-after tx-result))
+           true (update :tempids merge (:tempids tx-result)))))
+
+     {}
+     (partition-all 200 txes))))
+
+(defn audit-transact [txes id]
+  @(d/transact conn (conj txes {:db/id "datomic.tx"
+                                 :audit/user (str (:user/role id) "-" (:user/name id))})))

src/clj/auto_ap/datomic/invoices.clj

@@ -5,7 +5,8 @@
             [auto-ap.parse :as parse]
             [clj-time.coerce :as c]
             [clojure.set :refer [rename-keys]]
-            [clojure.string :as str]))
+            [clojure.string :as str]
+            [clojure.tools.logging :as log]))
 
 (def default-read '[*
                     {:invoice/client [:client/name :db/id :client/locations :client/code]}
@@ -24,7 +25,7 @@
        (rename-keys  {:invoice-payment/_invoice :invoice/payments})))
 
 (defn raw-graphql-ids [db args]
-  (->> (cond-> {:query {:find []
+  (->> (doto (cond-> {:query {:find []
                               :in ['$]
                               :where ['[?e :invoice/invoice-number]]}
                       :args [(d/db (d/connect uri))]}
@@ -119,6 +120,9 @@
                true
                (merge-query {:query {:find ['?e]
                                      :where ['[?e :invoice/client]]}}) )
+         (#(log/info %)))
+       
+
        (d/query)
        (apply-sort-3 args)
        (apply-pagination args)))
@@ -149,6 +153,7 @@
     0.0)))
 
 (defn get-graphql [args]
+  
   (let [db (d/db (d/connect uri))
         {ids-to-retrieve :ids matching-count :count} (raw-graphql-ids db args)
         outstanding (sum-outstanding ids-to-retrieve)]

src/clj/auto_ap/datomic/migrate.clj

@@ -7,6 +7,7 @@
             [auto-ap.datomic.migrate.add-general-ledger :as add-general-ledger]
             [auto-ap.datomic.migrate.sales :as sales]
             [auto-ap.datomic.migrate.clients :as clients]
+            [auto-ap.datomic.migrate.audit :as audit]
             
             [clojure.java.io :as io]
             [io.rkn.conformity :as c])
@@ -314,7 +315,8 @@
                                                       :db/cardinality :db.cardinality/one}]]}
                           :auto-ap/fix-reset-rels {:txes-fn `reset-function}}
                          sales/norms-map
-                         clients/norms-map)
+                         clients/norms-map
+                         audit/norms-map)
         ]
       (println "Conforming database...")
       (c/ensure-conforms  conn norms-map)

src/clj/auto_ap/datomic/migrate/audit.clj

@@ -0,0 +1,12 @@
+(ns auto-ap.datomic.migrate.audit)
+
+(def norms-map {::add-audit-fields
+                {:txes [[{:db/ident :audit/user
+                          :db/doc "Which user commited this transaction"
+                          :db/valueType :db.type/string
+                          :db/cardinality :db.cardinality/one}
+
+                         {:db/ident :audit/batch
+                          :db/doc "Which batch was this part of"
+                          :db/valueType :db.type/string
+                          :db/cardinality :db.cardinality/one}]]}})

src/clj/auto_ap/datomic/transactions.clj

@@ -116,6 +116,7 @@
                                                  args)
                  true
                  (merge-query {:query {:find ['?e] :where ['[?e :transaction/id]]}}))]
+     (println query)
      (cond->> query
        true (d/query)
        true (apply-sort-3 args)

src/clj/auto_ap/graphql.clj

@@ -941,7 +941,8 @@
                                 (:invoice_payments args))
                            (:client_id args)
                            (:bank_account_id args)
-                           (:type args))))
+                           (:type args)
+                           (:id context))))
 
 (defn get-expense-account-stats [context {:keys [client_id] } value]
   (let [result (cond-> {:query {:find ['?account '?account-name '(sum ?amount)]

src/clj/auto_ap/graphql/checks.clj

@@ -11,7 +11,7 @@
             [auto-ap.datomic.transactions :as d-transactions]
             [auto-ap.datomic.clients :as d-clients]
             [auto-ap.datomic.bank-accounts :as d-bank-accounts]
-            [auto-ap.datomic :refer [uri remove-nils]]
+            [auto-ap.datomic :refer [uri remove-nils audit-transact]]
             [auto-ap.utils :refer [by dollars-0?]]
             [auto-ap.numeric :refer [num->words]]
             [config.core :refer [env]] 
@@ -246,21 +246,22 @@
                 :payment/type :payment-type/check
                 :payment/memo  memo
                 :payment/status  :payment-status/pending
-                :payment/pdf-data (pr-str {:vendor vendor
+                :payment/pdf-data (doto (pr-str {:vendor vendor
                                                  :paid-to (or (:vendor/paid-to vendor) (:vendor/name vendor))
                                                  :amount (reduce + 0 (map (comp invoice-amounts :db/id) invoices))
                                                  :check (str (+ index (:bank-account/check-number bank-account)))
                                                  :memo  memo
                                                  :date (date->str (local-now))
-                                           :client client
+                                                 :client (dissoc client :client/bank-accounts)
-                                           :bank-account bank-account
+                                                 :bank-account (dissoc bank-account :bank-account/start-date)
                                                  #_#_:client {:name (:name client)
                                                               :address (:address client)
                                                               :signature-file (:signature-file client)
                                                               :bank {:name (:bank-account/bank-name bank-account)
                                                                      :acct (:bank-account/bank-code bank-account)
                                                                      :routing (:bank-account/routing bank-account)
-                                                               :acct-number (:bank-account/number bank-account)}}})))]
+                                                                     :acct-number (:bank-account/number bank-account)}}})
+                                    println)))]
     
     (-> []
         (conj payment)
@@ -306,7 +307,7 @@
                        :client-id client-id
                        :invoices (map :invoice/invoice-number invoices)}))))
 
-(defn print-checks [invoice-payments client-id bank-account-id type]
+(defn print-checks [invoice-payments client-id bank-account-id type id]
   (let [type (keyword "payment-type" (name type))
         invoices (d-invoices/get-multi (map :invoice-id invoice-payments))
         client (d-clients/get-by-id client-id)
@@ -330,7 +331,7 @@
                                (> (:payment/amount %) 0.0)
                                )
                          checks)))
-    @(d/transact (d/connect uri) checks)
+    (audit-transact checks id)
     
     
     {:invoices  (d-invoices/get-multi (map :invoice-id invoice-payments))
@@ -372,13 +373,14 @@
                                   0
                                   invoice-payment-lookup)]
     
-    @(d/transact (d/connect uri)
+    (audit-transact 
      (into [(assoc base-payment
                    :payment/type :payment-type/check
                    :payment/status :payment-status/pending
                    :payment/check-number (:check_number args)
                    :payment/date (c/to-date (parse (:date args) iso-date)))]
-                       (invoice-payments invoices invoice-payment-lookup)))
+           (invoice-payments invoices invoice-payment-lookup))
+     (:id context))
     (->graphql
      {:s3-url nil
       :invoices (d-invoices/get-multi (map :invoice_id (:invoice_payments args)))})))
@@ -404,7 +406,8 @@
                            :payment/amount 0.0
                            :payment/status :payment-status/voided}]
       
-      @(d/transact (d/connect uri) (conj removing-payments updated-payment)))
+      (audit-transact (conj removing-payments updated-payment)
+                      (:id context)))
     
     (-> (d-checks/get-by-id id)
         (->graphql))))

src/clj/auto_ap/graphql/invoices.clj

@@ -9,7 +9,7 @@
             [auto-ap.time :refer [parse iso-date]]
             [auto-ap.utils :refer [dollars=]]
             [datomic.api :as d]
-            [auto-ap.datomic :refer [uri remove-nils]]
+            [auto-ap.datomic :refer [uri remove-nils audit-transact]]
             [clj-time.coerce :as coerce]
             [clj-time.core :as time]
             [clojure.set :as set]))
@@ -34,15 +34,14 @@
 
 (defn reject-invoices [context {:keys [invoices] :as in} value]
   (assert-admin (:id context))
-  
   (let [transactions (map (fn [i] [:db/retractEntity i ]) invoices)
-        transaction-result @(d/transact (d/connect uri) transactions)]
+        transaction-result (audit-transact transactions (:id context))]
     invoices))
 
 (defn approve-invoices [context {:keys [invoices] :as in} value]
   (assert-admin (:id context))
   (let [transactions (map (fn [i] {:db/id i :invoice/import-status :import-status/imported}) invoices)
-        transaction-result @(d/transact (d/connect uri) transactions)]
+        transaction-result (audit-transact transactions (:id context))]
     invoices))
 
 (defn assert-no-conflicting [{:keys [total invoice_number location client_id vendor_id vendor_name date] :as in}]
@@ -95,7 +94,7 @@
 (defn add-invoice [context {{:keys [total invoice_number location client_id vendor_id vendor_name date] :as in} :invoice} value]
   (assert-no-conflicting in)
   (assert-can-see-client (:id context) client_id)
-  (let [transaction-result @(d/transact (d/connect uri) [(add-invoice-transaction in)])]
+  (let [transaction-result (audit-transact [(add-invoice-transaction in)] (:id context))]
     (-> (d-invoices/get-by-id (get-in transaction-result [:tempids "invoice"]))
         (->graphql))))
 
@@ -107,12 +106,13 @@
   (assert-no-conflicting in)
   (assert-can-see-client (:id context) client_id)
   (assert-bank-account-belongs client_id bank-account-id)
-  (let [transaction-result @(d/transact (d/connect uri) [(add-invoice-transaction in)])]
+  (let [transaction-result (audit-transact [(add-invoice-transaction in)] (:id context))]
     (-> (gq-checks/print-checks [{:invoice-id (get-in transaction-result [:tempids "invoice"])
                                   :amount total}]
                                 client_id
                                 bank-account-id
-                                type)
+                                type
+                                (:id context))
         ->graphql)))
 
 
@@ -142,24 +142,25 @@
                                                                 expense_accounts)}
                           due (assoc :invoice/due (coerce/to-date due))
                           (boolean? automatically_paid_when_due) (assoc :invoice/automatically-paid-when-due automatically_paid_when_due))]
-    @(d/transact (d/connect uri) (concat [updated-invoice]
+    (audit-transact (concat [updated-invoice]
-                                         (map (fn [d] [:db/retract id :invoice/expense-accounts d]) deleted)))
+                            (map (fn [d] [:db/retract id :invoice/expense-accounts d]) deleted))
+                    (:id context))
     (-> (d-invoices/get-by-id id)
         (->graphql))))
 
 (defn void-invoice [context {id :invoice_id} value]
  (let [invoice (d-invoices/get-by-id id)
-  _ (assert-can-see-client (:id context) (:db/id (:invoice/client invoice)))
+  _ (assert-can-see-client (:id context) (:db/id (:invoice/client invoice)))]
-  updated-invoice (d-invoices/update {:db/id id
+   (audit-transact [{:db/id id
                      :invoice/total 0.0
                      :invoice/outstanding-balance 0.0
                      :invoice/status :invoice-status/voided
                      :invoice/expense-accounts (map (fn [ea] {:db/id (:db/id ea)
                                                               :invoice-expense-account/amount 0.0})
-                                                                     (:invoice/expense-accounts invoice))})]
+                                                    (:invoice/expense-accounts invoice))}]
+                   (:id context))
 
-  (-> updated-invoice
+   (-> (d-invoices/get-by-id id) (->graphql))))
-   (->graphql))))
 
 
 (defn unvoid-invoice [context {id :invoice_id} value]
@@ -176,7 +177,7 @@
                               :in ['$ '?e]}
                       :args [history id]})
         [last-transaction] (->> txs (sort-by first) (last))]
-    @(d/transact conn [(->> txs
+    (audit-transact [(->> txs
                           (filter (fn [[tx]] (= tx last-transaction)))
                           (reduce (fn [new-transaction [_ entity original-status original-outstanding total expense-account expense-account-amount]]
                                     (-> new-transaction 
@@ -186,7 +187,8 @@
                                                :invoice/outstanding-balance original-outstanding)
 
                                         (update :invoice/expense-accounts conj {:db/id expense-account :invoice-expense-account/amount expense-account-amount}))
-                                      ) {}))])
+                                    ) {}))]
+                    (:id context))
 
     (-> (d-invoices/get-by-id id)
         (->graphql))))
@@ -201,8 +203,9 @@
                                             expense-account->entity
                                             (:expense_accounts args))}]
 
-    @(d/transact (d/connect uri) (concat [updated]
+    (audit-transact (concat [updated]
-                                         (map (fn [d] [:db/retract invoice-id :invoice/expense-accounts d])deleted)))
+                            (map (fn [d] [:db/retract invoice-id :invoice/expense-accounts d])deleted))
+                    (:id context))
     (->graphql
      (d-invoices/get-by-id (:invoice_id args)))))
 

src/clj/auto_ap/graphql/transactions.clj

@@ -5,7 +5,7 @@
             [auto-ap.datomic.checks :as d-checks]
             [auto-ap.graphql.transaction-rules :as g-tr]
             [datomic.api :as d]
-            [auto-ap.datomic :refer [uri remove-nils]]
+            [auto-ap.datomic :refer [uri remove-nils audit-transact audit-transact-batch]]
             [com.walmartlabs.lacinia :refer [execute]]
             [com.walmartlabs.lacinia.executor :as executor]
             [com.walmartlabs.lacinia.resolve :as resolve]
@@ -23,14 +23,14 @@
 (def approval-status->graphql (ident->enum-f :transaction/approval-status))
 
 (defn get-transaction-page [context args value]
-  (let [args (assoc args :id (:id context))
+  (let [args (assoc (:filters args) :id (:id context))
-        [transactions transactions-count] (d-transactions/get-graphql (update (<-graphql (:filters args)) :approval-status enum->keyword  "transaction-approval-status"))
+        [transactions transactions-count] (d-transactions/get-graphql (update (<-graphql args) :approval-status enum->keyword  "transaction-approval-status"))
         transactions (map ->graphql (map approval-status->graphql transactions))]
     {:data transactions
      :total transactions-count
      :count (count transactions)
-     :start (:start (:filters args) 0)
+     :start (:start args 0)
-     :end (+ (:start (:filters args) 0) (count transactions))}))
+     :end (+ (:start args 0) (count transactions))}))
 
 (defn unapprove-transactions [context args value]
   (let [_ (assert-admin (:id context))
@@ -45,7 +45,13 @@
         all-ids (into (set ids) specific-ids)]
 
     (log/info "Unapproving " (count all-ids) args)
-    (d-transactions/unapprove all-ids)
+
+    (audit-transact-batch 
+     (mapv (fn [i]
+             {:db/id i
+              :transaction/approval-status :transaction-approval-status/unapproved})
+           all-ids)
+     (:id context))
     {:message (str "Succesfully unapproved " (count all-ids) " transactions.")}))
 
 
@@ -62,7 +68,12 @@
         all-ids (into (set ids) specific-ids)]
 
     (log/info "Deleting " (count all-ids) args)
-    (d-transactions/delete all-ids)
+    (audit-transact-batch
+     (mapcat (fn [i]
+               [[:db/retractEntity i]
+                [:db/retractEntity [:journal-entry/original-entity i]]])
+             all-ids)
+     (:id context))
     {:message (str "Succesfully deleted " (count all-ids) " transactions.")}))
 
 (defn transaction-account->entity [{:keys [id account_id amount location]}]
@@ -103,8 +114,7 @@
     (when missing-locations
       (throw (ex-info (str "Location '" (str/join ", " missing-locations) "' not found on client.") {})) )
     
-    @(d/transact (d/connect uri)
+    (audit-transact (concat [(remove-nils {:db/id id
-                 (doto (concat [(remove-nils {:db/id id
                                            :transaction/vendor vendor_id
                                            :transaction/approval-status (some->> approval_status
                                                                                  name
@@ -125,7 +135,7 @@
                             (map (fn [d]
                                    [:db/retract id :transaction/accounts d])
                                  deleted))
-                   clojure.pprint/pprint))
+                    (:id context))
     (-> (d-transactions/get-by-id id)
         approval-status->graphql
         ->graphql)))
@@ -142,8 +152,7 @@
     (when-not (dollars= (- (:transaction/amount transaction))
                         (:payment/amount payment))
       (throw (ex-info "Amounts don't match" {:validation-error "Amounts don't match"})))
-    @(d/transact (d/connect uri)
+    (audit-transact (into 
-                (into 
                      [{:db/id (:db/id payment)
                        :payment/status :payment-status/cleared}
 
@@ -155,7 +164,8 @@
                                                :transaction-account/location "A"
                                                :transaction-account/amount (Math/abs (:transaction/amount transaction))}]}]
                      (map (fn [x] [:db/retractEntity (:db/id x)] )
-                      (:transaction/accounts transaction)))))
+                          (:transaction/accounts transaction)))
+                    (:id context)))
   (-> (d-transactions/get-by-id transaction_id)
       approval-status->graphql
       ->graphql))
@@ -188,8 +198,7 @@
       (when (:transaction/payment transaction)
 
         (throw (ex-info "Transaction already associated with a payment" {:validation-error "Transaction already associated with a payment"}))))
-    @(d/transact (d/connect uri)
+    (audit-transact (transduce
-                 (transduce
                      (map #(into 
                             [(remove-nils (rm/apply-rule {:db/id (:db/id %)
                                                           :transaction/amount (:transaction/amount %)}
@@ -201,7 +210,8 @@
                                  (:transaction/accounts %))))
                      into
                      []
-                  transactions))
+                     transactions)
+                    (:id context))
     )
   (transduce
    (comp

src/clj/user.clj

@@ -383,3 +383,13 @@
                (d/tx-range (d/log (d/connect uri))
                            i
                            (inc i))))))
+(defn tx-range-detail [i]
+  (map (juxt :e #(d/ident (d/db (d/connect uri))  (:a %)) :v)
+       
+       (mapcat :data (d/tx-range (d/log (d/connect uri))
+                                 (- i 100)
+                                 (+ i 100)))))
+
+
+(defn start-db []
+  (mount.core/start (mount.core/only #{#'auto-ap.datomic/conn})))

src/cljs/auto_ap/views/pages/admin/rules.cljs

@@ -100,7 +100,7 @@
 (defn admin-rules-page []
   (let [{:keys [active?]} @(re-frame/subscribe [::forms/form ::form/form])]
     [side-bar-layout {:side-bar [admin-side-bar {}
-                                 [side-bar/rule-side-bar]]
+                                 [side-bar/rule-side-bar {:data-page ::page}]]
                       :main [rules-content]
                       :right-side-bar [appearing-side-bar {:visible? active?}
                                        [form/form {:data-page ::page}]]

src/cljs/auto_ap/views/pages/admin/rules/side_bar.cljs

@@ -2,57 +2,18 @@
   (:require
    [re-frame.core :as re-frame]
    [auto-ap.subs :as subs]
-   [auto-ap.views.components.typeahead :refer [typeahead-entity]]))
+   [auto-ap.views.components.typeahead :refer [typeahead-entity]]
-
+   [auto-ap.views.pages.data-page :as data-page]))
-(re-frame/reg-sub
- ::specific-filters
- (fn [db ]
-   (::filters db nil)))
-
-(re-frame/reg-sub
- ::filters
- :<- [::specific-filters]
- :<- [::subs/vendors-by-id]
- :<- [::subs/query-params]
- (fn [[specific-filters vendors-by-id query-params] ]
-   (let [url-filters (-> query-params
-                         (select-keys #{:vendor-id}))
-         url-filters {:vendor (when-let [vendor-id (:vendor-id url-filters)]
-                                {:id (str vendor-id)
-                                 :name (get-in vendors-by-id [(str vendor-id) :name] "Loading...")})}]
-     (merge url-filters specific-filters ))))
-
-(re-frame/reg-sub
- ::filter
- :<- [::filters]
- (fn [filters [_ which]]
-   (get filters which)))
-
-(re-frame/reg-sub
- ::filter-params
- :<- [::filters]
- :<- [::subs/active-page]
- (fn [[filters ap ]]
-   {:vendor-id (:id (:vendor filters))}))
 
 
-(re-frame/reg-event-fx
+(defn rule-side-bar [{:keys [data-page]}]
- ::filter-changed
- (fn [{:keys [db]} [_ & params]]
-   (let [[a b c] params
-         [which val] (if (= 3 (count params))
-                       [(into [a] b) c]
-                       [[a] b])]
-     {:db (assoc-in db (into [::filters] which) val)})))
-
-
-(defn rule-side-bar []
   [:div
    [:p.menu-label "Vendor"]
    [:div
     [typeahead-entity {:matches @(re-frame/subscribe [::subs/vendors])
-                       :on-change #(re-frame/dispatch [::filter-changed :vendor %])
+                       :on-change #(re-frame/dispatch [::data-page/filter-changed data-page :vendor %])
                        :match->text :name
+                       :include-keys [:name :id]
                        :type "typeahead-entity"
-                       :value @(re-frame/subscribe [::filter :vendor])}]]])
+                       :value @(re-frame/subscribe [::data-page/filter data-page :vendor])}]]])
 

test/clj/auto_ap/graphql.clj

@@ -23,7 +23,67 @@
    :user/role "admin"
    :user/name "TEST ADMIN"})
 
+(defn user-token []
+  {:user "TEST USER"
+   :exp (time/plus (time/now) (time/days 1))
+   :user/role "user"
+   :user/name "TEST USER"
+   :user/clients [{:db/id 1}]})
+
+(defn new-client [args]
+  (merge {:client/name "Test client"
+          :client/code (.toString (java.util.UUID/randomUUID))
+          :client/locations ["AB"]}
+         args))
+
+(defn new-transaction [args]
+  (merge {:transaction/amount 100.0
+          :transaction/id (.toString (java.util.UUID/randomUUID))}
+         args))
+
+(defn new-invoice [args]
+  (merge {:invoice/total 100.0
+          :invoice/invoice-number (.toString (java.util.UUID/randomUUID))}
+         args))
+
 (use-fixtures :each wrap-setup)
+(deftest transaction-page
+  (testing "transaction page"
+    @(d/transact (d/connect uri)
+                 [(new-client {:db/id "client"})
+                  (new-transaction {:transaction/client "client"})])
+    
+    (testing "It should find all transactions"
+      (let [result (:transaction-page (:data (sut/query (admin-token) "{ transaction_page(filters: {client_id: null}) { count, start, data { id } }}")))]
+        (is (= 1 (:count result)))
+        (is (= 0 (:start result)))
+        (is (= 1 (count (:data result))))))
+
+    (testing "Users should not see transactions they don't own"
+      (let [result (:transaction-page (:data (sut/query (user-token) "{ transaction_page(filters: {client_id: null}) { count, start, data { id } }}")))]
+        (is (= 0 (:count result)))
+        (is (= 0 (:start result)))
+        (is (= 0 (count (:data result))))))))
+
+
+(deftest invoice-page
+  (testing "invoice page"
+    @(d/transact (d/connect uri)
+                 [(new-client {:db/id "client"})
+                  (new-invoice {:invoice/client "client"
+                                :invoice/status :invoice-status/paid})])
+    (testing "It should find all invoices"
+      (let [result (first (:invoice-page (:data (sut/query (admin-token) "{ invoice_page(client_id: null, status:paid) { count, start, invoices { id } }}"))))]
+        (is (= 1 (:count result)))
+        (is (= 0 (:start result)))
+        (is (= 1 (count (:invoices result))))))
+
+    (testing "Users should not see transactions they don't own"
+      (let [result (first (:invoice-page (:data (sut/query (user-token) "{ invoice_page(client_id: null) { count, start, invoices { id } }}"))))]
+        (is (= 0 (:count result)))
+        (is (= 0 (:start result)))
+        (is (= 0 (count (:data result))))))))
+
 (deftest ledger-page
   (testing "ledger"
     (testing "it should find ledger entries"