diff --git a/Marco.Pms.Services/Service/ExpensesService.cs b/Marco.Pms.Services/Service/ExpensesService.cs index 38d554d..0443b2b 100644 --- a/Marco.Pms.Services/Service/ExpensesService.cs +++ b/Marco.Pms.Services/Service/ExpensesService.cs @@ -132,17 +132,16 @@ namespace Marco.Pms.Services.Service await _cache.AddExpensesListToCache(expenses: await expensesQuery.ToListAsync(), tenantId); // Apply permission-based filtering BEFORE any other filters or pagination. - - if (!hasViewAllPermissionTask.Result && hasViewSelfPermissionTask.Result) + if (hasViewAllPermissionTask.Result) + { + expensesQuery = expensesQuery.Where(e => e.CreatedById != loggedInEmployeeId || e.StatusId != Draft); + } + else if (hasViewSelfPermissionTask.Result) { // User only has 'View Self' permission, so restrict the query to their own expenses. _logger.LogInfo("User {EmployeeId} has 'View Self' permission. Restricting query to their expenses.", loggedInEmployeeId); expensesQuery = expensesQuery.Where(e => e.CreatedById == loggedInEmployeeId); } - else - { - expensesQuery = expensesQuery.Where(e => e.CreatedById != loggedInEmployeeId || e.StatusId != Draft); - } if (expenseFilter != null) {