Dentolize · Expense & Salary Date Permissions Walkthrough
On this pageWhy this mattersRisk / impactWhat to communicate at launch

For Stakeholders

Why this matters

Expenses and salary adjustments both feed financial and payroll reporting. Before this change, the ability to file an expense and the ability to choose what date it's filed under were the same permission — meaning any staff member trusted to log an expense could also, intentionally or by mistake, date it into a closed reporting period. Salary adjustments had the same gap, plus expense payments were carrying an inconsistent rule of their own (owner-only, regardless of what the parent expense permission allowed).

This PR closes that gap by giving clinics a dedicated, per-role control over who can move these dates — consistent with the model already used for appointments and patient records.

Risk / impact

  • Low blast radius: this is additive. No existing permission is removed;

a new one is introduced and defaults to off for every existing group (new enum values start ungranted). Nobody loses access they had before — except for one deliberate change, below.

  • One behavior change to flag: expense payment dates used to be

owner-only (doAll). They now follow the same EXPENSES_CREATED_AT permission as the parent expense. In practice this widens access (any group with the new permission can now do what only owners could do before) — worth a one-line mention in release notes so an owner isn't surprised that a non-owner can now set a payment date.

  • No data migration risk: the underlying date/createdAt fields on

Expense, ExpensePayment, and SalaryAdjustment are unchanged; this is a permission check added around existing write paths, not a schema change to those records themselves. Existing data is untouched.

  • Rollout dependency: relies on a Prisma enum migration

(ALTER TYPE "Permission" ADD VALUE ...) — additive to the Permission enum, no destructive change.

What to communicate at launch

  • This is a controls/permissions refinement for expenses and salary

adjustments, in line with existing "created at" controls on appointments and patient records.

  • Clinics don't need to do anything — existing groups keep working exactly as

before, with the one payments-widening caveat above. Clinics that want the new, finer control need to explicitly grant it per group.