Dentolize · Expense & Salary Date Permissions Walkthrough
On this pageBusiness viewWhat changed, in one sentenceTechnical view

Overview

Business view

Every expense and every salary adjustment carries a date — the date the clinic's reports read it by. Until now, anyone who was allowed to add an expense or a salary adjustment could also back-date or post-date it, because the "when did this happen" question and the "am I allowed to add this" question were the same permission.

This change splits them apart. Adding an expense, an expense payment, or a salary adjustment is still governed by the existing Add/Edit permissions. But choosing a date other than today (for a new record) or moving the date (on an existing record) now requires its own permission: Change Creation Date.

The date field itself never disappears — it stays on the form for everyone, so nobody is confused about what date a record will land on. Staff without the permission simply see it greyed out, with a short explanation ("You don't have permission to change this date") on hover.

This is the same model the system already uses for appointments and patient records (APPOINTMENTS_CREATED_AT, PATIENTS_DETAILS_CREATED_AT, and friends) — this PR extends it to two areas that didn't have it yet: expenses (including expense payments) and salary adjustments.

What changed, in one sentence

Two new permissions — Expenses: Change Creation Date and Salary Hub: Change Creation Date — now gate who can pick a non-default date on an expense, an expense payment, or a salary adjustment; without the permission a new record silently falls back to today and an editing user can't move the date on an existing one.

Technical view

  • Two new values were added to the shared Permission enum: EXPENSES_CREATED_AT

and SALARY_ADJUSTMENT_CREATED_AT (/work/repo/packages/prisma/schema.prisma:6160, /work/repo/packages/server/src/enums.graphql:412), shipped via migration /work/repo/packages/prisma/migrations/20260902160000_add_created_at_permissions/migration.sql.

  • A new server helper, getPermittedDate(args, request, permission)

(/work/repo/packages/server/src/utils/helpers.js:2560), mirrors the existing getCreatedAt helper but returns undefined unless the caller holds the named permission or DO_ALL. It is wired into the expense and salary adjustment create/edit resolvers.

  • The web and mobile forms read a new front-end permission flag

(expensesCreatedAt, salaryAdjustmentCreatedAt) and use it to disable — not hide — the date picker, with a tooltip/help text explaining why.

  • The Permission Groups screen (Settings tab) gained a Change Creation Date

column, shown only for the rows that support it (Expenses, Salary Hub), so clinic owners can grant or revoke the permission per group.

See Walkthrough for annotated screenshots, and the feature breakdown pages for the full behavioral detail, including exactly what happens in the "no permission" case for a new record versus an edit.