Flip every user-facing read (dashboard, cashflow, transactions, budgets,
accounts, settings, analytics, sync, shared props) from user-scoped to
active-space-scoped via explicit $space->… relations, and re-key the category
tree, spending, and budget-assignment services by space_id. Authorization moves
from creator-ownership to space membership.
Add the visible spaces layer behind a Pennant 'spaces' flag: a sidebar space
switcher, a settings page to create/rename/delete/switch spaces, per-space
offline-cache flushing, and the currentSpace/spaces shared props. Data creation
is unchanged — the BelongsToSpace trait already stamps space_id from the active
space. Isolation tests prove no cross-space leakage.
The provisioning pass enumerated users through the default (soft-delete-aware)
query, so trashed users got no personal space and their accounts, transactions,
categories, etc. kept a null space_id — an incomplete backfill that would block
a NOT NULL constraint and hide a restored account's data under space-scoped
reads. Include trashed users in the pass (the row-stamping already covers their
rows). Verified on a prod-scale copy: 0 rows left unstamped afterwards.
Introduce the multi-tenant Space concept without changing any behaviour yet:
every user gets an invisible personal space provisioned on creation, and all
owned models (accounts, connections, transactions, categories, labels, budgets,
automation rules, saved filters) gain a nullable space_id stamped via a
BelongsToSpace trait. An idempotent, chunked spaces:backfill command (run from a
migration) stamps existing rows so space-scoped reads can go live safely.
Víctor Falcón