fix(assets): expose full inventory for scoped users and stabilize previews

src/server/routes/asset-assistant/execute.ts

@@ -5,6 +5,8 @@ import type {
   AssistantResult,
 } from "../../../shared/assets/assistant.js";
 import { DIMENSIONS } from "../../../shared/assets/assistant.js";
+import type { AuthUser } from "../../auth/types.js";
+import { filterByPermission } from "../../auth/permissions.js";
 import type { Vehicle } from "../../types.js";
 import { vehicleRepository } from "../vehicles/repository.js";
 import { listDateRange } from "../vehicles/utils.js";
@@ -12,7 +14,10 @@ import { assetResult, filterVehicles, toRow, validatePlan } from "./model.js";
 export async function execute(
   vehicles: Vehicle[],
   plan: QueryPlan,
+  user?: AuthUser,
 ): Promise<AssistantResult> {
+  // Public current stock must not broaden access to historical business events.
+  if (plan.kind === "flow" && user) vehicles = filterByPermission(vehicles, user);
   let result = assetResult(vehicles, plan);
   if (plan.kind === "flow") {
     const selected = filterVehicles(vehicles, plan);
@@ -94,7 +99,7 @@ export async function execute(
       start,
       end,
       comparePrevious: false,
-    });
+    }, user);
     result.comparisonPeriod = { start, end };
     result.comparison = result.metrics.map((m, i) => ({
       label: m.label,