Added Multi-Company Support

server/middleware/company.js

@@ -0,0 +1,13 @@
+// Resolve the active company for the request from the X-Company-Id header. The company must be one
+// the user may access (see companies.companiesForUser); otherwise we fall back to their first
+// accessible company so the app always has a valid, permitted company context. Mount after requireAuth.
+// Required lazily to avoid a load-time cycle (companies -> roles -> ...).
+function resolveCompany(req, res, next) {
+  const { companyIdsForUser } = require('../services/companies');
+  const accessible = companyIdsForUser(req.user);
+  const requested = Number(req.headers['x-company-id']);
+  req.companyId = accessible.includes(requested) ? requested : (accessible[0] || null);
+  return next();
+}
+
+module.exports = { resolveCompany };