From ca7a0d7ff780628fe852867e36482916be416809 Mon Sep 17 00:00:00 2001
From: bot-hermes <bot-hermes@buzzbee.dev>
Date: Thu, 6 Aug 2026 13:56:29 +0000
Subject: [PATCH] fix(reports): honor passed token in report-service generate*
 helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The generateWeeklySummary/generateProjectHealth/generateHabitAnalysis/
generateTimeAudit helpers all had "const pb = token ? createAdminClient()
: createAdminClient();" — both branches return the admin client, so a
passed user token was silently discarded and every caller got admin-level
access. Use createPocketBaseClient(token) when a token is provided,
matching the sibling project-service.ts / note-service.ts pattern.
---
 apps/web/lib/services/report-service.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/web/lib/services/report-service.ts b/apps/web/lib/services/report-service.ts
index 807044f..14be7d4 100644
--- a/apps/web/lib/services/report-service.ts
+++ b/apps/web/lib/services/report-service.ts
@@ -1,4 +1,4 @@
-import { createAdminClient } from '../pocketbase';
+import { createAdminClient, createPocketBaseClient } from '../pocketbase';
 import type {
   Task,
   Habit,
@@ -46,7 +46,7 @@ export async function generateWeeklySummary(
   streaks: Array<{ name: string; streak: number }>;
   byDomain: Record<string, { tasks: number; habits: number }>;
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   // Tasks completed this week
   const taskResults = await pb.collection('tasks').getFullList({
@@ -112,7 +112,7 @@ export async function generateProjectHealth(
   milestoneStatus: Record<string, number>;
   completionRate: number;
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   const taskResults = await pb.collection('tasks').getFullList({
     filter: `project_id = "${projectId}"`,
@@ -169,7 +169,7 @@ export async function generateHabitAnalysis(
   }>;
   atRiskHabits: string[];
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   const startDate = new Date();
   startDate.setDate(startDate.getDate() - days);
@@ -225,7 +225,7 @@ export async function generateTimeAudit(
   byProject: Record<string, number>;
   byTag: Record<string, number>;
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   const entryResults = await pb.collection('time_entries').getFullList({
     filter: `started_at >= "${startDate}" && started_at <= "${endDate}"`,