Since the report can be generated using only a date, we must ensure that users can only access records they are authorized to view. The backend should enforce this by filtering and returning only the records the user is permitted to see, applying facility, program, and product constraints.

NOTE: Even if no filters are provided, the BE must still perform this access check.

AC:

1. Users can only access records for permitted facilities, programs, and products.

2. The BE must enforce access restrictions even if no filters are provided.

3. Unauthorized records must be excluded from the report.

Solution Concept:

• When generating the report, pass the userId as a parameter and modify the SQL query accordingly to meet the requirements.