@7365admin1/core 3.139.0 → 3.139.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/core
 
+## 3.139.1
+
+### Patch Changes
+
+- 45755c1: Security: a membership that was taken away ("inactive" after the service-provider Repair or Finish-setup Undo, or "deleted") no longer grants organisation, site or role reach (resolveInviteActor, camera site entitlement, role-holder check).
+
 ## 3.139.0
 
 ### Minor Changes

package/dist/index.js

@@ -4402,6 +4402,7 @@ function pickLookupMembership(rows, type, site = "", org = "") {
   return preferWorkingMembership(list.filter((m) => sameAppType(m.type, type)));
 }
 var WORKING = /* @__PURE__ */ new Set(["active", "approved"]);
+var TAKEN_AWAY_MEMBER_STATUSES = ["deleted", "inactive"];
 function preferWorkingMembership(rows, defaultOrg = "") {
   const list = Array.isArray(rows) ? rows : [];
   const working = list.filter((m) => WORKING.has(String(m.status ?? "")) && !m.deletedAt);
@@ -5255,7 +5256,7 @@ function useMemberRepo() {
       // sets it inactive, removal deletes it) must not keep the organisation
       // on the person's list: latitude.sec@ still saw JLL Singapore beside its
       // own company after the repair (owner report 2026-09-30).
-      status: { $nin: ["inactive", "deleted"] }
+      status: { $nin: TAKEN_AWAY_MEMBER_STATUSES }
     };
     const cacheOptions = {
       page: page2,
@@ -9905,7 +9906,7 @@ async function resolveInviteActor(userId) {
   const db2 = import_node_server_utils28.useAtlas.getDb();
   if (!db2)
     return { ...EMPTY, id };
-  const members = await db2.collection("members").find({ user: new import_mongodb26.ObjectId(id), status: { $ne: "deleted" } }).toArray();
+  const members = await db2.collection("members").find({ user: new import_mongodb26.ObjectId(id), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).toArray();
   const adminMember = members.find((m) => m.type === "admin");
   let isSuperAdmin2 = false;
   let staffPermissions;
@@ -10212,7 +10213,7 @@ async function holdsRole(userId, roleId, orgId) {
   const member = await db2.collection("members").findOne({
     user: new import_mongodb26.ObjectId(id),
     role: new import_mongodb26.ObjectId(role),
-    status: { $ne: "deleted" },
+    status: { $nin: TAKEN_AWAY_MEMBER_STATUSES },
     // both shapes, as `hasOrgInvitation` does for `metadata.org`
     ...org ? { org: { $in: [new import_mongodb26.ObjectId(org), org] } } : {}
   });
@@ -23243,7 +23244,7 @@ function useCameraViewService() {
     }
   }
   async function resolveSiteAccess(params) {
-    const memberships = await params.db.collection("members").find({ user: new import_mongodb52.ObjectId(params.userId), status: { $ne: "deleted" } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
+    const memberships = await params.db.collection("members").find({ user: new import_mongodb52.ObjectId(params.userId), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
     const memberOrgIds = [
       ...new Map(
         memberships.filter((membership) => membership.org).map((membership) => [String(membership.org), membership.org])