@7365admin1/core 3.46.1-staging.112 → 3.46.1-staging.113

package/.changeset/staff-console-authorization.md

@@ -0,0 +1,29 @@
+---
+"@7365admin1/core": patch
+---
+
+Staff console authorization: subscriptions, plans, promo codes, client status and platform Terms now require a Seven365 staff membership
+
+The organisation, subscription, subscription-plan, promo-code and platform-terms
+controllers checked only that a session existed, so every write behind the
+Seven365 staff console was reachable by any signed-in account on the platform.
+
+- `requirePlatformStaff` (new `src/utils/console-authz.util.ts`) gates the writes
+  that are ours to make: creating an organisation, suspending or reactivating a
+  client, the plan catalogue, minting a promo code, and publishing platform-wide
+  Terms. It reuses `isSuperAdmin` — a `members` row of type "admin" whose role is
+  also of type "admin" — the same check SP Approvals, Marketplace Vendors and the
+  notification broadcast already use. No role-name string takes part.
+- `requireOrgAccess` gates the two writes a client legitimately makes on their
+  own account — editing their organisation during onboarding, and changing the
+  seat count on their own subscription. The organisation is read off the stored
+  subscription, never off the request.
+- `POST /terms` took `createdBy` from the request body; it is now the session, so
+  published Terms can no longer be attributed to somebody else. The `user` field
+  is still accepted and ignored, so no application has to be released in step.
+- The two `organizations/v2` reads page over every organisation on the platform
+  with its subscription and billing data; they are gated to staff for the same
+  reason.
+
+The paid signup checkout and self-signup organisation creation are deliberately
+left open — they are customer paths, and a test pins them that way.

package/dist/index.d.ts

@@ -697,6 +697,12 @@ declare function useOrgController(): {
 
 /**
  * V2 organization HTTP surface — new handlers; v1 `useOrgController` remains unchanged.
+ *
+ * Both handlers page over EVERY organisation on the platform, and
+ * `getOrganizationsWithSubscription` joins each one to its subscription — plan,
+ * seats, billing cycle, next billing date. That is one tenant's commercial data
+ * readable by another tenant's staff, so these two reads are gated even though
+ * they are reads. The only consumer is the staff Client List.
  */
 declare function useOrgControllerV2(): {
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;