@7365admin1/core 3.46.1-staging.116 → 3.46.1-staging.117
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.changeset/terms-acceptance-per-user.md +5 -0
- package/dist/index.js +15 -0
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +24 -5
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
- package/test/staff-console-authz.test.mjs +51 -9
package/dist/index.js
CHANGED
|
@@ -82634,6 +82634,19 @@ function usePlatformTermsController() {
|
|
|
82634
82634
|
add: _add
|
|
82635
82635
|
} = usePlatformTermsService();
|
|
82636
82636
|
const schemaUserParam = import_joi159.default.string().hex().length(24).required().label("user");
|
|
82637
|
+
async function requireOwnRecord(req, user, { staffMayRead = false } = {}) {
|
|
82638
|
+
const id = callerId2(req);
|
|
82639
|
+
if (!id) {
|
|
82640
|
+
throw new import_node_server_utils284.UnauthorizedError("Not authorized.");
|
|
82641
|
+
}
|
|
82642
|
+
if (id === user) {
|
|
82643
|
+
return id;
|
|
82644
|
+
}
|
|
82645
|
+
if (staffMayRead) {
|
|
82646
|
+
return await requirePlatformStaff(req);
|
|
82647
|
+
}
|
|
82648
|
+
throw new import_node_server_utils284.UnauthorizedError("Not authorized.");
|
|
82649
|
+
}
|
|
82637
82650
|
async function getLatest(_req, res, next) {
|
|
82638
82651
|
try {
|
|
82639
82652
|
res.json(await _getLatest());
|
|
@@ -82671,6 +82684,7 @@ function usePlatformTermsController() {
|
|
|
82671
82684
|
return;
|
|
82672
82685
|
}
|
|
82673
82686
|
try {
|
|
82687
|
+
await requireOwnRecord(req, value, { staffMayRead: true });
|
|
82674
82688
|
res.json(await _getStatusByUserId(value));
|
|
82675
82689
|
return;
|
|
82676
82690
|
} catch (error2) {
|
|
@@ -82695,6 +82709,7 @@ function usePlatformTermsController() {
|
|
|
82695
82709
|
return;
|
|
82696
82710
|
}
|
|
82697
82711
|
try {
|
|
82712
|
+
await requireOwnRecord(req, value.user);
|
|
82698
82713
|
res.json(await _acceptByUserId(value.user, value.terms));
|
|
82699
82714
|
return;
|
|
82700
82715
|
} catch (error2) {
|