@7365admin1/core 3.47.1-staging.126 → 3.47.1-staging.129

package/.changeset/members-paging-skip.md

@@ -0,0 +1,18 @@
+---
+"@7365admin1/core": patch
+---
+
+Fix GET /api/members returning the same page over and over
+
+`member.repo.ts` `getAll` built its aggregate with `{ $limit: limit }` and no
+`$skip`. `paginate()` only *labels* the range — it returns `items` untouched and
+computes `pageRange` arithmetically — so the server answered page 2 with page
+1's rows under an "11-20 of 42" heading. Every Members screen in every app was
+affected, not one screen.
+
+`{ $skip: page * limit }` is added ahead of the limit, matching the two
+`getOrgs*` reads in the same file that were already correct. `page` is
+zero-based by then, and the cache key already varies by page, so no cache
+change is needed.
+
+The response shape is unchanged: `{ items, pages, pageRange }`.

package/.changeset/service-provider-org-filter.md

@@ -0,0 +1,17 @@
+---
+"@7365admin1/core": patch
+---
+
+Fix the ignored serviceProviderOrgId filter on GET /api/service-providers
+
+`service-provider.controller.ts` `getServiceProviders` validated
+`serviceProviderOrgId` in its Joi schema but read
+`req.query.serviceProviderId`. Joi rejects unknown keys, so no caller could
+ever send the name that was read — the value was permanently `undefined` and
+the documented filter was silently ignored, answering with every service
+provider rather than the one organisation's.
+
+The read now uses the key the schema declares. The repository already handled
+`serviceProviderOrgId` correctly, so nothing below the controller changes.
+
+Raised in web-app-org #142.

package/.changeset/users-list-staff-guard.md

@@ -0,0 +1,17 @@
+---
+"@7365admin1/core": patch
+---
+
+Require Seven365 staff to read the platform-wide user list
+
+`GET /api/users` was `requireAuth` only. It is not filtered by organisation or
+by site, so it returns every account on the platform — every client's residents,
+guards and cleaners — and any signed-in account could page through the lot.
+
+It now calls `requirePlatformStaff`, the same gate the rest of the staff console
+uses. No second mechanism is introduced.
+
+The per-user endpoints in the same controller (`getById`, `getByEmail`,
+`getUsersByOrgId`, the profile and password writes) are deliberately unchanged —
+they are a person's own account, not a cross-tenant read — and a test pins that
+so a later sweep cannot close them by reflex.