@7365admin1/core 3.47.1-staging.127 → 3.47.1-staging.130

package/.changeset/service-provider-org-filter.md

@@ -0,0 +1,17 @@
+---
+"@7365admin1/core": patch
+---
+
+Fix the ignored serviceProviderOrgId filter on GET /api/service-providers
+
+`service-provider.controller.ts` `getServiceProviders` validated
+`serviceProviderOrgId` in its Joi schema but read
+`req.query.serviceProviderId`. Joi rejects unknown keys, so no caller could
+ever send the name that was read — the value was permanently `undefined` and
+the documented filter was silently ignored, answering with every service
+provider rather than the one organisation's.
+
+The read now uses the key the schema declares. The repository already handled
+`serviceProviderOrgId` correctly, so nothing below the controller changes.
+
+Raised in web-app-org #142.

package/.changeset/users-list-staff-guard.md

@@ -0,0 +1,17 @@
+---
+"@7365admin1/core": patch
+---
+
+Require Seven365 staff to read the platform-wide user list
+
+`GET /api/users` was `requireAuth` only. It is not filtered by organisation or
+by site, so it returns every account on the platform — every client's residents,
+guards and cleaners — and any signed-in account could page through the lot.
+
+It now calls `requirePlatformStaff`, the same gate the rest of the staff console
+uses. No second mechanism is introduced.
+
+The per-user endpoints in the same controller (`getById`, `getByEmail`,
+`getUsersByOrgId`, the profile and password writes) are deliberately unchanged —
+they are a person's own account, not a cross-tenant read — and a test pins that
+so a later sweep cannot close them by reflex.

package/.changeset/users-v2-list-staff-guard.md

@@ -0,0 +1,13 @@
+---
+"@7365admin1/core": patch
+---
+
+Require Seven365 staff to read the platform-wide user list on /api/users/v2 too
+
+`/api/users` and `/api/users/v2` are separate mounts onto separate controllers,
+each with its own copy of the same unfiltered platform-wide list. Gating only
+v1 left the gate bypassable by adding `/v2` to the URL.
+
+`user-v2.controller.ts` `getUsers` now calls `requirePlatformStaff`, the same
+gate. The v2 per-user endpoints are unchanged, and the test that pins the v1
+profile endpoints as ungated now covers both controllers.