@7365admin1/core 3.47.1-staging.129 → 3.47.1-staging.130
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.changeset/users-v2-list-staff-guard.md +13 -0
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +1 -0
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
- package/test/staff-console-authz.test.mjs +22 -12
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
---
|
|
2
|
+
"@7365admin1/core": patch
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
Require Seven365 staff to read the platform-wide user list on /api/users/v2 too
|
|
6
|
+
|
|
7
|
+
`/api/users` and `/api/users/v2` are separate mounts onto separate controllers,
|
|
8
|
+
each with its own copy of the same unfiltered platform-wide list. Gating only
|
|
9
|
+
v1 left the gate bypassable by adding `/v2` to the URL.
|
|
10
|
+
|
|
11
|
+
`user-v2.controller.ts` `getUsers` now calls `requirePlatformStaff`, the same
|
|
12
|
+
gate. The v2 per-user endpoints are unchanged, and the test that pins the v1
|
|
13
|
+
profile endpoints as ungated now covers both controllers.
|
package/dist/index.js
CHANGED
|
@@ -80406,6 +80406,7 @@ function useUserControllerV2() {
|
|
|
80406
80406
|
if (error)
|
|
80407
80407
|
return rejectValidation(error, next);
|
|
80408
80408
|
try {
|
|
80409
|
+
await requirePlatformStaff(req);
|
|
80409
80410
|
const users = await _getUsers({
|
|
80410
80411
|
search: value.search ?? "",
|
|
80411
80412
|
page: value.page,
|