@7365admin1/core 3.47.1-staging.140 → 3.47.1-staging.142

package/.changeset/organization-read-scope.md

@@ -0,0 +1,44 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the organisation lookups so they stop mapping one client to another.
+
+Four reads on `/api/organizations` carried `requireAuth` and nothing more, and
+every one took its key straight from the URL:
+
+- `GET /api/organizations/user/:user` — which organisations ANY person belongs to
+- `GET /api/organizations/orgs/:email` — the same, keyed on ANY email address
+- `GET /api/organizations/name/:name` — any organisation, by name
+- `GET /api/organizations/email/:email` — any organisation, by email address
+
+Together those are a cross-client directory and an account-enumeration oracle: a
+resident of one estate could map which clients an address or a user id belongs
+to across the whole platform.
+
+Each is now decided from the session:
+
+- `user/:user` — the caller's own id, or Seven365 staff. Every live caller asks
+  about itself: the seven service-provider app layouts, the org app, and the
+  resident mobile app all pass the signed-in user's own id.
+- `orgs/:email` — the caller's own address, compared case-insensitively after
+  being resolved from the session, or Seven365 staff. All three live callers
+  pass the signed-in user's own address.
+- `name/:name` — Seven365 staff. Its only caller is the staff console's client
+  list.
+- `email/:email` — Seven365 staff. No caller exists in any repository in the
+  organisation.
+
+A key that does not exist is refused exactly as one that does, so the refusal
+itself is not an oracle.
+
+`GET /api/organizations/id/:id` is deliberately NOT guarded here: the same
+controller function is mounted a second time, unauthenticated, at
+`/api/organizations/org/id/:id`, which the sign-up-invite screens call before an
+account exists. Guarding the handler would guard both mounts and break
+registration. That one needs the alias split first.
+
+`GET /api/organizations/` (the full client list) is also unchanged and is
+recorded as a decision for the leads: it is reached from a live signup path that
+must move onto the organisation `POST /api/organizations/onboarding` already
+returns before the list can be staff-gated.

package/.changeset/person-search-filter-collision.md

@@ -0,0 +1,26 @@
+---
+"@7365admin1/core": patch
+---
+
+Make the people search filters narrow each other instead of overwriting each
+other.
+
+`person.repo.getAll` built its Mongo filter as one object literal in which four
+different filters each wrote a `$or` key — the date range (`dateTo`), the
+free-text `search`, `contact` and `plateNumber`. An object literal can only
+carry one `$or`, so the last one written silently replaced every earlier one.
+In practice:
+
+- searching by name **and** contact number searched only the contact number,
+- searching by name **and** plate number searched only the plate number,
+- and a **date range was dropped entirely** the moment any of the three was
+  used — which is the live case, because `layer-common`
+  `composables/usePeople.ts:2-30` sends `search`, `dateFrom` and `dateTo`
+  together from the visitor/people list.
+
+No error was raised; the endpoint simply answered a narrower question than it
+was asked, with rows that should not have matched.
+
+The four groups are now collected and combined with `$and`, so each one narrows
+the result. A single filter behaves exactly as before, and a request with no
+filters is unchanged.

package/dist/index.js

@@ -17370,46 +17370,47 @@ function usePersonRepo() {
   }, session) {
     page = page > 0 ? page - 1 : 0;
     const start = dateFrom ? { $gte: new Date(dateFrom).toISOString() } : void 0;
-    const end = dateTo ? {
-      $or: [
+    const anyOf = [];
+    if (dateTo) {
+      anyOf.push([
         { end: { $lte: new Date(dateTo).toISOString() } },
         { end: null }
-      ]
-    } : void 0;
+      ]);
+    }
+    if (search) {
+      anyOf.push([
+        { name: { $regex: search, $options: "i" } },
+        { email: { $regex: search, $options: "i" } },
+        { nric: { $regex: search, $options: "i" } },
+        { "plates.plateNumber": { $regex: search, $options: "i" } },
+        { contact: { $regex: makeContainsRegex(search) } },
+        { contacts: { $regex: makeContainsRegex(search) } },
+        { plateNumbers: { $regex: makeContainsRegex(search) } }
+      ]);
+    }
+    if (contact) {
+      anyOf.push([
+        { contact: { $regex: makeContainsRegex(contact) } },
+        { contacts: { $regex: makeContainsRegex(contact) } }
+      ]);
+    }
+    if (plateNumber) {
+      anyOf.push([
+        { "plates.plateNumber": { $regex: makeContainsRegex(plateNumber) } },
+        { plateNumbers: { $regex: makeContainsRegex(plateNumber) } }
+      ]);
+    }
     const query2 = {
       ...status && status !== "all" ? { status } : { status: { $nin: ["deleted", "rejected"] } },
       ...start && { start },
-      ...end,
-      ...search && {
-        $or: [
-          { name: { $regex: search, $options: "i" } },
-          { email: { $regex: search, $options: "i" } },
-          { nric: { $regex: search, $options: "i" } },
-          { "plates.plateNumber": { $regex: search, $options: "i" } },
-          { contact: { $regex: makeContainsRegex(search) } },
-          { contacts: { $regex: makeContainsRegex(search) } },
-          { plateNumbers: { $regex: makeContainsRegex(search) } }
-        ]
-      },
+      ...anyOf.length > 0 && { $and: anyOf.map(($or) => ({ $or })) },
       ...import_mongodb36.ObjectId.isValid(org) && { org: new import_mongodb36.ObjectId(org) },
       ...!import_mongodb36.ObjectId.isValid(org) && orgs && {
         org: { $in: orgs.filter(import_mongodb36.ObjectId.isValid).map((o) => new import_mongodb36.ObjectId(o)) }
       },
       ...import_mongodb36.ObjectId.isValid(site) && { site: new import_mongodb36.ObjectId(site) },
       ...PERSON_TYPES.includes(type) && { type },
-      ...nric && { nric: { $regex: makeContainsRegex(nric), $options: "i" } },
-      ...contact && {
-        $or: [
-          { contact: { $regex: makeContainsRegex(contact) } },
-          { contacts: { $regex: makeContainsRegex(contact) } }
-        ]
-      },
-      ...plateNumber && {
-        $or: [
-          { "plates.plateNumber": { $regex: makeContainsRegex(plateNumber) } },
-          { plateNumbers: { $regex: makeContainsRegex(plateNumber) } }
-        ]
-      }
+      ...nric && { nric: { $regex: makeContainsRegex(nric), $options: "i" } }
     };
     sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
     try {
@@ -21171,6 +21172,7 @@ async function recordConsoleAction(entry) {
 // src/controllers/organization.controller.ts
 function useOrgController() {
   const { getOrgsByMembership } = useMemberRepo();
+  const { getUserById: _getUserById } = useUserRepo();
   const {
     getByName: _getByName,
     getById: _getById,
@@ -21298,6 +21300,9 @@ function useOrgController() {
     const user = req.params.user;
     const type = req.query.type ?? "";
     try {
+      if (user !== callerId(req)) {
+        await requirePlatformStaff(req);
+      }
       const data = await getOrgsByMembership({
         search,
         page,
@@ -21323,6 +21328,7 @@ function useOrgController() {
       return;
     }
     try {
+      await requirePlatformStaff(req);
       const data = await _getByName(name);
       res.json(data);
       return;
@@ -21360,6 +21366,7 @@ function useOrgController() {
       return;
     }
     try {
+      await requirePlatformStaff(req);
       const data = await _getByEmail(email);
       if (!data) {
         next(new import_node_server_utils54.NotFoundError("Organization not found."));
@@ -21387,6 +21394,10 @@ function useOrgController() {
     }
     const email = req.params.email;
     try {
+      const self = await _getUserById(callerId(req)).catch(() => null);
+      if (!self?.email || self.email.toLowerCase() !== email.toLowerCase()) {
+        await requirePlatformStaff(req);
+      }
       const data = await _getOrgsByEmail(email);
       res.json(data);
       return;