@7365admin1/core 3.47.1-staging.146 → 3.47.1-staging.147

package/dist/index.d.ts

@@ -5472,6 +5472,7 @@ declare function useDocumentManagementRepo(): {
         pageRange: string;
     } | TDocumentManagement>;
     getDocumentById: (_id: string | ObjectId) => Promise<bson.Document>;
+    getDocumentScope: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateDocumentById: (_id: string | ObjectId, value: TDocumentManagement) => Promise<number>;
     updateFolderById: (_id: string | ObjectId, value: TFolderUpdate) => Promise<number>;
     deleteDocumentById: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;

package/dist/index.js

@@ -55480,12 +55480,25 @@ function useDocumentManagementRepo() {
       throw error;
     }
   }
+  async function getDocumentScope(_id) {
+    let id;
+    try {
+      id = new import_mongodb102.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils164.BadRequestError("Invalid document ID format.");
+    }
+    return await collection.findOne(
+      { _id: id },
+      { projection: { site: 1, org: 1 } }
+    );
+  }
   return {
     createIndex,
     createTextIndex,
     add,
     getAll,
     getDocumentById,
+    getDocumentScope,
     updateDocumentById,
     updateFolderById,
     deleteDocumentById,
@@ -55740,8 +55753,24 @@ function useDocumentManagementController() {
     updateFolderById: _updateFolderById,
     deleteDocumentById: _deleteDocumentById,
     deleteFolderById: _deleteFolderById,
-    getDocumentManagementBySiteId: _getDocumentManagementBySiteId
+    getDocumentManagementBySiteId: _getDocumentManagementBySiteId,
+    getDocumentScope: _getDocumentScope
   } = useDocumentManagementRepo();
+  async function requireDocumentReach(req, _id) {
+    const doc = await _getDocumentScope(_id);
+    const site = doc?.site?.toString() ?? "";
+    if (site) {
+      await requireSiteReach(req, site);
+      return;
+    }
+    const actor = await resolveInviteActor(callerId(req));
+    if (actor.isSuperAdmin)
+      return;
+    const org = doc?.org?.toString() ?? "";
+    if (!org || !actor.orgIds.includes(org)) {
+      throw new import_node_server_utils166.NotFoundError("Document not found.");
+    }
+  }
   async function add(req, res, next) {
     const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
       (acc, [key, value]) => ({ ...acc, [key]: value }),
@@ -55834,6 +55863,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       const data = await _getDocumentById(_id);
       res.json(data);
       return;
@@ -55875,6 +55905,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _updateDocumentById(_id, payload);
       res.json({ message: "Successfully updated document." });
       return;
@@ -55907,6 +55938,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _updateFolderById(_id, payload);
       res.json({ message: "Successfully updated folder." });
       return;
@@ -55926,6 +55958,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _deleteDocumentById(_id);
       res.json({ message: "Successfully deleted document." });
       return;
@@ -55945,6 +55978,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _deleteFolderById(_id);
       res.json({ message: "Successfully deleted folder." });
       return;
@@ -55965,6 +55999,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireSiteReach(req, _id);
       const data = await _getDocumentManagementBySiteId(_id, type);
       res.json(data);
       return;