@7365admin1/core 3.48.1-staging.151 → 3.48.1-staging.152

package/.changeset/service-provider-record-scope.md

@@ -0,0 +1,39 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the service provider record routes to the site the engagement works on.
+
+A `site.service-providers` row is an ENGAGEMENT: a provider organisation attached
+to one client's site. Two routes took its id straight out of the URL with
+`requireAuth` and nothing more, so any signed-in account could use them against
+any client:
+
+- `GET /api/service-providers/:id` returned any client's engagement — provider
+  name, category, contact email and the site it works on.
+- `PATCH /api/service-providers/:id/status` suspended or reactivated it.
+  Suspending an engagement stops that provider's guards and cleaners reaching the
+  estate; reactivating one puts them back.
+
+Both now decide from the **site stored on the row**, through the existing
+`requireSiteReach` rule that `/api/vehicles` and `/api/documents` already use.
+That rule admits both sides of the engagement: the client, and the contracted
+provider whose reach comes from `customer.sites` rather than from a membership in
+the client's organisation.
+
+An engagement the caller cannot reach answers exactly as one that does not exist
+(404), so ids cannot be enumerated from the difference. A row carrying no site at
+all is refused, not waved through. Guards sit after each handler's Joi
+validation, so a malformed id or status still answers 400 exactly as today.
+
+Scope note — deliberately NOT changed here: the four list routes
+(`GET /api/service-providers`, `/name`, `/category`,
+`/org/:serviceProviderOrgId/type/:type`) and `GET /provider/:provider/org/:org`.
+Their `orgId`, `siteId` and `serviceProviderOrgId` are optional filters the
+caller sends, and `layer-common useServiceProvider.ts` defaults every one of them
+to an empty string, so it is not yet established which callers depend on the
+unfiltered list. That is the same open question as the site-less
+`GET /api/vehicles` and needs a product decision rather than a guess.
+
+Nothing changes for a permitted caller: same response shape, same fields, same
+status.

package/dist/index.js

@@ -32562,6 +32562,7 @@ function useServiceProviderController() {
     }
     try {
       const data = await _getServiceProviderById(_id);
+      await requireSiteReach(req, data?.siteId?.toString());
       res.json(data);
       return;
     } catch (error2) {
@@ -32625,6 +32626,8 @@ function useServiceProviderController() {
       return;
     }
     try {
+      const existing = await _getServiceProviderById(value.id);
+      await requireSiteReach(req, existing?.siteId?.toString());
       await _updateStatusById(value.id, value.status);
       res.json({ message: "Service provider status updated successfully." });
       return;