@7365admin1/core 3.48.1-staging.168 → 3.48.1-staging.169

package/.changeset/provider-billing-org-scope.md

@@ -0,0 +1,21 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the service provider billing routes to the organisation
+
+`/api/provider-billings` carried `requireAuth` and nothing more on all five
+handlers, and `service-provider-billing.controller.ts` held no authorization
+identifier of any kind. A service provider billing record is what a contractor
+invoices an organisation for, so any signed-in account on the platform could
+read another organisation's invoices, swap the attachments that evidence one,
+flip its status, add an acknowledgement that was never given, or delete it.
+
+The scope here is the ORGANISATION, not the estate: every row carries `orgId`
+and no `site`, so the rule is `requireOrgAccess` — Seven365 staff, or a live
+member of that organisation — not `requireSiteReach`.
+
+Adds `requireServiceProviderBillingReach`, plus an uncached
+`getRawServiceProviderBillingById` so the check is not decided from a 15-minute
+cache entry (the existing reader is cached and throws `NotFoundError`, which
+would also answer before the guard ran).

package/dist/index.d.ts

@@ -5438,6 +5438,7 @@ declare function useServiceProviderBillingRepo(): {
         pageRange: string;
     } | TServiceProviderBilling>;
     getSiteServiceProviderBillingById: (_id: string | ObjectId, session?: ClientSession) => Promise<mongodb.WithId<bson.Document> | TServiceProviderBilling>;
+    getRawServiceProviderBillingById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateServiceProviderBillingById: (_id: ObjectId | string, value: Partial<TServiceProviderBilling>, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     deleteServiceProviderBillingById: (_id: string | ObjectId) => Promise<number>;
     createIndexes: () => Promise<void>;
@@ -5448,6 +5449,36 @@ declare function useServiceProviderBillingService(): {
     updateServiceProviderBillingById: (id: string | ObjectId, value: Partial<TServiceProviderBilling>) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, a service provider's billing records.
+ *
+ * A service provider billing record is what a contractor invoices an
+ * organisation for - the amount, the period, the attachments that evidence it,
+ * and the people who acknowledged it. It is money.
+ *
+ * All five routes on `/api/provider-billings` carried `requireAuth` and nothing
+ * more, and this controller held no authorization identifier of any kind, so
+ * being signed in ANYWHERE on the platform was enough to read another
+ * organisation's invoices, restate one, replace its evidence, or delete it.
+ *
+ * The scope here is the ORGANISATION, not the estate. Every row carries
+ * `orgId` and no `site` - `getAll` is asked for an `org`, and the repository
+ * builds `{ orgId: org, status }`. So the rule is `requireOrgAccess`, the same
+ * one `/api/customer-sites` and `/api/members` already use: Seven365 staff, or
+ * a live member of that organisation. Using `requireSiteReach` here would be
+ * asking the wrong question of the wrong field.
+ *
+ *  - `POST /` already REQUIRES `orgId` in the body and `GET /` already REQUIRES
+ *    `org` in the query, so the guard checks the organisation the request
+ *    already names and no caller's contract changes.
+ *  - The three record routes name only a record, so the organisation is read
+ *    off the STORED row via `requireServiceProviderBillingReach`, and an
+ *    `orgId` in the caller's own body cannot stand in for it.
+ *
+ * `PUT /id/:id` cannot MOVE a record between organisations:
+ * `schemaUpdateServiceProviderBilling` does not accept `orgId` at all, so there
+ * is no destination to check.
+ */
 declare function useServiceProviderBillingController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -54331,10 +54331,19 @@ function useServiceProviderBillingRepo() {
       throw error;
     }
   }
+  async function getRawServiceProviderBillingById(_id) {
+    try {
+      _id = new import_mongodb98.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils158.BadRequestError("Invalid service provider billing ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   return {
     add,
     getAll,
     getSiteServiceProviderBillingById,
+    getRawServiceProviderBillingById,
     updateServiceProviderBillingById,
     deleteServiceProviderBillingById,
     createIndexes
@@ -54393,8 +54402,13 @@ function useServiceProviderBillingController() {
   const {
     getAll: _getAll,
     getSiteServiceProviderBillingById: _getServiceProviderBillingById,
+    getRawServiceProviderBillingById: _getRawServiceProviderBillingById,
     deleteServiceProviderBillingById: _deleteServiceProviderBillingById
   } = useServiceProviderBillingRepo();
+  async function requireServiceProviderBillingReach(req, _id) {
+    const row = await _getRawServiceProviderBillingById(_id);
+    await requireOrgAccess(req, row?.orgId?.toString());
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaServiceProviderBilling.validate(payload, {
@@ -54407,6 +54421,7 @@ function useServiceProviderBillingController() {
       return;
     }
     try {
+      await requireOrgAccess(req, payload.orgId);
       const data = await _add(payload);
       res.status(201).json(data);
       return;
@@ -54453,6 +54468,7 @@ function useServiceProviderBillingController() {
       }
     });
     try {
+      await requireOrgAccess(req, org);
       const data = await _getAll({
         search,
         page,
@@ -54479,6 +54495,7 @@ function useServiceProviderBillingController() {
       return;
     }
     try {
+      await requireServiceProviderBillingReach(req, _id);
       const data = await _getServiceProviderBillingById(_id);
       res.status(200).json(data);
       return;
@@ -54501,6 +54518,7 @@ function useServiceProviderBillingController() {
       return;
     }
     try {
+      await requireServiceProviderBillingReach(req, _id);
       const result = await _updateServiceProviderBillingById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -54520,6 +54538,7 @@ function useServiceProviderBillingController() {
       return;
     }
     try {
+      await requireServiceProviderBillingReach(req, _id);
       await _deleteServiceProviderBillingById(_id);
       res.status(200).json({ message: "Successfully deleted service provider billing." });
       return;