@7365admin1/core 3.48.1-staging.170 → 3.48.1-staging.171

package/.changeset/site-soa-scope.md

@@ -0,0 +1,30 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the statement of account routes to the estate and the unit, and take the requester and approver from the session
+
+Eight of the nine routes on `/api/site-soa` carried `requireAuth` and nothing
+more, and `site-soa.controller.ts` held no authorization identifier of any kind.
+A statement of account is one unit's ledger for a period, so any signed-in
+account on the platform could read another estate's statements, restate one,
+approve or reject it, move it to another estate, or delete it.
+
+`GET /user` is named for the signed-in resident but took `site` and `unitId`
+from the query and identified the caller not at all, so a resident could read a
+neighbour's statement of account by changing one id in a URL. It now requires
+`unitId` and checks it against a live `people` row joining the caller to that
+unit, via `requireOwnUnit`.
+
+`add` set `createdBy`, and `reviewSOA` set `approvedBy._id`, by parsing the raw
+`user` cookie off the request, so a statement could be requested under another
+resident's name and approved under another person's. Both now come from
+`callerId(req)`.
+
+Adds `requireStatementReach` plus an uncached `getRawStatementOfAccountById`.
+`PUT /id/:id` checks both ends, because `schemaUpdateStatementOfAccount` accepts
+`site` and `updateById` writes it.
+
+`GET /generate-pdf` is deliberately unchanged: it is the platform's PDF service,
+called from every web app by `@7365admin1/layer-common`'s `usePDFDownload`, and
+it is authorized by forwarding the caller's own session to the headless browser.

package/dist/index.d.ts

@@ -7204,6 +7204,7 @@ declare function useStatementOfAccountRepo(): {
         dateTo?: string | undefined;
     }, session?: ClientSession) => Promise<{}>;
     getById: (_id: string | ObjectId) => Promise<TStatementOfAccount | null>;
+    getRawStatementOfAccountById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateById: (_id: string | ObjectId, value: Partial<TStatementOfAccount>, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     deleteById: (_id: string | ObjectId) => Promise<number>;
     updateStatusById: (_id: string | ObjectId, value: Pick<TStatementOfAccount, "status">, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
@@ -7227,6 +7228,43 @@ declare function useStatementOfAccountRepo(): {
     createIndexes: () => Promise<string>;
 };
 
+/**
+ * Who may see, or change, a statement of account.
+ *
+ * A statement of account is one unit's ledger for a period - every charge and
+ * every payment on a household's account, requested by the resident and
+ * approved by the estate. It is money, and on the resident side it is somebody
+ * else's household finances.
+ *
+ * Eight of the nine routes on `/api/site-soa` carried `requireAuth` and nothing
+ * more, and this controller held no authorization identifier of any kind, so
+ * being signed in ANYWHERE on the platform was enough to read another estate's
+ * statements, restate one, approve or reject it, move it to another estate, or
+ * delete it.
+ *
+ * Three distinct problems, and they need three different answers.
+ *
+ * 1. THE ESTATE SIDE. `POST /` and `GET /` name a site, so the guard checks the
+ *    site the request already names. The four record routes name only a record,
+ *    so the site is read off the STORED row via `requireStatementReach`, and a
+ *    `site` in the caller's own body cannot stand in for it. `PUT /id/:id` CAN
+ *    move a statement - `schemaUpdateStatementOfAccount` accepts `site` and
+ *    `updateById` writes it - so both ends are checked.
+ *
+ * 2. THE RESIDENT SIDE. `GET /user` is named for the signed-in resident but
+ *    took `site` and `unitId` from the QUERY and identified the caller not at
+ *    all, so it was never "my statements": it was any unit's, at any estate.
+ *    `requireOwnUnit` asks the question the data already answers - is there a
+ *    live `people` row joining this caller to this unit at this site?
+ *
+ * 3. IDENTITY FROM THE REQUEST. `add` set `createdBy` and `reviewSOA` set
+ *    `approvedBy._id` by parsing the raw `user` COOKIE off the request, so a
+ *    statement could be requested under another resident's name and, worse,
+ *    APPROVED under another person's. Both now come from `callerId(req)`.
+ *
+ * `GET /generate-pdf` is deliberately NOT scoped here - see the note on the
+ * handler.
+ */
 declare function useStatementOfAccountController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -67762,11 +67762,20 @@ function useStatementOfAccountRepo() {
       throw error;
     }
   }
+  async function getRawStatementOfAccountById(_id) {
+    try {
+      _id = new import_mongodb127.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils200.BadRequestError("Invalid statement of account ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   return {
     createTextIndex,
     add,
     getAll,
     getById,
+    getRawStatementOfAccountById,
     updateById,
     deleteById,
     updateStatusById,
@@ -67947,19 +67956,20 @@ function useStatementOfAccountController() {
     updateById: _updateById,
     deleteById: _deleteById,
     updateStatusById: _updateStatusById,
-    getResidentUserSoa: _getResidentUserSoa
+    getResidentUserSoa: _getResidentUserSoa,
+    getRawStatementOfAccountById: _getRawStatementOfAccountById
   } = useStatementOfAccountRepo();
   const {
     add: _add,
     generatePDF: _generatePDF,
     reviewSOA: _reviewSOA
   } = useStatementOfAccountService();
+  async function requireStatementReach(req, _id) {
+    const row = await _getRawStatementOfAccountById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    req.body.createdBy = cookies?.["user"] ? cookies["user"].toString() : req.body.createdBy;
+    req.body.createdBy = callerId(req);
     const data = { ...req.body };
     const validation = import_joi104.default.object({
       dateFrom: import_joi104.default.string().required(),
@@ -67982,6 +67992,7 @@ function useStatementOfAccountController() {
       throw new import_node_server_utils202.BadRequestError(queryError.message);
     }
     try {
+      await requireSiteReach(req, bodyValue.site);
       const soa = await _add(bodyValue, queryValue.dateFrom, queryValue.dateTo);
       res.status(201).json({
         message: "SOA added successfully.",
@@ -68030,6 +68041,7 @@ function useStatementOfAccountController() {
       }
     });
     try {
+      await requireSiteReach(req, req.query.site);
       const data = await _getAll({
         search,
         page,
@@ -68059,6 +68071,7 @@ function useStatementOfAccountController() {
       return;
     }
     try {
+      await requireStatementReach(req, id);
       const soa = await _getById(id);
       res.json({
         message: "Successfully retrieved soa.",
@@ -68082,6 +68095,9 @@ function useStatementOfAccountController() {
       return;
     }
     try {
+      await requireStatementReach(req, _id);
+      if (req.body?.site)
+        await requireSiteReach(req, req.body.site);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -68101,6 +68117,7 @@ function useStatementOfAccountController() {
       return;
     }
     try {
+      await requireStatementReach(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted site SOA." });
       return;
@@ -68192,6 +68209,7 @@ function useStatementOfAccountController() {
     try {
       const _id = req.params.id;
       const status = req.params.status;
+      await requireStatementReach(req, _id);
       const result = await _updateStatusById(_id, { status });
       res.status(200).json({ message: result });
       return;
@@ -68233,6 +68251,7 @@ function useStatementOfAccountController() {
     const unitId = req.query.unitId;
     const category = req.query.category ?? "";
     try {
+      await requireOwnUnit(req, site, unitId);
       const data = await _getResidentUserSoa({
         search,
         page,
@@ -68253,15 +68272,10 @@ function useStatementOfAccountController() {
     }
   }
   async function reviewSOA(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
     req.body.approvedBy = {
-      _id: "",
+      _id: callerId(req),
       name: ""
     };
-    req.body.approvedBy._id = cookies?.["user"] ? cookies["user"].toString() : req.body.approvedBy._id;
     const _id = req.params.id;
     const payload = { _id, ...req.body };
     const schema2 = import_joi104.default.object({
@@ -68277,6 +68291,7 @@ function useStatementOfAccountController() {
       return;
     }
     try {
+      await requireStatementReach(req, _id);
       const result = await _reviewSOA(_id, req.body);
       res.status(200).json({ message: result });
       return;