@7365admin1/core 3.48.1-staging.174 → 3.48.1-staging.176

package/.changeset/site-billing-configuration-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the site billing configuration routes to the estate, and take createdBy from the session

package/.changeset/site-billing-item-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the site billing item routes to the estate, and check the unit list against the item's own site

package/dist/index.d.ts

@@ -6171,6 +6171,30 @@ declare function useSiteBillingItemRepo(): {
     createIndexes: () => Promise<string>;
 };
 
+/**
+ * A billing item is a charge the estate raises on its residents — the name, the
+ * amount, the tax that rides on it, how often it repeats, and which units it is
+ * attached to.
+ *
+ * All five handlers carried `requireAuth` and nothing else, and the controller
+ * held no authorization identifier of any kind. The record id came from the URL
+ * and the site came from the caller's own query or body, so any signed-in
+ * account on the platform could list another client's charges, add a charge to
+ * their estate, change what a charge costs, MOVE a charge onto a different
+ * estate (`site` is writable on the update schema), or delete it.
+ *
+ * The rule is the existing one — `requireSiteReach`, i.e. `entitleSite` — asked
+ * about the site the request names on the way in, and about the STORED site for
+ * the id routes, which name no site at all. `PUT` asks twice, once about where
+ * the record is and once about where the body wants to move it, because a MOVE
+ * needs its destination checked too. This is the same shape as
+ * `site-billing-configuration.controller.ts`, not a second mechanism.
+ *
+ * The unit list is checked separately, in the service — see
+ * `site-billing-item.service.ts`. Reaching a site is not the same question as
+ * "do these units belong to it", and the service is where the unit ids are
+ * actually consumed.
+ */
 declare function useSiteBillingItemController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -6253,6 +6277,23 @@ declare function useSiteBillingConfigurationRepo(): {
     createIndexes: () => Promise<string>;
 };
 
+/**
+ * Billing configuration is per-estate — the tax rate, the rounding and the
+ * payment settings every bill at that site is calculated from.
+ *
+ * Every one of these five handlers carried `requireAuth` and nothing else. The
+ * record id came from the URL and the site came from the caller's own query or
+ * body, so any signed-in account on the platform could read another client's
+ * billing settings, change their tax rate, move a configuration to a different
+ * estate, or delete it. `createdBy` was read off the raw `user` COOKIE with a
+ * fall back to the body, so the "who set this up" name was client-supplied.
+ *
+ * The rule is the existing one — `requireSiteReach`, i.e. `entitleSite` — asked
+ * about the site the request names on the way in, and about the STORED site for
+ * the id routes, which name no site at all. `PUT` asks twice: once about where
+ * the record is and once about where the body wants to move it, because a MOVE
+ * needs the destination checked too. `createdBy` now comes from the session.
+ */
 declare function useSiteBillingConfigurationController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -58520,6 +58520,12 @@ function useSiteBillingItemService() {
   } = useSiteBillingItemRepo();
   const { updateById: _updateBuildingUnitById, getById: _getById } = useBuildingUnitRepo();
   const { getAll } = useSiteBillingConfigurationRepo();
+  function assertUnitAtSite(buildingUnit, site) {
+    const siteId = site?.toString?.() ?? "";
+    if (!siteId || (buildingUnit?.site?.toString() ?? "") !== siteId) {
+      throw new import_node_server_utils179.UnauthorizedError("Not authorized.");
+    }
+  }
   async function add(value) {
     const session = import_node_server_utils179.useAtlas.getClient()?.startSession();
     if (!session) {
@@ -58550,6 +58556,7 @@ function useSiteBillingItemService() {
         const promises = value.units.map(async (unit) => {
           const unitId = unit?._id?.toString() || "";
           const buildingUnit = await _getById(unitId);
+          assertUnitAtSite(buildingUnit, value.site);
           const normalizedExistingBilling = (buildingUnit.billing || []).map(
             (bill) => ({
               _id: bill._id?.toString(),
@@ -58646,6 +58653,7 @@ function useSiteBillingItemService() {
                 unit._id?.toString() || "",
                 session
               );
+              assertUnitAtSite(buildingUnit, value.site ?? billing_item?.site);
               const normalizedBilling = (buildingUnit.billing || []).map(
                 (bill) => ({
                   _id: bill._id?.toString() || "",
@@ -58686,7 +58694,7 @@ function useSiteBillingItemService() {
         message: error.message
       });
       await session.abortTransaction();
-      if (error instanceof import_node_server_utils179.BadRequestError) {
+      if (error instanceof import_node_server_utils179.BadRequestError || error instanceof import_node_server_utils179.UnauthorizedError) {
         throw error;
       }
       throw new import_node_server_utils179.BadRequestError("Failed to update Site Billing Item.");
@@ -58717,6 +58725,7 @@ function useSiteBillingItemController() {
       return;
     }
     try {
+      await requireSiteReach(req, value.site);
       const question = await _add(value);
       res.status(201).json({
         message: "Site Billing Item added successfully.",
@@ -58761,6 +58770,7 @@ function useSiteBillingItemController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -58789,6 +58799,7 @@ function useSiteBillingItemController() {
     }
     try {
       const building = await _getById(id);
+      await requireSiteReach(req, building?.site);
       res.json({
         message: "Successfully retrieved site billing item.",
         data: { building }
@@ -58811,6 +58822,10 @@ function useSiteBillingItemController() {
       return;
     }
     try {
+      const current = await _getById(_id);
+      await requireSiteReach(req, current?.site);
+      if (req.body?.site)
+        await requireSiteReach(req, req.body.site);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -58830,6 +58845,8 @@ function useSiteBillingItemController() {
       return;
     }
     try {
+      const current = await _getById(_id);
+      await requireSiteReach(req, current?.site);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted site billing item." });
       return;
@@ -58897,11 +58914,6 @@ function useSiteBillingConfigurationController() {
   } = useSiteBillingConfigurationRepo();
   const { add: _add } = useSiteBillingConfigurationService();
   async function add(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value2]) => ({ ...acc, [key]: value2 }),
-      {}
-    );
-    req.body.createdBy = cookies?.["user"] ? cookies["user"].toString() : req.body.createdBy;
     const data = { ...req.body };
     const { error, value } = schemaBillingConfiguration.validate(data);
     if (error) {
@@ -58909,7 +58921,8 @@ function useSiteBillingConfigurationController() {
       return;
     }
     try {
-      const question = await _add(value);
+      await requireSiteReach(req, value.site);
+      const question = await _add({ ...value, createdBy: callerId(req) });
       res.status(201).json({
         message: "Site Billing Configuration added successfully.",
         data: question
@@ -58953,6 +58966,7 @@ function useSiteBillingConfigurationController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -58981,6 +58995,7 @@ function useSiteBillingConfigurationController() {
     }
     try {
       const building = await _getById(id);
+      await requireSiteReach(req, building?.site);
       res.json({
         message: "Successfully retrieved site billing configuration.",
         data: { building }
@@ -59003,6 +59018,10 @@ function useSiteBillingConfigurationController() {
       return;
     }
     try {
+      const current = await _getById(_id);
+      await requireSiteReach(req, current?.site);
+      if (req.body?.site)
+        await requireSiteReach(req, req.body.site);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -59022,6 +59041,8 @@ function useSiteBillingConfigurationController() {
       return;
     }
     try {
+      const current = await _getById(_id);
+      await requireSiteReach(req, current?.site);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted site billing configuration." });
       return;