@7365admin1/core 3.48.1-staging.177 → 3.48.1-staging.178

package/.changeset/facility-booking-site-scope.md

@@ -0,0 +1,10 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the facility booking routes to the estate. `/api/facility-bookings` carried
+`requireAuth` and nothing else on all five routes: any signed-in account could book
+a facility at another estate, list another client's bookings, and read, rewrite or
+cancel any booking by id alone — including moving a booking to a different estate.
+Reach is now checked on the site named in the request, and on the stored row where
+the request names only an id.

package/dist/index.js

@@ -55697,6 +55697,14 @@ function useSiteFacilityBookingController() {
     getSiteFacilityBookingById: _getSiteFacilityBookingById,
     deleteSiteFacilityBookingById: _deleteSiteFacilityBookingById
   } = useSiteFacilityBookingRepo();
+  async function loadReachable(req, id) {
+    const booking = await _getSiteFacilityBookingById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(booking)) {
+      throw new import_node_server_utils168.NotFoundError("Site facility booking not found.");
+    }
+    return booking;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaSiteFacilityBooking.validate(req.body, {
@@ -55708,6 +55716,7 @@ function useSiteFacilityBookingController() {
         next(new import_node_server_utils168.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -55741,6 +55750,7 @@ function useSiteFacilityBookingController() {
       const sortObj = {
         [sort]: order === "asc" /* ASC */ ? 1 : -1
       };
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -55768,7 +55778,7 @@ function useSiteFacilityBookingController() {
         next(new import_node_server_utils168.BadRequestError(error.message));
         return;
       }
-      const data = await _getSiteFacilityBookingById(value._id);
+      const data = await loadReachable(req, value._id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -55792,6 +55802,9 @@ function useSiteFacilityBookingController() {
     }
     const { _id, ...rest } = value;
     try {
+      await loadReachable(req, _id);
+      if (rest.site)
+        await requireSiteReach(req, rest.site);
       const result = await _updateSiteFacilityBookingById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -55814,6 +55827,7 @@ function useSiteFacilityBookingController() {
     }
     const { _id } = value;
     try {
+      await loadReachable(req, _id);
       await _deleteSiteFacilityBookingById(_id);
       res.status(200).json({ message: "Successfully deleted site facility booking." });
       return;