@7365admin1/core 3.48.1-staging.177 → 3.48.1-staging.179

package/.changeset/facility-booking-site-scope.md

@@ -0,0 +1,10 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the facility booking routes to the estate. `/api/facility-bookings` carried
+`requireAuth` and nothing else on all five routes: any signed-in account could book
+a facility at another estate, list another client's bookings, and read, rewrite or
+cancel any booking by id alone — including moving a booking to a different estate.
+Reach is now checked on the site named in the request, and on the stored row where
+the request names only an id.

package/.changeset/max-seats-zero-unlimited.md

@@ -0,0 +1,11 @@
+---
+"@7365admin1/core": patch
+---
+
+Treat a maximum seat count of 0 as unlimited when an organisation sends an
+invitation. `createOrganizationInvite` read the subscription's `maxSeats` through
+`?? 0` and then refused on any falsy value, so an organisation configured with 0
+seats — which the plan dialog offers and the console labels UNLIMITED — had every
+invitation rejected with "No seats configured for organization." 0 now admits
+invitations without a cap, a real limit is still enforced at the limit, and only a
+genuinely absent or non-numeric value is still treated as a misconfiguration.

package/dist/index.js

@@ -55697,6 +55697,14 @@ function useSiteFacilityBookingController() {
     getSiteFacilityBookingById: _getSiteFacilityBookingById,
     deleteSiteFacilityBookingById: _deleteSiteFacilityBookingById
   } = useSiteFacilityBookingRepo();
+  async function loadReachable(req, id) {
+    const booking = await _getSiteFacilityBookingById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(booking)) {
+      throw new import_node_server_utils168.NotFoundError("Site facility booking not found.");
+    }
+    return booking;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaSiteFacilityBooking.validate(req.body, {
@@ -55708,6 +55716,7 @@ function useSiteFacilityBookingController() {
         next(new import_node_server_utils168.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -55741,6 +55750,7 @@ function useSiteFacilityBookingController() {
       const sortObj = {
         [sort]: order === "asc" /* ASC */ ? 1 : -1
       };
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -55768,7 +55778,7 @@ function useSiteFacilityBookingController() {
         next(new import_node_server_utils168.BadRequestError(error.message));
         return;
       }
-      const data = await _getSiteFacilityBookingById(value._id);
+      const data = await loadReachable(req, value._id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -55792,6 +55802,9 @@ function useSiteFacilityBookingController() {
     }
     const { _id, ...rest } = value;
     try {
+      await loadReachable(req, _id);
+      if (rest.site)
+        await requireSiteReach(req, rest.site);
       const result = await _updateSiteFacilityBookingById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -55814,6 +55827,7 @@ function useSiteFacilityBookingController() {
     }
     const { _id } = value;
     try {
+      await loadReachable(req, _id);
       await _deleteSiteFacilityBookingById(_id);
       res.status(200).json({ message: "Successfully deleted site facility booking." });
       return;
@@ -80429,12 +80443,12 @@ function useVerificationServiceV2() {
       _countMemberByOrg(orgId),
       _countPendingOrgInvites(orgId)
     ]);
-    const maxSeats = subscription?.maxSeats ?? 0;
-    if (!maxSeats) {
+    const maxSeats = subscription?.maxSeats;
+    if (typeof maxSeats !== "number" || !Number.isFinite(maxSeats)) {
       throw new import_node_server_utils260.BadRequestError("No seats configured for organization.");
     }
     const usedSeats = memberCount + pendingInviteCount;
-    if (usedSeats >= maxSeats) {
+    if (maxSeats > 0 && usedSeats >= maxSeats) {
       throw new import_node_server_utils260.BadRequestError("No available seats for new invitation.");
     }
     return createUserInvite({ email, metadata });