@7365admin1/core 3.48.1-staging.183 → 3.48.1-staging.185

package/.changeset/event-management-site-scope.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the event-management routes to the caller's own estate.
+
+All five `/api/event-management` routes carried `requireAuth` and nothing more,
+and the controller held no authorization identifier of any kind, so any
+signed-in account in any organisation could file an event into another client's
+calendar, read that calendar, and read, rewrite or delete any single event
+reached by id alone.
+
+`add` and `getAll` now authorise the site named in the request with
+`requireSiteReach`; the three by-id handlers take the verdict off the STORED row
+with a new module-named `requireEventReach`, which answers "not yours" and "does
+not exist" identically so event ids cannot be enumerated.

package/dist/index.js

@@ -29881,7 +29881,7 @@ function useSubscriptionService() {
       }
       const items = [];
       const dueInvoice = await getByDueDate(
-        subscription.nextBillingDate,
+        new Date(subscription.nextBillingDate),
         "pending"
       );
       if (value.promoCode) {
@@ -30022,7 +30022,13 @@ function useSubscriptionService() {
         {
           _id: value.subscriptionId,
           currentSeats: value.seats,
-          maxSeats: 0,
+          // Keep the organisation's own seat limit. It is worked out above —
+          // the current limit, raised when the new seat count is larger — and
+          // was then thrown away here in favour of a literal 0. Now that 0
+          // means UNLIMITED, writing it handed the organisation an uncapped
+          // subscription on every seat change. A plan that really is unlimited
+          // is already 0 above, so it still passes through untouched.
+          maxSeats,
           paidSeats: paidSeats > value.seats ? paidSeats : value.seats,
           promoCode: value.promoCode ?? "",
           amount: value.seats * Number(newMonthlySubscriptionPrice.toFixed(2))
@@ -59641,6 +59647,14 @@ function useEventManagementController() {
     getEventManagementById: _getEventManagementById,
     deleteEventManagementById: _deleteEventManagementById
   } = useEventManagementRepo();
+  async function requireEventReach(req, id) {
+    const event = await _getEventManagementById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(event)) {
+      throw new import_node_server_utils185.NotFoundError("Event not found.");
+    }
+    return event;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaEventManagement.validate(req.body, {
@@ -59652,6 +59666,7 @@ function useEventManagementController() {
         next(new import_node_server_utils185.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -59685,6 +59700,7 @@ function useEventManagementController() {
         return;
       }
       const { search, page, limit, site, status, type, startDate, endDate, sort, order } = value;
+      await requireSiteReach(req, site);
       const sortObj = {
         [sort ?? "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
       };
@@ -59719,7 +59735,7 @@ function useEventManagementController() {
         return;
       }
       const { _id } = value;
-      const data = await _getEventManagementById(_id);
+      const data = await requireEventReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -59741,6 +59757,7 @@ function useEventManagementController() {
     }
     const { _id, ...rest } = value;
     try {
+      await requireEventReach(req, _id);
       const result = await _updateEventManagementById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -59762,6 +59779,7 @@ function useEventManagementController() {
         return;
       }
       const { _id } = value;
+      await requireEventReach(req, _id);
       await _deleteEventManagementById(_id);
       res.status(200).json({ message: "Successfully deleted event." });
       return;