@7365admin1/core 3.48.1-staging.184 → 3.48.1-staging.185

package/.changeset/event-management-site-scope.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the event-management routes to the caller's own estate.
+
+All five `/api/event-management` routes carried `requireAuth` and nothing more,
+and the controller held no authorization identifier of any kind, so any
+signed-in account in any organisation could file an event into another client's
+calendar, read that calendar, and read, rewrite or delete any single event
+reached by id alone.
+
+`add` and `getAll` now authorise the site named in the request with
+`requireSiteReach`; the three by-id handlers take the verdict off the STORED row
+with a new module-named `requireEventReach`, which answers "not yours" and "does
+not exist" identically so event ids cannot be enumerated.

package/dist/index.js

@@ -59647,6 +59647,14 @@ function useEventManagementController() {
     getEventManagementById: _getEventManagementById,
     deleteEventManagementById: _deleteEventManagementById
   } = useEventManagementRepo();
+  async function requireEventReach(req, id) {
+    const event = await _getEventManagementById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(event)) {
+      throw new import_node_server_utils185.NotFoundError("Event not found.");
+    }
+    return event;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaEventManagement.validate(req.body, {
@@ -59658,6 +59666,7 @@ function useEventManagementController() {
         next(new import_node_server_utils185.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -59691,6 +59700,7 @@ function useEventManagementController() {
         return;
       }
       const { search, page, limit, site, status, type, startDate, endDate, sort, order } = value;
+      await requireSiteReach(req, site);
       const sortObj = {
         [sort ?? "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
       };
@@ -59725,7 +59735,7 @@ function useEventManagementController() {
         return;
       }
       const { _id } = value;
-      const data = await _getEventManagementById(_id);
+      const data = await requireEventReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -59747,6 +59757,7 @@ function useEventManagementController() {
     }
     const { _id, ...rest } = value;
     try {
+      await requireEventReach(req, _id);
       const result = await _updateEventManagementById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -59768,6 +59779,7 @@ function useEventManagementController() {
         return;
       }
       const { _id } = value;
+      await requireEventReach(req, _id);
       await _deleteEventManagementById(_id);
       res.status(200).json({ message: "Successfully deleted event." });
       return;