@7365admin1/core 3.48.1-staging.185 → 3.48.1-staging.186

package/.changeset/bulletin-board-site-scope.md

@@ -0,0 +1,19 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the bulletin-board routes to the caller's own estate.
+
+All five `/api/bulletin-boards` routes carried `requireAuth` and nothing more,
+and the controller held no authorization identifier of any kind, so any
+signed-in account in any organisation could publish an announcement into another
+client's estate — which also fans out as a notification to every recipient group
+at that site — read that board, and read, rewrite or delete any single bulletin
+reached by id alone.
+
+`add` and `getAll` now authorise the site named in the request with
+`requireSiteReach`; `site` is optional on the add schema, so the org-wide case is
+asked about separately rather than an absent site leaving the write unscoped. The
+three by-id handlers take the verdict off the STORED row with a new module-named
+`requireBulletinReach`, which answers "not yours" and "does not exist"
+identically so bulletin ids cannot be enumerated.

package/dist/index.js

@@ -57728,6 +57728,15 @@ function useBulletinBoardController() {
     deleteBulletinBoardById: _deleteBulletinBoardById
   } = useBulletinBoardService();
   const { getAll: _getAll, getBulletinBoardById: _getBulletinBoardById } = useBulletinBoardRepo();
+  const scopeOf = (row) => ({ site: row?.site, org: row?.orgId });
+  async function requireBulletinReach(req, id) {
+    const bulletin = await _getBulletinBoardById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(scopeOf(bulletin))) {
+      throw new import_node_server_utils174.NotFoundError("Bulletin board not found.");
+    }
+    return bulletin;
+  }
   async function add(req, res, next) {
     const { error, value } = schemaBulletinBoard.validate(req.body, {
       abortEarly: false
@@ -57739,6 +57748,14 @@ function useBulletinBoardController() {
       return;
     }
     try {
+      if (value.site) {
+        await requireSiteReach(req, value.site);
+      } else {
+        const { canReach } = await siteReachOf(req);
+        if (!await canReach(scopeOf(value))) {
+          throw new import_node_server_utils174.UnauthorizedError("Not authorized.");
+        }
+      }
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -57811,6 +57828,7 @@ function useBulletinBoardController() {
       [sort ? sort : "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
     };
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -57841,7 +57859,7 @@ function useBulletinBoardController() {
         return;
       }
       const { _id } = value;
-      const data = await _getBulletinBoardById(_id);
+      const data = await requireBulletinReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -57863,6 +57881,7 @@ function useBulletinBoardController() {
       return;
     }
     try {
+      await requireBulletinReach(req, _id);
       const result = await _updateBulletinBoardById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -57884,6 +57903,7 @@ function useBulletinBoardController() {
     }
     const { _id } = value;
     try {
+      await requireBulletinReach(req, _id);
       await _deleteBulletinBoardById(_id);
       res.status(200).json({ message: "Successfully deleted bulletin board." });
       return;