@7365admin1/core 3.48.1-staging.188 → 3.48.1-staging.189

package/.changeset/invoice-subscription-owner-scope.md

@@ -0,0 +1,23 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope a subscription's invoices to the subscription's owner.
+
+`GET /api/invoices/subscription/:id` carried `requireAuth` and nothing more, and
+`invoice.controller.ts` held no authorization identifier of any kind: the
+subscription id came off the URL and went straight into the query. Being signed
+in anywhere on the platform was therefore enough to page through another
+organisation's billing history — invoice numbers, amounts, line-item
+descriptions, due dates and payment status.
+
+A new module-named `requireInvoiceReach` takes the verdict off the STORED
+subscription, never from anything the caller supplied. A subscription is owned
+by an organisation OR by a single user, so both are checked: `siteReachOf`'s
+`canReach` answers the organisation half, and the personal half is the caller
+being that user. A subscription that names neither is refused. "Not yours",
+"does not exist" and "not a valid id" all answer 404 identically, so
+subscription ids cannot be enumerated.
+
+Read access to invoice records only — no card handling, no payment gateway and
+no money movement is touched.

package/dist/index.js

@@ -31022,6 +31022,15 @@ var import_node_server_utils82 = require("@7365admin1/node-server-utils");
 var import_joi39 = __toESM(require("joi"));
 function useInvoiceController() {
   const { getBySubscriptionId: _getBySubscriptionId } = useInvoiceRepo();
+  const { getById: _getSubscriptionById } = useSubscriptionRepo();
+  async function requireInvoiceReach(req, id) {
+    const subscription = await _getSubscriptionById(id).catch(() => null);
+    const { actor, canReach } = await siteReachOf(req);
+    const owned = await canReach(subscription) || Boolean(actor.id) && Boolean(subscription?.user) && subscription?.user?.toString() === actor.id;
+    if (!owned) {
+      throw new import_node_server_utils82.NotFoundError("Subscription not found.");
+    }
+  }
   async function getBySubscriptionId(req, res, next) {
     const validation = import_joi39.default.object({
       id: import_joi39.default.string().required(),
@@ -31044,6 +31053,7 @@ function useInvoiceController() {
     const page = parseInt(req.query.page ?? "1");
     const limit = parseInt(req.query.limit ?? "10");
     try {
+      await requireInvoiceReach(req, id);
       const data = await _getBySubscriptionId({
         id,
         search,