@7365admin1/core 3.48.1-staging.188 → 3.48.1-staging.190

package/.changeset/invoice-subscription-owner-scope.md

@@ -0,0 +1,23 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope a subscription's invoices to the subscription's owner.
+
+`GET /api/invoices/subscription/:id` carried `requireAuth` and nothing more, and
+`invoice.controller.ts` held no authorization identifier of any kind: the
+subscription id came off the URL and went straight into the query. Being signed
+in anywhere on the platform was therefore enough to page through another
+organisation's billing history — invoice numbers, amounts, line-item
+descriptions, due dates and payment status.
+
+A new module-named `requireInvoiceReach` takes the verdict off the STORED
+subscription, never from anything the caller supplied. A subscription is owned
+by an organisation OR by a single user, so both are checked: `siteReachOf`'s
+`canReach` answers the organisation half, and the personal half is the caller
+being that user. A subscription that names neither is refused. "Not yours",
+"does not exist" and "not a valid id" all answer 404 identically, so
+subscription ids cannot be enumerated.
+
+Read access to invoice records only — no card handling, no payment gateway and
+no money movement is touched.

package/.changeset/site-facility-site-scope.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the site facility routes to the estate. `/api/site-facilities` carried
+`requireAuth` and nothing else on all six routes: any signed-in account could add a
+facility to another estate, list another client's facilities — or, by omitting the
+optional `site` filter, every estate's facilities at once — and read, rewrite or
+archive any facility by id alone, including its opening hours, booking fees, deposit
+and policies. Reach is now checked on the site named in the request, and on the
+stored row where the request names only an id; the unfiltered cross-estate list is
+left to platform staff.

package/dist/index.js

@@ -31022,6 +31022,15 @@ var import_node_server_utils82 = require("@7365admin1/node-server-utils");
 var import_joi39 = __toESM(require("joi"));
 function useInvoiceController() {
   const { getBySubscriptionId: _getBySubscriptionId } = useInvoiceRepo();
+  const { getById: _getSubscriptionById } = useSubscriptionRepo();
+  async function requireInvoiceReach(req, id) {
+    const subscription = await _getSubscriptionById(id).catch(() => null);
+    const { actor, canReach } = await siteReachOf(req);
+    const owned = await canReach(subscription) || Boolean(actor.id) && Boolean(subscription?.user) && subscription?.user?.toString() === actor.id;
+    if (!owned) {
+      throw new import_node_server_utils82.NotFoundError("Subscription not found.");
+    }
+  }
   async function getBySubscriptionId(req, res, next) {
     const validation = import_joi39.default.object({
       id: import_joi39.default.string().required(),
@@ -31044,6 +31053,7 @@ function useInvoiceController() {
     const page = parseInt(req.query.page ?? "1");
     const limit = parseInt(req.query.limit ?? "10");
     try {
+      await requireInvoiceReach(req, id);
       const data = await _getBySubscriptionId({
         id,
         search,
@@ -54711,6 +54721,14 @@ function useSiteFacilityController() {
     getSiteFacilityById: _getSiteFacilityById,
     deleteSiteFacilityById: _deleteSiteFacilityById
   } = useSiteFacilityRepo();
+  async function requireFacilityReach(req, id) {
+    const facility = await _getSiteFacilityById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(facility)) {
+      throw new import_node_server_utils162.NotFoundError("Site facility not found.");
+    }
+    return facility;
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaSiteFacility.validate(payload, {
@@ -54723,6 +54741,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json(data);
       return;
@@ -54769,6 +54788,13 @@ function useSiteFacilityController() {
       }
     });
     try {
+      if (site) {
+        await requireSiteReach(req, site);
+      } else {
+        const { actor } = await siteReachOf(req);
+        if (!actor.isSuperAdmin)
+          throw new import_node_server_utils162.UnauthorizedError("Not authorized.");
+      }
       const data = await _getAll({
         search,
         page,
@@ -54795,7 +54821,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
-      const data = await _getSiteFacilityById(_id);
+      const data = await requireFacilityReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -54817,6 +54843,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireFacilityReach(req, _id);
       const result = await _updateSiteFacilityById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -54836,6 +54863,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireFacilityReach(req, _id);
       await _deleteSiteFacilityById(_id);
       res.status(200).json({ message: "Successfully deleted site facility." });
       return;
@@ -54862,6 +54890,7 @@ function useSiteFacilityController() {
       return next(new import_node_server_utils162.BadRequestError(error.message));
     }
     try {
+      await requireSiteReach(req, value.site);
       const data = await _getSiteFacilityTimeSlotById(
         payload._id,
         value.date,