@7365admin1/core 3.48.1-staging.189 → 3.48.1-staging.190

package/.changeset/site-facility-site-scope.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the site facility routes to the estate. `/api/site-facilities` carried
+`requireAuth` and nothing else on all six routes: any signed-in account could add a
+facility to another estate, list another client's facilities — or, by omitting the
+optional `site` filter, every estate's facilities at once — and read, rewrite or
+archive any facility by id alone, including its opening hours, booking fees, deposit
+and policies. Reach is now checked on the site named in the request, and on the
+stored row where the request names only an id; the unfiltered cross-estate list is
+left to platform staff.

package/dist/index.js

@@ -54721,6 +54721,14 @@ function useSiteFacilityController() {
     getSiteFacilityById: _getSiteFacilityById,
     deleteSiteFacilityById: _deleteSiteFacilityById
   } = useSiteFacilityRepo();
+  async function requireFacilityReach(req, id) {
+    const facility = await _getSiteFacilityById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(facility)) {
+      throw new import_node_server_utils162.NotFoundError("Site facility not found.");
+    }
+    return facility;
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaSiteFacility.validate(payload, {
@@ -54733,6 +54741,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json(data);
       return;
@@ -54779,6 +54788,13 @@ function useSiteFacilityController() {
       }
     });
     try {
+      if (site) {
+        await requireSiteReach(req, site);
+      } else {
+        const { actor } = await siteReachOf(req);
+        if (!actor.isSuperAdmin)
+          throw new import_node_server_utils162.UnauthorizedError("Not authorized.");
+      }
       const data = await _getAll({
         search,
         page,
@@ -54805,7 +54821,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
-      const data = await _getSiteFacilityById(_id);
+      const data = await requireFacilityReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -54827,6 +54843,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireFacilityReach(req, _id);
       const result = await _updateSiteFacilityById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -54846,6 +54863,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireFacilityReach(req, _id);
       await _deleteSiteFacilityById(_id);
       res.status(200).json({ message: "Successfully deleted site facility." });
       return;
@@ -54872,6 +54890,7 @@ function useSiteFacilityController() {
       return next(new import_node_server_utils162.BadRequestError(error.message));
     }
     try {
+      await requireSiteReach(req, value.site);
       const data = await _getSiteFacilityTimeSlotById(
         payload._id,
         value.date,