@7365admin1/core 3.48.1-staging.189 → 3.48.1-staging.191

package/.changeset/manpower-designation-site-scope.md

@@ -0,0 +1,11 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the manpower designation routes to the estate, and stamp who filed the plan
+from the session. `/api/manpower-designations` carried `requireAuth` and nothing
+else on all three routes: any signed-in account could file a manning plan into
+another estate, read any estate's guard-strength plan, or rewrite one by id alone.
+`createdBy` and `createdByName` were taken from the request body, so the plan could
+be attributed to anybody. Reach is now checked on the site named in the request and
+on the stored row for the update, and the two identity fields come from the session.

package/.changeset/site-facility-site-scope.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the site facility routes to the estate. `/api/site-facilities` carried
+`requireAuth` and nothing else on all six routes: any signed-in account could add a
+facility to another estate, list another client's facilities — or, by omitting the
+optional `site` filter, every estate's facilities at once — and read, rewrite or
+archive any facility by id alone, including its opening hours, booking fees, deposit
+and policies. Reach is now checked on the site named in the request, and on the
+stored row where the request names only an id; the unfiltered cross-estate list is
+left to platform staff.

package/dist/index.d.ts

@@ -8807,6 +8807,7 @@ declare class MManpowerDesignations implements Partial<TManpowerDesignations> {
 declare function useManpowerDesignationRepo(): {
     createManpowerDesignations: (value: TManpowerDesignations) => Promise<mongodb.InsertOneResult<bson.Document>>;
     getManpowerDesignationsBySiteId: (_id: string | ObjectId, serviceProviderId?: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
+    getManpowerDesignationsById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateManpowerDesignations: (_id: string | ObjectId, value: TManpowerDesignationsUpdate) => Promise<number>;
     createIndexes: () => Promise<string>;
 };

package/dist/index.js

@@ -54721,6 +54721,14 @@ function useSiteFacilityController() {
     getSiteFacilityById: _getSiteFacilityById,
     deleteSiteFacilityById: _deleteSiteFacilityById
   } = useSiteFacilityRepo();
+  async function requireFacilityReach(req, id) {
+    const facility = await _getSiteFacilityById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(facility)) {
+      throw new import_node_server_utils162.NotFoundError("Site facility not found.");
+    }
+    return facility;
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaSiteFacility.validate(payload, {
@@ -54733,6 +54741,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json(data);
       return;
@@ -54779,6 +54788,13 @@ function useSiteFacilityController() {
       }
     });
     try {
+      if (site) {
+        await requireSiteReach(req, site);
+      } else {
+        const { actor } = await siteReachOf(req);
+        if (!actor.isSuperAdmin)
+          throw new import_node_server_utils162.UnauthorizedError("Not authorized.");
+      }
       const data = await _getAll({
         search,
         page,
@@ -54805,7 +54821,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
-      const data = await _getSiteFacilityById(_id);
+      const data = await requireFacilityReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -54827,6 +54843,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireFacilityReach(req, _id);
       const result = await _updateSiteFacilityById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -54846,6 +54863,7 @@ function useSiteFacilityController() {
       return;
     }
     try {
+      await requireFacilityReach(req, _id);
       await _deleteSiteFacilityById(_id);
       res.status(200).json({ message: "Successfully deleted site facility." });
       return;
@@ -54872,6 +54890,7 @@ function useSiteFacilityController() {
       return next(new import_node_server_utils162.BadRequestError(error.message));
     }
     try {
+      await requireSiteReach(req, value.site);
       const data = await _getSiteFacilityTimeSlotById(
         payload._id,
         value.date,
@@ -76974,6 +76993,14 @@ function useManpowerDesignationRepo() {
       throw error;
     }
   }
+  async function getManpowerDesignationsById(_id) {
+    try {
+      _id = new import_mongodb151.ObjectId(_id);
+    } catch (error) {
+      return null;
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateManpowerDesignations(_id, value) {
     try {
       _id = new import_mongodb151.ObjectId(_id);
@@ -76997,6 +77024,7 @@ function useManpowerDesignationRepo() {
   return {
     createManpowerDesignations,
     getManpowerDesignationsBySiteId,
+    getManpowerDesignationsById,
     updateManpowerDesignations,
     createIndexes
   };
@@ -77009,8 +77037,17 @@ function useManpowerDesignationCtrl() {
   const {
     createManpowerDesignations: _createManpowerDesignations,
     getManpowerDesignationsBySiteId: _getManpowerDesignationsBySiteId,
+    getManpowerDesignationsById: _getManpowerDesignationsById,
     updateManpowerDesignations: _updateManpowerDesignations
   } = useManpowerDesignationRepo();
+  async function requireDesignationReach(req, _id) {
+    const row = await _getManpowerDesignationsById(_id);
+    const { canReach } = await siteReachOf(req);
+    if (!row || !await canReach({ site: row.siteId })) {
+      throw new import_node_server_utils241.NotFoundError("Manpower designations not found.");
+    }
+    return row;
+  }
   async function createManpowerDesignations(req, res, next) {
     try {
       const payload = { ...req.body };
@@ -77019,6 +77056,12 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils241.BadRequestError(error.message));
         return;
       }
+      const { actor, canReach } = await siteReachOf(req);
+      if (!await canReach({ site: payload.siteId })) {
+        throw new import_node_server_utils241.NotFoundError("Site not found.");
+      }
+      payload.createdBy = actor.id;
+      payload.createdByName = actor.name;
       const result = await _createManpowerDesignations(payload);
       return res.json(result);
     } catch (error) {
@@ -77039,6 +77082,7 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils241.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, id);
       const result = await _getManpowerDesignationsBySiteId(
         id,
         serviceProviderId
@@ -77063,6 +77107,7 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils241.BadRequestError(error.message));
         return;
       }
+      await requireDesignationReach(req, _id);
       const result = await _updateManpowerDesignations(_id, payload);
       return res.json(result);
     } catch (error) {