@7365admin1/core 3.48.1-staging.190 → 3.48.1-staging.192

package/.changeset/manpower-designation-site-scope.md

@@ -0,0 +1,11 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the manpower designation routes to the estate, and stamp who filed the plan
+from the session. `/api/manpower-designations` carried `requireAuth` and nothing
+else on all three routes: any signed-in account could file a manning plan into
+another estate, read any estate's guard-strength plan, or rewrite one by id alone.
+`createdBy` and `createdByName` were taken from the request body, so the plan could
+be attributed to anybody. Reach is now checked on the site named in the request and
+on the stored row for the update, and the two identity fields come from the session.

package/.changeset/online-form-site-scope.md

@@ -0,0 +1,15 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the online form routes to the estate
+
+All six `/api/online-forms` routes carried `requireAuth` and nothing more, so any
+signed-in account on the platform could read, rewrite, move or archive another
+estate's form templates. The controller now takes its verdict from the session:
+a new `requireOnlineFormReach` for the by-id read, update and delete, a site
+check on the add and on the by-site list, both tenancy filters closed on the
+list query, and the update's destination `site` checked as well as the source.
+`createdBy`/`updatedBy` are stamped from the session instead of the caller's
+`user` cookie, and `getOnlineFormsBySiteId` now actually applies the estate
+filter it was given.

package/dist/index.d.ts

@@ -8807,6 +8807,7 @@ declare class MManpowerDesignations implements Partial<TManpowerDesignations> {
 declare function useManpowerDesignationRepo(): {
     createManpowerDesignations: (value: TManpowerDesignations) => Promise<mongodb.InsertOneResult<bson.Document>>;
     getManpowerDesignationsBySiteId: (_id: string | ObjectId, serviceProviderId?: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
+    getManpowerDesignationsById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateManpowerDesignations: (_id: string | ObjectId, value: TManpowerDesignationsUpdate) => Promise<number>;
     createIndexes: () => Promise<string>;
 };

package/dist/index.js

@@ -73090,8 +73090,9 @@ function useOnlineFormRepo() {
       query2.$or = [{ name: { $regex: search, $options: "i" } }];
       cacheOptions.search = search;
     }
+    query2.site = site;
     cacheOptions.site = site;
-    const cacheKey = (0, import_node_server_utils227.makeCacheKey)(namespace_collection, { site });
+    const cacheKey = (0, import_node_server_utils227.makeCacheKey)(namespace_collection, cacheOptions);
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
       import_node_server_utils227.logger.info(`Cache hit for key: ${cacheKey}`);
@@ -73147,12 +73148,16 @@ function useOnlineFormController() {
     deleteOnlineFormById: _deleteOnlineFormById,
     getOnlineFormsBySiteId: _getOnlineFormsBySiteId
   } = useOnlineFormRepo();
+  async function requireOnlineFormReach(req, id) {
+    const form = await _getOnlineFormById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(form)) {
+      throw new import_node_server_utils228.NotFoundError("Document not found.");
+    }
+    return form;
+  }
   async function add(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const createdBy = cookies?.["user"].toString() ?? "";
+    const createdBy = callerId(req);
     const payload = { ...req.body, createdBy };
     const { error } = schemaOnlineForm.validate(payload, {
       abortEarly: false
@@ -73164,6 +73169,7 @@ function useOnlineFormController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json({ message: data });
       return;
@@ -73197,6 +73203,15 @@ function useOnlineFormController() {
     const org = req.query.org ?? "";
     const site = req.query.site ?? "";
     try {
+      const { actor } = await siteReachOf(req);
+      if (site) {
+        await requireSiteReach(req, site);
+      } else if (!actor.isSuperAdmin) {
+        throw new import_node_server_utils228.UnauthorizedError("Not authorized.");
+      }
+      if (org && !actor.isSuperAdmin && !actor.orgIds.includes(org)) {
+        throw new import_node_server_utils228.UnauthorizedError("Not authorized.");
+      }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
       return;
@@ -73216,7 +73231,7 @@ function useOnlineFormController() {
       return;
     }
     try {
-      const data = await _getOnlineFormById(_id);
+      const data = await requireOnlineFormReach(req, _id);
       res.json(data);
       return;
     } catch (error2) {
@@ -73243,11 +73258,7 @@ function useOnlineFormController() {
       site: import_joi118.default.string().hex().optional().allow("", null),
       updatedBy: import_joi118.default.string().hex().optional().allow("", null)
     });
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const updatedBy = cookies?.["user"].toString() ?? "";
+    const updatedBy = callerId(req);
     const _id = req.params.id;
     const payload = { ...req.body, updatedBy };
     const { error } = validation.validate({ _id, ...payload });
@@ -73257,6 +73268,16 @@ function useOnlineFormController() {
       return;
     }
     try {
+      await requireOnlineFormReach(req, _id);
+      if (payload.site) {
+        await requireSiteReach(req, payload.site);
+      }
+      if (payload.org) {
+        const { actor } = await siteReachOf(req);
+        if (!actor.isSuperAdmin && !actor.orgIds.includes(payload.org)) {
+          throw new import_node_server_utils228.UnauthorizedError("Not authorized.");
+        }
+      }
       await _updateOnlineFormById(_id, payload);
       res.json({ message: "Successfully updated online form." });
       return;
@@ -73276,6 +73297,7 @@ function useOnlineFormController() {
       return;
     }
     try {
+      await requireOnlineFormReach(req, _id);
       await _deleteOnlineFormById(_id);
       res.json({ message: "Successfully deleted online form." });
       return;
@@ -73297,6 +73319,7 @@ function useOnlineFormController() {
       return;
     }
     try {
+      await requireSiteReach(req, _id);
       const data = await _getOnlineFormsBySiteId(_id, { ...query2 });
       res.json(data);
       return;
@@ -76993,6 +77016,14 @@ function useManpowerDesignationRepo() {
       throw error;
     }
   }
+  async function getManpowerDesignationsById(_id) {
+    try {
+      _id = new import_mongodb151.ObjectId(_id);
+    } catch (error) {
+      return null;
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateManpowerDesignations(_id, value) {
     try {
       _id = new import_mongodb151.ObjectId(_id);
@@ -77016,6 +77047,7 @@ function useManpowerDesignationRepo() {
   return {
     createManpowerDesignations,
     getManpowerDesignationsBySiteId,
+    getManpowerDesignationsById,
     updateManpowerDesignations,
     createIndexes
   };
@@ -77028,8 +77060,17 @@ function useManpowerDesignationCtrl() {
   const {
     createManpowerDesignations: _createManpowerDesignations,
     getManpowerDesignationsBySiteId: _getManpowerDesignationsBySiteId,
+    getManpowerDesignationsById: _getManpowerDesignationsById,
     updateManpowerDesignations: _updateManpowerDesignations
   } = useManpowerDesignationRepo();
+  async function requireDesignationReach(req, _id) {
+    const row = await _getManpowerDesignationsById(_id);
+    const { canReach } = await siteReachOf(req);
+    if (!row || !await canReach({ site: row.siteId })) {
+      throw new import_node_server_utils241.NotFoundError("Manpower designations not found.");
+    }
+    return row;
+  }
   async function createManpowerDesignations(req, res, next) {
     try {
       const payload = { ...req.body };
@@ -77038,6 +77079,12 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils241.BadRequestError(error.message));
         return;
       }
+      const { actor, canReach } = await siteReachOf(req);
+      if (!await canReach({ site: payload.siteId })) {
+        throw new import_node_server_utils241.NotFoundError("Site not found.");
+      }
+      payload.createdBy = actor.id;
+      payload.createdByName = actor.name;
       const result = await _createManpowerDesignations(payload);
       return res.json(result);
     } catch (error) {
@@ -77058,6 +77105,7 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils241.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, id);
       const result = await _getManpowerDesignationsBySiteId(
         id,
         serviceProviderId
@@ -77082,6 +77130,7 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils241.BadRequestError(error.message));
         return;
       }
+      await requireDesignationReach(req, _id);
       const result = await _updateManpowerDesignations(_id, payload);
       return res.json(result);
     } catch (error) {