@7365admin1/core 3.48.1-staging.192 → 3.48.1-staging.194

package/.changeset/bulletin-video-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the bulletin video routes to their estate. `POST /api/bulletin-videos`, the list, the by-id read, the update and the delete carried `requireAuth` and nothing more, so any signed-in account on the platform could publish a video into another client's estate, list that estate's videos, or read, rewrite and delete any video by its id alone. Reach is now decided from the session — on the site named in the request for the write and the list, and on the stored row for the three by-id routes.

package/.changeset/form-entry-scope.md

@@ -0,0 +1,29 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the form-entry routes to the estate and to the resident who submitted them
+
+`/api/form-entries` is a second controller over the same collection as
+`/api/online-forms`, and the rows in it are not templates only - a resident's
+submission lives there too. Three of its seven routes carried no session check
+at all, and the other four carried `requireAuth` and nothing more with no
+authorization identifier in the controller.
+
+`GET /resident` took `org`, `site` and `userId` from the query string and
+matched on exactly those with no projection, so an unauthenticated caller who
+could name a resident's user id got that resident's whole submission history.
+It now answers only for the caller themselves, or for somebody who reaches the
+estate being asked about.
+
+The reads, the update and the archive are decided by `requireFormEntryReach`,
+on the STORED row: the estate through `entitleSite`, or the person whose
+`userId` the row carries - residents hold no `members` document, so the
+owns-it branch is required or every resident loses their own submissions. The
+list closes both halves of its optional `site`. The update authorises its
+destination as well as its source, drops `userId` so ownership cannot be
+reassigned, and stops a resident approving their own application while leaving
+resubmission working. `POST /resident` stamps `userId` from the session instead
+of the body, and `add` stamps `createdBy` from the session instead of the
+caller's own cookie (which also removes a crash for any request sending cookies
+without a `user`).

package/dist/index.d.ts

@@ -10368,6 +10368,7 @@ declare function MFormEntry(value: TFormEntry): {
     unit: string | ObjectId;
     name: string;
     phoneNumber: string;
+    createdBy: any;
     fields: DynamicFormFields;
     status: FormEntryStatus | undefined;
     org: string | ObjectId | undefined;

package/dist/index.js

@@ -68057,6 +68057,14 @@ function useBulletinVideoController() {
     getBulletinVideoById: _getBulletinVideoById,
     deleteBulletinVideoById: _deleteBulletinVideoById
   } = useBulletinVideoRepo();
+  async function requireBulletinVideoReach(req, id) {
+    const video = await _getBulletinVideoById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(video)) {
+      throw new import_node_server_utils203.NotFoundError("Bulletin video not found.");
+    }
+    return video;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaBulletinVideo.validate(req.body, {
@@ -68068,6 +68076,7 @@ function useBulletinVideoController() {
         next(new import_node_server_utils203.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -68102,6 +68111,7 @@ function useBulletinVideoController() {
       [sort ?? "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
     };
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -68131,7 +68141,7 @@ function useBulletinVideoController() {
         return;
       }
       const { _id } = value;
-      const data = await _getBulletinVideoById(_id);
+      const data = await requireBulletinVideoReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -68153,6 +68163,7 @@ function useBulletinVideoController() {
       return;
     }
     try {
+      await requireBulletinVideoReach(req, _id);
       const result = await _updateBulletinVideoById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -68174,6 +68185,7 @@ function useBulletinVideoController() {
         return;
       }
       const { _id } = value;
+      await requireBulletinVideoReach(req, _id);
       await _deleteBulletinVideoById(_id);
       res.status(200).json({ message: "Successfully deleted bulletin video." });
       return;
@@ -85528,6 +85540,14 @@ function MFormEntry(value) {
     unit: value.unit,
     name: value.name,
     phoneNumber: value.phoneNumber,
+    // `createdBy` is `required` on the schema above but was dropped here, so
+    // the author was validated and then thrown away - and the value being
+    // validated came off the caller's own `user` cookie anyway. It is stamped
+    // from the session now, so it is worth keeping, and keeping it is what
+    // makes a row written through `/api/form-entries` carry the same author
+    // field as a row written through `/api/online-forms` into the very same
+    // collection.
+    createdBy: value.createdBy,
     fields: value.fields,
     status: value.status,
     org: value.org,
@@ -85824,6 +85844,16 @@ function useFormEntryController() {
     addResidentForm: _addResidentForm,
     residentForm: _residentForm
   } = useFormEntryRepo();
+  async function requireFormEntryReach(req, id) {
+    const entry = await _getFormEntryById(id);
+    const { actor, canReach } = await siteReachOf(req);
+    const owner = entry?.userId?.toString?.() ?? "";
+    const isOwner = Boolean(actor.id) && owner === actor.id;
+    if (!isOwner && !await canReach(entry)) {
+      throw new import_node_server_utils291.NotFoundError("Document not found.");
+    }
+    return { entry, isOwner, actor };
+  }
   function toCamelCase(str) {
     return str.replace(/\s(.)/g, (_, char) => char.toUpperCase()).replace(/\s+/g, "").replace(/^(.)/, (_, char) => char.toLowerCase());
   }
@@ -85903,6 +85933,13 @@ function useFormEntryController() {
         return;
       }
       const { search, page, limit, status, org, site } = value;
+      if (site) {
+        await requireSiteReach(req, site);
+      } else {
+        const { actor } = await siteReachOf(req);
+        if (!actor.isSuperAdmin)
+          throw new import_node_server_utils291.UnauthorizedError("Not authorized.");
+      }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
       return;
@@ -85925,8 +85962,8 @@ function useFormEntryController() {
         return;
       }
       const { _id } = value;
-      const data = await _getFormEntryById(_id);
-      res.json(data);
+      const { entry } = await requireFormEntryReach(req, _id);
+      res.json(entry);
       return;
     } catch (error) {
       import_node_server_utils291.logger.log({ level: "error", message: error.message });
@@ -85947,6 +85984,13 @@ function useFormEntryController() {
         return;
       }
       const { _id, ...rest } = value;
+      const { isOwner } = await requireFormEntryReach(req, _id);
+      if (rest.site)
+        await requireSiteReach(req, rest.site);
+      delete rest.userId;
+      if (isOwner && rest.status && rest.status !== "pending") {
+        throw new import_node_server_utils291.UnauthorizedError("Not authorized.");
+      }
       await _updateFormEntryById(_id, rest);
       res.json({ message: "Successfully updated online form." });
       return;
@@ -85966,6 +86010,7 @@ function useFormEntryController() {
         next(new import_node_server_utils291.BadRequestError(error.message));
         return;
       }
+      await requireFormEntryReach(req, _id);
       await _deleteOnlineFormById(_id);
       res.json({ message: "Successfully deleted online form." });
       return;
@@ -85976,11 +86021,7 @@ function useFormEntryController() {
     }
   }
   async function add(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const createdBy = cookies?.["user"].toString() ?? "";
+    const createdBy = callerId(req);
     const payload = { ...req.body, createdBy };
     const { error } = schemaFormEntry.validate(payload, {
       abortEarly: false
@@ -85992,6 +86033,7 @@ function useFormEntryController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json({ message: data });
       return;
@@ -86002,7 +86044,12 @@ function useFormEntryController() {
     }
   }
   async function residentFormSubmission(req, res, next) {
-    const payload = { ...req.body };
+    const userId = callerId(req);
+    if (!userId) {
+      next(new import_node_server_utils291.UnauthorizedError("Not authorized."));
+      return;
+    }
+    const payload = { ...req.body, userId };
     const { error } = residentFormEntry.validate(payload, {
       abortEarly: false
     });
@@ -86042,6 +86089,10 @@ function useFormEntryController() {
         return;
       }
       const { site, userId, org, search, page, limit } = value;
+      const { actor } = await siteReachOf(req);
+      if (!actor.id || actor.id !== userId) {
+        await requireSiteReach(req, site);
+      }
       const result = await _residentForm({ userId, site, org, search, page, limit });
       res.json(result);
     } catch (error) {