@7365admin1/core 3.48.1-staging.193 → 3.48.1-staging.194

package/.changeset/bulletin-video-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the bulletin video routes to their estate. `POST /api/bulletin-videos`, the list, the by-id read, the update and the delete carried `requireAuth` and nothing more, so any signed-in account on the platform could publish a video into another client's estate, list that estate's videos, or read, rewrite and delete any video by its id alone. Reach is now decided from the session — on the site named in the request for the write and the list, and on the stored row for the three by-id routes.

package/dist/index.js

@@ -68057,6 +68057,14 @@ function useBulletinVideoController() {
     getBulletinVideoById: _getBulletinVideoById,
     deleteBulletinVideoById: _deleteBulletinVideoById
   } = useBulletinVideoRepo();
+  async function requireBulletinVideoReach(req, id) {
+    const video = await _getBulletinVideoById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(video)) {
+      throw new import_node_server_utils203.NotFoundError("Bulletin video not found.");
+    }
+    return video;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaBulletinVideo.validate(req.body, {
@@ -68068,6 +68076,7 @@ function useBulletinVideoController() {
         next(new import_node_server_utils203.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -68102,6 +68111,7 @@ function useBulletinVideoController() {
       [sort ?? "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
     };
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -68131,7 +68141,7 @@ function useBulletinVideoController() {
         return;
       }
       const { _id } = value;
-      const data = await _getBulletinVideoById(_id);
+      const data = await requireBulletinVideoReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -68153,6 +68163,7 @@ function useBulletinVideoController() {
       return;
     }
     try {
+      await requireBulletinVideoReach(req, _id);
       const result = await _updateBulletinVideoById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -68174,6 +68185,7 @@ function useBulletinVideoController() {
         return;
       }
       const { _id } = value;
+      await requireBulletinVideoReach(req, _id);
       await _deleteBulletinVideoById(_id);
       res.status(200).json({ message: "Successfully deleted bulletin video." });
       return;