@7365admin1/core 3.48.1-staging.193 → 3.48.1-staging.195

package/.changeset/attendance-settings-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the attendance settings routes to their estate. `GET` and `PUT /api/attendance-settings/site/:site` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could read and rewrite any estate's attendance settings — turn location capture off, move the clock-in coordinates, or widen the geofence radius so a shift can be clocked in from anywhere. The read also created a default settings row for a site that had none, so an unauthorised read wrote into another estate's data. Reach is now decided from the session, on the site named in the request, before either the read or the write happens.

package/.changeset/bulletin-video-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the bulletin video routes to their estate. `POST /api/bulletin-videos`, the list, the by-id read, the update and the delete carried `requireAuth` and nothing more, so any signed-in account on the platform could publish a video into another client's estate, list that estate's videos, or read, rewrite and delete any video by its id alone. Reach is now decided from the session — on the site named in the request for the write and the list, and on the stored row for the three by-id routes.

package/dist/index.js

@@ -40522,6 +40522,9 @@ var import_node_server_utils121 = require("@7365admin1/node-server-utils");
 function useAttendanceSettingsController() {
   const { getAttendanceSettingsBySite: _getAttendanceSettingsBySite } = useAttendanceSettingsService();
   const { updateAttendanceSettings: _updateAttendanceSettings } = useAttendanceSettingsRepository();
+  async function requireAttendanceSettingsReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function getAttendanceSettingsBySite(req, res, next) {
     const query2 = { ...req.query, ...req.params };
     const validation = import_joi60.default.object({
@@ -40537,6 +40540,7 @@ function useAttendanceSettingsController() {
     const site = req.params.site ?? "";
     const serviceType = req.query.serviceType ?? "";
     try {
+      await requireAttendanceSettingsReach(req, site);
       const data = await _getAttendanceSettingsBySite(site, serviceType);
       res.json(data);
       return;
@@ -40555,6 +40559,7 @@ function useAttendanceSettingsController() {
       return;
     }
     try {
+      await requireAttendanceSettingsReach(req, payload.site);
       await _updateAttendanceSettings(payload.site, payload);
       res.json({ message: "Attendance settings updated successfully." });
       return;
@@ -68057,6 +68062,14 @@ function useBulletinVideoController() {
     getBulletinVideoById: _getBulletinVideoById,
     deleteBulletinVideoById: _deleteBulletinVideoById
   } = useBulletinVideoRepo();
+  async function requireBulletinVideoReach(req, id) {
+    const video = await _getBulletinVideoById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(video)) {
+      throw new import_node_server_utils203.NotFoundError("Bulletin video not found.");
+    }
+    return video;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaBulletinVideo.validate(req.body, {
@@ -68068,6 +68081,7 @@ function useBulletinVideoController() {
         next(new import_node_server_utils203.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -68102,6 +68116,7 @@ function useBulletinVideoController() {
       [sort ?? "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
     };
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -68131,7 +68146,7 @@ function useBulletinVideoController() {
         return;
       }
       const { _id } = value;
-      const data = await _getBulletinVideoById(_id);
+      const data = await requireBulletinVideoReach(req, _id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -68153,6 +68168,7 @@ function useBulletinVideoController() {
       return;
     }
     try {
+      await requireBulletinVideoReach(req, _id);
       const result = await _updateBulletinVideoById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -68174,6 +68190,7 @@ function useBulletinVideoController() {
         return;
       }
       const { _id } = value;
+      await requireBulletinVideoReach(req, _id);
       await _deleteBulletinVideoById(_id);
       res.status(200).json({ message: "Successfully deleted bulletin video." });
       return;