@7365admin1/core 3.48.1-staging.194 → 3.48.1-staging.195

package/.changeset/attendance-settings-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the attendance settings routes to their estate. `GET` and `PUT /api/attendance-settings/site/:site` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could read and rewrite any estate's attendance settings — turn location capture off, move the clock-in coordinates, or widen the geofence radius so a shift can be clocked in from anywhere. The read also created a default settings row for a site that had none, so an unauthorised read wrote into another estate's data. Reach is now decided from the session, on the site named in the request, before either the read or the write happens.

package/dist/index.js

@@ -40522,6 +40522,9 @@ var import_node_server_utils121 = require("@7365admin1/node-server-utils");
 function useAttendanceSettingsController() {
   const { getAttendanceSettingsBySite: _getAttendanceSettingsBySite } = useAttendanceSettingsService();
   const { updateAttendanceSettings: _updateAttendanceSettings } = useAttendanceSettingsRepository();
+  async function requireAttendanceSettingsReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function getAttendanceSettingsBySite(req, res, next) {
     const query2 = { ...req.query, ...req.params };
     const validation = import_joi60.default.object({
@@ -40537,6 +40540,7 @@ function useAttendanceSettingsController() {
     const site = req.params.site ?? "";
     const serviceType = req.query.serviceType ?? "";
     try {
+      await requireAttendanceSettingsReach(req, site);
       const data = await _getAttendanceSettingsBySite(site, serviceType);
       res.json(data);
       return;
@@ -40555,6 +40559,7 @@ function useAttendanceSettingsController() {
       return;
     }
     try {
+      await requireAttendanceSettingsReach(req, payload.site);
       await _updateAttendanceSettings(payload.site, payload);
       res.json({ message: "Attendance settings updated successfully." });
       return;