@7365admin1/core 3.48.1-staging.194 → 3.48.1-staging.196

package/.changeset/attendance-settings-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the attendance settings routes to their estate. `GET` and `PUT /api/attendance-settings/site/:site` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could read and rewrite any estate's attendance settings — turn location capture off, move the clock-in coordinates, or widen the geofence radius so a shift can be clocked in from anywhere. The read also created a default settings row for a site that had none, so an unauthorised read wrote into another estate's data. Reach is now decided from the session, on the site named in the request, before either the read or the write happens.

package/.changeset/org-anon-lookup-projection.md

@@ -0,0 +1,33 @@
+---
+"@7365admin1/core": patch
+---
+
+Return the organisation's name only on the anonymous organisation lookup.
+
+`GET /api/organizations/org/id/:id` is the unguarded twin of `/id/:id`, and it
+shares this controller's `getById`. The handler answered `res.json(data)` on the
+raw stored organisation document, which carries the client's own business
+`email` and `contact` number alongside `description`, `busInst`, `nature`,
+`defaultSite`, `terms` and `policies`. So anyone at all, with no session, who
+knew or guessed an organisation id got a client's business contact details back.
+
+It cannot be given a guard. Its only callers anywhere in the organisation are
+`web-app-main`'s `sign-up-invite/onboarding-admin` and
+`sign-up-invite/service-provider` pages (via `layer-common`'s
+`useOrg.getOrgById`), reached from an invite e-mail before the account being
+invited exists. Both pages do the same thing with the reply:
+`form.organization = org?.name || ""` — they read `name` and nothing else.
+
+So the anonymous path now uses a new `getNameById` on the organisation
+repository: `findOne` with an **allow-list** projection of `_id` and `name`. A
+field added to the organisation document later is excluded by default rather
+than leaking on the day it is added.
+
+`getById` itself is untouched. About twenty callers inside this package need the
+whole document — `customer`, `feedback`, `member`, `person`, `robot`,
+`service-provider`, `service-provider-invite`, `site` and `user-v2` services all
+read it — so projecting that function would have broken them. The new function
+sits beside it, and the controller picks between the two on whether the request
+carries a session (`callerId(req)`), which is the same shape used for the
+pre-login user lookup and resident-create routes. The guarded `/id/:id` route is
+therefore unchanged: still the whole document, still 401 without a session.

package/dist/index.d.ts

@@ -714,6 +714,7 @@ declare function useOrgRepo(): {
         pageRange: string;
     } | TOrg>;
     getById: (_id?: string | ObjectId) => Promise<TOrg>;
+    getNameById: (_id?: string | ObjectId) => Promise<mongodb.WithId<bson.Document>>;
     getByName: (name: string) => Promise<TOrg>;
     getByEmail: (email: string) => Promise<TOrg | null>;
     updateFieldById: ({ _id, field, value, }: {

package/dist/index.js

@@ -11718,6 +11718,21 @@ function useOrgRepo() {
       throw error;
     }
   }
+  async function getNameById(_id) {
+    try {
+      _id = new import_mongodb18.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils20.BadRequestError("Invalid organization ID format.");
+    }
+    const data = await collection.findOne(
+      { _id },
+      { projection: { _id: 1, name: 1 } }
+    );
+    if (!data) {
+      throw new import_node_server_utils20.NotFoundError("Organization not found.");
+    }
+    return data;
+  }
   async function getById(_id) {
     try {
       _id = new import_mongodb18.ObjectId(_id);
@@ -12118,6 +12133,7 @@ function useOrgRepo() {
     update,
     getAll,
     getById,
+    getNameById,
     getByName,
     getByEmail,
     updateFieldById,
@@ -27644,6 +27660,7 @@ function useOrgController() {
   const {
     getByName: _getByName,
     getById: _getById,
+    getNameById: _getNameById,
     getByEmail: _getByEmail,
     getAll: _getAll,
     add: _add,
@@ -27815,7 +27832,7 @@ function useOrgController() {
       return;
     }
     try {
-      const data = await _getById(_id);
+      const data = callerId(req) ? await _getById(_id) : await _getNameById(_id);
       res.json(data);
       return;
     } catch (error2) {
@@ -40522,6 +40539,9 @@ var import_node_server_utils121 = require("@7365admin1/node-server-utils");
 function useAttendanceSettingsController() {
   const { getAttendanceSettingsBySite: _getAttendanceSettingsBySite } = useAttendanceSettingsService();
   const { updateAttendanceSettings: _updateAttendanceSettings } = useAttendanceSettingsRepository();
+  async function requireAttendanceSettingsReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function getAttendanceSettingsBySite(req, res, next) {
     const query2 = { ...req.query, ...req.params };
     const validation = import_joi60.default.object({
@@ -40537,6 +40557,7 @@ function useAttendanceSettingsController() {
     const site = req.params.site ?? "";
     const serviceType = req.query.serviceType ?? "";
     try {
+      await requireAttendanceSettingsReach(req, site);
       const data = await _getAttendanceSettingsBySite(site, serviceType);
       res.json(data);
       return;
@@ -40555,6 +40576,7 @@ function useAttendanceSettingsController() {
       return;
     }
     try {
+      await requireAttendanceSettingsReach(req, payload.site);
       await _updateAttendanceSettings(payload.site, payload);
       res.json({ message: "Attendance settings updated successfully." });
       return;