@7365admin1/core 3.48.1-staging.195 → 3.48.1-staging.196

package/.changeset/org-anon-lookup-projection.md

@@ -0,0 +1,33 @@
+---
+"@7365admin1/core": patch
+---
+
+Return the organisation's name only on the anonymous organisation lookup.
+
+`GET /api/organizations/org/id/:id` is the unguarded twin of `/id/:id`, and it
+shares this controller's `getById`. The handler answered `res.json(data)` on the
+raw stored organisation document, which carries the client's own business
+`email` and `contact` number alongside `description`, `busInst`, `nature`,
+`defaultSite`, `terms` and `policies`. So anyone at all, with no session, who
+knew or guessed an organisation id got a client's business contact details back.
+
+It cannot be given a guard. Its only callers anywhere in the organisation are
+`web-app-main`'s `sign-up-invite/onboarding-admin` and
+`sign-up-invite/service-provider` pages (via `layer-common`'s
+`useOrg.getOrgById`), reached from an invite e-mail before the account being
+invited exists. Both pages do the same thing with the reply:
+`form.organization = org?.name || ""` — they read `name` and nothing else.
+
+So the anonymous path now uses a new `getNameById` on the organisation
+repository: `findOne` with an **allow-list** projection of `_id` and `name`. A
+field added to the organisation document later is excluded by default rather
+than leaking on the day it is added.
+
+`getById` itself is untouched. About twenty callers inside this package need the
+whole document — `customer`, `feedback`, `member`, `person`, `robot`,
+`service-provider`, `service-provider-invite`, `site` and `user-v2` services all
+read it — so projecting that function would have broken them. The new function
+sits beside it, and the controller picks between the two on whether the request
+carries a session (`callerId(req)`), which is the same shape used for the
+pre-login user lookup and resident-create routes. The guarded `/id/:id` route is
+therefore unchanged: still the whole document, still 401 without a session.

package/dist/index.d.ts

@@ -714,6 +714,7 @@ declare function useOrgRepo(): {
         pageRange: string;
     } | TOrg>;
     getById: (_id?: string | ObjectId) => Promise<TOrg>;
+    getNameById: (_id?: string | ObjectId) => Promise<mongodb.WithId<bson.Document>>;
     getByName: (name: string) => Promise<TOrg>;
     getByEmail: (email: string) => Promise<TOrg | null>;
     updateFieldById: ({ _id, field, value, }: {

package/dist/index.js

@@ -11718,6 +11718,21 @@ function useOrgRepo() {
       throw error;
     }
   }
+  async function getNameById(_id) {
+    try {
+      _id = new import_mongodb18.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils20.BadRequestError("Invalid organization ID format.");
+    }
+    const data = await collection.findOne(
+      { _id },
+      { projection: { _id: 1, name: 1 } }
+    );
+    if (!data) {
+      throw new import_node_server_utils20.NotFoundError("Organization not found.");
+    }
+    return data;
+  }
   async function getById(_id) {
     try {
       _id = new import_mongodb18.ObjectId(_id);
@@ -12118,6 +12133,7 @@ function useOrgRepo() {
     update,
     getAll,
     getById,
+    getNameById,
     getByName,
     getByEmail,
     updateFieldById,
@@ -27644,6 +27660,7 @@ function useOrgController() {
   const {
     getByName: _getByName,
     getById: _getById,
+    getNameById: _getNameById,
     getByEmail: _getByEmail,
     getAll: _getAll,
     add: _add,
@@ -27815,7 +27832,7 @@ function useOrgController() {
       return;
     }
     try {
-      const data = await _getById(_id);
+      const data = callerId(req) ? await _getById(_id) : await _getNameById(_id);
       res.json(data);
       return;
     } catch (error2) {