@7365admin1/core 3.48.1-staging.195 → 3.48.1-staging.197

package/.changeset/org-anon-lookup-projection.md

@@ -0,0 +1,33 @@
+---
+"@7365admin1/core": patch
+---
+
+Return the organisation's name only on the anonymous organisation lookup.
+
+`GET /api/organizations/org/id/:id` is the unguarded twin of `/id/:id`, and it
+shares this controller's `getById`. The handler answered `res.json(data)` on the
+raw stored organisation document, which carries the client's own business
+`email` and `contact` number alongside `description`, `busInst`, `nature`,
+`defaultSite`, `terms` and `policies`. So anyone at all, with no session, who
+knew or guessed an organisation id got a client's business contact details back.
+
+It cannot be given a guard. Its only callers anywhere in the organisation are
+`web-app-main`'s `sign-up-invite/onboarding-admin` and
+`sign-up-invite/service-provider` pages (via `layer-common`'s
+`useOrg.getOrgById`), reached from an invite e-mail before the account being
+invited exists. Both pages do the same thing with the reply:
+`form.organization = org?.name || ""` — they read `name` and nothing else.
+
+So the anonymous path now uses a new `getNameById` on the organisation
+repository: `findOne` with an **allow-list** projection of `_id` and `name`. A
+field added to the organisation document later is excluded by default rather
+than leaking on the day it is added.
+
+`getById` itself is untouched. About twenty callers inside this package need the
+whole document — `customer`, `feedback`, `member`, `person`, `robot`,
+`service-provider`, `service-provider-invite`, `site` and `user-v2` services all
+read it — so projecting that function would have broken them. The new function
+sits beside it, and the controller picks between the two on whether the request
+carries a session (`callerId(req)`), which is the same shape used for the
+pre-login user lookup and resident-create routes. The guarded `/id/:id` route is
+therefore unchanged: still the whole document, still 401 without a session.

package/.changeset/robot-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the robot routes to their estate. `POST /api/robots` and `GET /api/robots/organization/:organization/site/:site` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could page any estate's robot list — which projects `appKey` and `appToken`, the robot's credentials — and aim a robot registration at any estate. Reach is now decided from the session, on the site named in the request. A registration naming no estate is refused rather than falling through unscoped, and `createdBy` is taken from the session rather than from the request body.

package/dist/index.d.ts

@@ -714,6 +714,7 @@ declare function useOrgRepo(): {
         pageRange: string;
     } | TOrg>;
     getById: (_id?: string | ObjectId) => Promise<TOrg>;
+    getNameById: (_id?: string | ObjectId) => Promise<mongodb.WithId<bson.Document>>;
     getByName: (name: string) => Promise<TOrg>;
     getByEmail: (email: string) => Promise<TOrg | null>;
     updateFieldById: ({ _id, field, value, }: {

package/dist/index.js

@@ -11718,6 +11718,21 @@ function useOrgRepo() {
       throw error;
     }
   }
+  async function getNameById(_id) {
+    try {
+      _id = new import_mongodb18.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils20.BadRequestError("Invalid organization ID format.");
+    }
+    const data = await collection.findOne(
+      { _id },
+      { projection: { _id: 1, name: 1 } }
+    );
+    if (!data) {
+      throw new import_node_server_utils20.NotFoundError("Organization not found.");
+    }
+    return data;
+  }
   async function getById(_id) {
     try {
       _id = new import_mongodb18.ObjectId(_id);
@@ -12118,6 +12133,7 @@ function useOrgRepo() {
     update,
     getAll,
     getById,
+    getNameById,
     getByName,
     getByEmail,
     updateFieldById,
@@ -27644,6 +27660,7 @@ function useOrgController() {
   const {
     getByName: _getByName,
     getById: _getById,
+    getNameById: _getNameById,
     getByEmail: _getByEmail,
     getAll: _getAll,
     add: _add,
@@ -27815,7 +27832,7 @@ function useOrgController() {
       return;
     }
     try {
-      const data = await _getById(_id);
+      const data = callerId(req) ? await _getById(_id) : await _getNameById(_id);
       res.json(data);
       return;
     } catch (error2) {
@@ -51602,15 +51619,25 @@ var import_joi70 = __toESM(require("joi"));
 var import_node_server_utils143 = require("@7365admin1/node-server-utils");
 function useRobotController() {
   const { createRobot: _createRobot, getRobots: _getRobots } = useRobotService();
+  async function requireRobotReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function createRobot(req, res, next) {
-    const payload = { ...req.body };
+    const payload = { ...req.body, createdBy: callerId(req) };
     const { error } = robotSchema.validate(payload);
     if (error) {
       import_node_server_utils143.logger.log({ level: "error", message: error.message });
       next(new import_node_server_utils143.BadRequestError(error.message));
       return;
     }
+    if (!payload.metadata?.siteId) {
+      const message = "metadata.siteId is required.";
+      import_node_server_utils143.logger.log({ level: "error", message });
+      next(new import_node_server_utils143.BadRequestError(message));
+      return;
+    }
     try {
+      await requireRobotReach(req, payload.metadata.siteId);
       await _createRobot(payload);
       res.status(201).json({ message: "Successfully created robot." });
       return;
@@ -51649,6 +51676,7 @@ function useRobotController() {
     const from = req.query.from ?? "";
     const to = req.query.to ?? "";
     try {
+      await requireRobotReach(req, site);
       const data = await _getRobots({
         search,
         page,