@7365admin1/core 3.48.1-staging.196 → 3.48.1-staging.197

package/.changeset/robot-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the robot routes to their estate. `POST /api/robots` and `GET /api/robots/organization/:organization/site/:site` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could page any estate's robot list — which projects `appKey` and `appToken`, the robot's credentials — and aim a robot registration at any estate. Reach is now decided from the session, on the site named in the request. A registration naming no estate is refused rather than falling through unscoped, and `createdBy` is taken from the session rather than from the request body.

package/dist/index.js

@@ -51619,15 +51619,25 @@ var import_joi70 = __toESM(require("joi"));
 var import_node_server_utils143 = require("@7365admin1/node-server-utils");
 function useRobotController() {
   const { createRobot: _createRobot, getRobots: _getRobots } = useRobotService();
+  async function requireRobotReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function createRobot(req, res, next) {
-    const payload = { ...req.body };
+    const payload = { ...req.body, createdBy: callerId(req) };
     const { error } = robotSchema.validate(payload);
     if (error) {
       import_node_server_utils143.logger.log({ level: "error", message: error.message });
       next(new import_node_server_utils143.BadRequestError(error.message));
       return;
     }
+    if (!payload.metadata?.siteId) {
+      const message = "metadata.siteId is required.";
+      import_node_server_utils143.logger.log({ level: "error", message });
+      next(new import_node_server_utils143.BadRequestError(message));
+      return;
+    }
     try {
+      await requireRobotReach(req, payload.metadata.siteId);
       await _createRobot(payload);
       res.status(201).json({ message: "Successfully created robot." });
       return;
@@ -51666,6 +51676,7 @@ function useRobotController() {
     const from = req.query.from ?? "";
     const to = req.query.to ?? "";
     try {
+      await requireRobotReach(req, site);
       const data = await _getRobots({
         search,
         page,