@7365admin1/core 3.48.1-staging.196 → 3.48.1-staging.198

package/.changeset/patrol-email-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the patrol log email route to its estate. `POST /api/patrol-logs/email` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could name another client's site and that site's patrol log ids and have the report emailed — to a list of up to 25 addresses of their own choosing, from the platform's sending address. The service's own log-belongs-to-site check is internal consistency, not reach: name the other estate's site and its own logs and the two agree. Reach is now decided from the session, on the site named in the request body, before anything is read, recorded, rendered or sent. `createdBy` — the audit row for who emailed patrol logs out of the system — is taken from the session rather than from the request body.

package/.changeset/robot-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the robot routes to their estate. `POST /api/robots` and `GET /api/robots/organization/:organization/site/:site` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could page any estate's robot list — which projects `appKey` and `appToken`, the robot's credentials — and aim a robot registration at any estate. Reach is now decided from the session, on the site named in the request. A registration naming no estate is refused rather than falling through unscoped, and `createdBy` is taken from the session rather than from the request body.

package/dist/index.js

@@ -51619,15 +51619,25 @@ var import_joi70 = __toESM(require("joi"));
 var import_node_server_utils143 = require("@7365admin1/node-server-utils");
 function useRobotController() {
   const { createRobot: _createRobot, getRobots: _getRobots } = useRobotService();
+  async function requireRobotReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function createRobot(req, res, next) {
-    const payload = { ...req.body };
+    const payload = { ...req.body, createdBy: callerId(req) };
     const { error } = robotSchema.validate(payload);
     if (error) {
       import_node_server_utils143.logger.log({ level: "error", message: error.message });
       next(new import_node_server_utils143.BadRequestError(error.message));
       return;
     }
+    if (!payload.metadata?.siteId) {
+      const message = "metadata.siteId is required.";
+      import_node_server_utils143.logger.log({ level: "error", message });
+      next(new import_node_server_utils143.BadRequestError(message));
+      return;
+    }
     try {
+      await requireRobotReach(req, payload.metadata.siteId);
       await _createRobot(payload);
       res.status(201).json({ message: "Successfully created robot." });
       return;
@@ -51666,6 +51676,7 @@ function useRobotController() {
     const from = req.query.from ?? "";
     const to = req.query.to ?? "";
     try {
+      await requireRobotReach(req, site);
       const data = await _getRobots({
         search,
         page,
@@ -53595,9 +53606,12 @@ var schemaSendPatrolEmail = import_joi77.default.object({
     "string.pattern.base": '"url" must be a root-relative path, for example "/org/site/patrol-logs/report?ids=..."'
   }),
   site: import_joi77.default.string().hex().length(24).required(),
+  // Pinned from the session by the controller, never taken from the request.
+  // `name` allows "" because it is denormalised from the account and an account
+  // may hold none - the same shape `schemaPatrolEmailCreatedBy` already stores.
   createdBy: import_joi77.default.object({
     _id: import_joi77.default.string().hex().length(24).required(),
-    name: import_joi77.default.string().trim().max(200).required()
+    name: import_joi77.default.string().trim().max(200).required().allow("")
   }).required()
 });
 function toObjectId15(value, label) {
@@ -54038,10 +54052,15 @@ function usePatrolEmailService() {
 var import_node_server_utils159 = require("@7365admin1/node-server-utils");
 function usePatrolEmailController() {
   const { send: _send } = usePatrolEmailService();
+  async function requirePatrolEmailReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function send2(req, res, next) {
-    const { error, value } = schemaSendPatrolEmail.validate(req.body, {
-      abortEarly: false
-    });
+    const actor = await resolveInviteActor(callerId(req));
+    const { error, value } = schemaSendPatrolEmail.validate(
+      { ...req.body, createdBy: { _id: actor.id, name: actor.name } },
+      { abortEarly: false }
+    );
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
       import_node_server_utils159.logger.log({ level: "error", message: messages });
@@ -54049,6 +54068,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requirePatrolEmailReach(req, value.site);
       const cookieHeader = req.headers.cookie;
       const data = await _send({
         site: value.site,
@@ -54064,7 +54084,6 @@ function usePatrolEmailController() {
       res.status(201).json({ message: "success", data });
       return;
     } catch (err) {
-      console.log("err", err);
       import_node_server_utils159.logger.log({ level: "error", message: `${err.message}` });
       next(err);
       return;