@7365admin1/core 3.48.1-staging.197 → 3.48.1-staging.198

package/.changeset/patrol-email-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the patrol log email route to its estate. `POST /api/patrol-logs/email` carried `requireAuth` and nothing more and the controller held no authorization identifier, so any signed-in account on the platform could name another client's site and that site's patrol log ids and have the report emailed — to a list of up to 25 addresses of their own choosing, from the platform's sending address. The service's own log-belongs-to-site check is internal consistency, not reach: name the other estate's site and its own logs and the two agree. Reach is now decided from the session, on the site named in the request body, before anything is read, recorded, rendered or sent. `createdBy` — the audit row for who emailed patrol logs out of the system — is taken from the session rather than from the request body.

package/dist/index.js

@@ -53606,9 +53606,12 @@ var schemaSendPatrolEmail = import_joi77.default.object({
     "string.pattern.base": '"url" must be a root-relative path, for example "/org/site/patrol-logs/report?ids=..."'
   }),
   site: import_joi77.default.string().hex().length(24).required(),
+  // Pinned from the session by the controller, never taken from the request.
+  // `name` allows "" because it is denormalised from the account and an account
+  // may hold none - the same shape `schemaPatrolEmailCreatedBy` already stores.
   createdBy: import_joi77.default.object({
     _id: import_joi77.default.string().hex().length(24).required(),
-    name: import_joi77.default.string().trim().max(200).required()
+    name: import_joi77.default.string().trim().max(200).required().allow("")
   }).required()
 });
 function toObjectId15(value, label) {
@@ -54049,10 +54052,15 @@ function usePatrolEmailService() {
 var import_node_server_utils159 = require("@7365admin1/node-server-utils");
 function usePatrolEmailController() {
   const { send: _send } = usePatrolEmailService();
+  async function requirePatrolEmailReach(req, site) {
+    await requireSiteReach(req, site);
+  }
   async function send2(req, res, next) {
-    const { error, value } = schemaSendPatrolEmail.validate(req.body, {
-      abortEarly: false
-    });
+    const actor = await resolveInviteActor(callerId(req));
+    const { error, value } = schemaSendPatrolEmail.validate(
+      { ...req.body, createdBy: { _id: actor.id, name: actor.name } },
+      { abortEarly: false }
+    );
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
       import_node_server_utils159.logger.log({ level: "error", message: messages });
@@ -54060,6 +54068,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requirePatrolEmailReach(req, value.site);
       const cookieHeader = req.headers.cookie;
       const data = await _send({
         site: value.site,
@@ -54075,7 +54084,6 @@ function usePatrolEmailController() {
       res.status(201).json({ message: "success", data });
       return;
     } catch (err) {
-      console.log("err", err);
       import_node_server_utils159.logger.log({ level: "error", message: `${err.message}` });
       next(err);
       return;