@7365admin1/core 3.48.1-staging.201 → 3.48.1-staging.202

package/.changeset/invite-org-scope.md

@@ -0,0 +1,38 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope invitation creation to an organisation the caller can reach, and stop a
+non-staff caller minting a Seven365 staff invitation on the v1 endpoints.
+
+Six endpoints took `metadata.org` — and the `app` that becomes the accepted
+membership's `type` — straight from the request body, behind `requireAuth` and
+nothing else:
+
+- `POST /api/auth/invite` (`auth.route.ts:29`)
+- `POST /api/auth/invite/user` (`auth.route.ts:30`)
+- `POST /api/auth/invite/member` (`auth.route.ts:31`)
+- `POST /api/auth/invite/service-provider/with-org` (`auth.route.ts:33`)
+- `POST /api/auth/v2/invite` (`auth-v2.route.ts:22`)
+- `POST /api/auth/v2/invite/organization` (`auth-v2.route.ts:23`)
+
+Two things followed from that.
+
+**The organisation.** The roles/members fix lets somebody holding an invitation
+into an organisation reach it, because the client onboarding wizard needs that.
+An attacker could therefore issue themselves the invitation the gate asks for —
+one authenticated write naming any victim organisation — and walk straight back
+into the chain that fix closed.
+
+**`app`.** "admin" is what makes a membership Seven365 staff, and
+`member.service.ts acceptInvite` writes `type: invite.metadata.app` verbatim.
+`createMemberDirect` already refuses a staff membership from a non-staff caller;
+the invitation road to the same place was open on the v1 mounts. The v2 twin
+asked; the v1 mounts, which are the ones the web apps call, did not.
+
+All six now call `requireInviteReach` (`utils/console-authz.util.ts`): Seven365
+staff, a live member of the organisation, or somebody holding an invitation into
+it — plus `requirePlatformStaff` when the invitation names the staff app. An
+invitation that names no organisation is unchanged; it grants no organisation,
+exactly as an org-less `GET /api/roles` does. The two service-provider invites
+that already resolved their caller from the session are unchanged.

package/dist/index.js

@@ -18337,6 +18337,14 @@ async function requireOrgReach(req, orgId) {
     return id;
   throw new import_node_server_utils41.UnauthorizedError("Not authorized.");
 }
+async function requireInviteReach(req, org, app) {
+  const apps = Array.isArray(app) ? app : [app];
+  if (apps.some((a) => a === PLATFORM_STAFF_MEMBER_TYPE)) {
+    await requirePlatformStaff(req);
+  }
+  if (org)
+    await requireOrgReach(req, org);
+}
 
 // src/utils/user-response.util.ts
 function withoutCredentials(user) {
@@ -26092,6 +26100,7 @@ function useVerificationController() {
     const siteId = req.body.siteId ?? "";
     const siteName = req.body.siteName ?? "";
     try {
+      await requireInviteReach(req, org, app);
       await _createUserInvite({
         email,
         metadata: {
@@ -26145,6 +26154,7 @@ function useVerificationController() {
         siteId,
         siteName
       } = value;
+      await requireInviteReach(req, org, app);
       const verificationIds = await _createSimpleUserInvite({
         email,
         metadata: {
@@ -26208,6 +26218,7 @@ function useVerificationController() {
     const siteId = req.body.siteId ?? "";
     const siteName = req.body.siteName ?? "";
     try {
+      await requireInviteReach(req, org, app);
       await _createSimpleMemberInvite({
         email,
         metadata: {
@@ -26332,6 +26343,7 @@ function useVerificationController() {
     const siteId = req.body.siteId ?? "";
     const siteName = req.body.siteName ?? "";
     try {
+      await requireInviteReach(req, orgId, app);
       await _createSimpleServiceProviderInvite({
         email,
         app,
@@ -81041,9 +81053,7 @@ function useVerificationControllerV2() {
     }
     const { email, app, role, name, org, siteId, siteName } = value;
     try {
-      if (app === PLATFORM_STAFF_MEMBER_TYPE) {
-        await requirePlatformStaff(req);
-      }
+      await requireInviteReach(req, org, app);
       await _createUserInvite({
         email,
         metadata: {
@@ -81115,6 +81125,7 @@ function useVerificationControllerV2() {
     }
     try {
       const { email, app, role, name, org, siteId, siteName } = value;
+      await requireInviteReach(req, org, app);
       await _createOrganizationInvite({
         email,
         metadata: {