@7365admin1/core 3.48.1-staging.201 → 3.48.1-staging.203

package/.changeset/hrmlabs-attendance-location-name.md

@@ -0,0 +1,35 @@
+---
+"@7365admin1/core": patch
+---
+
+Decide the HRM Labs location server-side, so an entitled caller cannot read
+another site's roster.
+
+`requireSiteReach(req, siteId, ATTENDANCE_READ)` guards all four manpower-attendance
+reads, but `siteId` is not what selects the roster — it only picks the local
+`manpower-settings` row. The roster is selected by `locationName`, the field HRM Labs
+is asked for, and that came straight from the request body's `siteName` with nothing
+checking it against `siteId`.
+
+So the two could disagree. A caller entitled to site A could send site A's `siteId`,
+pass the guard, and pair it with **another** site's `siteName` — and read that site's
+employee roster back: names, staff numbers, job titles, NRICs
+(`identificationNumber`) and the check-in/check-out photographs. The exposure had been
+narrowed from anyone on the internet to any signed-in account; this closes it.
+
+The location now comes from `config.siteName`, the settings row the caller was already
+entitled to, via one `locationOf()` helper called in each of the four functions. That
+is the same source the screen reads from: the security app fills `siteId` and
+`siteName` from one HRM Labs site-list entry (`site.id` / `site.text`),
+`manpowerMonitoringSchema` makes `siteName` required on both write paths, and
+`TManpowerMonitoringUpdate` cannot change it — so for every legitimate row the pair
+already agreed and the server simply stops asking.
+
+A row with no stored name is refused rather than falling back to the body; a fallback
+would re-open the hole for exactly the rows an attacker would want to name for
+themselves.
+
+Nothing legitimate changes. The Joi schemas still accept `siteName`, so no client needs
+a coordinated release — it is accepted and ignored. The three internal callers
+(`manpower.event.ts` and the two `cron.util.ts` sweeps) get more reliable, not less:
+they were passing `manpower-remarks.siteName`, which that model marks optional.

package/.changeset/invite-org-scope.md

@@ -0,0 +1,38 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope invitation creation to an organisation the caller can reach, and stop a
+non-staff caller minting a Seven365 staff invitation on the v1 endpoints.
+
+Six endpoints took `metadata.org` — and the `app` that becomes the accepted
+membership's `type` — straight from the request body, behind `requireAuth` and
+nothing else:
+
+- `POST /api/auth/invite` (`auth.route.ts:29`)
+- `POST /api/auth/invite/user` (`auth.route.ts:30`)
+- `POST /api/auth/invite/member` (`auth.route.ts:31`)
+- `POST /api/auth/invite/service-provider/with-org` (`auth.route.ts:33`)
+- `POST /api/auth/v2/invite` (`auth-v2.route.ts:22`)
+- `POST /api/auth/v2/invite/organization` (`auth-v2.route.ts:23`)
+
+Two things followed from that.
+
+**The organisation.** The roles/members fix lets somebody holding an invitation
+into an organisation reach it, because the client onboarding wizard needs that.
+An attacker could therefore issue themselves the invitation the gate asks for —
+one authenticated write naming any victim organisation — and walk straight back
+into the chain that fix closed.
+
+**`app`.** "admin" is what makes a membership Seven365 staff, and
+`member.service.ts acceptInvite` writes `type: invite.metadata.app` verbatim.
+`createMemberDirect` already refuses a staff membership from a non-staff caller;
+the invitation road to the same place was open on the v1 mounts. The v2 twin
+asked; the v1 mounts, which are the ones the web apps call, did not.
+
+All six now call `requireInviteReach` (`utils/console-authz.util.ts`): Seven365
+staff, a live member of the organisation, or somebody holding an invitation into
+it — plus `requirePlatformStaff` when the invitation names the staff app. An
+invitation that names no organisation is unchanged; it grants no organisation,
+exactly as an org-less `GET /api/roles` does. The two service-provider invites
+that already resolved their caller from the session are unchanged.

package/dist/index.js

@@ -18337,6 +18337,14 @@ async function requireOrgReach(req, orgId) {
     return id;
   throw new import_node_server_utils41.UnauthorizedError("Not authorized.");
 }
+async function requireInviteReach(req, org, app) {
+  const apps = Array.isArray(app) ? app : [app];
+  if (apps.some((a) => a === PLATFORM_STAFF_MEMBER_TYPE)) {
+    await requirePlatformStaff(req);
+  }
+  if (org)
+    await requireOrgReach(req, org);
+}
 
 // src/utils/user-response.util.ts
 function withoutCredentials(user) {
@@ -26092,6 +26100,7 @@ function useVerificationController() {
     const siteId = req.body.siteId ?? "";
     const siteName = req.body.siteName ?? "";
     try {
+      await requireInviteReach(req, org, app);
       await _createUserInvite({
         email,
         metadata: {
@@ -26145,6 +26154,7 @@ function useVerificationController() {
         siteId,
         siteName
       } = value;
+      await requireInviteReach(req, org, app);
       const verificationIds = await _createSimpleUserInvite({
         email,
         metadata: {
@@ -26208,6 +26218,7 @@ function useVerificationController() {
     const siteId = req.body.siteId ?? "";
     const siteName = req.body.siteName ?? "";
     try {
+      await requireInviteReach(req, org, app);
       await _createSimpleMemberInvite({
         email,
         metadata: {
@@ -26332,6 +26343,7 @@ function useVerificationController() {
     const siteId = req.body.siteId ?? "";
     const siteName = req.body.siteName ?? "";
     try {
+      await requireInviteReach(req, orgId, app);
       await _createSimpleServiceProviderInvite({
         email,
         app,
@@ -78077,6 +78089,15 @@ var {
   totalCountPerStatus: totalCountPerStatus2,
   chartCountData: chartCountData2
 } = hrmlabs_attendance_util_default;
+function locationOf(config2) {
+  const name = typeof config2?.siteName === "string" ? config2.siteName.trim() : "";
+  if (!name) {
+    throw new Error(
+      "Manpower monitoring settings for this site have no HRM Labs location name."
+    );
+  }
+  return name;
+}
 function useHrmLabsAttendanceSrvc() {
   const { getManpowerSettingsBySiteId: _getManpowerSettingsBySiteId } = useManpowerMonitoringRepo();
   const { getManpowerDesignationsBySiteId: _getManpowerDesignationsBySiteId } = useManpowerDesignationRepo();
@@ -78084,7 +78105,6 @@ function useHrmLabsAttendanceSrvc() {
     const {
       startDate,
       endDate,
-      siteName,
       siteId,
       shiftName,
       search,
@@ -78114,6 +78134,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const shiftType = config2.shiftType === "2-shifts" ? "2-shifts" : "3-shifts";
       const shiftData = config2.shifts[shiftType].find(
         (s) => s.name === shiftName
@@ -78183,7 +78204,7 @@ function useHrmLabsAttendanceSrvc() {
     }
   }
   async function getAttendanceDataCount(payload) {
-    const { startDate, endDate, siteName, siteId, search, serviceProviderId } = payload;
+    const { startDate, endDate, siteId, search, serviceProviderId } = payload;
     const username = process.env.HRMLABS_USERNAME;
     const domain = process.env.HRMLABS_DOMAIN;
     const password = process.env.HRMLABS_PASSWORD;
@@ -78206,6 +78227,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const shiftType = config2.shiftType;
       const shiftData = config2.shifts[shiftType];
       if (!shiftData) {
@@ -78296,7 +78318,7 @@ function useHrmLabsAttendanceSrvc() {
     }
   }
   async function getAllAttendance(payload) {
-    const { startDate, endDate, siteName, siteId, search, serviceProviderId } = payload;
+    const { startDate, endDate, siteId, search, serviceProviderId } = payload;
     let { shiftName } = payload;
     const username = process.env.HRMLABS_USERNAME;
     const domain = process.env.HRMLABS_DOMAIN;
@@ -78319,6 +78341,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const designationConfig = await _getManpowerDesignationsBySiteId(
         siteId,
         serviceProviderId
@@ -78470,7 +78493,6 @@ function useHrmLabsAttendanceSrvc() {
     const {
       startDate,
       endDate,
-      siteName,
       siteId,
       search,
       serviceProviderId,
@@ -78498,6 +78520,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const designationConfig = await _getManpowerDesignationsBySiteId(
         siteId,
         serviceProviderId
@@ -81041,9 +81064,7 @@ function useVerificationControllerV2() {
     }
     const { email, app, role, name, org, siteId, siteName } = value;
     try {
-      if (app === PLATFORM_STAFF_MEMBER_TYPE) {
-        await requirePlatformStaff(req);
-      }
+      await requireInviteReach(req, org, app);
       await _createUserInvite({
         email,
         metadata: {
@@ -81115,6 +81136,7 @@ function useVerificationControllerV2() {
     }
     try {
       const { email, app, role, name, org, siteId, siteName } = value;
+      await requireInviteReach(req, org, app);
       await _createOrganizationInvite({
         email,
         metadata: {