@7365admin1/core 3.48.1-staging.205 → 3.48.1-staging.207

package/.changeset/organization-and-promo-list-scope.md

@@ -0,0 +1,39 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the organisation list to the caller, and put the promo-code list behind the staff gate.
+
+`GET /api/organizations` and `GET /api/promo-codes` performed no authorization
+at all — `requireAuth` and nothing more — while every sibling handler in the
+same two files guarded. So any signed-in account on the platform, a resident or
+a cleaner included, could page through the name, e-mail, nature and status of
+**every Seven365 client**, and read off **every discount code** we have ever
+minted, with its rate and its expiry, and then redeem whichever is worth most.
+
+The two rules are different, because the callers are different.
+
+**`GET /api/organizations` is now a SCOPE, not a refusal.** Seven365 staff see
+every organisation exactly as before; anybody else sees the organisations they
+hold a live membership of, plus any registered under their own verified account
+e-mail. The e-mail half is not decoration: `web-app-main
+pages/verify/email/index.vue:322` — the org-owner self-signup — lists
+organisations to find the one it created a line earlier, at which point that
+brand-new client owner is a member of nothing. Refusing them would have traded
+the leak for a broken signup. The comparison is the one
+`getOrgsByEmail` already makes, against the address on the caller's own `users`
+row; nothing the caller sends takes part in it. It also removes a real bug from
+that flow: the page takes `items[0]` of a newest-first list, so two client
+owners signing up in the same moment could be handed each other's organisation
+as their `defaultOrg`.
+
+The scope is part of the Redis cache key as well as the query, so one caller's
+narrowed page is never replayed to the next, and `countDocuments` runs the
+scoped query so pagination cannot walk past the scope.
+
+**`GET /api/promo-codes` is Seven365 staff only,** together with
+`GET /api/promo-codes/id/:id`, which is the same disclosure one record at a
+time. Both are read solely by the staff console. A client at checkout is
+unaffected: `web-app-org pages/checkout.vue` and
+`subscription/manage-seats.vue` type a code and validate it through
+`GET /api/promo-codes/code`, which stays signed-in-only and is untouched.

package/.changeset/revoke-sessions-when-access-is-taken-away.md

@@ -0,0 +1,63 @@
+---
+"@7365admin1/core": minor
+---
+
+Make revoking somebody's access actually end their session.
+
+A session in this product is an opaque `sid` whose only record of truth is a
+Redis key `sid:<sid>` holding a copy of the user document. `requireAuth`
+authenticates a request by finding that key and nothing else — it never reads
+the database — and it re-`EXPIRE`s the key to four hours on every request, so a
+session that is in use never ages out on its own.
+
+**Signing out was never the problem.** `logout()` deletes the key, so a
+signed-out session is refused; that half already worked. Every other way access
+is taken away did not.
+
+**Suspending somebody changed a column and nothing else.**
+`suspendResidentById` writes `users.status = "suspended"` through
+`updateUserFieldById`, which cleared the user-document cache and left the
+`sid:` key untouched. The person carried on working, and every request they made
+pushed the four-hour expiry out another four hours. On top of that,
+`refreshToken()` minted a **brand new** session through `issueSession` with no
+account-status check at all — the mobile refresh token is seven days and
+rotating, so a suspended account's phone could keep issuing itself fresh
+sessions indefinitely. Suspension was not a delay, it was a no-op for anyone
+already signed in.
+
+**Two of the statuses the product writes were never refused at sign-in either.**
+Both `login()`s checked `suspended` and `pending` only, so `rejected` (written by
+`reviewPerson`, whose email is the one that hides the login link) and `deleted`
+(`UserStatus.DELETED`, the soft-delete marker) could sign in fresh with a
+password.
+
+The fix is the two halves of that, at the two choke points that already exist:
+
+- **Minting refuses a non-live account** — `assertAccountLive` in `issueSession`
+  in both auth services, which is the one place every sign-in path in this
+  package goes through (login and mobile refresh, v1 and v2), for the same
+  reason `assertOrganizationNotSuspended` lives there.
+- **Revoking destroys what already exists** — `revokeAccountAccess` from
+  `updateUserFieldById`, the only path in either user repository that writes
+  `users.status`. It deletes every `sid:` key the person holds and every refresh
+  token in `tokens`, so nothing can mint a replacement.
+
+Finding every session a person holds needs an index: `users.sid` only ever
+remembers the most recent sign-in, v2 never writes it, and nothing reads it — a
+fix built on that column would revoke the phone and leave the browser signed in.
+The index is a Redis set (`user-sessions:<userId>`), so there is no schema
+change and no migration; `users.sid` stays as the fallback that catches v1
+sessions minted before the set existed.
+
+The blocking statuses are `suspended`, `pending`, `rejected` and `deleted`, as a
+deny-list — `status` is optional on the model and legacy rows carry `""` or no
+field at all, and an allow-list would lock every one of them out. `resubmit` is
+deliberately live: that email keeps the login link, because resubmitting the
+application is done signed in.
+
+Nothing is logged out by deploying this — no existing session is touched, and
+the two sign-in messages for `suspended` and `pending` are unchanged, because
+`login()` still checks those two itself before minting. What changes for a
+signed-in user is only that a `rejected` or soft-deleted account can no longer
+obtain a session, and that a suspension now takes effect at once rather than
+never.

package/dist/index.d.ts

@@ -67,6 +67,7 @@ declare function useSessionRepo(): {
         token: string;
     }>;
     revokeFamily: (familyId: string, session?: ClientSession) => Promise<void>;
+    revokeAllForUser: (userId: string | ObjectId, session?: ClientSession) => Promise<void>;
 };
 
 declare function useAuthService(): {
@@ -701,13 +702,17 @@ declare function useOrgRepo(): {
     createUniqueIndex: () => Promise<void>;
     add: (value: TOrg, session?: ClientSession) => Promise<ObjectId>;
     update: (id: string, value: Partial<TOrg>, session?: ClientSession) => Promise<string>;
-    getAll: ({ search, page, limit, sort, status, nature, }: {
+    getAll: ({ search, page, limit, sort, status, nature, scope, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
         sort?: Record<string, number> | undefined;
         status?: string | undefined;
         nature?: string | undefined;
+        scope?: {
+            orgIds?: string[] | undefined;
+            email?: string | undefined;
+        } | undefined;
     }) => Promise<{
         items: any[];
         pages: number;
@@ -993,8 +998,8 @@ declare const TPrice: z.ZodObject<{
     updatedAt: z.ZodOptional<z.ZodDate>;
     deletedAt: z.ZodOptional<z.ZodDate>;
 }, "strip", z.ZodTypeAny, {
-    name: string;
     type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+    name: string;
     value: number;
     _id?: ObjectId | undefined;
     createdAt?: Date | undefined;
@@ -1016,8 +1021,8 @@ declare const TPrice: z.ZodObject<{
 type TPrice = z.infer<typeof TPrice>;
 declare function usePriceModel(db: Db): {
     createPrice: (value: Pick<TPrice, "type" | "name" | "value">) => {
-        name: string;
         type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+        name: string;
         value: number;
         _id?: ObjectId | undefined;
         createdAt?: Date | undefined;
@@ -1037,8 +1042,8 @@ declare function usePriceModel(db: Db): {
         saleValue?: number | undefined;
         saleExpiry?: Date | undefined;
     }, {
-        name: string;
         type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+        name: string;
         value: number;
         _id?: ObjectId | undefined;
         createdAt?: Date | undefined;
@@ -1048,8 +1053,8 @@ declare function usePriceModel(db: Db): {
         saleExpiry?: Date | undefined;
     }>;
     collection: Collection<{
-        name: string;
         type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+        name: string;
         value: number;
         _id?: ObjectId | undefined;
         createdAt?: Date | undefined;
@@ -1226,8 +1231,8 @@ declare const TInvoice: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodDefault<z.ZodDate>>;
     updatedAt: z.ZodOptional<z.ZodDate>;
 }, "strip", z.ZodTypeAny, {
-    status: "pending" | "cancelled" | "paid" | "overdue";
     type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+    status: "pending" | "cancelled" | "paid" | "overdue";
     items: {
         description: string;
         total: number;
@@ -1263,8 +1268,8 @@ declare const TInvoice: z.ZodObject<{
     dueDate: Date;
     _id?: string | ObjectId | undefined;
     createdAt?: Date | undefined;
-    status?: "pending" | "cancelled" | "paid" | "overdue" | undefined;
     type?: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment" | undefined;
+    status?: "pending" | "cancelled" | "paid" | "overdue" | undefined;
     updatedAt?: Date | undefined;
     metadata?: {
         description?: string | undefined;
@@ -1280,8 +1285,8 @@ type TInvoice = z.infer<typeof TInvoice>;
 declare function useInvoiceModel(db: Db): {
     createInvoice: (data: TInvoice) => TInvoice;
     collection: Collection<{
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -1312,8 +1317,8 @@ declare function useInvoiceRepo(): {
     createUniqueIndex: () => Promise<void>;
     add: (value: TInvoice, session?: ClientSession) => Promise<void>;
     getByDueDate: (dueDate: Date, status?: TInvoice["status"]) => Promise<{
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -1348,8 +1353,8 @@ declare function useInvoiceRepo(): {
         pages: number;
         pageRange: string;
     } | {
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -1374,8 +1379,8 @@ declare function useInvoiceRepo(): {
         descriptions?: string | undefined;
     }>;
     getOverdueInvoices: (BATCH_SIZE?: number) => Promise<{
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -9860,8 +9865,8 @@ declare function useUserRepoV2(): {
     createTextIndex: () => Promise<void>;
     createUniqueIndex: () => Promise<void>;
     createUser: (value: TUser, session?: ClientSession) => Promise<ObjectId>;
-    getUserByEmail: (email: string) => Promise<TUser | mongodb.WithId<bson.Document> | null>;
-    getUserByEmailStatus: (email: string) => Promise<TUser | mongodb.WithId<bson.Document> | null>;
+    getUserByEmail: (email: string) => Promise<mongodb.WithId<bson.Document> | TUser | null>;
+    getUserByEmailStatus: (email: string) => Promise<mongodb.WithId<bson.Document> | TUser | null>;
     getUserById: (id: string | ObjectId) => Promise<TUser>;
     getUsers: ({ search, page, limit, sort, type, status, }: {
         search?: string | undefined;