@7365admin1/core 3.48.1-staging.206 → 3.48.1-staging.207

package/.changeset/organization-and-promo-list-scope.md

@@ -0,0 +1,39 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the organisation list to the caller, and put the promo-code list behind the staff gate.
+
+`GET /api/organizations` and `GET /api/promo-codes` performed no authorization
+at all — `requireAuth` and nothing more — while every sibling handler in the
+same two files guarded. So any signed-in account on the platform, a resident or
+a cleaner included, could page through the name, e-mail, nature and status of
+**every Seven365 client**, and read off **every discount code** we have ever
+minted, with its rate and its expiry, and then redeem whichever is worth most.
+
+The two rules are different, because the callers are different.
+
+**`GET /api/organizations` is now a SCOPE, not a refusal.** Seven365 staff see
+every organisation exactly as before; anybody else sees the organisations they
+hold a live membership of, plus any registered under their own verified account
+e-mail. The e-mail half is not decoration: `web-app-main
+pages/verify/email/index.vue:322` — the org-owner self-signup — lists
+organisations to find the one it created a line earlier, at which point that
+brand-new client owner is a member of nothing. Refusing them would have traded
+the leak for a broken signup. The comparison is the one
+`getOrgsByEmail` already makes, against the address on the caller's own `users`
+row; nothing the caller sends takes part in it. It also removes a real bug from
+that flow: the page takes `items[0]` of a newest-first list, so two client
+owners signing up in the same moment could be handed each other's organisation
+as their `defaultOrg`.
+
+The scope is part of the Redis cache key as well as the query, so one caller's
+narrowed page is never replayed to the next, and `countDocuments` runs the
+scoped query so pagination cannot walk past the scope.
+
+**`GET /api/promo-codes` is Seven365 staff only,** together with
+`GET /api/promo-codes/id/:id`, which is the same disclosure one record at a
+time. Both are read solely by the staff console. A client at checkout is
+unaffected: `web-app-org pages/checkout.vue` and
+`subscription/manage-seats.vue` type a code and validate it through
+`GET /api/promo-codes/code`, which stays signed-in-only and is untouched.

package/dist/index.d.ts

@@ -702,13 +702,17 @@ declare function useOrgRepo(): {
     createUniqueIndex: () => Promise<void>;
     add: (value: TOrg, session?: ClientSession) => Promise<ObjectId>;
     update: (id: string, value: Partial<TOrg>, session?: ClientSession) => Promise<string>;
-    getAll: ({ search, page, limit, sort, status, nature, }: {
+    getAll: ({ search, page, limit, sort, status, nature, scope, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
         sort?: Record<string, number> | undefined;
         status?: string | undefined;
         nature?: string | undefined;
+        scope?: {
+            orgIds?: string[] | undefined;
+            email?: string | undefined;
+        } | undefined;
     }) => Promise<{
         items: any[];
         pages: number;

package/dist/index.js

@@ -11739,7 +11739,8 @@ function useOrgRepo() {
     limit = 10,
     sort = {},
     status = "active",
-    nature = ""
+    nature = "",
+    scope
   }) {
     const query2 = { status };
     sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
@@ -11749,6 +11750,22 @@ function useOrgRepo() {
       page,
       limit
     };
+    if (scope) {
+      const ids2 = Array.from(
+        new Set((scope.orgIds ?? []).filter((id) => import_mongodb19.ObjectId.isValid(id)))
+      ).sort();
+      const email = (scope.email ?? "").trim();
+      const reach = [];
+      if (ids2.length)
+        reach.push({ _id: { $in: ids2.map((id) => new import_mongodb19.ObjectId(id)) } });
+      if (email)
+        reach.push({ email });
+      if (!reach.length) {
+        return (0, import_node_server_utils21.paginate)([], page > 0 ? page - 1 : 0, limit, 0);
+      }
+      query2.$or = reach;
+      cacheOptions.scope = `${ids2.join(",")}|${email.toLowerCase()}`;
+    }
     if (search) {
       query2.$text = { $search: search };
       cacheOptions.search = search;
@@ -27890,11 +27907,19 @@ function useOrgController() {
     const limit = parseInt(req.query.limit ?? "10");
     const nature = req.query.nature ?? "";
     try {
+      const id = callerId(req);
+      const actor = await resolveInviteActor(id);
+      let scope;
+      if (!actor.isSuperAdmin) {
+        const self = await _getUserById(id).catch(() => null);
+        scope = { orgIds: actor.orgIds, email: self?.email ?? "" };
+      }
       const data = await _getAll({
         search,
         page,
         limit,
-        nature
+        nature,
+        scope
       });
       res.json(data);
       return;
@@ -31336,6 +31361,7 @@ function usePromoCodeController() {
       return;
     }
     try {
+      await requirePlatformStaff(req);
       const data = await _getById(_id);
       res.json(data);
       return;
@@ -31364,6 +31390,7 @@ function usePromoCodeController() {
     const limit = parseInt(req.query.limit ?? "10");
     const status = req.query.status ?? "active";
     try {
+      await requirePlatformStaff(req);
       const data = await _getPromoCodes({
         search,
         page,