@7365admin1/core 3.52.1-staging.231 → 3.52.1-staging.233
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.changeset/onboarding-org-update-reach.md +17 -0
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +1 -1
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
- package/test/e2e/harness.mjs +11 -0
- package/test/e2e/onboarding-wizard-walk.e2e.test.mjs +370 -0
- package/test/e2e/organization-update-onboarding.e2e.test.mjs +248 -0
- package/test/staff-console-authz.test.mjs +8 -1
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
---
|
|
2
|
+
"@7365admin1/core": patch
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
Let a client owner save their organisation details during onboarding.
|
|
6
|
+
|
|
7
|
+
`PUT /api/organizations/:id` — the write behind step 1 of the onboarding wizard —
|
|
8
|
+
was gated on `requireOrgAccess` (staff, or a live member of the organisation).
|
|
9
|
+
The client owner has no `members` row at that point; theirs is created at the
|
|
10
|
+
last step of the wizard. Every new client therefore got 401 on the first step of
|
|
11
|
+
onboarding and could not leave it.
|
|
12
|
+
|
|
13
|
+
The gate is now `requireOrgReach`: staff, a live member, **or** somebody holding
|
|
14
|
+
an invitation naming that organisation — the same rule the roles, members and
|
|
15
|
+
invite endpoints already use for the three pre-membership flows. Nothing is
|
|
16
|
+
widened: a member of another client, and a caller holding only a password-reset
|
|
17
|
+
row, are still refused.
|
package/dist/index.js
CHANGED
|
@@ -28387,7 +28387,7 @@ function useOrgController() {
|
|
|
28387
28387
|
}
|
|
28388
28388
|
const id = req.params.id;
|
|
28389
28389
|
try {
|
|
28390
|
-
await
|
|
28390
|
+
await requireOrgReach(req, id);
|
|
28391
28391
|
await _update(id, req.body);
|
|
28392
28392
|
const data = await _getById(id);
|
|
28393
28393
|
res.json({
|