@7365admin1/core 3.52.12-staging.260 → 3.52.12

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @iservice365/core
 
+## 3.52.12
+
+### Patch Changes
+
+- 855d32b: Scope the building, unit and level lists to the caller's own sites
+
+  `GET /api/buildings`, `GET /api/building-units` and `GET /api/building-levels`
+  took an optional `site` and applied it as a plain filter, so a request that
+  named none was answered from the whole collection — every client's estate. An
+  explicit site was never authorised either. `GET /api/building-units/site/:site`,
+  which returns units together with their owners, took the site from the URL and
+  checked nothing.
+
+  All four now use the same rule the vehicle, visitor, document and camera lists
+  use: an explicit site goes through `requireSiteReach`, and no site falls back to
+  `entitledSites`. The restriction is part of the Redis cache key as well as the
+  query, so one caller's page is not served to another.
+
 ## 3.52.11
 
 ### Patch Changes

package/dist/index.js

@@ -52460,7 +52460,7 @@ function useVisitorTransactionService() {
         unitName: unit?.name,
         org: inviter?.org?.toString(),
         site: inviter?.site.toString(),
-        status: value?.type === "contractor" ? isAutoApprovedInvitation ? "approved" /* APPROVED */ : "pending" /* PENDING */ : "approved" /* APPROVED */,
+        status: value?.type === "contractor" ? isAutoApprovedInvitation ? "approved" /* APPROVED */ : "pending" /* PENDING */ : "pending" /* PENDING */,
         inviterId: userId
       };
       const leadId = new import_mongodb86.ObjectId();