@7365admin1/core 3.52.14 → 3.52.15-staging.264

package/.changeset/preloved-customer-tenant-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope `GET /api/post-preloved` to the caller's entitled sites, stop a caller-supplied `status` from returning soft-deleted posts, and authorise the `org` on `GET /api/customers`.

package/dist/index.d.ts

@@ -10909,7 +10909,7 @@ declare function MPost(value: TPost): {
 declare function usePostPrelovedRepo(): {
     add: (value: TPost, session?: any) => Promise<ObjectId>;
     getById: (_id: string | ObjectId, userId?: string | ObjectId) => Promise<bson.Document>;
-    getAll: ({ search, page, limit, filter, site, status, category, subcategory, userId, }: {
+    getAll: ({ search, page, limit, filter, site, status, category, subcategory, userId, siteScope, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
@@ -10919,6 +10919,12 @@ declare function usePostPrelovedRepo(): {
         category?: string | ObjectId | undefined;
         subcategory?: (string | ObjectId)[] | undefined;
         userId?: string | undefined;
+        /**
+         * The sites this caller may be shown, or `null` for no restriction. Set
+         * only when the request named NO site - see `entitledSites`. Same
+         * parameter, same meaning, as `vehicle.repo.ts`.
+         */
+        siteScope?: string[] | null | undefined;
     }, session?: any) => Promise<{
         items: any[];
         pages: number;

package/dist/index.js

@@ -34435,6 +34435,7 @@ function useCustomerController() {
       }
     });
     try {
+      await requireOrgReach(req, org);
       const data = await _getAll({
         search,
         page,
@@ -86827,7 +86828,8 @@ function usePostPrelovedRepo() {
     status,
     category,
     subcategory,
-    userId
+    userId,
+    siteScope = null
   }, session) {
     page = page > 0 ? page - 1 : 0;
     if (site) {
@@ -86856,7 +86858,15 @@ function usePostPrelovedRepo() {
       }
     }
     const query2 = {
-      status: { $ne: "deleted" /* DELETED */ },
+      // `$ne` and `$in` are both operators on the SAME field, so Mongo ANDs
+      // them: a caller-supplied `status` narrows the answer but can never
+      // widen it back to deleted rows. Written as one object rather than two
+      // spreads because the second spread REPLACED the key - `?status=deleted`
+      // listed every soft-deleted post the noticeboard had hidden.
+      status: {
+        $ne: "deleted" /* DELETED */,
+        ...status && { $in: Array.isArray(status) ? status : [status] }
+      },
       ...site && { site },
       ...search && {
         $or: [
@@ -86864,9 +86874,16 @@ function usePostPrelovedRepo() {
           { description: { $regex: search, $options: "i" } }
         ]
       },
-      ...status && {
-        status: { $in: Array.isArray(status) ? status : [status] }
-      },
+      // The sites this caller may be shown, set only when the request named NO
+      // site - see `entitledSites`. Applied inside the query so the page counts
+      // describe what the caller can actually see. An EMPTY array is a real
+      // answer: `$in: []` matches nothing, which is the fail-closed side, so it
+      // is deliberately not collapsed into the falsy branch alongside `null`.
+      ...siteScope ? {
+        site: {
+          $in: siteScope.filter((id) => import_mongodb166.ObjectId.isValid(id)).map((id) => new import_mongodb166.ObjectId(id))
+        }
+      } : {},
       ...categoryId && { category: categoryId },
       ...subcategoryIds && { subcategory: { $in: subcategoryIds } }
     };
@@ -86979,7 +86996,14 @@ function usePostPrelovedRepo() {
       });
     }
     const query2 = {
-      status: { $ne: "deleted" /* DELETED */ },
+      // Same merge as `getAll` above, and for the same reason: the second
+      // spread replaced the key, so `?status=deleted` returned this owner's
+      // soft-deleted posts. Scope is unchanged here - the list is already
+      // bounded to one `createdBy`.
+      status: {
+        $ne: "deleted" /* DELETED */,
+        ...status && { $in: Array.isArray(status) ? status : [status] }
+      },
       createdBy: ownerObjectId,
       ...site && { site },
       ...search && {
@@ -86988,9 +87012,6 @@ function usePostPrelovedRepo() {
           { description: { $regex: search, $options: "i" } }
         ]
       },
-      ...status && {
-        status: { $in: Array.isArray(status) ? status : [status] }
-      },
       ...categoryIds && { category: { $in: categoryIds } }
     };
     const sortObj = buildSortObj(filter);
@@ -87391,12 +87412,16 @@ function usePostPrelovedController() {
       userId
     } = value;
     try {
+      const siteScope = site ? null : await entitledSites(req);
+      if (site)
+        await requireSiteReach(req, site);
       const data = await _getAll({
         page,
         limit,
         search,
         filter,
         site,
+        siteScope,
         status: status ? Array.isArray(status) ? status : [status] : void 0,
         category: category ?? void 0,
         subcategory: subcategory ? Array.isArray(subcategory) ? subcategory : [subcategory] : void 0,