@7365admin1/core 3.52.14 → 3.52.15

package/dist/index.mjs

@@ -34005,6 +34005,7 @@ function useCustomerController() {
       }
     });
     try {
+      await requireOrgReach(req, org);
       const data = await _getAll({
         search,
         page,
@@ -86963,7 +86964,8 @@ function usePostPrelovedRepo() {
     status,
     category,
     subcategory,
-    userId
+    userId,
+    siteScope = null
   }, session) {
     page = page > 0 ? page - 1 : 0;
     if (site) {
@@ -86992,7 +86994,15 @@ function usePostPrelovedRepo() {
       }
     }
     const query2 = {
-      status: { $ne: "deleted" /* DELETED */ },
+      // `$ne` and `$in` are both operators on the SAME field, so Mongo ANDs
+      // them: a caller-supplied `status` narrows the answer but can never
+      // widen it back to deleted rows. Written as one object rather than two
+      // spreads because the second spread REPLACED the key - `?status=deleted`
+      // listed every soft-deleted post the noticeboard had hidden.
+      status: {
+        $ne: "deleted" /* DELETED */,
+        ...status && { $in: Array.isArray(status) ? status : [status] }
+      },
       ...site && { site },
       ...search && {
         $or: [
@@ -87000,9 +87010,16 @@ function usePostPrelovedRepo() {
           { description: { $regex: search, $options: "i" } }
         ]
       },
-      ...status && {
-        status: { $in: Array.isArray(status) ? status : [status] }
-      },
+      // The sites this caller may be shown, set only when the request named NO
+      // site - see `entitledSites`. Applied inside the query so the page counts
+      // describe what the caller can actually see. An EMPTY array is a real
+      // answer: `$in: []` matches nothing, which is the fail-closed side, so it
+      // is deliberately not collapsed into the falsy branch alongside `null`.
+      ...siteScope ? {
+        site: {
+          $in: siteScope.filter((id) => ObjectId166.isValid(id)).map((id) => new ObjectId166(id))
+        }
+      } : {},
       ...categoryId && { category: categoryId },
       ...subcategoryIds && { subcategory: { $in: subcategoryIds } }
     };
@@ -87115,7 +87132,14 @@ function usePostPrelovedRepo() {
       });
     }
     const query2 = {
-      status: { $ne: "deleted" /* DELETED */ },
+      // Same merge as `getAll` above, and for the same reason: the second
+      // spread replaced the key, so `?status=deleted` returned this owner's
+      // soft-deleted posts. Scope is unchanged here - the list is already
+      // bounded to one `createdBy`.
+      status: {
+        $ne: "deleted" /* DELETED */,
+        ...status && { $in: Array.isArray(status) ? status : [status] }
+      },
       createdBy: ownerObjectId,
       ...site && { site },
       ...search && {
@@ -87124,9 +87148,6 @@ function usePostPrelovedRepo() {
           { description: { $regex: search, $options: "i" } }
         ]
       },
-      ...status && {
-        status: { $in: Array.isArray(status) ? status : [status] }
-      },
       ...categoryIds && { category: { $in: categoryIds } }
     };
     const sortObj = buildSortObj(filter);
@@ -87532,12 +87553,16 @@ function usePostPrelovedController() {
       userId
     } = value;
     try {
+      const siteScope = site ? null : await entitledSites(req);
+      if (site)
+        await requireSiteReach(req, site);
       const data = await _getAll({
         page,
         limit,
         search,
         filter,
         site,
+        siteScope,
         status: status ? Array.isArray(status) ? status : [status] : void 0,
         category: category ?? void 0,
         subcategory: subcategory ? Array.isArray(subcategory) ? subcategory : [subcategory] : void 0,