@7365admin1/core 3.52.16-staging.265 → 3.52.16-staging.266

package/.changeset/patrol-email-scope-restore.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+Restore and extend the site scoping on the patrol-log email endpoints.
+
+#1967 added a `requireSiteReach` guard to `POST /api/patrol-logs/email`. #1981,
+branched before #1967 landed, rewrote the same controller to add the history
+endpoints and dropped the guard. Neither repo runs its tests in CI, so the e2e
+test #1967 shipped has been failing on `main` unnoticed ever since.
+
+All five endpoints now resolve the caller from the session: the two that name a
+site (`send`, `getAll`) check that site, and the three that name a record
+(`resend`, `getById`, `deleteById`) check the site stored on the record. The
+`createdBy` pinning is restored with them, so a send cannot be filed under
+another user's name.

package/dist/index.js

@@ -61485,10 +61485,20 @@ function usePatrolEmailController() {
     getById: _getById,
     deleteById: _deleteById
   } = usePatrolEmailService();
+  async function requirePatrolEmailReach(req, site) {
+    await requireSiteReach(req, site);
+  }
+  async function requireRecordReach(req, id) {
+    const record = await _getById(id);
+    await requirePatrolEmailReach(req, record?.site);
+    return record;
+  }
   async function send2(req, res, next) {
-    const { error, value } = schemaSendPatrolEmail.validate(req.body, {
-      abortEarly: false
-    });
+    const actor = await resolveInviteActor(callerId(req));
+    const { error, value } = schemaSendPatrolEmail.validate(
+      { ...req.body, createdBy: { _id: actor.id, name: actor.name } },
+      { abortEarly: false }
+    );
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
       import_node_server_utils163.logger.log({ level: "error", message: messages });
@@ -61496,6 +61506,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requirePatrolEmailReach(req, value.site);
       const cookieHeader = req.headers.cookie;
       const data = await _send({
         site: value.site,
@@ -61539,6 +61550,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requireRecordReach(req, params.value.id);
       const data = await _resend({
         id: params.value.id,
         createdBy: value.createdBy,
@@ -61566,6 +61578,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requirePatrolEmailReach(req, value.site);
       res.json(await _getAll(value));
       return;
     } catch (err) {
@@ -61585,7 +61598,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
-      res.json({ data: await _getById(value.id) });
+      res.json({ data: await requireRecordReach(req, value.id) });
       return;
     } catch (err) {
       import_node_server_utils163.logger.log({ level: "error", message: `${err.message}` });
@@ -61604,6 +61617,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requireRecordReach(req, value.id);
       res.json({ message: await _deleteById(value.id) });
       return;
     } catch (err) {