@7365admin1/core 3.52.16-staging.266 → 3.52.16-staging.268

package/.changeset/org-update-diagnosable-error.md

@@ -0,0 +1,14 @@
+---
+"@7365admin1/core": patch
+---
+
+Say what is wrong when an organisation cannot be saved.
+
+`PUT /api/organizations/:id` — the write behind onboarding step 1 and the staff
+Client List edit — collapsed every MongoDB write error into a 500 reading
+"Failed to update organization.", with only `error.message` in the log. A
+duplicate-key refusal (the `organizations` collection still carries a unique
+index an earlier version of this file created and nothing ever dropped) is now
+a 400 naming the field the caller has to change, a typed error raised
+underneath is no longer turned into a 500, and the log line carries the error
+name, code, key and the organisation id.

package/.changeset/user-email-allowlist-subscription-authz.md

@@ -0,0 +1,21 @@
+---
+"@7365admin1/core": patch
+---
+
+Narrow the account-by-e-mail lookup to identity only, and scope the two open subscription reads
+
+`GET /api/users/email/:email` and its v2 twin `GET /api/users/v2/email/:email`
+stripped the password hash and session id from the reply but answered every
+other stored field, so any signed-in account could read any other account's
+NRIC, contact number, date of birth, gender, default organisation, status and
+profile just by knowing the e-mail address — across every client on the
+platform. Both now answer `{_id, name, email}` and nothing else. An
+organisation gate would have been the wrong fix: this endpoint exists for the
+invite flow, where the person being looked up is deliberately not in the
+caller's organisation yet.
+
+`GET /api/subscriptions/org/:id` answered any organisation's billing record —
+plan, seat count, price, currency, renewal date — to any signed-in account, and
+`GET /api/subscriptions/` answered every subscription on the platform in one
+list. They now carry `requireOrgAccess` and `requirePlatformStaff`, the two
+gates already used elsewhere in the same file.

package/dist/index.js

@@ -11683,6 +11683,19 @@ function MOrg(value) {
 
 // src/repositories/organization.repo.ts
 var import_mongodb19 = require("mongodb");
+var DUPLICATE_FIELD_LABEL = {
+  name: "name",
+  email: "email address"
+};
+function duplicatedField(error) {
+  if (error?.code !== 11e3 && !/duplicate/i.test(error?.message ?? "")) {
+    return "";
+  }
+  const fromPattern = Object.keys(error?.keyPattern ?? {})[0];
+  if (fromPattern)
+    return fromPattern;
+  return /index:\s*([A-Za-z0-9_]+?)_\d/.exec(error?.message ?? "")?.[1] ?? "";
+}
 function useOrgRepo() {
   const db2 = import_node_server_utils21.useAtlas.getDb();
   if (!db2) {
@@ -11764,8 +11777,21 @@ function useOrgRepo() {
       await delNamespace();
       return id;
     } catch (error) {
-      import_node_server_utils21.logger.log({ level: "error", message: error.message });
-      throw new import_node_server_utils21.InternalServerError("Failed to update organization.");
+      import_node_server_utils21.logger.log({
+        level: "error",
+        message: `Organization update failed for ${id}: ${error?.name ?? "Error"}${error?.code !== void 0 ? ` code=${error.code}` : ""}${duplicatedField(error) ? ` key=${duplicatedField(error)}` : ""} fields=[${Object.keys(value ?? {}).join(",")}] ${error?.message ?? ""}`
+      });
+      if (error instanceof import_node_server_utils21.AppError)
+        throw error;
+      const field = duplicatedField(error);
+      if (field) {
+        throw new import_node_server_utils21.BadRequestError(
+          `Another organization already uses this ${DUPLICATE_FIELD_LABEL[field] ?? field}. Please use a different one.`
+        );
+      }
+      throw new import_node_server_utils21.InternalServerError(
+        `Failed to update organization${error?.code !== void 0 ? ` (${error.code})` : ""}.`
+      );
     }
   }
   async function getAll({
@@ -18680,11 +18706,11 @@ async function requireUserFieldWrite(req, userId, field) {
 }
 
 // src/utils/user-response.util.ts
-function withoutCredentials(user) {
+function publicIdentity(user) {
   if (!user || typeof user !== "object")
     return user;
-  const { password, sid, ...rest } = user;
-  return rest;
+  const { _id, name, email } = user;
+  return { _id, name, email };
 }
 
 // src/controllers/user.controller.ts
@@ -18776,7 +18802,7 @@ function useUserController() {
         return;
       }
       const user = await _getByEmail(email);
-      res.json(withoutCredentials(user));
+      res.json(publicIdentity(user));
       return;
     } catch (error2) {
       import_node_server_utils43.logger.log({ level: "error", message: `${error2.message}` });
@@ -31692,6 +31718,7 @@ function useSubscriptionController() {
       return;
     }
     try {
+      await requireOrgAccess(req, _id);
       const data = await _getByOrgId(_id);
       res.json(data);
       return;
@@ -31718,6 +31745,7 @@ function useSubscriptionController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
+      await requirePlatformStaff(req);
       const data = await _getSubscriptions({ search, page, status });
       res.json(data);
       return;
@@ -86094,7 +86122,7 @@ function useUserControllerV2() {
       return rejectValidation(error, next);
     try {
       const user = await _getUserByEmail(value);
-      res.json(withoutCredentials(user));
+      res.json(publicIdentity(user));
       return;
     } catch (err) {
       import_node_server_utils269.logger.log({ level: "error", message: `${err.message}` });