@7365admin1/core 3.52.16-staging.267 → 3.52.17

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @iservice365/core
 
+## 3.52.17
+
+### Patch Changes
+
+- edf3a60: Restore and extend the site scoping on the patrol-log email endpoints.
+
+  #1967 added a `requireSiteReach` guard to `POST /api/patrol-logs/email`. #1981,
+  branched before #1967 landed, rewrote the same controller to add the history
+  endpoints and dropped the guard. Neither repo runs its tests in CI, so the e2e
+  test #1967 shipped has been failing on `main` unnoticed ever since.
+
+  All five endpoints now resolve the caller from the session: the two that name a
+  site (`send`, `getAll`) check that site, and the three that name a record
+  (`resend`, `getById`, `deleteById`) check the site stored on the record. The
+  `createdBy` pinning is restored with them, so a send cannot be filed under
+  another user's name.
+
+## 3.52.16
+
+### Patch Changes
+
+- e9419b3: Scope `GET /api/roles/id/:id`: a caller may read a role they themselves hold (resolved from the session's own `members` rows), otherwise the role's organisation rule applies. Closes the cross-tenant read of any organisation's role name and permissions.
+
 ## 3.52.15
 
 ### Patch Changes

package/dist/index.js

@@ -18680,11 +18680,11 @@ async function requireUserFieldWrite(req, userId, field) {
 }
 
 // src/utils/user-response.util.ts
-function publicIdentity(user) {
+function withoutCredentials(user) {
   if (!user || typeof user !== "object")
     return user;
-  const { _id, name, email } = user;
-  return { _id, name, email };
+  const { password, sid, ...rest } = user;
+  return rest;
 }
 
 // src/controllers/user.controller.ts
@@ -18776,7 +18776,7 @@ function useUserController() {
         return;
       }
       const user = await _getByEmail(email);
-      res.json(publicIdentity(user));
+      res.json(withoutCredentials(user));
       return;
     } catch (error2) {
       import_node_server_utils43.logger.log({ level: "error", message: `${error2.message}` });
@@ -31692,7 +31692,6 @@ function useSubscriptionController() {
       return;
     }
     try {
-      await requireOrgAccess(req, _id);
       const data = await _getByOrgId(_id);
       res.json(data);
       return;
@@ -31719,7 +31718,6 @@ function useSubscriptionController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
       const data = await _getSubscriptions({ search, page, status });
       res.json(data);
       return;
@@ -86096,7 +86094,7 @@ function useUserControllerV2() {
       return rejectValidation(error, next);
     try {
       const user = await _getUserByEmail(value);
-      res.json(publicIdentity(user));
+      res.json(withoutCredentials(user));
       return;
     } catch (err) {
       import_node_server_utils269.logger.log({ level: "error", message: `${err.message}` });