@7365admin1/core 3.52.16 → 3.52.18

package/dist/index.mjs

@@ -18091,11 +18091,11 @@ async function requireUserFieldWrite(req, userId, field) {
 }
 
 // src/utils/user-response.util.ts
-function withoutCredentials(user) {
+function publicIdentity(user) {
   if (!user || typeof user !== "object")
     return user;
-  const { password, sid, ...rest } = user;
-  return rest;
+  const { _id, name, email } = user;
+  return { _id, name, email };
 }
 
 // src/controllers/user.controller.ts
@@ -18187,7 +18187,7 @@ function useUserController() {
         return;
       }
       const user = await _getByEmail(email);
-      res.json(withoutCredentials(user));
+      res.json(publicIdentity(user));
       return;
     } catch (error2) {
       logger24.log({ level: "error", message: `${error2.message}` });
@@ -31232,6 +31232,7 @@ function useSubscriptionController() {
       return;
     }
     try {
+      await requireOrgAccess(req, _id);
       const data = await _getByOrgId(_id);
       res.json(data);
       return;
@@ -31258,6 +31259,7 @@ function useSubscriptionController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
+      await requirePlatformStaff(req);
       const data = await _getSubscriptions({ search, page, status });
       res.json(data);
       return;
@@ -61241,10 +61243,20 @@ function usePatrolEmailController() {
     getById: _getById,
     deleteById: _deleteById
   } = usePatrolEmailService();
+  async function requirePatrolEmailReach(req, site) {
+    await requireSiteReach(req, site);
+  }
+  async function requireRecordReach(req, id) {
+    const record = await _getById(id);
+    await requirePatrolEmailReach(req, record?.site);
+    return record;
+  }
   async function send2(req, res, next) {
-    const { error, value } = schemaSendPatrolEmail.validate(req.body, {
-      abortEarly: false
-    });
+    const actor = await resolveInviteActor(callerId(req));
+    const { error, value } = schemaSendPatrolEmail.validate(
+      { ...req.body, createdBy: { _id: actor.id, name: actor.name } },
+      { abortEarly: false }
+    );
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
       logger114.log({ level: "error", message: messages });
@@ -61252,6 +61264,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requirePatrolEmailReach(req, value.site);
       const cookieHeader = req.headers.cookie;
       const data = await _send({
         site: value.site,
@@ -61295,6 +61308,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requireRecordReach(req, params.value.id);
       const data = await _resend({
         id: params.value.id,
         createdBy: value.createdBy,
@@ -61322,6 +61336,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requirePatrolEmailReach(req, value.site);
       res.json(await _getAll(value));
       return;
     } catch (err) {
@@ -61341,7 +61356,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
-      res.json({ data: await _getById(value.id) });
+      res.json({ data: await requireRecordReach(req, value.id) });
       return;
     } catch (err) {
       logger114.log({ level: "error", message: `${err.message}` });
@@ -61360,6 +61375,7 @@ function usePatrolEmailController() {
       return;
     }
     try {
+      await requireRecordReach(req, value.id);
       res.json({ message: await _deleteById(value.id) });
       return;
     } catch (err) {
@@ -86203,7 +86219,7 @@ function useUserControllerV2() {
       return rejectValidation(error, next);
     try {
       const user = await _getUserByEmail(value);
-      res.json(withoutCredentials(user));
+      res.json(publicIdentity(user));
       return;
     } catch (err) {
       logger202.log({ level: "error", message: `${err.message}` });