@7365admin1/core 3.53.1 → 3.53.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/core
 
+## 3.53.2
+
+### Patch Changes
+
+- 972c701: Scope file deletion to the uploader's tenant. New uploads are stamped with the caller's user id server-side; a stamped file can only be deleted by its uploader, someone sharing an organisation with them, or a super admin. Files with no stamp (everything uploaded before this change, and the anonymous resident sign-up upload) behave exactly as before — no backfill, no migration.
+
 ## 3.53.1
 
 ### Patch Changes

package/dist/index.d.ts

@@ -644,6 +644,13 @@ type TFile = {
     size?: number;
     status?: string;
     createdAt: string;
+    /**
+     * The signed-in user who uploaded this file, stamped server-side from the
+     * session. OPTIONAL on purpose: every row written before this shipped has no
+     * stamp, and the delete gate leaves those exactly as they were. See
+     * `utils/file-owner.util.ts`.
+     */
+    createdBy?: string;
 };
 declare class MFile implements TFile {
     _id?: ObjectId;
@@ -652,6 +659,7 @@ declare class MFile implements TFile {
     size?: number;
     status?: string;
     createdAt: string;
+    createdBy?: string;
     constructor(value: TFile);
 }
 
@@ -665,7 +673,7 @@ declare function useFileRepo(): {
 };
 
 declare function useFileService(): {
-    createFile: (value: Express.Multer.File, folder?: string) => Promise<string>;
+    createFile: (value: Express.Multer.File, folder?: string, createdBy?: string) => Promise<string>;
     deleteFile: (id: string) => Promise<string>;
     deleteDraft: () => void;
 };

package/dist/index.js

@@ -16836,6 +16836,8 @@ var MFile = class {
     this.size = value.size ?? 0;
     this.status = value.status ?? "draft";
     this.createdAt = value.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+    if (value.createdBy)
+      this.createdBy = value.createdBy.toString();
   }
 };
 
@@ -22532,13 +22534,14 @@ function useFileService() {
     bucket: SPACES_BUCKET,
     forcePathStyle: true
   });
-  async function createFile(value, folder = "default") {
+  async function createFile(value, folder = "default", createdBy) {
     const session = import_node_server_utils51.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     const file = {
       name: value.originalname,
       size: value.size ?? (value.buffer ? value.buffer.length : 0),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...createdBy ? { createdBy } : {}
     };
     try {
       const id = await _createFile(file, session);
@@ -27624,6 +27627,49 @@ function useVerificationController() {
 // src/controllers/file.controller.ts
 var import_node_server_utils59 = require("@7365admin1/node-server-utils");
 var import_joi27 = __toESM(require("joi"));
+
+// src/utils/file-owner.util.ts
+function fileOwnerId(file) {
+  return file?.createdBy?.toString?.() ?? "";
+}
+function mayDeleteFile(params) {
+  if (!params.ownerId)
+    return true;
+  if (!params.callerId)
+    return false;
+  if (params.callerId === params.ownerId)
+    return true;
+  if (params.callerIsSuperAdmin)
+    return true;
+  const ownerOrgs = new Set((params.ownerOrgIds ?? []).map(String));
+  return (params.callerOrgIds ?? []).some((org) => ownerOrgs.has(String(org)));
+}
+
+// src/controllers/file.controller.ts
+async function requireFileDelete(req, file) {
+  const ownerId = fileOwnerId(file);
+  if (!ownerId)
+    return;
+  const caller = callerId(req);
+  if (!caller)
+    throw new import_node_server_utils59.UnauthorizedError("Not authorized.");
+  if (caller === ownerId)
+    return;
+  const [me, owner] = await Promise.all([
+    resolveInviteActor(caller),
+    resolveInviteActor(ownerId)
+  ]);
+  if (mayDeleteFile({
+    ownerId,
+    callerId: caller,
+    callerIsSuperAdmin: me.isSuperAdmin,
+    callerOrgIds: me.orgIds,
+    ownerOrgIds: owner.orgIds
+  })) {
+    return;
+  }
+  throw new import_node_server_utils59.UnauthorizedError("Not authorized.");
+}
 function useFileController() {
   const { createFile, deleteFile: _deleteFile } = useFileService();
   const { getFileById: _getFileById } = useFileRepo();
@@ -27633,7 +27679,7 @@ function useFileController() {
       return;
     }
     try {
-      const id = await createFile(req.file);
+      const id = await createFile(req.file, "default", callerId(req) || void 0);
       res.status(201).json({ message: "Successfully uploaded file", id });
       return;
     } catch (error) {
@@ -27652,6 +27698,7 @@ function useFileController() {
       return;
     }
     try {
+      await requireFileDelete(req, await _getFileById(_id));
       const message = await _deleteFile(_id);
       res.json({ message });
       return;