@7365admin1/core 3.53.2 → 3.53.3

package/dist/index.mjs

@@ -10221,39 +10221,28 @@ import { ObjectId as ObjectId15 } from "mongodb";
 import { useAtlas as useAtlas8 } from "@7365admin1/node-server-utils";
 import { ObjectId as ObjectId14 } from "mongodb";
 var LIVE_ROLE = { status: { $ne: "deleted" } };
-async function isSuperAdmin(userId) {
+async function resolveStaffRole(userId) {
   const id = userId?.toString() ?? "";
   if (!id || !ObjectId14.isValid(id))
-    return false;
+    return null;
   const db2 = useAtlas8.getDb();
   if (!db2)
-    return false;
+    return null;
   const member = await db2.collection("members").findOne({
     user: new ObjectId14(id),
     type: "admin",
     status: { $ne: "deleted" }
   });
   if (!member?.role || !ObjectId14.isValid(member.role.toString()))
-    return false;
+    return null;
   const role = await db2.collection("roles").findOne({ _id: new ObjectId14(member.role.toString()), ...LIVE_ROLE });
-  return role?.type === "admin";
+  return role?.type === "admin" ? role : null;
+}
+async function isSuperAdmin(userId) {
+  return await resolveStaffRole(userId) !== null;
 }
 async function isPlatformOwner(userId) {
-  const id = userId?.toString() ?? "";
-  if (!id || !ObjectId14.isValid(id))
-    return false;
-  const db2 = useAtlas8.getDb();
-  if (!db2)
-    return false;
-  const member = await db2.collection("members").findOne({
-    user: new ObjectId14(id),
-    type: "admin",
-    status: { $ne: "deleted" }
-  });
-  if (!member?.role || !ObjectId14.isValid(member.role.toString()))
-    return false;
-  const role = await db2.collection("roles").findOne({ _id: new ObjectId14(member.role.toString()), ...LIVE_ROLE });
-  return role?.type === "admin" && role?.default === true;
+  return (await resolveStaffRole(userId))?.default === true;
 }
 
 // src/utils/org-suspension.util.ts
@@ -18072,32 +18061,127 @@ function usePersonRepo() {
 
 // src/utils/console-authz.util.ts
 import { UnauthorizedError as UnauthorizedError3 } from "@7365admin1/node-server-utils";
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name) => `${name}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name) => consoleSpellings(resource, name).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+
+// src/utils/console-authz.util.ts
 function callerId(req) {
   const user = req.user;
   return user?.user?.toString?.() || user?._id?.toString?.() || "";
 }
-async function requirePlatformStaff(req) {
+async function requirePlatformStaff(req, grant) {
   const id = callerId(req);
-  if (!id || !await isSuperAdmin(id)) {
+  const role = id ? await resolveStaffRole(id) : null;
+  if (!role) {
+    throw new UnauthorizedError3("Not authorized.");
+  }
+  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
     throw new UnauthorizedError3("Not authorized.");
   }
   return id;
 }
-async function requireSelfOrPlatformStaff(req, userId) {
+async function requireConsolePermission(req, resource, action) {
+  return await requirePlatformStaff(req, { resource, action });
+}
+async function requireSelfOrPlatformStaff(req, userId, grant) {
   const id = callerId(req);
   const target = userId?.toString() ?? "";
   if (id && target && target === id)
     return id;
-  return await requirePlatformStaff(req);
+  return await requirePlatformStaff(req, grant);
 }
 async function requireOrgAccess(req, orgId) {
   return await requireOrgReach(req, orgId);
 }
-async function requirePlatformOwner(req) {
+async function requirePlatformOwner(req, grant) {
   const id = callerId(req);
   if (!id || !await isPlatformOwner(id)) {
     throw new UnauthorizedError3("Not authorized.");
   }
+  if (grant)
+    await requirePlatformStaff(req, grant);
   return id;
 }
 async function requireOrgReach(req, orgId) {
@@ -18124,10 +18208,10 @@ async function requireInviteReach(req, org, app) {
   if (org)
     await requireOrgReach(req, org);
 }
-async function requireUserFieldWrite(req, userId, field) {
+async function requireUserFieldWrite(req, userId, field, grant) {
   if (field === "email")
-    return await requirePlatformStaff(req);
-  return await requireSelfOrPlatformStaff(req, userId);
+    return await requirePlatformStaff(req, grant);
+  return await requireSelfOrPlatformStaff(req, userId, grant);
 }
 
 // src/utils/user-response.util.ts
@@ -18167,7 +18251,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users", action: "see-user-details" });
       const user = await _getById(_id);
       res.json(user);
       return;
@@ -18252,7 +18336,7 @@ function useUserController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "users", "see-all-users");
       const data = await _getUsers({ search, page, status });
       res.json(data);
       return;
@@ -18347,7 +18431,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       const message = await _updateBirthday({ _id, ...payload });
       res.json({ message });
       return;
@@ -18389,7 +18473,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field);
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
       let message;
       if (payload.field === "plateNumber") {
         message = await updatePlateNumberByUserId(
@@ -18431,7 +18515,7 @@ function useUserController() {
     const newPassword = req.body.newPassword ?? "";
     const passwordConfirmation = req.body.passwordConfirmation ?? "";
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       await _updatePasswordById(
         _id,
         currentPassword,
@@ -18540,7 +18624,7 @@ function useRoleService() {
 async function requireRoleOrg(req, org) {
   const orgId = org?.toString() ?? "";
   if (!orgId) {
-    await requirePlatformStaff(req);
+    await requireConsolePermission(req, "roles-and-permissions");
     return;
   }
   await requireOrgAccess(req, orgId);
@@ -18582,7 +18666,7 @@ function useRoleController() {
     }
     try {
       if (payload.type === PLATFORM_STAFF_ROLE_TYPE) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "roles-and-permissions", "add-role");
       }
       if (payload.org) {
         await requireOrgReach(req, payload.org);
@@ -26207,7 +26291,7 @@ async function entitledSites(req) {
 async function requireMemberOrg(req, org) {
   const orgId = org?.toString() ?? "";
   if (!orgId) {
-    await requirePlatformStaff(req);
+    await requireConsolePermission(req, "members");
     return;
   }
   await requireOrgAccess(req, orgId);
@@ -26254,7 +26338,7 @@ function useMemberController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, userId);
+      await requireSelfOrPlatformStaff(req, userId, { resource: "members", action: "view-members" });
       const data = await _getByUserId(userId);
       res.json(data);
       return;
@@ -26304,7 +26388,7 @@ function useMemberController() {
     const user = req.params.id;
     const type = req.params.type;
     try {
-      await requireSelfOrPlatformStaff(req, user);
+      await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
       const data = await _getByUserIdType(user, type);
       res.json(data);
       return;
@@ -26350,11 +26434,11 @@ function useMemberController() {
     }
     try {
       if (type === "admin") {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "members", "view-members");
       } else if (org) {
         await requireOrgAccess(req, org);
       } else if (user && user !== callerId(req)) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "users", "see-all-users");
       }
       const items = await _getAll({
         search,
@@ -26549,7 +26633,7 @@ function useMemberController() {
     const type = req.params.type;
     const org = req.query.org;
     try {
-      await requireSelfOrPlatformStaff(req, user);
+      await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
       const data = await _getByUserIdTypeOrg(
         user,
         type,
@@ -28405,7 +28489,7 @@ function useOrgController() {
       return;
     }
     try {
-      const createdBy = await requirePlatformStaff(req);
+      const createdBy = await requireConsolePermission(req, "organizations");
       await _add({ ...req.body, createdBy });
       res.status(201).json({ message: "Successfully created organization." });
       return;
@@ -28511,7 +28595,7 @@ function useOrgController() {
     const type = req.query.type ?? "";
     try {
       if (user !== callerId(req)) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "organizations", "see-all-organizations");
       }
       const data = await getOrgsByMembership({
         search,
@@ -28538,7 +28622,7 @@ function useOrgController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-organization-details");
       const data = await _getByName(name);
       res.json(data);
       return;
@@ -28576,7 +28660,7 @@ function useOrgController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-organization-details");
       const data = await _getByEmail(email);
       if (!data) {
         next(new NotFoundError17("Organization not found."));
@@ -28606,7 +28690,7 @@ function useOrgController() {
     try {
       const self = await _getUserById(callerId(req)).catch(() => null);
       if (!self?.email || self.email.toLowerCase() !== email.toLowerCase()) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "organizations", "see-all-organizations");
       }
       const data = await _getOrgsByEmail(email);
       res.json(data);
@@ -28666,7 +28750,7 @@ function useOrgController() {
     const orgId = req.params.id;
     const { status } = req.body;
     try {
-      const ownerId = await requirePlatformOwner(req);
+      const ownerId = await requirePlatformOwner(req, { resource: "organizations" });
       await _updateStatusById(orgId, status);
       const subscription = await _getSubscriptionByOrgId(orgId);
       if (subscription) {
@@ -28737,7 +28821,7 @@ function useOrgControllerV2() {
     const nature = value.nature ?? "";
     const status = value.status;
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-all-organizations");
       const data = await _getAll({
         search,
         page,
@@ -28774,7 +28858,7 @@ function useOrgControllerV2() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-all-organizations");
       const data = await _getOrganizationsWithSubscription({
         search: value.search ?? "",
         page: value.page ?? 1,
@@ -31303,7 +31387,7 @@ function useSubscriptionController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const id = await _add(payload);
       res.status(201).json({ message: "Successfully added subscription.", id });
       return;
@@ -31350,7 +31434,7 @@ function useSubscriptionController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "see-all-subscriptions");
       const data = await _getSubscriptions({ search, page, status });
       res.json(data);
       return;
@@ -31484,7 +31568,7 @@ function useSubscriptionController() {
   }
   async function createConsoleSubscription(req, res, next) {
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const form = await readConsoleForm(req);
       const existing = await _getByOrgId(form.orgId);
       if (existing && existing.status !== "ended") {
@@ -31530,7 +31614,7 @@ function useSubscriptionController() {
   }
   async function updateConsoleSubscription(req, res, next) {
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const form = await readConsoleForm(req);
       const existing = await _getByOrgId(form.orgId);
       if (!existing?._id) {
@@ -31570,7 +31654,7 @@ function useSubscriptionController() {
   }
   async function getConsoleSubscription(req, res, next) {
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "see-subscription-details");
       const orgId = req.params.id;
       if (!/^[0-9a-fA-F]{24}$/.test(orgId ?? "")) {
         throw new BadRequestError70("That client could not be found.");
@@ -31639,7 +31723,7 @@ function useSubscriptionPlanController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const _id = await _add(req.body);
       const data = await _getById(_id);
       await recordConsoleAction({
@@ -31735,7 +31819,7 @@ function useSubscriptionPlanController() {
     }
     const id = req.params.id;
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const before = await _getById(id);
       await _update(id, req.body);
       const data = await _getById(id);
@@ -31767,7 +31851,7 @@ function useSubscriptionPlanController() {
     const id = req.params.id;
     const { status } = req.body;
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       await _updateStatusById(id, status);
       const data = await _getById(id);
       await recordConsoleAction({
@@ -31912,7 +31996,7 @@ function usePromoCodeController() {
     payload.code = payload.code.trim().toUpperCase();
     payload.fixed_rate = parseInt(payload.fixed_rate ?? "0");
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "create-promo-code");
       const created = await _add(payload);
       await recordConsoleAction({
         action: "promo-code.created" /* PROMO_CODE_CREATED */,
@@ -31965,7 +32049,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "promo-codes", "see-promo-code-details");
       const data = await _getById(_id);
       res.json(data);
       return;
@@ -31994,7 +32078,7 @@ function usePromoCodeController() {
     const limit = parseInt(req.query.limit ?? "10");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "promo-codes");
       const data = await _getPromoCodes({
         search,
         page,
@@ -32019,7 +32103,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "edit-promo-code-details");
       const before = await _getById(req.params.id);
       await _updateById(req.params.id, req.body);
       await recordConsoleAction({
@@ -32055,7 +32139,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "change-promo-code-status");
       await _updateStatusById(req.params.id, status.value.status);
       await recordConsoleAction({
         action: "promo-code.status-changed" /* PROMO_CODE_STATUS_CHANGED */,
@@ -32084,7 +32168,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "delete-promo-code");
       await _softDeleteById(req.params.id, staffId);
       await recordConsoleAction({
         action: "promo-code.removed" /* PROMO_CODE_REMOVED */,
@@ -86473,7 +86557,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, value);
+      await requireSelfOrPlatformStaff(req, value, { resource: "users", action: "see-user-details" });
       const user = await _getById(value);
       res.json(user);
       return;
@@ -86510,7 +86594,7 @@ function useUserControllerV2() {
     if (error)
       return rejectValidation(error, next);
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "users", "see-all-users");
       const users = await _getUsers({
         search: value.search ?? "",
         page: value.page,
@@ -86635,7 +86719,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       const message = await _updateBirthday({ _id, ...payload });
       res.json({ message });
       return;
@@ -86667,7 +86751,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field);
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
       const message = await _updateUserFieldById({ _id, ...payload });
       res.json({ message });
       return;
@@ -86698,7 +86782,7 @@ function useUserControllerV2() {
     const newPassword = req.body.newPassword ?? "";
     const passwordConfirmation = req.body.passwordConfirmation ?? "";
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       await _updatePasswordById(
         _id,
         currentPassword,
@@ -86882,7 +86966,7 @@ function useRoleControllerV2() {
     }
     try {
       if (value.type === PLATFORM_STAFF_ROLE_TYPE) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "roles-and-permissions", "add-role");
       }
       if (value.org) {
         await requireOrgReach(req, value.org);
@@ -91616,7 +91700,7 @@ function usePlatformTermsController() {
       return id;
     }
     if (staffMayRead) {
-      return await requirePlatformStaff(req);
+      return await requireConsolePermission(req, "platform-terms", "see-platform-terms");
     }
     throw new UnauthorizedError23("Not authorized.");
   }
@@ -91708,7 +91792,7 @@ function usePlatformTermsController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "platform-terms", "see-platform-terms");
       res.json(
         await _listAcceptance({
           version: value.version || null,
@@ -91740,7 +91824,7 @@ function usePlatformTermsController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "platform-terms", "edit-platform-terms");
       const created = await _add({
         terms: value.terms,
         policies: value.policies,
@@ -91798,7 +91882,7 @@ function useConsoleAuditController() {
     }
     const to = value.to && value.to.length === 10 ? `${value.to}T23:59:59.999Z` : value.to;
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "activity-history", "see-activity-history");
       res.json(
         await _list({
           org: value.org || "",
@@ -92464,6 +92548,7 @@ export {
   resolveHidPhysicalCardValue,
   resolveInviteActor,
   resolveSiteTimezone,
+  resolveStaffRole,
   robotSchema,
   rtspUrl,
   schema,