@7365admin1/core 3.53.5 → 3.53.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +16 -0
- package/dist/index.js +1175 -1125
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +3186 -3132
- package/dist/index.mjs.map +1 -1
- package/package.json +2 -2
- package/test/invite-org-scope.test.mjs +1 -1
- package/test/invite-role-scope.test.mjs +236 -0
- package/test/member-staff-gate.test.mjs +1 -1
- package/test/verification-scope.test.mjs +96 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,21 @@
|
|
|
1
1
|
# @iservice365/core
|
|
2
2
|
|
|
3
|
+
## 3.53.7
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 185f92a: Scope the invitation list and cancel: `GET /api/verifications` refuses an estate-wide read to anyone who is not Seven365 staff, and `PUT /api/verifications/:id/cancel` authorizes against the stored verification's organisation.
|
|
8
|
+
|
|
9
|
+
## 3.53.6
|
|
10
|
+
|
|
11
|
+
### Patch Changes
|
|
12
|
+
|
|
13
|
+
- 21c73fe: Invitations may no longer hand out a role that belongs to another organisation, or a Seven365 console role.
|
|
14
|
+
|
|
15
|
+
Every invite endpoint validated `role` as `Joi.string().hex()` and nothing else, so the id could name any role in the collection and `acceptInvite` wrote it verbatim onto the new membership. `requireInviteReach` now also checks the stored role: a role carrying a different organisation, or a role of the platform-staff type on a non-staff invitation, is refused with a 400.
|
|
16
|
+
|
|
17
|
+
Org-less template roles, an organisation's own roles, site-pinned roles used elsewhere in the same organisation, and invitations that name no organisation are all unaffected.
|
|
18
|
+
|
|
3
19
|
## 3.53.5
|
|
4
20
|
|
|
5
21
|
### Patch Changes
|