@7365admin1/core 3.53.6 → 3.53.7

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/core
 
+## 3.53.7
+
+### Patch Changes
+
+- 185f92a: Scope the invitation list and cancel: `GET /api/verifications` refuses an estate-wide read to anyone who is not Seven365 staff, and `PUT /api/verifications/:id/cancel` authorizes against the stored verification's organisation.
+
 ## 3.53.6
 
 ### Patch Changes

package/dist/index.js

@@ -15682,6 +15682,19 @@ async function requireUserFieldWrite(req, userId, field, grant) {
     return await requirePlatformStaff(req, grant);
   return await requireSelfOrPlatformStaff(req, userId, grant);
 }
+async function requireVerificationListReach(req, orgId) {
+  if (orgId) {
+    await requireOrgReach(req, orgId);
+    return;
+  }
+  await requirePlatformStaff(req);
+}
+async function requireVerificationReach(req, verification) {
+  const org = verification?.metadata?.org?.toString?.() ?? "";
+  if (!org)
+    return;
+  await requireOrgReach(req, org);
+}
 
 // src/services/service-provider-invite.service.ts
 var INVITE_VALID_HOURS = 72;
@@ -27652,6 +27665,7 @@ function useVerificationController() {
       });
     }
     try {
+      await requireVerificationListReach(req, orgId);
       const data = await _getVerifications({
         search,
         page,
@@ -27739,6 +27753,7 @@ function useVerificationController() {
       return;
     }
     try {
+      await requireVerificationReach(req, await _getVerificationById(otpId));
       await _cancelUserInvitation(otpId);
       res.json({
         message: "User invite has been cancelled."
@@ -85028,7 +85043,7 @@ function useVerificationControllerV2() {
     cancelUserInvitation: _cancelUserInvitation,
     resendSignUpVerification: _resendSignUpVerification
   } = useVerificationServiceV2();
-  const { getVerifications: _getVerifications } = useVerificationRepoV2();
+  const { getVerifications: _getVerifications, getVerificationById: _getVerificationById } = useVerificationRepoV2();
   async function verify(req, res, next) {
     try {
       const schema2 = import_joi142.default.object({ verificationCode: import_joi142.default.string().required() });
@@ -85209,6 +85224,7 @@ function useVerificationControllerV2() {
     }
     const { search, page, status, app, email, type } = value;
     try {
+      await requireVerificationListReach(req, null);
       const data = await _getVerifications({
         search,
         page,
@@ -85235,6 +85251,7 @@ function useVerificationControllerV2() {
       return;
     }
     try {
+      await requireVerificationReach(req, await _getVerificationById(otpId));
       await _cancelUserInvitation(otpId);
       res.json({
         message: "User invite has been cancelled."