@7365admin1/core 3.53.6 → 3.53.8

package/dist/index.mjs

@@ -14213,7 +14213,10 @@ var NOTIFICATION_CATEGORIES = [
     key: "serviceProviderInvite",
     label: "Service Provider Invitations",
     description: "When a property manager invites your company to provide services at a site.",
-    channels: { inApp: true, push: true, email: true },
+    channels: { inApp: true, push: true, email: false },
+    channelNote: {
+      email: "The invitation email is the invitation itself \u2014 for a company that has no account here yet it is the only copy, so it is always sent to the address the invitation was addressed to. The switches above control the copy that reaches you inside the app."
+    },
     permissionResources: ["service-provider-mgmt"],
     rendered: true
   },
@@ -14240,7 +14243,12 @@ var NOTIFICATION_CATEGORIES = [
     channelNote: { email: NO_EMAIL_RECIPIENT },
     permissionResources: ["emergency-contact"],
     safety: true,
-    rendered: true
+    // Nothing sends this. The sender below exists, but the only place emergency
+    // contacts are written is `iservice365-API-core`, and the change that would
+    // have called it from there (API-core #997) was closed, not merged. Until a
+    // caller exists this stays out of the screen rather than offering a switch
+    // over a message that never arrives.
+    rendered: false
   },
   {
     key: "virtualPatrol",
@@ -15053,6 +15061,19 @@ async function requireUserFieldWrite(req, userId, field, grant) {
     return await requirePlatformStaff(req, grant);
   return await requireSelfOrPlatformStaff(req, userId, grant);
 }
+async function requireVerificationListReach(req, orgId) {
+  if (orgId) {
+    await requireOrgReach(req, orgId);
+    return;
+  }
+  await requirePlatformStaff(req);
+}
+async function requireVerificationReach(req, verification) {
+  const org = verification?.metadata?.org?.toString?.() ?? "";
+  if (!org)
+    return;
+  await requireOrgReach(req, org);
+}
 
 // src/services/service-provider-invite.service.ts
 var INVITE_VALID_HOURS = 72;
@@ -27103,6 +27124,7 @@ function useVerificationController() {
       });
     }
     try {
+      await requireVerificationListReach(req, orgId);
       const data = await _getVerifications({
         search,
         page,
@@ -27190,6 +27212,7 @@ function useVerificationController() {
       return;
     }
     try {
+      await requireVerificationReach(req, await _getVerificationById(otpId));
       await _cancelUserInvitation(otpId);
       res.json({
         message: "User invite has been cancelled."
@@ -85124,7 +85147,7 @@ function useVerificationControllerV2() {
     cancelUserInvitation: _cancelUserInvitation,
     resendSignUpVerification: _resendSignUpVerification
   } = useVerificationServiceV2();
-  const { getVerifications: _getVerifications } = useVerificationRepoV2();
+  const { getVerifications: _getVerifications, getVerificationById: _getVerificationById } = useVerificationRepoV2();
   async function verify(req, res, next) {
     try {
       const schema2 = Joi142.object({ verificationCode: Joi142.string().required() });
@@ -85305,6 +85328,7 @@ function useVerificationControllerV2() {
     }
     const { search, page, status, app, email, type } = value;
     try {
+      await requireVerificationListReach(req, null);
       const data = await _getVerifications({
         search,
         page,
@@ -85331,6 +85355,7 @@ function useVerificationControllerV2() {
       return;
     }
     try {
+      await requireVerificationReach(req, await _getVerificationById(otpId));
       await _cancelUserInvitation(otpId);
       res.json({
         message: "User invite has been cancelled."