@7365admin1/core 3.60.0 → 3.60.1-staging.273

package/.changeset/org-update-diagnosable-error.md

@@ -0,0 +1,14 @@
+---
+"@7365admin1/core": patch
+---
+
+Say what is wrong when an organisation cannot be saved.
+
+`PUT /api/organizations/:id` — the write behind onboarding step 1 and the staff
+Client List edit — collapsed every MongoDB write error into a 500 reading
+"Failed to update organization.", with only `error.message` in the log. A
+duplicate-key refusal (the `organizations` collection still carries a unique
+index an earlier version of this file created and nothing ever dropped) is now
+a 400 naming the field the caller has to change, a typed error raised
+underneath is no longer turned into a 500, and the log line carries the error
+name, code, key and the organisation id.

package/.changeset/patrol-email-scope-restore.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+Restore and extend the site scoping on the patrol-log email endpoints.
+
+#1967 added a `requireSiteReach` guard to `POST /api/patrol-logs/email`. #1981,
+branched before #1967 landed, rewrote the same controller to add the history
+endpoints and dropped the guard. Neither repo runs its tests in CI, so the e2e
+test #1967 shipped has been failing on `main` unnoticed ever since.
+
+All five endpoints now resolve the caller from the session: the two that name a
+site (`send`, `getAll`) check that site, and the three that name a record
+(`resend`, `getById`, `deleteById`) check the site stored on the record. The
+`createdBy` pinning is restored with them, so a send cannot be filed under
+another user's name.

package/.changeset/role-read-self-arm.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope `GET /api/roles/id/:id`: a caller may read a role they themselves hold (resolved from the session's own `members` rows), otherwise the role's organisation rule applies. Closes the cross-tenant read of any organisation's role name and permissions.

package/.changeset/user-email-allowlist-subscription-authz.md

@@ -0,0 +1,21 @@
+---
+"@7365admin1/core": patch
+---
+
+Narrow the account-by-e-mail lookup to identity only, and scope the two open subscription reads
+
+`GET /api/users/email/:email` and its v2 twin `GET /api/users/v2/email/:email`
+stripped the password hash and session id from the reply but answered every
+other stored field, so any signed-in account could read any other account's
+NRIC, contact number, date of birth, gender, default organisation, status and
+profile just by knowing the e-mail address — across every client on the
+platform. Both now answer `{_id, name, email}` and nothing else. An
+organisation gate would have been the wrong fix: this endpoint exists for the
+invite flow, where the person being looked up is deliberately not in the
+caller's organisation yet.
+
+`GET /api/subscriptions/org/:id` answered any organisation's billing record —
+plan, seat count, price, currency, renewal date — to any signed-in account, and
+`GET /api/subscriptions/` answered every subscription on the platform in one
+list. They now carry `requireOrgAccess` and `requirePlatformStaff`, the two
+gates already used elsewhere in the same file.

package/dist/index.d.ts

@@ -718,6 +718,8 @@ type TOrg = {
     nature: string;
     email?: string;
     contact?: string;
+    /** Chosen by the owner while creating the organisation. */
+    country?: string;
     busInst?: string;
     status?: string;
     defaultSite?: string;
@@ -753,6 +755,7 @@ declare const orgSchema: Joi.ObjectSchema<any>;
 declare function MOrg(value: TOrg): TOrg;
 
 declare function useOrgRepo(): {
+    getByCreatorAndNature: (createdBy: string | ObjectId, nature: string) => Promise<TOrg | null>;
     createIndex: () => Promise<void>;
     createTextIndex: () => Promise<void>;
     createUniqueIndex: () => Promise<void>;
@@ -10192,6 +10195,13 @@ type TVerificationCode = {
     attempts?: number;
     /** Set when the code was accepted; the code itself is cleared at that point. */
     verifiedAt?: string | null;
+    /**
+     * The PASSWORD gate, used instead of a code when the invitee already has an
+     * account (a second organisation under the same person). Counted per
+     * invitation so a fumbled attempt here never locks the real sign-in.
+     */
+    passwordAttempts?: number;
+    lockedUntil?: string | null;
 };
 /**
  * Where an invitee got to in onboarding, kept on the invitation so it survives
@@ -10338,6 +10348,11 @@ declare function useVerificationRepoV2(): {
         org?: string | ObjectId | null | undefined;
         completed?: boolean | undefined;
     }, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
+    setInvitePasswordGate: ({ _id, attempts, lockedUntil, }: {
+        _id: string | ObjectId;
+        attempts: number;
+        lockedUntil: string | null;
+    }, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
 };
 
 declare function useVerificationServiceV2(): {
@@ -10448,6 +10463,55 @@ declare function useVerificationServiceV2(): {
         org: string;
         completedAt: string | null;
     }>;
+    verifyInvitePassword: ({ inviteId, password, }: {
+        inviteId: string;
+        password: string;
+    }) => Promise<{
+        status: string;
+        lockedUntil: string | null | undefined;
+        secondsRemaining: number;
+        message: string;
+        sid?: undefined;
+        user?: undefined;
+        email?: undefined;
+        name?: undefined;
+        inviteId?: undefined;
+        app?: undefined;
+        attemptsLeft?: undefined;
+    } | {
+        status: string;
+        sid: string;
+        user: string;
+        email: string;
+        name: string;
+        inviteId: string;
+        app: string;
+        message: string;
+        lockedUntil?: undefined;
+        secondsRemaining?: undefined;
+        attemptsLeft?: undefined;
+    } | {
+        status: string;
+        attemptsLeft: number;
+        message: string;
+        lockedUntil?: undefined;
+        secondsRemaining?: undefined;
+        sid?: undefined;
+        user?: undefined;
+        email?: undefined;
+        name?: undefined;
+        inviteId?: undefined;
+        app?: undefined;
+    }>;
+    getInviteAccount: (inviteId: string) => Promise<{
+        inviteId: string;
+        email: string;
+        app: string;
+        role: string;
+        invitedName: string;
+        exists: boolean;
+        name: string;
+    }>;
 };
 
 declare function useVerificationControllerV2(): {
@@ -10463,6 +10527,8 @@ declare function useVerificationControllerV2(): {
     verifyInviteCode: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getOnboarding: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateOnboarding: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    verifyInvitePassword: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    getInviteAccount: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
 
 /**