@7365admin1/core 3.64.0 → 3.64.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @iservice365/core
 
+## 3.64.1
+
+### Patch Changes
+
+- 1d856a3: Stop `/api/roles/v2` minting a role that holds the console's own resources.
+
+  `role.controller createRole` has carried `requireNoPlatformGrant` for a while;
+  `role-v2.controller createRole` did not. It is a separate controller behind a
+  separate route and accepts any permission string, so the hole was reachable by
+  adding `/v2` to the URL.
+
+  Measured on production before adding: no site-scoped role holds a platform-only
+  string, and this mount requires a `site`, so the check refuses nothing that
+  exists today. It only ever refuses a NEW grant regardless.
+
 ## 3.64.0
 
 ### Minor Changes

package/dist/index.js

@@ -88415,6 +88415,10 @@ function useRoleControllerV2() {
       if (value.org) {
         await requireOrgReach(req, value.org);
       }
+      requireNoPlatformGrant(
+        { type: value.type, org: value.org, permissions: [] },
+        value.permissions
+      );
       requireWithinModules(
         await moduleCeiling(value.org, value.site),
         value.permissions