@7365admin1/core 3.64.0 → 3.64.2

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @iservice365/core
 
+## 3.64.2
+
+### Patch Changes
+
+- f90c6f0: Return one row per site from `/api/customer-sites`, named by the site.
+
+  `getAll` grouped by `{ name, site }`. A customer-sites row is an ENGAGEMENT and
+  one site can carry more than one, so two rows for the same site with different
+  names both survived as "distinct" — a provider's site list showed four entries
+  for three sites, and the site switcher ticked two at once.
+
+  `name` is also a snapshot from when the engagement was created and goes stale
+  when the site is renamed; recency is no guide, since the newer row held the
+  staler name. The site is now looked up and its live name projected over the
+  snapshot, with the stored name kept as a fallback.
+
+  The search and the sort both run after the rename, so a site is found and
+  ordered by the name it actually has, and the count is derived from the same
+  pipeline.
+
+## 3.64.1
+
+### Patch Changes
+
+- 1d856a3: Stop `/api/roles/v2` minting a role that holds the console's own resources.
+
+  `role.controller createRole` has carried `requireNoPlatformGrant` for a while;
+  `role-v2.controller createRole` did not. It is a separate controller behind a
+  separate route and accepts any permission string, so the hole was reachable by
+  adding `/v2` to the URL.
+
+  Measured on production before adding: no site-scoped role holds a platform-only
+  string, and this mount requires a `site`, so the check refuses nothing that
+  exists today. It only ever refuses a NEW grant regardless.
+
 ## 3.64.0
 
 ### Minor Changes

package/dist/index.js

@@ -14145,7 +14145,6 @@ function useCustomerSiteRepo() {
       cacheOptions.siteScope = scoped.length ? [...scoped].sort().join(",") : "no-site";
     }
     if (search) {
-      query2.$or = [{ name: { $regex: search, $options: "i" } }];
       cacheOptions.search = search;
     }
     const cacheKey = (0, import_node_server_utils26.makeCacheKey)(namespace_collection2, cacheOptions);
@@ -14158,8 +14157,20 @@ function useCustomerSiteRepo() {
       const distinctPipeline = [
         { $match: query2 },
         { $sort: sort },
-        { $group: { _id: { name: "$name", site: "$site" }, doc: { $first: "$$ROOT" } } },
+        { $group: { _id: "$site", doc: { $first: "$$ROOT" } } },
         { $replaceRoot: { newRoot: "$doc" } },
+        {
+          $lookup: {
+            from: "sites",
+            localField: "site",
+            foreignField: "_id",
+            as: "_liveSite"
+          }
+        },
+        { $unwind: { path: "$_liveSite", preserveNullAndEmptyArrays: true } },
+        { $set: { name: { $ifNull: ["$_liveSite.name", "$name"] } } },
+        { $unset: "_liveSite" },
+        ...search ? [{ $match: { name: { $regex: search, $options: "i" } } }] : [],
         { $sort: sort }
       ];
       const items = await collection.aggregate(
@@ -14170,14 +14181,7 @@ function useCustomerSiteRepo() {
         ],
         { session }
       ).toArray();
-      const countResult = await collection.aggregate(
-        [
-          { $match: query2 },
-          { $group: { _id: { name: "$name", site: "$site" } } },
-          { $count: "total" }
-        ],
-        { session }
-      ).toArray();
+      const countResult = await collection.aggregate([...distinctPipeline, { $count: "total" }], { session }).toArray();
       const length = countResult[0]?.total ?? 0;
       const data = (0, import_node_server_utils26.paginate)(items, page, limit, length);
       setCache(cacheKey, data, 15 * 60).then(() => {
@@ -88415,6 +88419,10 @@ function useRoleControllerV2() {
       if (value.org) {
         await requireOrgReach(req, value.org);
       }
+      requireNoPlatformGrant(
+        { type: value.type, org: value.org, permissions: [] },
+        value.permissions
+      );
       requireWithinModules(
         await moduleCeiling(value.org, value.site),
         value.permissions