@7365admin1/core 3.64.5-staging.293 → 3.64.5-staging.294

package/.changeset/member-direct-role-org.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+POST /api/members/direct refuses (400) a role that belongs to a different organisation, unless the caller already holds that role in the organisation being joined.

package/dist/index.d.ts

@@ -11138,7 +11138,9 @@ declare function hasOrgOwnership(userId?: string | ObjectId | null, orgId?: stri
  * `status: { $ne: "deleted" }` is the same liveness test every other membership
  * read in this package uses, so a revoked membership stops conferring the read.
  */
-declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null): Promise<boolean>;
+declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null, 
+/** when given, the live membership must also be in THIS organisation */
+orgId?: string | ObjectId | null): Promise<boolean>;
 
 declare function useAuthControllerV2(): {
     signUp: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -14627,19 +14627,24 @@ async function hasOrgOwnership(userId, orgId) {
   );
   return Boolean(found);
 }
-async function holdsRole(userId, roleId) {
+async function holdsRole(userId, roleId, orgId) {
   const id = userId?.toString() ?? "";
   const role = roleId?.toString() ?? "";
+  const org = orgId?.toString() ?? "";
   if (!id || !role || !import_mongodb25.ObjectId.isValid(id) || !import_mongodb25.ObjectId.isValid(role)) {
     return false;
   }
+  if (orgId !== void 0 && !import_mongodb25.ObjectId.isValid(org))
+    return false;
   const db2 = import_node_server_utils27.useAtlas.getDb();
   if (!db2)
     return false;
   const member = await db2.collection("members").findOne({
     user: new import_mongodb25.ObjectId(id),
     role: new import_mongodb25.ObjectId(role),
-    status: { $ne: "deleted" }
+    status: { $ne: "deleted" },
+    // both shapes, as `hasOrgInvitation` does for `metadata.org`
+    ...org ? { org: { $in: [new import_mongodb25.ObjectId(org), org] } } : {}
   });
   return Boolean(member);
 }
@@ -20662,6 +20667,12 @@ function useMemberService() {
     if (targetRole?.type === PLATFORM_STAFF_MEMBER_TYPE) {
       await requireStaffCaller(callerId5, "assign a Seven365 staff role");
     }
+    const roleOrg = targetRole?.org?.toString?.() ?? "";
+    if (roleOrg && roleOrg !== (orgId?.toString() ?? "").toLowerCase() && !await holdsRole(callerId5, roleId, orgId)) {
+      throw new import_node_server_utils50.BadRequestError(
+        "That role belongs to a different organisation."
+      );
+    }
     const session = import_node_server_utils50.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {