@7365admin1/core 3.64.5-staging.293 → 3.64.5-staging.295

package/.changeset/member-direct-role-org.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+POST /api/members/direct refuses (400) a role that belongs to a different organisation, unless the caller already holds that role in the organisation being joined.

package/.changeset/user-field-self-allowlist.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+PATCH /api/users/field/:id (and v2): on your own account you may change only name, contact, nric, dateOfBirth, profile and gender, and defaultOrg to an organisation you reach. status, email and plateNumber are staff-only.

package/dist/index.d.ts

@@ -11138,7 +11138,9 @@ declare function hasOrgOwnership(userId?: string | ObjectId | null, orgId?: stri
  * `status: { $ne: "deleted" }` is the same liveness test every other membership
  * read in this package uses, so a revoked membership stops conferring the read.
  */
-declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null): Promise<boolean>;
+declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null, 
+/** when given, the live membership must also be in THIS organisation */
+orgId?: string | ObjectId | null): Promise<boolean>;
 
 declare function useAuthControllerV2(): {
     signUp: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -14627,19 +14627,24 @@ async function hasOrgOwnership(userId, orgId) {
   );
   return Boolean(found);
 }
-async function holdsRole(userId, roleId) {
+async function holdsRole(userId, roleId, orgId) {
   const id = userId?.toString() ?? "";
   const role = roleId?.toString() ?? "";
+  const org = orgId?.toString() ?? "";
   if (!id || !role || !import_mongodb25.ObjectId.isValid(id) || !import_mongodb25.ObjectId.isValid(role)) {
     return false;
   }
+  if (orgId !== void 0 && !import_mongodb25.ObjectId.isValid(org))
+    return false;
   const db2 = import_node_server_utils27.useAtlas.getDb();
   if (!db2)
     return false;
   const member = await db2.collection("members").findOne({
     user: new import_mongodb25.ObjectId(id),
     role: new import_mongodb25.ObjectId(role),
-    status: { $ne: "deleted" }
+    status: { $ne: "deleted" },
+    // both shapes, as `hasOrgInvitation` does for `metadata.org`
+    ...org ? { org: { $in: [new import_mongodb25.ObjectId(org), org] } } : {}
   });
   return Boolean(member);
 }
@@ -16122,11 +16127,32 @@ async function requireInviteReach(req, org, app, role) {
     await requireOrgReach(req, org);
   await requireRoleInvitable(role, org, apps);
 }
-async function requireUserFieldWrite(req, userId, field, grant) {
-  if (field === "email")
-    return await requirePlatformStaff(req, grant);
-  return await requireSelfOrPlatformStaff(req, userId, grant);
+async function requireUserFieldWrite(req, userId, field, grant, value) {
+  if (field && SELF_EDITABLE_USER_FIELDS.includes(field)) {
+    return await requireSelfOrPlatformStaff(req, userId, grant);
+  }
+  if (field === "defaultOrg") {
+    const id = callerId(req);
+    const org = value?.toString?.() ?? "";
+    if (id && userId?.toString() === id && org) {
+      const reaches = await requireOrgReach(req, org).then(
+        () => true,
+        () => false
+      );
+      if (reaches)
+        return id;
+    }
+  }
+  return await requirePlatformStaff(req, grant);
 }
+var SELF_EDITABLE_USER_FIELDS = [
+  "name",
+  "contact",
+  "nric",
+  "dateOfBirth",
+  "profile",
+  "gender"
+];
 async function requireVerificationListReach(req, orgId) {
   if (orgId) {
     await requireOrgReach(req, orgId);
@@ -19791,7 +19817,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" }, payload.value);
       let message;
       if (payload.field === "plateNumber") {
         message = await updatePlateNumberByUserId(
@@ -20662,6 +20688,12 @@ function useMemberService() {
     if (targetRole?.type === PLATFORM_STAFF_MEMBER_TYPE) {
       await requireStaffCaller(callerId5, "assign a Seven365 staff role");
     }
+    const roleOrg = targetRole?.org?.toString?.() ?? "";
+    if (roleOrg && roleOrg !== (orgId?.toString() ?? "").toLowerCase() && !await holdsRole(callerId5, roleId, orgId)) {
+      throw new import_node_server_utils50.BadRequestError(
+        "That role belongs to a different organisation."
+      );
+    }
     const session = import_node_server_utils50.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
@@ -90210,7 +90242,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" }, payload.value);
       const message = await _updateUserFieldById({ _id, ...payload });
       res.json({ message });
       return;