@7365admin1/core 3.64.5-staging.294 → 3.64.5-staging.295

package/.changeset/user-field-self-allowlist.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+PATCH /api/users/field/:id (and v2): on your own account you may change only name, contact, nric, dateOfBirth, profile and gender, and defaultOrg to an organisation you reach. status, email and plateNumber are staff-only.

package/dist/index.js

@@ -16127,11 +16127,32 @@ async function requireInviteReach(req, org, app, role) {
     await requireOrgReach(req, org);
   await requireRoleInvitable(role, org, apps);
 }
-async function requireUserFieldWrite(req, userId, field, grant) {
-  if (field === "email")
-    return await requirePlatformStaff(req, grant);
-  return await requireSelfOrPlatformStaff(req, userId, grant);
+async function requireUserFieldWrite(req, userId, field, grant, value) {
+  if (field && SELF_EDITABLE_USER_FIELDS.includes(field)) {
+    return await requireSelfOrPlatformStaff(req, userId, grant);
+  }
+  if (field === "defaultOrg") {
+    const id = callerId(req);
+    const org = value?.toString?.() ?? "";
+    if (id && userId?.toString() === id && org) {
+      const reaches = await requireOrgReach(req, org).then(
+        () => true,
+        () => false
+      );
+      if (reaches)
+        return id;
+    }
+  }
+  return await requirePlatformStaff(req, grant);
 }
+var SELF_EDITABLE_USER_FIELDS = [
+  "name",
+  "contact",
+  "nric",
+  "dateOfBirth",
+  "profile",
+  "gender"
+];
 async function requireVerificationListReach(req, orgId) {
   if (orgId) {
     await requireOrgReach(req, orgId);
@@ -19796,7 +19817,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" }, payload.value);
       let message;
       if (payload.field === "plateNumber") {
         message = await updatePlateNumberByUserId(
@@ -90221,7 +90242,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" }, payload.value);
       const message = await _updateUserFieldById({ _id, ...payload });
       res.json({ message });
       return;