@7365admin1/core 3.64.5-staging.298 → 3.64.5-staging.300

package/.changeset/members-by-user-reach.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+`GET /api/members/users/:id` no longer shows anybody's memberships to any signed-in account. The person and Seven365 staff still get the full list; anyone else gets only the memberships in organisations they belong to, were invited to or own (an empty list, not an error, when there are none).

package/.changeset/module-ceiling-site-owner.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Role writes: a site's own module list narrows a role only when the site belongs to the role's organisation. A service provider's role at a client's site is no longer refused modules the client switched off for that site — matching what the role editor now offers.

package/dist/index.js

@@ -11769,6 +11769,13 @@ function effectiveSiteModules(orgModules, siteModules) {
   const allowed = site.filter((key) => org.includes(key));
   return allowed.length ? allowed : org;
 }
+function siteModulesForOrg(site, orgId) {
+  const org = orgId?.toString() ?? "";
+  if (!org)
+    return site?.metadata?.modules;
+  const owner = String(site?.orgId ?? site?.org ?? "");
+  return owner && owner === org ? site?.metadata?.modules : void 0;
+}
 function rejectedSiteModules(orgModules, requested) {
   if (!narrows(orgModules))
     return [];
@@ -21229,7 +21236,7 @@ async function moduleCeiling(org, site) {
     ]);
     return effectiveSiteModules(
       orgDoc?.modules,
-      siteDoc?.metadata?.modules
+      siteModulesForOrg(siteDoc, orgId)
     );
   } catch {
     return [];
@@ -29469,6 +29476,31 @@ async function requireMemberOrg(req, org) {
   }
   await requireOrgAccess(req, orgId);
 }
+async function membershipsInReach(req, items) {
+  const warn = (error) => {
+    import_node_server_utils65.logger.log({ level: "warn", message: `members/users reach check: ${error?.message}` });
+    return false;
+  };
+  if (!await callerAccountApproved(callerId(req)).catch(warn)) {
+    return { items: [], total: 0 };
+  }
+  const orgs = new Set(
+    items.map((m) => m?.org?.toString?.() ?? "").filter(Boolean)
+  );
+  const own = new Set(
+    await resolveInviteActor(callerId(req)).then((actor) => actor.orgIds.map(String)).catch((error) => (warn(error), []))
+  );
+  const reached = new Set([...orgs].filter((org) => own.has(org)));
+  for (const org of orgs) {
+    if (reached.has(org))
+      continue;
+    const ok = await requireOrgReach(req, org).then(() => true, () => false);
+    if (ok)
+      reached.add(org);
+  }
+  const kept = items.filter((m) => reached.has(m?.org?.toString?.() ?? ""));
+  return { items: kept, total: kept.length };
+}
 function memberModulesHandlers({
   requireSelfOrPlatformStaff: requireSelfOrPlatformStaff2,
   gateData
@@ -29572,7 +29604,11 @@ function useMemberController() {
     }
     try {
       const data = await _getAllByUser(userId);
-      res.json(data);
+      const whole = await requireSelfOrPlatformStaff(req, userId, {
+        resource: "members",
+        action: "view-members"
+      }).then(() => true, () => false);
+      res.json(whole ? data : await membershipsInReach(req, data.items));
       return;
     } catch (error2) {
       import_node_server_utils65.logger.log({