piper-utils 1.1.69 → 1.1.70

package/bin/main.js

@@ -516,46 +516,56 @@ let parsed;try{parsed=JSON.parse(query[qKey])}catch(e){return}if(parsed&&"object
  * Scope to the union of partnerBusinessId + businessIds.
  * Use for tickets — partner sees own tickets + portfolio merchants' tickets.
  *
- *   global   → deletes where.businessId
- *   partner  → sets where.businessId = [partnerBusinessId, ...businessIds]
- *   standard → sets where.businessId = access.businessIds
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → allowed = uniq([partnerBusinessId, ...businessIds]);
+ *              requested ? allowed ∩ requested : where.businessId = allowed
+ *   standard → allowed = businessIds;
+ *              requested ? allowed ∩ requested : where.businessId = allowed
  *              (explicitly handled here because ticket routes may not call
  *               createFilters before scoping, e.g. delete/resolve handlers)
  *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
  * @param {{ getPartnerById: Function }} deps
  */
-async function scopeToBookUnionOwn(where,access,{getPartnerById}={}){if(!access)throw _errorCodes.errorList.unauthorized;if("global"===access.level)return void delete where.businessId;if("partner"===access.level){await(0,_accessContext.ensurePartnerScope)(access,{getPartnerById});const ids=_lodash.default.uniq([access.partnerBusinessId,...access.businessIds||[]].filter(Boolean));return void(where.businessId=ids)}if("standard"===access.level)return void(where.businessId=access.businessIds)}
+async function scopeToBookUnionOwn(where,access,requested=[],{getPartnerById}={}){if(!access)throw _errorCodes.errorList.unauthorized;if("global"===access.level)return void(requested.length?where.businessId=requested:delete where.businessId);if("partner"===access.level){await(0,_accessContext.ensurePartnerScope)(access,{getPartnerById});const allowed=_lodash.default.uniq([access.partnerBusinessId,...access.businessIds||[]].filter(Boolean));return void(where.businessId=requested.length?_lodash.default.intersection(allowed,requested):allowed)}if("standard"===access.level){const allowed=access.businessIds||[];return void(where.businessId=requested.length?_lodash.default.intersection(allowed,requested):allowed)}}
 /***/,exports.scopeToOwnBusiness=
+// `requested` is the caller-supplied businessIds array (what the route extracts via
+// getRequestedBusinessIds(event)). Empty array = no explicit filter (back-compat path).
+// When non-empty it is intersected against the role's allowed set so a user can never
+// widen their scope past what their role permits by passing a query-string businessId.
 /**
  * Scope a WHERE clause to the partner's own business (partnerBusinessId).
  * Use for "mine" resources: deal, activity, application, template.
  *
- *   global   → deletes where.businessId (super sees everything)
- *   partner  → sets where.businessId = partnerBusinessId
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → requested ? [partnerBusinessId] ∩ requested : where.businessId = partnerBusinessId
  *              throws partnerNotConfigured if partnerBusinessId is missing
  *   standard → no-op (createFilters already handled)
  *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
  * @param {{ getPartnerById: Function }} deps
  */
-async function scopeToOwnBusiness(where,access,{getPartnerById}={}){if(!access)throw _errorCodes.errorList.unauthorized;if("global"===access.level)return void delete where.businessId;if("partner"===access.level){if(await(0,_accessContext.ensurePartnerScope)(access,{getPartnerById}),!access.partnerBusinessId)throw _errorCodes.errorList.partnerNotConfigured;return void(where.businessId=access.partnerBusinessId)}
+async function scopeToOwnBusiness(where,access,requested=[],{getPartnerById}={}){if(!access)throw _errorCodes.errorList.unauthorized;if("global"===access.level)return void(requested.length?where.businessId=requested:delete where.businessId);if("partner"===access.level){if(await(0,_accessContext.ensurePartnerScope)(access,{getPartnerById}),!access.partnerBusinessId)throw _errorCodes.errorList.partnerNotConfigured;return void(requested.length?where.businessId=_lodash.default.intersection([access.partnerBusinessId],requested):where.businessId=access.partnerBusinessId)}
 // standard → no-op (createFilters already injected from JWT)
 }
 /**
  * Scope a WHERE clause to the partner's portfolio (businessIds array).
  * Use for "book" resources (future transaction lists, merchant inbox views).
  *
- *   global   → deletes where.businessId
- *   partner  → sets where.businessId = businessIds[]
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → requested ? businessIds ∩ requested : where.businessId = businessIds[]
+ *              (own business is intentionally excluded — book is portfolio only)
  *   standard → no-op
  *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
  * @param {{ getPartnerById: Function }} deps
- */,exports.scopeToPartnerBook=async function scopeToPartnerBook(where,access,{getPartnerById}={}){if(!access)throw _errorCodes.errorList.unauthorized;if("global"===access.level)return void delete where.businessId;if("partner"===access.level)return await(0,_accessContext.ensurePartnerScope)(access,{getPartnerById}),void(where.businessId=access.businessIds||[]);
+ */,exports.scopeToPartnerBook=async function scopeToPartnerBook(where,access,requested=[],{getPartnerById}={}){if(!access)throw _errorCodes.errorList.unauthorized;if("global"===access.level)return void(requested.length?where.businessId=requested:delete where.businessId);if("partner"===access.level){await(0,_accessContext.ensurePartnerScope)(access,{getPartnerById});const allowed=access.businessIds||[];return void(where.businessId=requested.length?_lodash.default.intersection(allowed,requested):allowed)}
 // standard → no-op
 };var _lodash=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(__webpack_require__(825)),_accessContext=__webpack_require__(62),_errorCodes=__webpack_require__(953)},
 /***/515(module){module.exports=require("@aws-sdk/lib-dynamodb");
@@ -577,7 +587,7 @@ async function scopeToOwnBusiness(where,access,{getPartnerById}={}){if(!access)t
  * @param {{ getPartnerById: Function }} deps
  * @returns {object} Pre-bound helpers.
  */
-function createAccessHelpers({getPartnerById}){const deps={getPartnerById};return{ensurePartnerScope:access=>(0,_accessContext.ensurePartnerScope)(access,deps),scopeToOwnBusiness:(where,access)=>(0,_accessScope.scopeToOwnBusiness)(where,access,deps),scopeToPartnerBook:(where,access)=>(0,_accessScope.scopeToPartnerBook)(where,access,deps),scopeToBookUnionOwn:(where,access)=>(0,_accessScope.scopeToBookUnionOwn)(where,access,deps),assertCanWriteOwnBusiness:(access,businessId)=>(0,_accessWrites.assertCanWriteOwnBusiness)(access,businessId,deps),assertCanWriteBookBusiness:(access,businessId)=>(0,_accessWrites.assertCanWriteBookBusiness)(access,businessId,deps),assertCanWriteBookUnionOwn:(access,businessId)=>(0,_accessWrites.assertCanWriteBookUnionOwn)(access,businessId,deps),stampOwnBusinessId:(access,body)=>(0,_accessWrites.stampOwnBusinessId)(access,body,deps)}}
+function createAccessHelpers({getPartnerById}){const deps={getPartnerById};return{ensurePartnerScope:access=>(0,_accessContext.ensurePartnerScope)(access,deps),scopeToOwnBusiness:(where,access,requested)=>(0,_accessScope.scopeToOwnBusiness)(where,access,requested,deps),scopeToPartnerBook:(where,access,requested)=>(0,_accessScope.scopeToPartnerBook)(where,access,requested,deps),scopeToBookUnionOwn:(where,access,requested)=>(0,_accessScope.scopeToBookUnionOwn)(where,access,requested,deps),assertCanWriteOwnBusiness:(access,businessId)=>(0,_accessWrites.assertCanWriteOwnBusiness)(access,businessId,deps),assertCanWriteBookBusiness:(access,businessId)=>(0,_accessWrites.assertCanWriteBookBusiness)(access,businessId,deps),assertCanWriteBookUnionOwn:(access,businessId)=>(0,_accessWrites.assertCanWriteBookUnionOwn)(access,businessId,deps),stampOwnBusinessId:(access,body)=>(0,_accessWrites.stampOwnBusinessId)(access,body,deps)}}
 /***/;var _accessContext=__webpack_require__(62),_accessScope=__webpack_require__(513),_accessWrites=__webpack_require__(165)},
 /***/564(module){module.exports=require("bluebird");
 /***/},