piper-utils 1.1.69 → 1.1.70

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "piper-utils",
-    "version": "1.1.69",
+    "version": "1.1.70",
     "description": "Utility library for Piper",
     "main": "bin/main.js",
     "scripts": {

package/src/database/dbUtils/partnerAccess/accessScope.js

@@ -1,99 +1,128 @@
-import _ from 'lodash';
-import { ensurePartnerScope } from './accessContext.js';
-import { errorList } from '../../../requestResponse/errorCodes.js';
-
-/**
- * Scope a WHERE clause to the partner's own business (partnerBusinessId).
- * Use for "mine" resources: deal, activity, application, template.
- *
- *   global   → deletes where.businessId (super sees everything)
- *   partner  → sets where.businessId = partnerBusinessId
- *              throws partnerNotConfigured if partnerBusinessId is missing
- *   standard → no-op (createFilters already handled)
- *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
- * @param {{ getPartnerById: Function }} deps
- */
-export async function scopeToOwnBusiness(where, access, { getPartnerById } = {}) {
-    if (!access) {
-        throw errorList.unauthorized;
-    }
-    if (access.level === 'global') {
-        delete where.businessId;
-        return;
-    }
-    if (access.level === 'partner') {
-        await ensurePartnerScope(access, { getPartnerById });
-        if (!access.partnerBusinessId) {
-            throw errorList.partnerNotConfigured;
-        }
-        where.businessId = access.partnerBusinessId;
-        return;
-    }
-    // standard → no-op (createFilters already injected from JWT)
-}
-
-/**
- * Scope a WHERE clause to the partner's portfolio (businessIds array).
- * Use for "book" resources (future transaction lists, merchant inbox views).
- *
- *   global   → deletes where.businessId
- *   partner  → sets where.businessId = businessIds[]
- *   standard → no-op
- *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
- * @param {{ getPartnerById: Function }} deps
- */
-export async function scopeToPartnerBook(where, access, { getPartnerById } = {}) {
-    if (!access) {
-        throw errorList.unauthorized;
-    }
-    if (access.level === 'global') {
-        delete where.businessId;
-        return;
-    }
-    if (access.level === 'partner') {
-        await ensurePartnerScope(access, { getPartnerById });
-        where.businessId = access.businessIds || [];
-        return;
-    }
-    // standard → no-op
-}
-
-/**
- * Scope to the union of partnerBusinessId + businessIds.
- * Use for tickets — partner sees own tickets + portfolio merchants' tickets.
- *
- *   global   → deletes where.businessId
- *   partner  → sets where.businessId = [partnerBusinessId, ...businessIds]
- *   standard → sets where.businessId = access.businessIds
- *              (explicitly handled here because ticket routes may not call
- *               createFilters before scoping, e.g. delete/resolve handlers)
- *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
- * @param {{ getPartnerById: Function }} deps
- */
-export async function scopeToBookUnionOwn(where, access, { getPartnerById } = {}) {
-    if (!access) {
-        throw errorList.unauthorized;
-    }
-    if (access.level === 'global') {
-        delete where.businessId;
-        return;
-    }
-    if (access.level === 'partner') {
-        await ensurePartnerScope(access, { getPartnerById });
-        const ids = _.uniq(
-            [access.partnerBusinessId, ...(access.businessIds || [])].filter(Boolean)
-        );
-        where.businessId = ids;
-        return;
-    }
-    if (access.level === 'standard') {
-        where.businessId = access.businessIds;
-        return;
-    }
-}
+import _ from 'lodash';
+import { ensurePartnerScope } from './accessContext.js';
+import { errorList } from '../../../requestResponse/errorCodes.js';
+
+// `requested` is the caller-supplied businessIds array (what the route extracts via
+// getRequestedBusinessIds(event)). Empty array = no explicit filter (back-compat path).
+// When non-empty it is intersected against the role's allowed set so a user can never
+// widen their scope past what their role permits by passing a query-string businessId.
+
+/**
+ * Scope a WHERE clause to the partner's own business (partnerBusinessId).
+ * Use for "mine" resources: deal, activity, application, template.
+ *
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → requested ? [partnerBusinessId] ∩ requested : where.businessId = partnerBusinessId
+ *              throws partnerNotConfigured if partnerBusinessId is missing
+ *   standard → no-op (createFilters already handled)
+ *
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
+ * @param {{ getPartnerById: Function }} deps
+ */
+export async function scopeToOwnBusiness(where, access, requested = [], { getPartnerById } = {}) {
+    if (!access) {
+        throw errorList.unauthorized;
+    }
+    if (access.level === 'global') {
+        if (requested.length) {
+            where.businessId = requested;
+        } else {
+            delete where.businessId;
+        }
+        return;
+    }
+    if (access.level === 'partner') {
+        await ensurePartnerScope(access, { getPartnerById });
+        if (!access.partnerBusinessId) {
+            throw errorList.partnerNotConfigured;
+        }
+        if (requested.length) {
+            where.businessId = _.intersection([access.partnerBusinessId], requested);
+        } else {
+            where.businessId = access.partnerBusinessId;
+        }
+        return;
+    }
+    // standard → no-op (createFilters already injected from JWT)
+}
+
+/**
+ * Scope a WHERE clause to the partner's portfolio (businessIds array).
+ * Use for "book" resources (future transaction lists, merchant inbox views).
+ *
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → requested ? businessIds ∩ requested : where.businessId = businessIds[]
+ *              (own business is intentionally excluded — book is portfolio only)
+ *   standard → no-op
+ *
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
+ * @param {{ getPartnerById: Function }} deps
+ */
+export async function scopeToPartnerBook(where, access, requested = [], { getPartnerById } = {}) {
+    if (!access) {
+        throw errorList.unauthorized;
+    }
+    if (access.level === 'global') {
+        if (requested.length) {
+            where.businessId = requested;
+        } else {
+            delete where.businessId;
+        }
+        return;
+    }
+    if (access.level === 'partner') {
+        await ensurePartnerScope(access, { getPartnerById });
+        const allowed = access.businessIds || [];
+        where.businessId = requested.length ? _.intersection(allowed, requested) : allowed;
+        return;
+    }
+    // standard → no-op
+}
+
+/**
+ * Scope to the union of partnerBusinessId + businessIds.
+ * Use for tickets — partner sees own tickets + portfolio merchants' tickets.
+ *
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → allowed = uniq([partnerBusinessId, ...businessIds]);
+ *              requested ? allowed ∩ requested : where.businessId = allowed
+ *   standard → allowed = businessIds;
+ *              requested ? allowed ∩ requested : where.businessId = allowed
+ *              (explicitly handled here because ticket routes may not call
+ *               createFilters before scoping, e.g. delete/resolve handlers)
+ *
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
+ * @param {{ getPartnerById: Function }} deps
+ */
+export async function scopeToBookUnionOwn(where, access, requested = [], { getPartnerById } = {}) {
+    if (!access) {
+        throw errorList.unauthorized;
+    }
+    if (access.level === 'global') {
+        if (requested.length) {
+            where.businessId = requested;
+        } else {
+            delete where.businessId;
+        }
+        return;
+    }
+    if (access.level === 'partner') {
+        await ensurePartnerScope(access, { getPartnerById });
+        const allowed = _.uniq(
+            [access.partnerBusinessId, ...(access.businessIds || [])].filter(Boolean)
+        );
+        where.businessId = requested.length ? _.intersection(allowed, requested) : allowed;
+        return;
+    }
+    if (access.level === 'standard') {
+        const allowed = access.businessIds || [];
+        where.businessId = requested.length ? _.intersection(allowed, requested) : allowed;
+        return;
+    }
+}

package/src/database/dbUtils/partnerAccess/createAccessHelpers.js

@@ -27,9 +27,9 @@ export function createAccessHelpers({ getPartnerById }) {
     const deps = { getPartnerById };
     return {
         ensurePartnerScope: (access) => ensurePartnerScope(access, deps),
-        scopeToOwnBusiness: (where, access) => scopeToOwnBusiness(where, access, deps),
-        scopeToPartnerBook: (where, access) => scopeToPartnerBook(where, access, deps),
-        scopeToBookUnionOwn: (where, access) => scopeToBookUnionOwn(where, access, deps),
+        scopeToOwnBusiness: (where, access, requested) => scopeToOwnBusiness(where, access, requested, deps),
+        scopeToPartnerBook: (where, access, requested) => scopeToPartnerBook(where, access, requested, deps),
+        scopeToBookUnionOwn: (where, access, requested) => scopeToBookUnionOwn(where, access, requested, deps),
         assertCanWriteOwnBusiness: (access, businessId) => assertCanWriteOwnBusiness(access, businessId, deps),
         assertCanWriteBookBusiness: (access, businessId) => assertCanWriteBookBusiness(access, businessId, deps),
         assertCanWriteBookUnionOwn: (access, businessId) => assertCanWriteBookUnionOwn(access, businessId, deps),