WEBDIENSTE/OpenSign
1
0
Fork 0
mirror of https://github.com/OpenSignLabs/OpenSign.git synced 2026-08-21 15:12:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2576 from nxglabs/sync-to-public_repo-27677371306

Browse Source 
Merge pull request #2575 from nxglabs/staging
This commit is contained in:
raktima-opensignlabs
2026-06-17 09:08:15 +00:00
parent 6271fedcbf
commit be0c4a2cbf
25 changed files with 1079 additions and 671 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/OpenSignServer/cloud/parsefunction/getUserListByOrg.js
+33
View File
@@ -9,6 +9,39 @@ export default async function getUserListByOrg(req) {
throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'User is not authenticated.');
} else {
try {
if (!OrganizationId) {
throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Please provide organizationId.');
}
// Authorize the requested organization against the caller's server-side
// tenant/organization. This prevents an authenticated user from
// enumerating users in an arbitrary organization or tenant.
const callerQuery = new Parse.Query('contracts_Users');
callerQuery.equalTo('UserId', {
__type: 'Pointer',
className: '_User',
objectId: req.user.id,
});
callerQuery.notEqualTo('IsDisabled', true);
const callerExtUser = await callerQuery.first({ useMasterKey: true });
if (!callerExtUser) {
throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'User not found.');
}
const callerTenantId = callerExtUser.get('TenantId')?.id;
const callerOrgId = callerExtUser.get('OrganizationId')?.id;
const callerRole = callerExtUser.get('UserRole');
const isAdmin = callerRole === 'contracts_Admin' || callerRole === 'contracts_OrgAdmin';
const orgQuery = new Parse.Query('contracts_Organizations');
const targetOrg = await orgQuery.get(OrganizationId, { useMasterKey: true });
// Must belong to the caller's tenant.
if (!callerTenantId || targetOrg.get('TenantId')?.id !== callerTenantId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
// Non-admins may only list their own organization.
if (!isAdmin && OrganizationId !== callerOrgId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const extUser = new Parse.Query('contracts_Users');
extUser.equalTo('OrganizationId', orgPtr);
extUser.include('TeamIds');