WEBDIENSTE/OpenSign
1
0
Fork 0
mirror of https://github.com/OpenSignLabs/OpenSign.git synced 2026-08-17 21:25:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2576 from nxglabs/sync-to-public_repo-27677371306

Browse Source 
Merge pull request #2575 from nxglabs/staging
This commit is contained in:
raktima-opensignlabs
2026-06-17 09:08:15 +00:00
parent 6271fedcbf
commit be0c4a2cbf
25 changed files with 1079 additions and 671 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/OpenSignServer/cloud/parsefunction/updateTenant.js
+24
View File
@@ -8,6 +8,30 @@ export default async function updateTenant(request) {
if (!request.user) {
throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'unauthorized');
}
// Derive the caller's tenant and role server-side. Never trust the
// client-supplied tenantId: an authenticated user may only update their own
// tenant and must hold an admin role to do so.
const callerQuery = new Parse.Query('contracts_Users');
callerQuery.equalTo('UserId', {
__type: 'Pointer',
className: '_User',
objectId: request.user.id,
});
callerQuery.notEqualTo('IsDisabled', true);
const callerExtUser = await callerQuery.first({ useMasterKey: true });
if (!callerExtUser) {
throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'User not found.');
}
const callerRole = callerExtUser.get('UserRole');
if (callerRole !== 'contracts_Admin' && callerRole !== 'contracts_OrgAdmin') {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const callerTenantId = callerExtUser.get('TenantId')?.id;
if (!callerTenantId || callerTenantId !== tenantId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const validKeys = ['CompletionBody', 'CompletionSubject', 'RequestBody', 'RequestSubject'];
try {
const tenant = new Parse.Object('partners_Tenant');