feat: scope GET /opportunity to an AGENT caller's own agents

src/server/routes/opportunity/opportunity-volunteer.routes.ts

@@ -1,9 +1,11 @@
 import { FastifyInstance, FastifyPluginOptions } from "fastify";
-import { BadRequestError } from "../../../config/error/fastify";
+import { UserRole } from "need4deed-sdk";
+import { BadRequestError, NotFoundError } from "../../../config/error/fastify";
 import OpportunityVolunteer from "../../../data/entity/m2m/opportunity-volunteer";
 import { opportunityOpportunityVolunteerDTO } from "../../../services";
 import { idParamSchema, responseSchema } from "../../schema";
 import {
+  getCallerAgentIds,
   maskVolunteerIdentities,
   shouldMaskInactiveAgentData,
 } from "../../utils";
@@ -36,6 +38,22 @@ export default function opportunityOpportunityVolunteerRoutes(
         throw new BadRequestError(msg400);
       }
 
+      if (request.authUser?.role === UserRole.AGENT) {
+        const opportunity = await fastify.db.opportunityRepository.findOne({
+          where: { id: opportunityId },
+          select: { id: true, agentId: true },
+        });
+        const agentIds = await getCallerAgentIds(
+          fastify,
+          request.authUser.personId,
+        );
+        if (!opportunity?.agentId || !agentIds.includes(opportunity.agentId)) {
+          throw new NotFoundError(
+            `Opportunity (id:${opportunityId}) not found.`,
+          );
+        }
+      }
+
       const opportunityVolunteerRepository =
         fastify.db.opportunityVolunteerRepository;
 
@@ -54,12 +72,12 @@ export default function opportunityOpportunityVolunteerRoutes(
         ],
       });
 
+      const agent = volunteers[0]?.opportunity?.agent;
       // An INACTIVE agent's linked volunteers shouldn't read as live,
       // actionable data (be#885) here either — this route surfaces the same
       // underlying rows as GET /agent/:id/volunteer-linked, just scoped by
       // opportunityId instead of agentId, so it needs the same rule. All
       // rows share one opportunity/agent, so checking the first is enough.
-      const agent = volunteers[0]?.opportunity?.agent;
       if (agent && shouldMaskInactiveAgentData(agent, request.authUser?.role)) {
         maskVolunteerIdentities(volunteers);
       }

src/server/routes/opportunity/opportunity.routes.ts

@@ -1,5 +1,6 @@
 import { FastifyInstance, FastifyPluginOptions } from "fastify";
 import {
+  AgentMembershipStatus,
   ApiOpportunityGet,
   ApiOpportunityPatch,
   CommunicationType,
@@ -13,7 +14,7 @@ import {
   SortOrder,
   UserRole,
 } from "need4deed-sdk";
-import { EntityManager } from "typeorm";
+import { EntityManager, In } from "typeorm";
 import {
   BadRequestError,
   NotFoundError,
@@ -62,6 +63,7 @@ import {
 import {
   addAgentTypeServiceTranslations,
   addComments2Entity,
+  getCallerAgentIds,
   getCategoryToDealHandler,
   getDistrictToAgentHandler,
   getDistrictToOpportunityHandler,
@@ -207,6 +209,15 @@ export default async function opportunityRoutes(
       if (!opportunity) {
         throw new NotFoundError(`Opportunity (id:${id}) not found.`);
       }
+      if (request.authUser?.role === UserRole.AGENT) {
+        const agentIds = await getCallerAgentIds(
+          fastify,
+          request.authUser.personId,
+        );
+        if (!opportunity.agentId || !agentIds.includes(opportunity.agentId)) {
+          throw new NotFoundError(`Opportunity (id:${id}) not found.`);
+        }
+      }
 
       const opportunityComments: Opportunity & { comments: Comment[] } =
         await addComments2Entity(opportunity);
@@ -286,6 +297,27 @@ export default async function opportunityRoutes(
             : undefined;
 
       const where = getOpportunityWhere(request.query.filter, request.query);
+      const message = `Opportunities page:${request.query.page}.`;
+
+      //  NGOs see only their own agent's opportunities
+      if (request.authUser?.role === UserRole.AGENT) {
+        const agentIds = await getCallerAgentIds(
+          fastify,
+          request.authUser.personId,
+        );
+
+        // An agent with no shelter must see nothing, so return here rather than
+        // skipping the filter, which would show everything.
+        if (agentIds.length === 0) {
+          return reply.status(200).send({
+            message,
+            data: [],
+            count: 0,
+          });
+        }
+        // NGOs are scoped to their own agents, so this overwrites any agent condition.
+        where.agent = { id: In(agentIds) };
+      }
 
       logger.debug(
         `GET /opportunities called. options: ${JSON.stringify({ where })}`,
@@ -373,7 +405,7 @@ export default async function opportunityRoutes(
 
       // DTO (dtoOpportunityGetList) runs in the preSerialization hook after PII masking.
       return reply.status(200).send({
-        message: `Opportunities page:${request.query.page}.`,
+        message,
         data: opportunitiesCategoryDistrict,
         count,
       });
@@ -439,6 +471,7 @@ export default async function opportunityRoutes(
           ? await fastify.db.agentPersonRepository.findOneBy({
               agentId,
               personId,
+              status: AgentMembershipStatus.ACTIVE,
             })
           : null;
         if (!membership) {
@@ -614,6 +647,7 @@ export default async function opportunityRoutes(
           ? await fastify.db.agentPersonRepository.findOneBy({
               agentId: opportunity.agentId,
               personId,
+              status: AgentMembershipStatus.ACTIVE,
             })
           : null;
         if (!membership) {
@@ -725,6 +759,7 @@ export default async function opportunityRoutes(
           await fastify.db.agentPersonRepository.findOneBy({
             agentId: effectiveAgentId,
             personId: contactLinkId,
+            status: AgentMembershipStatus.ACTIVE,
           });
         if (!agentContactMembership) {
           throw new NotFoundError(

src/server/utils/data/get-caller-agent-ids.ts

@@ -0,0 +1,19 @@
+import { FastifyInstance } from "fastify";
+import { AgentMembershipStatus } from "need4deed-sdk";
+
+//  The agents this caller belongs to. Only ACTIVE memberships count. A PENDING
+//  one is still waiting on a coordinator to approve it, so it grants nothing.
+export async function getCallerAgentIds(
+  fastify: FastifyInstance,
+  personId: number | null | undefined,
+): Promise<number[]> {
+  if (personId === null || personId === undefined) {
+    return [];
+  }
+
+  const memberships = await fastify.db.agentPersonRepository.find({
+    where: { personId, status: AgentMembershipStatus.ACTIVE },
+  });
+
+  return [...new Set(memberships.map((m) => m.agentId))];
+}

src/server/utils/data/index.ts

@@ -8,6 +8,7 @@ export * from "./create-agent-contact";
 export * from "./for-routes";
 export * from "./get-agent-by-postcode";
 export * from "./get-agent-where";
+export * from "./get-caller-agent-ids";
 export * from "./get-language-title";
 export * from "./get-opportunity-orphanage-agent";
 export * from "./get-opportunity-where";

src/server/utils/pii/visible-persons.ts

@@ -2,6 +2,7 @@ import { FastifyInstance } from "fastify";
 import { UserRole } from "need4deed-sdk";
 import { In } from "typeorm";
 import User from "../../../data/entity/user.entity";
+import { getCallerAgentIds } from "../data/get-caller-agent-ids";
 
 /**
  * What a non COORDINATOR/ADMIN caller may see UNMASKED, resolved per request
@@ -65,8 +66,9 @@ export async function resolveCallerVisibility(
   }
 
   const agentPersonRepository = fastify.db.agentPersonRepository;
-  const memberships = await agentPersonRepository.find({ where: { personId } });
-  memberships.forEach((m) => agentIds.add(m.agentId));
+  const callerAgentIds = await getCallerAgentIds(fastify, personId);
+  callerAgentIds.forEach((id) => agentIds.add(id));
+
   if (agentIds.size === 0) {
     return visibility;
   }