/store/companies endpoint exposes company data to logged in users

[lexvz14]

Hi there,

More of a heads-up than a bug, but the /store/companies endpoint exposes quite a bit of data to all users that have access to the platform as a customer. We plan on using Medusa for both B2B as well as B2C. The current structure allows B2C users to access B2B company data too. Besides that, employees from company A could fetch data for company B.

I added a filter to the GET /store/companies endpoint so that it only returns a company where the requestor is an employee, otherwise 404 is returned.

Depends on the use case I suppose, but worth knowing I suppose.

Thanks and best,
Lex

[riqwan]

Thanks for surfacing this @lexvz14, we've created a ticket internally to track this :)