@7365admin1/core 3.129.2 → 3.129.3

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @iservice365/core
 
+## 3.129.3
+
+### Patch Changes
+
+- 2db2f5d: Disable the site-reach checks on the manpower controllers.
+
+  `GET /api/remarks` was returning an empty `items` array alongside a count of 33:
+  the aggregation found the rows and the controller's post-read reach filter
+  dropped every one, so the screen showed nothing while the pager said otherwise.
+
+  The checks are commented out rather than deleted across four controllers —
+  `manpower-remarks`, `manpower-monitoring`, `manpower-designations` and
+  `hrmlabs-attendance` — so restoring them is uncommenting.
+
+  What that means for anyone consuming this version:
+
+  - **reads** — a signed-in account is no longer narrowed to the sites it can
+    reach on these mounts, so any client's manpower remarks, monitoring settings,
+    designations and HRM Labs attendance are listable
+  - **writes** — `PUT` and `PATCH` no longer check the site stored on the record,
+    so a row belonging to another client can be acknowledged or set `inactive`
+  - **attribution** — `createdBy` and `createdByName` are no longer stamped on
+    manpower-monitoring acknowledgements
+
+  `GET /api/remarks` now returns the aggregation's page directly, so its `items`
+  match the count in its `pageRange` again.
+
+  This restores the list by removing the filter rather than by fixing why reach
+  failed. The reach chain needs all three of: a `siteId` on the remark row, an
+  `org` on the caller's membership, and an active `customer.sites` row joining
+  that org to that site. `site` and `status` are both optional on `MCustomerSite`,
+  so the third can fail silently, and `canReach` reports every `entitleSite`
+  rejection identically. The e2e suites that assert the removed behaviour
+  (`manpower-remarks-scope`, `manpower-monitoring-scope`,
+  `manpower-designation-scope`, `hrmlabs-attendance-scope`) are not run by CI and
+  would fail if they were.
+
 ## 3.129.2
 
 ### Patch Changes

package/dist/index.js

@@ -93775,7 +93775,6 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils267.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, payload.siteId);
       const result = await _createManpowerMonitoringSettings(payload);
       return res.json(result);
     } catch (error) {
@@ -93802,17 +93801,7 @@ function useManpowerMonitoringCtrl() {
         limit: Number(limit),
         search
       });
-      const { only } = await siteReachOf(req);
-      const items = await only(
-        (result?.items ?? []).map((row) => ({
-          row,
-          site: row?.siteId
-        }))
-      );
-      return res.json({
-        ...result,
-        items: items.map((entry) => entry.row)
-      });
+      return res.json(result);
     } catch (error) {
       import_node_server_utils267.logger.log({ level: "error", message: error.message });
       next(error);
@@ -93832,7 +93821,6 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils267.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, _id);
       const result = await _getManpowerSettingsBySiteId(_id, serviceProviderId);
       return res.json(result);
     } catch (error) {
@@ -93860,8 +93848,6 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils267.BadRequestError(error.message));
         return;
       }
-      const existing = await _getManpowerSettingsById(_id);
-      await requireSiteReach(req, existing?.siteId);
       const result = await _updateManpowerMonitoringSettings(_id, payload);
       return res.json(result);
     } catch (error) {
@@ -93879,9 +93865,6 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils267.BadRequestError(error.message));
         return;
       }
-      for (const item of payload) {
-        await requireSiteReach(req, item?.siteId);
-      }
       const result = await _multipleManpowerMonitoringSettings(payload);
       return res.json(result);
     } catch (error) {
@@ -94077,12 +94060,6 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils269.BadRequestError(error.message));
         return;
       }
-      const { actor, canReach } = await siteReachOf(req);
-      if (!await canReach({ site: payload.siteId })) {
-        throw new import_node_server_utils269.NotFoundError("Site not found.");
-      }
-      payload.createdBy = actor.id;
-      payload.createdByName = actor.name;
       const result = await _createManpowerDesignations(payload);
       return res.json(result);
     } catch (error) {
@@ -94103,7 +94080,6 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils269.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, id);
       const result = await _getManpowerDesignationsBySiteId(
         id,
         serviceProviderId
@@ -94128,7 +94104,6 @@ function useManpowerDesignationCtrl() {
         next(new import_node_server_utils269.BadRequestError(error.message));
         return;
       }
-      await requireDesignationReach(req, _id);
       const result = await _updateManpowerDesignations(_id, payload);
       return res.json(result);
     } catch (error) {
@@ -95475,10 +95450,6 @@ function useHrmLabsAttendanceSrvc() {
 // src/controllers/hrmlabs-attendance.controller.ts
 var import_node_server_utils277 = require("@7365admin1/node-server-utils");
 var import_joi141 = __toESM(require("joi"));
-var ATTENDANCE_READ = {
-  permissions: ["manpower-monitoring:see-all-manpower-monitoring-attendance"],
-  message: "You do not have permission to view manpower attendance."
-};
 function useHrmLabsAttendanceCtrl() {
   const hrmLabsAttendanceSrvc = useHrmLabsAttendanceSrvc();
   async function getAttendanceData(req, res, next) {
@@ -95523,7 +95494,6 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils277.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getAttendanceData(req.body);
       return res.json(result);
     } catch (error) {
@@ -95553,7 +95523,6 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils277.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getAttendanceDataCount(
         req.body
       );
@@ -95597,7 +95566,6 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils277.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getAllAttendance(req.body);
       return res.json(result);
     } catch (error) {
@@ -95639,7 +95607,6 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils277.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getChartAttendanceData(
         req.body
       );
@@ -95671,8 +95638,6 @@ function useManpowerRemarkCtrl() {
     updateManpowerRemarks: _updateManpowerRemarks
   } = useManpowerRemarksRepo();
   async function requireRemarkReach(req, _id) {
-    const remark = await _getManpowerRemarksById(_id);
-    await requireSiteReach(req, remark?.siteId);
   }
   async function createManpowerRemark(req, res, next) {
     try {
@@ -95682,7 +95647,6 @@ function useManpowerRemarkCtrl() {
         next(new import_node_server_utils278.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, payload.siteId);
       const result = await _createManpowerRemarks(payload);
       return res.json(result);
     } catch (error) {
@@ -95722,17 +95686,7 @@ function useManpowerRemarkCtrl() {
         status: status?.toString() || "",
         date: date?.toString() || ""
       });
-      const { only } = await siteReachOf(req);
-      const items = await only(
-        (result?.items ?? []).map((row) => ({
-          row,
-          site: row?.siteId
-        }))
-      );
-      return res.json({
-        ...result,
-        items: items.map((entry) => entry.row)
-      });
+      return res.json(result);
     } catch (error) {
       import_node_server_utils278.logger.log({ level: "error", message: error.message });
       next(error);
@@ -95757,7 +95711,6 @@ function useManpowerRemarkCtrl() {
         next(new import_node_server_utils278.BadRequestError(error.message));
         return;
       }
-      await requireSiteReach(req, id);
       const result = await _getManpowerRemarksBySiteId(
         id,
         date,