@7365admin1/core 3.32.2-staging.67 → 3.32.2-staging.68

package/.changeset/camera-list-site-scoping.md

@@ -0,0 +1,42 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope `GET /site-cameras` to the caller's own site.
+
+The site was an OPTIONAL query parameter and nothing on the handler looked at
+the session beyond `requireAuth`. So any signed-in account, in any organisation,
+could page the whole estate's cameras - on staging that is all 15 active IP
+cameras across 3 owner organisations, each record carrying its `host` and its
+`username`. It is the plainest cross-tenant read left in the camera module.
+
+`site` is now required, and the caller is authorised against it with
+`entitleSite`: membership of the site, of its owning organisation, or an ACTIVE
+`customer.sites` engagement with it. "Not yours" and "does not exist" answer
+identically, so site ids cannot be enumerated from the difference.
+
+**Every caller in the estate already sends `site`** - checked across every
+repository, not assumed:
+
+| caller | sends |
+|---|---|
+| `iservice365-mobile-app-security` `pages/cctv/index.vue` (live) | `site`, `type: ip`, `page` |
+| `iservice365-mobile-app-security` `useAnprEnabled` (live) | `site`, `type: anpr` |
+| `iservice365-layer-common` `CameraMain.vue` (Site Settings) | `site`, `type`, `page` |
+| `iservice365-layer-common` `CameraWall.vue` | `site`, `type: ip`, `page` |
+| `iservice365-web-app-security` `VirtualPatrolRoutesForm.vue` | `site`, `type: ip`, `page: 1` |
+| `isecure365-mobile-app` `site.service.ts` `getAnprCameras` | `site`, `type: anpr` |
+
+So no running client breaks.
+
+Deliberately NOT gated on a camera permission. This is the same list the site's
+own Settings panel and the guard's app have always read; on staging only 25 of
+the 118 people entitled to a site with a camera hold a camera-view permission,
+so a permission gate here would strand people who are legitimately at the site.
+Restricting the read to the caller's own sites is the fix; who among them may
+look is a separate decision that needs its own measurement.
+
+The repository's 15-minute cache key already carries the site, so a cached page
+can only be served to callers authorised for that same site. No caller id was
+added to the key - it would make the cache per-person for an answer that is
+identical per site.

package/dist/index.js

@@ -34228,7 +34228,7 @@ function useSiteCameraController() {
     deleteById: _deleteById,
     findOne: _findOne
   } = useSiteCameraRepo();
-  const { authorizeSite } = useCameraViewService();
+  const { authorizeSite, entitleSite } = useCameraViewService();
   function callerId(req) {
     const user = req.user;
     return user?.user?.toString?.() || user?._id?.toString?.();
@@ -34300,10 +34300,9 @@ function useSiteCameraController() {
   }
   async function getAll(req, res, next) {
     const query2 = req.query;
-    const allowedTypes = ["ip", "exit", "entry", "both"];
     const validation = import_joi49.default.object({
       type: import_joi49.default.string().optional(),
-      site: import_joi49.default.string().optional(),
+      site: import_joi49.default.string().hex().length(24).required(),
       page: import_joi49.default.number().min(1).optional(),
       limit: import_joi49.default.number().min(10).optional()
     });
@@ -34313,10 +34312,18 @@ function useSiteCameraController() {
       return;
     }
     const type = value.type ?? null;
-    const site = value.site ?? "";
+    const site = value.site;
     const page = value.page ?? 1;
     const limit = value.limit ? parseInt(value.limit) : 10;
     try {
+      try {
+        await entitleSite({ siteId: site, userId: callerId(req) });
+      } catch (error2) {
+        if (error2 instanceof import_node_server_utils95.NotFoundError) {
+          throw new import_node_server_utils95.NotFoundError("Site not found.");
+        }
+        throw error2;
+      }
       const siteCameras = await _getAll({ type, site, page, limit });
       res.json(siteCameras);
       return;