@7365admin1/core 3.32.2-staging.67 → 3.32.2-staging.69

package/.changeset/camera-engagement-site-scope.md

@@ -0,0 +1,15 @@
+---
+"@7365admin1/core": patch
+---
+
+Camera entitlement: an engagement grants a site only to an org-level membership, and permissions resolve against the granting role
+
+Two follow-ups to the camera entitlement change:
+
+- the engagement branch of `cameraGrant` ignored `members.siteId`, so a member
+  pinned to one site could reach every site their organisation is engaged at.
+  It now requires an org-level membership, matching the owning-org branch above
+  it: a membership pinned to a site never grants a different site.
+- `getUserPermissions` accepts the granting membership's `role`, so a caller
+  holding several memberships in one organisation is no longer resolved by
+  whichever member document Mongo returns first.

package/.changeset/camera-list-site-scoping.md

@@ -0,0 +1,42 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope `GET /site-cameras` to the caller's own site.
+
+The site was an OPTIONAL query parameter and nothing on the handler looked at
+the session beyond `requireAuth`. So any signed-in account, in any organisation,
+could page the whole estate's cameras - on staging that is all 15 active IP
+cameras across 3 owner organisations, each record carrying its `host` and its
+`username`. It is the plainest cross-tenant read left in the camera module.
+
+`site` is now required, and the caller is authorised against it with
+`entitleSite`: membership of the site, of its owning organisation, or an ACTIVE
+`customer.sites` engagement with it. "Not yours" and "does not exist" answer
+identically, so site ids cannot be enumerated from the difference.
+
+**Every caller in the estate already sends `site`** - checked across every
+repository, not assumed:
+
+| caller | sends |
+|---|---|
+| `iservice365-mobile-app-security` `pages/cctv/index.vue` (live) | `site`, `type: ip`, `page` |
+| `iservice365-mobile-app-security` `useAnprEnabled` (live) | `site`, `type: anpr` |
+| `iservice365-layer-common` `CameraMain.vue` (Site Settings) | `site`, `type`, `page` |
+| `iservice365-layer-common` `CameraWall.vue` | `site`, `type: ip`, `page` |
+| `iservice365-web-app-security` `VirtualPatrolRoutesForm.vue` | `site`, `type: ip`, `page: 1` |
+| `isecure365-mobile-app` `site.service.ts` `getAnprCameras` | `site`, `type: anpr` |
+
+So no running client breaks.
+
+Deliberately NOT gated on a camera permission. This is the same list the site's
+own Settings panel and the guard's app have always read; on staging only 25 of
+the 118 people entitled to a site with a camera hold a camera-view permission,
+so a permission gate here would strand people who are legitimately at the site.
+Restricting the read to the caller's own sites is the fix; who among them may
+look is a separate decision that needs its own measurement.
+
+The repository's 15-minute cache key already carries the site, so a cached page
+can only be served to callers authorised for that same site. No caller id was
+added to the key - it would make the cache per-person for an answer that is
+identical per site.

package/dist/index.d.ts

@@ -2658,6 +2658,12 @@ declare function hasAnyPermission(permissions: unknown, allowed: Array<string>):
 type CameraMembership = {
     siteId?: unknown;
     org?: unknown;
+    /**
+     * The role this membership carries. Returned with the grant so permissions
+     * are read off the role that actually granted access — see
+     * `permissionsForGrant` in the service.
+     */
+    role?: unknown;
 };
 /**
  * WHICH membership lets this caller reach this site, or `null` for none.
@@ -2669,12 +2675,35 @@ type CameraMembership = {
  * 2. **A membership at the site's OWNING organisation, with no site on it** —
  *    an org-wide role. 90 rows, 56 people, are recorded this way.
  * 3. **An engagement** — an ACTIVE `customer.sites` row saying one of the
- *    caller's organisations is contracted to serve this site. This is how the
- *    product routes a security agency to a property manager's site, and it is
- *    the list the web apps' own site switcher is built from
- *    (`useCustomerSite().getAll()` in the Security app's layout). Nothing in the
- *    camera path read it before, so a guard whose agency is engaged at a site
- *    was refused a camera the switcher had just offered them.
+ *    caller's organisations is contracted to serve this site, AND a membership
+ *    that is not pinned to some other site. This is how the product routes a
+ *    security agency to a property manager's site, and it is the list the web
+ *    apps' own site switcher is built from (`useCustomerSite().getAll()` in the
+ *    Security app's layout). Nothing in the camera path read it before, so a
+ *    guard whose agency is engaged at a site was refused a camera the switcher
+ *    had just offered them.
+ *
+ * ## Why the engagement branch requires an ORG-LEVEL membership
+ *
+ * **Product decision, owner, 2026-08-10, settled:** an agency engaged at several
+ * sites gives its staff access to **the site each person is assigned to, and no
+ * other**. It matches how the rest of the product is described — modules are set
+ * up per site.
+ *
+ * So `!idOf(membership.siteId)` is required here exactly as branch 2 requires
+ * it. Before, this branch matched on organisation alone, which made a person
+ * pinned to site X reach every site their agency serves — while somebody pinned
+ * to site X of the site's OWNING organisation could not reach its other sites.
+ * The two branches now say the same thing: **a membership pinned to a site never
+ * grants a different site**, and a membership with no site is an org-wide role
+ * within whichever organisation holds it.
+ *
+ * Measured on staging before the change: this removes 68 (user, camera-site)
+ * grants, all of them cross-organisation engagements held by a membership pinned
+ * elsewhere; every one of those 68 belongs to somebody whose organisation is
+ * engaged at the site they ARE pinned to, so nobody is left without their own
+ * site. 0 grants through branch 2 are affected — **estate-side org-level access
+ * is a different path and is untouched.**
  *
  * The membership is RETURNED, not just a yes/no, because the caller's
  * permissions must then be resolved against the organisation that actually

package/dist/index.js

@@ -27401,6 +27401,7 @@ var import_mongodb49 = require("mongodb");
 async function getUserPermissions(params) {
   const user = params.user?.toString();
   const org = params.org?.toString();
+  const grantingRole = params.role?.toString();
   if (!user || !import_mongodb49.ObjectId.isValid(user)) {
     return [];
   }
@@ -27408,19 +27409,23 @@ async function getUserPermissions(params) {
   if (!db) {
     return [];
   }
-  const memberQuery = {
-    user: new import_mongodb49.ObjectId(user),
-    status: { $ne: "deleted" }
-  };
-  if (org && import_mongodb49.ObjectId.isValid(org)) {
-    memberQuery.org = new import_mongodb49.ObjectId(org);
-  }
-  const member = await db.collection("members").findOne(memberQuery);
-  if (!member?.role || !import_mongodb49.ObjectId.isValid(member.role)) {
-    return [];
+  let roleId = grantingRole;
+  if (!roleId || !import_mongodb49.ObjectId.isValid(roleId)) {
+    const memberQuery = {
+      user: new import_mongodb49.ObjectId(user),
+      status: { $ne: "deleted" }
+    };
+    if (org && import_mongodb49.ObjectId.isValid(org)) {
+      memberQuery.org = new import_mongodb49.ObjectId(org);
+    }
+    const member = await db.collection("members").findOne(memberQuery);
+    if (!member?.role || !import_mongodb49.ObjectId.isValid(member.role)) {
+      return [];
+    }
+    roleId = member.role.toString();
   }
   const role = await db.collection("roles").findOne({
-    _id: new import_mongodb49.ObjectId(member.role),
+    _id: new import_mongodb49.ObjectId(roleId),
     status: "active"
   });
   if (!role || !Array.isArray(role.permissions)) {
@@ -32349,7 +32354,7 @@ function cameraGrant(params) {
   if (atOrg)
     return atOrg;
   const engaged = params.engagedOrgs?.size ? params.memberships.find(
-    (membership) => params.engagedOrgs.has(idOf(membership.org))
+    (membership) => !idOf(membership.siteId) && params.engagedOrgs.has(idOf(membership.org))
   ) : void 0;
   return engaged ?? null;
 }
@@ -33691,7 +33696,8 @@ function useCameraViewService() {
   async function permissionsForGrant(userId, grant, memberships) {
     return getUserPermissions({
       user: userId,
-      org: grant?.org ?? memberships[0]?.org
+      org: grant?.org ?? memberships[0]?.org,
+      role: grant?.role
     });
   }
   async function authorizeCamera(params) {
@@ -34228,7 +34234,7 @@ function useSiteCameraController() {
     deleteById: _deleteById,
     findOne: _findOne
   } = useSiteCameraRepo();
-  const { authorizeSite } = useCameraViewService();
+  const { authorizeSite, entitleSite } = useCameraViewService();
   function callerId(req) {
     const user = req.user;
     return user?.user?.toString?.() || user?._id?.toString?.();
@@ -34300,10 +34306,9 @@ function useSiteCameraController() {
   }
   async function getAll(req, res, next) {
     const query2 = req.query;
-    const allowedTypes = ["ip", "exit", "entry", "both"];
     const validation = import_joi49.default.object({
       type: import_joi49.default.string().optional(),
-      site: import_joi49.default.string().optional(),
+      site: import_joi49.default.string().hex().length(24).required(),
       page: import_joi49.default.number().min(1).optional(),
       limit: import_joi49.default.number().min(10).optional()
     });
@@ -34313,10 +34318,18 @@ function useSiteCameraController() {
       return;
     }
     const type = value.type ?? null;
-    const site = value.site ?? "";
+    const site = value.site;
     const page = value.page ?? 1;
     const limit = value.limit ? parseInt(value.limit) : 10;
     try {
+      try {
+        await entitleSite({ siteId: site, userId: callerId(req) });
+      } catch (error2) {
+        if (error2 instanceof import_node_server_utils95.NotFoundError) {
+          throw new import_node_server_utils95.NotFoundError("Site not found.");
+        }
+        throw error2;
+      }
       const siteCameras = await _getAll({ type, site, page, limit });
       res.json(siteCameras);
       return;