@7365admin1/core 3.32.2-staging.76 → 3.32.2-staging.78

package/.changeset/dahua-spec-defects.md

@@ -0,0 +1,20 @@
+---
+"@7365admin1/core": patch
+---
+
+Fix three Dahua HTTP API defects found by checking our integration against the
+vendor specification (V3.37):
+
+- The ANPR reconnect loop retried authentication ten times at one-second
+  intervals. The device locks the account for 1800 seconds after three failed
+  logins in thirty, so our own recovery could take ANPR down at a site for half
+  an hour. Authentication now backs off well past the device's counting window,
+  and a network fault is distinguished from an authentication failure.
+- 401 and 403 were handled backwards. Per spec §3.4, 401 is the digest
+  challenge (retry) and 403 is a credentials rejection (stop). We treated 403 as
+  an account lock and killed the listener, and counted 401s toward a "wrong
+  password" warning.
+- `updatePlateNumber`, `bulkInsertPlateNumber` and `removePlateNumber`
+  interpolated values into the CGI query string unencoded, against the spec's
+  stated RFC 3986 requirement. A plate or owner name containing a space or "&"
+  broke the request or appended extra parameters to it.

package/.changeset/site-name-similarity-check.md

@@ -0,0 +1,26 @@
+---
+"@7365admin1/core": patch
+---
+
+Stop rejecting site names that only differ by their building number
+
+Adding a site refused any name within a Levenshtein distance of 2 of an
+existing site in the same organisation, and told the user to contact support.
+That is exactly one character, so "Winsland House II" could not be added next
+to "Winsland House I". The same rule blocked "Tower A" beside "Tower B",
+"Phase 2" beside "Phase 1" and "Block 15" beside "Block 5" — the standard way
+buildings are named here.
+
+The check now treats trailing numbers, Roman numerals and single letters as the
+part that tells two buildings apart: if they differ, the names are different
+sites and the distance is never measured. Real duplicates are still refused —
+an exact repeat, a different capitalisation, stray or doubled whitespace,
+punctuation-only differences, and a one or two character typo within the same
+building. "House 1" and "House I" are still read as the same building.
+
+The refusal now names the site it matched and says what to do about it instead
+of pointing the user at support.
+
+`site.repo.getByExactName` also built its case-insensitive regex from the raw
+name; a name containing regex characters either threw or matched a site it is
+not. It is escaped.

package/dist/index.js

@@ -11811,8 +11811,9 @@ function useSiteRepo() {
     } catch (error2) {
       throw new import_node_server_utils19.BadRequestError("Invalid org ID format.");
     }
+    const escapedName = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const query2 = {
-      name: { $regex: new RegExp(`^${name}$`, "i") },
+      name: { $regex: new RegExp(`^${escapedName}$`, "i") },
       // Case-insensitive exact match
       orgId,
       status: { $ne: "deleted" }
@@ -24777,6 +24778,45 @@ function shouldAlertOnFailure(consecutiveFailures) {
   return (consecutiveFailures - CAMERA_ALERT_EVERY_AFTER) % CAMERA_ALERT_EVERY_AFTER === 0;
 }
 
+// src/utils/dahua-protocol.util.ts
+var DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT = 2;
+var AUTH_BACKOFF_MS = [6e4, 3e5, 9e5];
+function dahuaAuthBackoffMs(consecutiveAuthFailures) {
+  const index = Math.min(
+    Math.max(consecutiveAuthFailures, 1),
+    AUTH_BACKOFF_MS.length
+  );
+  return AUTH_BACKOFF_MS[index - 1];
+}
+function classifyDahuaStatus(statusCode) {
+  if (statusCode === 401)
+    return "challenge";
+  if (statusCode === 403)
+    return "rejected";
+  if (statusCode === 400 || statusCode === 500)
+    return "fatal";
+  return "proceed";
+}
+function classifyDahuaFailure(message) {
+  const text = String(message ?? "");
+  if (/\b403\b|forbidden/i.test(text))
+    return "rejected";
+  if (/\b401\b|unauthorized|invalid authority|digest/i.test(text)) {
+    return "challenge";
+  }
+  return "transient";
+}
+var enc = (value) => encodeURIComponent(String(value));
+function buildPlateUpdateEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=update&name=${enc(value.mode)}&recno=${enc(value.recno)}&PlateNumber=${enc(value.plateNumber)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateInsertEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=insert&name=${enc(value.mode)}&PlateNumber=${enc(value.plateNumber)}&VehicleType=${enc(value.vehicleType)}&VehicleColor=${enc(value.vehicleColor)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateRemoveEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=remove&recno=${enc(value.recno)}&name=${enc(value.mode)}`;
+}
+
 // src/services/dahua.service.ts
 var cameraRegistry = /* @__PURE__ */ new Map();
 var _savedOnDetected;
@@ -24822,7 +24862,8 @@ async function useDahuaDigestWithRetry({
   retryDelayMs = 0
 }) {
   let lastError;
-  for (let attempt = 1; attempt <= retries; attempt++) {
+  const effectiveRetries = Math.min(retries, DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT);
+  for (let attempt = 1; attempt <= effectiveRetries; attempt++) {
     try {
       const effectiveTimeout = streaming ? 0 : timeout;
       const response = await useDahuaDigest({
@@ -24849,9 +24890,9 @@ async function useDahuaDigestWithRetry({
       }
       const errorText = streaming ? `HTTP ${statusCode}` : getDahuaResponseText(response);
       const shouldRetry = isDahuaInvalidAuthority(errorText);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -24863,9 +24904,9 @@ async function useDahuaDigestWithRetry({
       lastError = error;
       const message = error?.message || String(error);
       const shouldRetry = isDahuaInvalidAuthority(message);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -25276,7 +25317,6 @@ function useDahuaService() {
     let authFailureCount = 0;
     let connectionFailureCount = 0;
     let alertedFailureCount = 0;
-    const MAX_AUTH_RETRIES = 10;
     while (!signal.aborted) {
       let bufferQueue = null;
       let response = null;
@@ -25291,23 +25331,26 @@ function useDahuaService() {
           streaming: true
         });
         const statusCode = getDahuaStatusCode(response);
-        if (statusCode === 401) {
-          loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          console.log(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          throw new Error("401 Unauthorized - Handshake or Wrong Credentials");
-        } else if (statusCode === 403) {
+        const verdict = classifyDahuaStatus(statusCode);
+        if (verdict === "challenge") {
+          loggerDahua.warn(`[${camera?.siteName}-${camera?.direction}] 401 - digest challenge not completed; will re-authenticate after backoff.`);
+          throw new Error("401 Unauthorized - digest challenge not completed");
+        } else if (verdict === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden. Account locked or invalid permissions.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden - credentials rejected by the device. Not retrying.`
           );
           if (onDetected) {
             onDetected({
               site: camera?.site,
               direction: camera?.direction,
+              // Superseded #1803's own wording: cameraCredentialsMessage already
+              // says the login was refused and where to correct it, and no longer
+              // claims a ten-minute lockout.
               messagePermanent: cameraCredentialsMessage(camera)
             });
           }
           return;
-        } else if ([400, 500].includes(statusCode)) {
+        } else if (verdict === "fatal") {
           loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] Connection error: ${statusCode}`);
           if (onDetected) {
             onDetected({ site: camera?.site, messagePermanent: cameraNotAuthorisedMessage(camera) });
@@ -25375,9 +25418,10 @@ function useDahuaService() {
           break;
         }
         const errMsg = String(error?.message || error);
-        if (errMsg.includes("403") || errMsg.includes("Forbidden")) {
+        const failure = classifyDahuaFailure(errMsg);
+        if (failure === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client. Account locked or invalid credentials.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client - credentials rejected. Not retrying.`
           );
           if (onDetected) {
             onDetected({
@@ -25388,16 +25432,15 @@ function useDahuaService() {
           }
           return;
         }
-        const isAuthError = errMsg.includes("401") || errMsg.includes("Unauthorized") || errMsg.includes("Invalid Authority");
-        if (isAuthError) {
+        if (failure === "challenge") {
           authFailureCount++;
           isAuthFailure = true;
           loggerDahua.warn(
-            `[${camera?.siteName}-${camera?.direction}] Auth attempt ${authFailureCount}/${MAX_AUTH_RETRIES}`
+            `[${camera?.siteName}-${camera?.direction}] Authentication attempt ${authFailureCount} failed; next attempt in ${dahuaAuthBackoffMs(authFailureCount) / 1e3}s`
           );
-          if (authFailureCount >= MAX_AUTH_RETRIES) {
+          if (authFailureCount === DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT) {
             loggerDahua.error(
-              `[${camera?.siteName}-${camera?.direction}] Max auth failures reached (${MAX_AUTH_RETRIES}). Wrong credentials.`
+              `[${camera?.siteName}-${camera?.direction}] ${authFailureCount} consecutive authentication failures. Slowing down and alerting the operator.`
             );
             if (onDetected) {
               onDetected({
@@ -25406,7 +25449,6 @@ function useDahuaService() {
                 messagePermanent: cameraCredentialsMessage(camera)
               });
             }
-            return;
           }
         } else {
           authFailureCount = 0;
@@ -25446,7 +25488,7 @@ function useDahuaService() {
         }
       }
       if (!signal.aborted) {
-        const waitMs = isAuthFailure ? 1e3 : 1e4;
+        const waitMs = isAuthFailure ? dahuaAuthBackoffMs(authFailureCount) : 1e4;
         await new Promise((res) => setTimeout(res, waitMs));
       }
     }
@@ -25606,7 +25648,15 @@ function useDahuaService() {
       const openGateString = String(value.isOpenGate);
       _isOpenGate = openGateString ? openGateString : "true";
     }
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=update&name=${value.mode}&recno=${value.recno}&PlateNumber=${value.plateNumber}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${_isOpenGate}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateUpdateEndpoint({
+      mode: value.mode,
+      recno: value.recno,
+      plateNumber: value.plateNumber,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: _isOpenGate
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -25639,7 +25689,10 @@ function useDahuaService() {
         host: value.host,
         username: value.username,
         password: value.password,
-        endpoint: `/cgi-bin/recordUpdater.cgi?action=remove&recno=${value.recno}&name=${value.mode}`
+        endpoint: buildPlateRemoveEndpoint({
+          recno: value.recno,
+          mode: value.mode
+        })
       });
       return response;
     } catch (error2) {
@@ -25695,7 +25748,16 @@ function useDahuaService() {
     value.vehicleColor = String(value.vehicleColor ?? "").substring(0, 31) || "unknown";
     const _openGate = String(value.isOpenGate);
     const isOpenGateString = _openGate && _openGate !== "undefined" ? _openGate : "true";
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=insert&name=${value.mode}&PlateNumber=${value.plateNumber}&VehicleType=${value.vehicleType}&VehicleColor=${value.vehicleColor}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${isOpenGateString}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateInsertEndpoint({
+      mode: value.mode,
+      plateNumber: value.plateNumber,
+      vehicleType: value.vehicleType,
+      vehicleColor: value.vehicleColor,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: isOpenGateString
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -35022,7 +35084,57 @@ function useCustomerSiteRepo() {
 
 // src/services/customer-site.service.ts
 var import_node_server_utils98 = require("@7365admin1/node-server-utils");
+
+// src/utils/site-name.util.ts
 var import_fast_levenshtein = __toESM(require("fast-levenshtein"));
+var ROMAN = /^(?=[ivx])(x{0,3})(ix|iv|v?i{0,3})$/;
+var ROMAN_VALUE = { i: 1, v: 5, x: 10 };
+function normalizeSiteName(name) {
+  return String(name ?? "").normalize("NFKC").toLowerCase().replace(/[‘’']/g, "").replace(/[^a-z0-9]+/g, " ").trim();
+}
+function romanToNumber(token) {
+  let total = 0;
+  for (let i = 0; i < token.length; i++) {
+    const value = ROMAN_VALUE[token[i]];
+    const next = ROMAN_VALUE[token[i + 1]];
+    total += next && next > value ? -value : value;
+  }
+  return total;
+}
+function distinguishingTokens(normalized) {
+  if (!normalized)
+    return [];
+  return normalized.split(" ").filter((t) => /^\d+$/.test(t) || ROMAN.test(t) || /^[a-z]$/.test(t)).map((t) => ROMAN.test(t) ? String(romanToNumber(t)) : t);
+}
+function matchSiteName(candidate, existing) {
+  const a = normalizeSiteName(candidate);
+  const b = normalizeSiteName(existing);
+  if (!a || !b)
+    return null;
+  if (a === b)
+    return "duplicate";
+  const tokensA = distinguishingTokens(a).join(" ");
+  const tokensB = distinguishingTokens(b).join(" ");
+  if (tokensA !== tokensB)
+    return null;
+  return import_fast_levenshtein.default.get(a, b) <= 2 ? "near-duplicate" : null;
+}
+function findSiteNameClash(candidate, existingNames) {
+  for (const name of existingNames) {
+    const match = matchSiteName(candidate, name);
+    if (match)
+      return { name, match };
+  }
+  return null;
+}
+function siteNameClashMessage(existingName, match) {
+  if (match === "duplicate") {
+    return `A site called "${existingName}" already exists in this organisation. Give the new site a different name, or edit "${existingName}" instead.`;
+  }
+  return `This name is within a character or two of "${existingName}", which already exists in this organisation. If it is the same property, edit "${existingName}" instead. If it is a different one, include what tells them apart \u2014 the block, tower, phase, or number \u2014 and save again.`;
+}
+
+// src/services/customer-site.service.ts
 function useCustomerSiteService() {
   const { add: _add, updateCustomerSiteById, getById: _getById } = useCustomerSiteRepo();
   const {
@@ -35044,20 +35156,18 @@ function useCustomerSiteService() {
       const exactMatches = await getSiteByExactName(value.name, value.siteOrg);
       if (exactMatches && exactMatches.length > 0) {
         throw new import_node_server_utils98.BadRequestError(
-          "Site with this name already exists in the organization."
+          siteNameClashMessage(exactMatches[0].name, "duplicate")
         );
       }
-      const threshold = 2;
       const sites = await getSiteByName(value.name);
-      if (sites && sites.length > 0) {
-        const similar = sites.filter((doc) => {
-          return doc.orgId && doc.name && doc.orgId.toString() === value.siteOrg.toString() && import_fast_levenshtein.default.get(value.name.toLowerCase(), doc.name.toLowerCase()) <= threshold;
-        });
-        if (similar.length > 0) {
-          throw new import_node_server_utils98.BadRequestError(
-            "Failed to add site, site with closely similar name found. Please contact seven365 support."
-          );
-        }
+      const candidates = (sites ?? []).filter(
+        (doc) => doc.orgId && doc.name && doc.orgId.toString() === value.siteOrg.toString()
+      ).map((doc) => doc.name);
+      const clash = findSiteNameClash(value.name, candidates);
+      if (clash) {
+        throw new import_node_server_utils98.BadRequestError(
+          siteNameClashMessage(clash.name, clash.match)
+        );
       }
       const siteId = await createSite(
         {