@7365admin1/core 3.46.1-staging.119 → 3.46.1-staging.120

package/.changeset/hid-reader-handler-authorization.md

@@ -0,0 +1,21 @@
+---
+"@7365admin1/core": patch
+---
+
+HID: the five reader endpoints added for production readiness now authorise in their own handlers
+
+`listReaderUsers`, `listReaderAccessLogs`, `configureReaderIntegration`,
+`setReaderMonitor` and `setOperatingMode` had no check in their bodies. They are
+guarded today by `authorizeView` / `authorizeManage` in the API-core router, so
+this is not a live hole — but the guard and the handler sit in two different
+repositories, and this is a published package: a router edit or a second
+consumer mounting `useHidAmicoController()` would leave an endpoint that reaches
+a physical door reader with nothing in front of it.
+
+Each now calls `authorizeHidAccess` itself, at the level the router already
+applies — `view` for the two lists, `manage` for the three writes — with the
+site resolved from the stored reader, never from the request. No caller's
+authority changes.
+
+The guard test now covers all fifteen HID handlers and names the unguarded ones
+in its failure message.

package/dist/index.js

@@ -84050,6 +84050,11 @@ function useHidAmicoController() {
   const authorizeReader = (req, readerId) => service.authorizeReader(readerId, getAuthenticatedUserId(req));
   const authorizeReaderUser = (req, readerId, hidUserId) => service.authorizeReaderUser(readerId, hidUserId, getAuthenticatedUserId(req));
   const authorizeSite = (req, siteId) => service.authorizeSiteForCaller(siteId, getAuthenticatedUserId(req));
+  const authorizeReaderAccess = (req, readerId, level) => service.authorizeHidAccess({
+    userId: getAuthenticatedUserId(req),
+    level,
+    readerId
+  });
   function authorize(level) {
     return async (req, _res, next) => {
       try {
@@ -84249,6 +84254,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, params.value.readerId, "view");
       res.json(await service.listReaderUsers(
         params.value.readerId,
         query2.value.page,
@@ -84268,6 +84274,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, params.value.readerId, "view");
       res.json(await service.listReaderAccessLogs(
         params.value.readerId,
         query2.value.page,
@@ -84288,6 +84295,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, value.readerId, "manage");
       res.json({ data: await service.configureReaderIntegration(value.readerId) });
     } catch (error2) {
       next(error2);
@@ -84301,6 +84309,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, params.value.readerId, "manage");
       res.json({
         data: await service.setReaderMonitor(params.value.readerId, body.value.enabled)
       });
@@ -84316,6 +84325,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, params.value.readerId, "manage");
       res.json({ data: await service.setOperatingMode(params.value.readerId, body.value.mode) });
     } catch (error) {
       next(error);