@7365admin1/core 3.47.1-staging.122 → 3.47.1-staging.124

package/.changeset/hid-facial-sync-authorization.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Authorize the HID facial-data sync handler in its own body
+
+`syncReaderFacialData` reached `staging` with no authorization check inside the
+handler. The API-core router does apply `requireAuth` + `authorizeManage`, so it
+was not reachable by an ordinary signed-in user — but this is a published
+package, and the guard and the handler sat in two different repositories. It now
+runs the same `manage`-level check the router applies, with the site taken from
+the stored reader. The guard test pins it by name.

package/dist/index.d.ts

@@ -10199,13 +10199,16 @@ declare function useHidAmicoService(): {
         pages: number;
         pageRange: string;
     }>;
-    listReaderUsers: (readerId: string, page?: number, limit?: number, search?: string, status?: "mapped" | "unmapped" | "") => Promise<{
+    listReaderUsers: (readerId: string, page?: number, limit?: number, search?: string, status?: "mapped" | "unmapped" | "", includeVisitors?: boolean) => Promise<{
         items: {
             reader: string;
             hidUserId: string;
             registration: string;
             metadata: {
+                facialData?: string | undefined;
                 name: string;
+                hidUserTypeId: unknown;
+                facialEnrolled: boolean;
             };
             isAdministrator: boolean;
             _id?: bson.ObjectId | undefined;
@@ -10217,7 +10220,7 @@ declare function useHidAmicoService(): {
         hasMore: boolean;
         pageRange: string;
     }>;
-    listReaderAccessLogs: (readerId: string, page?: number, limit?: number, search?: string, status?: "authorized" | "not_authorized" | "unknown" | "", method?: "facial" | "qr_code" | "id_password" | "pin" | "card" | "", tab?: "resident" | "visitor" | "administrator") => Promise<{
+    listReaderAccessLogs: (readerId: string, page?: number, limit?: number, search?: string, status?: "authorized" | "not_authorized" | "unknown" | "", method?: "facial" | "qr_code" | "id_password" | "pin" | "card" | "", tab?: "all" | "unmapped" | "mapped" | "resident" | "visitor" | "administrator") => Promise<{
         items: unknown[];
         page: number;
         limit: number;
@@ -10331,6 +10334,13 @@ declare function useHidAmicoService(): {
         contentType: any;
         base64: string;
     }>;
+    syncReaderFacialData: (readerId: string) => Promise<{
+        readerId: string;
+        facialDetected: number;
+        syncedCount: number;
+        unmappedCount: number;
+        message: string;
+    }>;
     listUserCards: (readerId: string, hidUserIdValue: string | number) => Promise<{
         readerId: string;
         hidUserId: number;
@@ -10476,6 +10486,7 @@ declare function useHidAmicoController(): {
     deleteReader: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     testReader: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     syncReader: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    syncReaderFacialData: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     configureReaderIntegration: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     setReaderMonitor: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     setOperatingMode: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -42850,7 +42850,8 @@ var schemaHidAmicoReaderUserQuery = import_joi64.default.object({
   page: import_joi64.default.number().integer().min(1).default(1),
   limit: import_joi64.default.number().integer().min(1).max(100).default(10),
   search: import_joi64.default.string().trim().max(100).allow("").default(""),
-  status: import_joi64.default.string().valid("mapped", "unmapped").allow("").default("")
+  status: import_joi64.default.string().valid("mapped", "unmapped").allow("").default(""),
+  includeVisitors: import_joi64.default.boolean().default(false)
 });
 var schemaHidAmicoAccessLogQuery = import_joi64.default.object({
   page: import_joi64.default.number().integer().min(1).default(1),
@@ -42858,7 +42859,7 @@ var schemaHidAmicoAccessLogQuery = import_joi64.default.object({
   search: import_joi64.default.string().trim().max(100).allow("").default(""),
   status: import_joi64.default.string().valid("authorized", "not_authorized", "unknown").allow("").default(""),
   method: import_joi64.default.string().valid("facial", "qr_code", "id_password", "pin", "card").allow("").default(""),
-  tab: import_joi64.default.string().valid("resident", "visitor", "administrator").default("resident")
+  tab: import_joi64.default.string().valid("all", "unmapped", "mapped", "resident", "visitor", "administrator").default("all")
 });
 var schemaHidAmicoOperatingMode = import_joi64.default.object({
   mode: import_joi64.default.string().valid("standalone", "online").required()
@@ -44371,12 +44372,17 @@ function getSecretKey() {
 function getReaderCapabilities(readerModel, firmwareVersion) {
   return {
     card: hidFirmwareAtLeast(firmwareVersion, "6.5.1"),
-    facial: hidFirmwareAtLeast(firmwareVersion, "6.5.1"),
+    // VL35LF and VL70LF are biometric readers. Some deployed readers report
+    // their device firmware as 2.x even though their face API is available.
+    facial: readerModel === "VL35LF" || readerModel === "VL70LF",
     qr: hidFirmwareAtLeast(firmwareVersion, "6.5.1"),
     pin: hidFirmwareAtLeast(firmwareVersion, "6.9.0"),
     intercom: readerModel === "VL70LF"
   };
 }
+function readerSupportsFacial(reader) {
+  return reader.capabilities?.facial === true || reader.readerModel === "VL35LF" || reader.readerModel === "VL70LF";
+}
 function getMonitorConfiguration(callbackToken) {
   const configured = String(process.env.HID_AMICO_MONITOR_URL || "").trim();
   if (!configured) {
@@ -44839,26 +44845,6 @@ function getHidPortals(response) {
     areaToId: Number(portal.area_to_id)
   })).filter((portal) => Number.isSafeInteger(portal.id) && portal.id > 0 && portal.name);
 }
-function getHidObjectTotal(response, object) {
-  const root = isUnknownRecord2(response) ? response : {};
-  const data = isUnknownRecord2(root.data) ? root.data : root;
-  const nested = isUnknownRecord2(data.data) ? data.data : {};
-  const objectData = isUnknownRecord2(data[object]) ? data[object] : {};
-  for (const candidate of [
-    data.total,
-    data.total_count,
-    data.count,
-    nested.total,
-    nested.total_count,
-    nested.count,
-    objectData.total
-  ]) {
-    const total = Number(candidate);
-    if (Number.isSafeInteger(total) && total >= 0)
-      return total;
-  }
-  return null;
-}
 async function upsertHidObject(client, object, id, values) {
   const existing = await client.loadObjects({
     object,
@@ -45234,6 +45220,18 @@ var HidAmicoClient = class {
       base64: buffer.toString("base64")
     };
   }
+  async listUserImageIds() {
+    if (!this.session) {
+      await this.login();
+    }
+    const path5 = this.url("/user_list_images.fcgi?get_timestamp=0");
+    const response = await this.get(path5, "json").catch(() => this.post(path5, {}));
+    const payload = isUnknownRecord2(response.data) ? response.data : {};
+    const userIds = Array.isArray(payload.user_ids) ? payload.user_ids : [];
+    return [...new Set(
+      userIds.map((value) => Number(value)).filter((value) => Number.isSafeInteger(value) && value > 0)
+    )];
+  }
   async setUserImage(hidUserId, image, timestamp, match) {
     if (!this.session) {
       await this.login();
@@ -45809,8 +45807,9 @@ function useHidAmicoService() {
     return reader;
   }
   function assertReaderCapability(reader, capability) {
-    if (reader.capabilities?.[capability])
+    if (reader.capabilities?.[capability] || capability === "facial" && readerSupportsFacial(reader)) {
       return;
+    }
     const requirement = capability === "pin" ? "firmware 6.9.0 or newer" : capability === "intercom" ? "a VL70LF reader" : "firmware 6.5.1 or newer";
     throw new import_node_server_utils131.BadRequestError(
       `This reader has not reported ${capability} support (${requirement}). Reconfigure the reader to refresh its capabilities.`
@@ -46426,7 +46425,7 @@ function useHidAmicoService() {
   async function listIdentities(value) {
     return repo.listIdentities(value);
   }
-  async function listReaderUsers(readerId, page = 1, limit = 10, search = "", status = "") {
+  async function listReaderUsers(readerId, page = 1, limit = 10, search = "", status = "", includeVisitors = false) {
     const reader = await getActiveReader(readerId);
     const offset = (page - 1) * limit;
     const client = new HidAmicoClient(reader);
@@ -46434,7 +46433,7 @@ function useHidAmicoService() {
       await client.login();
       const normalizedSearch = search.trim();
       const numericSearch = /^\d{1,15}$/.test(normalizedSearch) ? Number(normalizedSearch) : null;
-      const userWhere = { user_type_id: 0 };
+      const userWhere = {};
       if (numericSearch !== null && Number.isSafeInteger(numericSearch)) {
         userWhere.id = numericSearch;
       } else if (normalizedSearch) {
@@ -46447,13 +46446,14 @@ function useHidAmicoService() {
         const response = await client.loadObjects({
           object: "users",
           where: { users: userWhere },
-          limit,
-          offset,
+          limit: 500,
+          offset: 0,
           order: ["id", "ascending"]
         });
-        rows = getHidObjectRows(response, "users");
-        reportedTotal = getHidObjectTotal(response, "users");
-        hasMore = rows.length === limit && (reportedTotal === null || offset + rows.length < reportedTotal);
+        const deviceRows = getHidObjectRows(response, "users").filter((row) => includeVisitors || Number(row.user_type_id) !== 1);
+        reportedTotal = deviceRows.length;
+        rows = deviceRows.slice(offset, offset + limit);
+        hasMore = offset + rows.length < deviceRows.length;
       } else {
         const linkedIdentities = await repo.listActiveIdentities(readerId);
         const mappedUserIds = new Set(
@@ -46474,6 +46474,8 @@ function useHidAmicoService() {
           });
           const batch = getHidObjectRows(response, "users");
           batch.forEach((row) => {
+            if (!includeVisitors && Number(row.user_type_id) === 1)
+              return;
             const mapped = mappedUserIds.has(String(row.id ?? ""));
             if (status === "mapped" && mapped || status === "unmapped" && !mapped) {
               matchedRows.push(row);
@@ -46486,7 +46488,7 @@ function useHidAmicoService() {
         hasMore = matchedRows.length > offset + limit || !exhausted;
       }
       const userIds = rows.map((row) => String(row.id ?? "")).filter(Boolean);
-      const [identities, administratorFlags] = await Promise.all([
+      const [identities, administratorFlags, facialUserIds] = await Promise.all([
         repo.findIdentitiesByHidUserIds(readerId, userIds),
         Promise.all(rows.map(async (row) => {
           const userId = Number(row.id);
@@ -46499,13 +46501,17 @@ function useHidAmicoService() {
             offset: 0
           });
           return getHidObjectRows(roleResponse, "user_roles").length > 0;
-        }))
+        })),
+        readerSupportsFacial(reader) ? client.listUserImageIds().catch(() => []) : Promise.resolve([])
       ]);
       const identityMap = new Map(
         identities.map((identity) => [String(identity.hidUserId), identity])
       );
+      const facialUserIdSet = new Set(facialUserIds.map(String));
       const items = rows.map((row, index) => {
         const identity = identityMap.get(String(row.id ?? ""));
+        const identityMetadata = identity && isUnknownRecord2(identity.metadata) ? identity.metadata : {};
+        const facialEnrolled = facialUserIdSet.has(String(row.id ?? "")) || identityMetadata.facialEnrolled === true;
         return {
           ...row,
           ...identity || {},
@@ -46513,8 +46519,11 @@ function useHidAmicoService() {
           hidUserId: String(row.id ?? identity?.hidUserId ?? ""),
           registration: String(row.registration ?? identity?.registration ?? ""),
           metadata: {
-            ...isUnknownRecord2(identity?.metadata) ? identity?.metadata : {},
-            name: String(row.name ?? identity?.metadata?.name ?? "")
+            ...identityMetadata,
+            name: String(row.name ?? identityMetadata.name ?? ""),
+            hidUserTypeId: row.user_type_id ?? identityMetadata.hidUserTypeId,
+            facialEnrolled,
+            ...facialEnrolled ? { facialData: String(row.id ?? "") } : {}
           },
           isAdministrator: administratorFlags[index]
         };
@@ -46533,7 +46542,7 @@ function useHidAmicoService() {
       await client.logout();
     }
   }
-  async function listReaderAccessLogs(readerId, page = 1, limit = 10, search = "", status = "", method = "", tab = "resident") {
+  async function listReaderAccessLogs(readerId, page = 1, limit = 10, search = "", status = "", method = "", tab = "all") {
     const reader = await getActiveReader(readerId);
     const offset = (page - 1) * limit;
     const client = new HidAmicoClient(reader);
@@ -46557,7 +46566,7 @@ function useHidAmicoService() {
       const normalizedSearch = search.trim().toLocaleLowerCase();
       const enrichRows = async (rows) => {
         const userIds = [...new Set(rows.map((row) => toPositiveInteger(row.user_id ?? row.userId)).filter((value) => value !== null))];
-        const [identities, roleResponse] = await Promise.all([
+        const [identities, roleResponse, userResponse] = await Promise.all([
           repo.findIdentitiesByHidUserIds(readerId, userIds.map(String)),
           userIds.length ? client.loadObjects({
             object: "user_roles",
@@ -46569,7 +46578,17 @@ function useHidAmicoService() {
             },
             limit: Math.max(1, userIds.length),
             offset: 0
-          }) : Promise.resolve({ user_roles: [] })
+          }) : Promise.resolve({ user_roles: [] }),
+          userIds.length ? client.loadObjects({
+            object: "users",
+            where: {
+              users: {
+                id: userIds.length === 1 ? userIds[0] : { IN: userIds }
+              }
+            },
+            limit: Math.max(1, userIds.length),
+            offset: 0
+          }) : Promise.resolve({ users: [] })
         ]);
         const identityMap = new Map(
           identities.map((identity) => [String(identity.hidUserId), identity])
@@ -46577,11 +46596,19 @@ function useHidAmicoService() {
         const administratorIds = new Set(
           getHidObjectRows(roleResponse, "user_roles").map((role) => String(role.user_id ?? "")).filter(Boolean)
         );
+        const readerUserById = new Map(
+          getHidObjectRows(userResponse, "users").map((user) => [String(user.id ?? ""), user]).filter(([userId]) => Boolean(userId))
+        );
         return rows.map((row) => {
           const userId = String(row.user_id ?? row.userId ?? "");
           const identity = identityMap.get(userId) || null;
+          const readerUser = readerUserById.get(userId);
+          const existingName = String(row.user_name ?? row.userName ?? "").trim();
+          const readerUserName = String(readerUser?.name ?? "").trim();
           return {
             ...row,
+            user_name: existingName || readerUserName,
+            user_type_id: row.user_type_id ?? readerUser?.user_type_id ?? "",
             identity,
             isAdministrator: administratorIds.has(userId),
             normalizedMethod: normalizeHidAccessLogMethod(row),
@@ -46592,7 +46619,12 @@ function useHidAmicoService() {
       const matchesRequestedFilters = (item) => {
         const identity = isUnknownRecord2(item.identity) ? item.identity : null;
         const itemTab = normalizeHidAccessLogTab(identity, Boolean(item.isAdministrator));
-        if (itemTab !== tab)
+        const isMapped = Boolean(identity);
+        if (tab === "unmapped" && isMapped)
+          return false;
+        if (tab === "mapped" && !isMapped)
+          return false;
+        if (["resident", "visitor", "administrator"].includes(tab) && itemTab !== tab)
           return false;
         if (status && item.normalizedStatus !== status)
           return false;
@@ -47133,6 +47165,98 @@ function useHidAmicoService() {
       await client.logout();
     }
   }
+  async function getReaderFacialUserIds(client) {
+    try {
+      return await client.listUserImageIds();
+    } catch {
+      const usersResponse = await client.loadObjects({
+        object: "users",
+        where: { users: {} },
+        limit: 500,
+        offset: 0,
+        order: ["id", "ascending"]
+      });
+      const userIds = getHidObjectRows(usersResponse, "users").map((user) => Number(user.id)).filter((userId) => Number.isSafeInteger(userId) && userId > 0);
+      const facialUserIds = [];
+      const batchSize = 4;
+      for (let offset = 0; offset < userIds.length; offset += batchSize) {
+        const batch = userIds.slice(offset, offset + batchSize);
+        const results = await Promise.all(batch.map(async (userId) => {
+          try {
+            const image = await client.getUserImage(userId);
+            return image.base64 ? userId : null;
+          } catch {
+            return null;
+          }
+        }));
+        facialUserIds.push(...results.filter((userId) => userId !== null));
+      }
+      return facialUserIds;
+    }
+  }
+  async function syncReaderFacialData(readerId) {
+    const reader = await getActiveReader(readerId);
+    assertReaderCapability(reader, "facial");
+    const client = new HidAmicoClient(reader);
+    try {
+      await client.login();
+      const facialUserIds = await getReaderFacialUserIds(client);
+      const activeIdentities = await repo.listActiveIdentities(readerId);
+      const identitiesByUserId = new Map(
+        activeIdentities.filter((identity) => identity._id && identity.hidUserId !== void 0).map((identity) => [String(identity.hidUserId), identity])
+      );
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      let syncedCount = 0;
+      let unmappedCount = 0;
+      for (const hidUserId of facialUserIds) {
+        const identity = identitiesByUserId.get(String(hidUserId));
+        if (!identity?._id) {
+          unmappedCount += 1;
+          continue;
+        }
+        const metadata = isUnknownRecord2(identity.metadata) ? identity.metadata : {};
+        await repo.updateIdentity(identity._id, {
+          metadata: {
+            ...metadata,
+            facialData: String(hidUserId),
+            facialEnrolled: true,
+            facialSyncedAt: syncedAt
+          }
+        });
+        syncedCount += 1;
+      }
+      const message = [
+        facialUserIds.length ? `Detected ${facialUserIds.length} facial enrollment(s) on the HID reader.` : "No facial enrollments found on the HID reader.",
+        syncedCount ? `${syncedCount} mapped HID user(s) updated.` : "",
+        unmappedCount ? `${unmappedCount} facial enrollment(s) still need HID User Mapping.` : ""
+      ].filter(Boolean).join(" ");
+      await repo.updateById(readerId, { status: "active", lastSeenAt: /* @__PURE__ */ new Date() });
+      await repo.addEvent({
+        reader: readerId,
+        site: reader.site,
+        type: "facial_sync",
+        payload: { facialDetected: facialUserIds.length, syncedCount, unmappedCount }
+      });
+      return {
+        readerId,
+        facialDetected: facialUserIds.length,
+        syncedCount,
+        unmappedCount,
+        message
+      };
+    } catch (error) {
+      await repo.addEvent({
+        reader: readerId,
+        site: reader.site,
+        type: "facial_sync_failed",
+        status: "failed",
+        payload: { message: getErrorMessage2(error) }
+      });
+      throw error;
+    } finally {
+      await client.logout();
+    }
+  }
   async function setVisitorImage(readerId, visitorId, image, options = {}) {
     assertHidFacialImage(image);
     const reader = await getActiveReader(readerId);
@@ -48284,6 +48408,7 @@ function useHidAmicoService() {
     setVisitorImage,
     deleteVisitorImage,
     getUserImage,
+    syncReaderFacialData,
     listUserCards,
     assignUserCard,
     enrollUserCard,
@@ -84298,6 +84423,19 @@ function useHidAmicoController() {
       next(error);
     }
   }
+  async function syncReaderFacialData(req, res, next) {
+    const { error, value } = schemaHidAmicoReaderIdParams.validate(req.params);
+    if (error) {
+      next(new import_node_server_utils286.BadRequestError(error.message));
+      return;
+    }
+    try {
+      await authorizeReaderAccess(req, value.readerId, "manage");
+      res.json({ data: await service.syncReaderFacialData(value.readerId) });
+    } catch (error2) {
+      next(error2);
+    }
+  }
   async function listLogs(req, res, next) {
     const params = schemaHidAmicoReaderIdParams.validate(req.params);
     const query2 = schemaHidAmicoLogQuery.validate(req.query);
@@ -84409,7 +84547,8 @@ function useHidAmicoController() {
         query2.value.page,
         query2.value.limit,
         query2.value.search,
-        query2.value.status
+        query2.value.status,
+        query2.value.includeVisitors
       ));
     } catch (error) {
       next(error);
@@ -84987,6 +85126,7 @@ function useHidAmicoController() {
     deleteReader,
     testReader,
     syncReader,
+    syncReaderFacialData,
     configureReaderIntegration,
     setReaderMonitor,
     setOperatingMode,