@7365admin1/core 3.47.1-staging.123 → 3.47.1-staging.124

package/.changeset/hid-facial-sync-authorization.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Authorize the HID facial-data sync handler in its own body
+
+`syncReaderFacialData` reached `staging` with no authorization check inside the
+handler. The API-core router does apply `requireAuth` + `authorizeManage`, so it
+was not reachable by an ordinary signed-in user — but this is a published
+package, and the guard and the handler sat in two different repositories. It now
+runs the same `manage`-level check the router applies, with the site taken from
+the stored reader. The guard test pins it by name.

package/dist/index.js

@@ -84430,6 +84430,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, value.readerId, "manage");
       res.json({ data: await service.syncReaderFacialData(value.readerId) });
     } catch (error2) {
       next(error2);