@7365admin1/core 3.47.1-staging.123 → 3.47.1-staging.125

package/.changeset/hid-facial-sync-authorization.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Authorize the HID facial-data sync handler in its own body
+
+`syncReaderFacialData` reached `staging` with no authorization check inside the
+handler. The API-core router does apply `requireAuth` + `authorizeManage`, so it
+was not reachable by an ordinary signed-in user — but this is a published
+package, and the guard and the handler sat in two different repositories. It now
+runs the same `manage`-level check the router applies, with the site taken from
+the stored reader. The guard test pins it by name.

package/.github/workflows/main.yml

@@ -15,3 +15,13 @@ jobs:
           cache: "yarn"
       - run: yarn install
       - run: yarn lint && yarn build
+      # Separate step so a red suite is attributable at a glance rather than
+      # buried in a chained command.
+      #
+      # `yarn test` only runs `test/*.test.mjs` — pure functions and assertions
+      # read from source files. None of them opens a database, a Redis or a
+      # network socket, so nothing here needs a secret or a service container.
+      #
+      # `yarn test:e2e` is deliberately NOT run: it needs a live database. It
+      # stays a local/manual check.
+      - run: yarn test

package/dist/index.js

@@ -84430,6 +84430,7 @@ function useHidAmicoController() {
       return;
     }
     try {
+      await authorizeReaderAccess(req, value.readerId, "manage");
       res.json({ data: await service.syncReaderFacialData(value.readerId) });
     } catch (error2) {
       next(error2);