@7365admin1/core 3.47.1-staging.133 → 3.47.1-staging.134

package/.changeset/people-read-scope.md

@@ -0,0 +1,40 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope `GET /api/people` to a site the caller can actually reach.
+
+The endpoint returns resident and visitor records — name, NRIC, contact number,
+unit, plate numbers — and filters on NRIC, contact and plate number. It carried
+`requireAuth` and nothing more, and took its `org` and `site` from the query
+string (`person.controller.ts:79-80, 93`). So any signed-in account on the
+platform could page through another estate's residents, or look a person up by
+NRIC across every client at once.
+
+The caller is now resolved from the session and the scope decided before
+anything is read:
+
+- a named `site` is checked with `entitleSite` — the same site-reach rule the
+  camera and HID modules already use: a membership at the site, an org-wide
+  membership at the site's owning organisation, or an ACTIVE `customer.sites`
+  engagement. Reusing it matters rather than being tidy: an agency contracted to
+  an estate holds no membership in that estate's organisation, so an
+  org-membership check would have locked every guard out of the site they work
+  at. A site the caller cannot reach answers exactly as a site that does not
+  exist, so site ids cannot be enumerated.
+- a named `org` is checked against the caller's own memberships.
+- naming neither — the NRIC, contact and plate lookups — is narrowed to the
+  caller's own organisations instead of searching the whole platform.
+- Seven365 staff keep cross-tenant reach, unchanged.
+
+Every live caller passes a site: `layer-common` `VisitorForm.vue`,
+`MemberInformation.vue` and `VehicleForm.vue` all pass the site the screen is
+open on, and the People list passes org and site from its route. The two
+composable functions that pass neither — `usePeople().findPersonByContact` and
+`findUsersByPlateNumber` — have no caller in any repository.
+
+`person.repo.getAll` gains an optional `orgs` filter for the last case. It
+applies only when no explicit `org` was given, so it cannot fight one, and its
+absence means "no restriction", which is what staff get.
+
+No response shape, status code or field changed for a permitted caller.

package/dist/index.d.ts

@@ -4570,7 +4570,7 @@ declare function useGuestManagementController(): {
 declare const site_people_namespace_collection = "site.people";
 declare function usePersonRepo(): {
     add: (value: TPerson, session?: ClientSession) => Promise<ObjectId>;
-    getAll: ({ search, page, limit, sort, status, dateFrom, dateTo, org, site, type, nric, contact, plateNumber, }: {
+    getAll: ({ search, page, limit, sort, status, dateFrom, dateTo, org, orgs, site, type, nric, contact, plateNumber, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
@@ -4579,6 +4579,13 @@ declare function usePersonRepo(): {
         dateFrom?: string | undefined;
         dateTo?: string | undefined;
         org?: string | undefined;
+        /**
+         * The organisations the CALLER may see, when they have named neither an
+         * organisation nor a site. Resolved from the session by the controller,
+         * never from the request. Absent means "no restriction" — which is what
+         * Seven365 staff get.
+         */
+        orgs?: string[] | undefined;
         site?: string | undefined;
         type?: string | undefined;
         nric?: string | undefined;