@7365admin1/core 3.47.1-staging.141 → 3.47.1-staging.143

package/.changeset/person-search-filter-collision.md

@@ -0,0 +1,26 @@
+---
+"@7365admin1/core": patch
+---
+
+Make the people search filters narrow each other instead of overwriting each
+other.
+
+`person.repo.getAll` built its Mongo filter as one object literal in which four
+different filters each wrote a `$or` key — the date range (`dateTo`), the
+free-text `search`, `contact` and `plateNumber`. An object literal can only
+carry one `$or`, so the last one written silently replaced every earlier one.
+In practice:
+
+- searching by name **and** contact number searched only the contact number,
+- searching by name **and** plate number searched only the plate number,
+- and a **date range was dropped entirely** the moment any of the three was
+  used — which is the live case, because `layer-common`
+  `composables/usePeople.ts:2-30` sends `search`, `dateFrom` and `dateTo`
+  together from the visitor/people list.
+
+No error was raised; the endpoint simply answered a narrower question than it
+was asked, with rows that should not have matched.
+
+The four groups are now collected and combined with `$and`, so each one narrows
+the result. A single filter behaves exactly as before, and a request with no
+filters is unchanged.

package/.changeset/person-write-scope.md

@@ -0,0 +1,38 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the resident and visitor WRITES to a site the caller can actually reach.
+
+`PUT /api/people/id/:id` (edit), `PUT /api/people/:id` (delete),
+`PATCH /api/people/:id` (approve / reject / ask to resubmit) and the exported
+`suspendResidentById` identify the person by an id in the URL and carried
+`requireAuth` and nothing more. Any signed-in account on the platform — a
+resident, a cleaner, a guard at a different estate — could rename, delete,
+approve or reject any other client's resident. #1907 closed the read
+(`GET /api/people`); these are the writes behind it.
+
+The scope is resolved from the **stored record**, never from the request, and
+that is not a stylistic choice: **not one live caller sends a site.**
+`layer-common usePeople.deleteById` sends no body at all,
+`reviewResidentPerson` sends only `{ status, remarks }`, and both
+`web-app-property-management pages/[org]/[site]/people-mgmt/index.vue:915-917`
+and `components/PeopleFormMgmt.vue:618-620` explicitly `delete payload.site`
+before calling `updateById`. A guard that read the site out of the body would
+have refused every real caller and protected nobody.
+
+The rule is the site-reach rule the camera, HID and people-list already use —
+membership of the site, an org-wide membership at the site's owner, or an active
+`customer.sites` engagement — so an agency contracted to an estate keeps
+working. A record carrying an organisation but no site falls back to that
+organisation. Seven365 staff are unchanged.
+
+A resident resubmitting their own registration from the mobile app still works:
+`person.service.ts:155-166` writes a `members` row pinned to the site at
+sign-up, before any approval, so a rejected resident still reaches their own
+site. There is an end-to-end case for exactly that.
+
+Also: **who approved a resident now comes from the session.** It was read out of
+the `user` cookie the browser sends, falling back to whatever `approvedBy` the
+request body claimed, so an approval could be attributed to anybody. No caller
+sends `approvedBy`, so nothing is lost.

package/dist/index.js

@@ -17370,46 +17370,47 @@ function usePersonRepo() {
   }, session) {
     page = page > 0 ? page - 1 : 0;
     const start = dateFrom ? { $gte: new Date(dateFrom).toISOString() } : void 0;
-    const end = dateTo ? {
-      $or: [
+    const anyOf = [];
+    if (dateTo) {
+      anyOf.push([
         { end: { $lte: new Date(dateTo).toISOString() } },
         { end: null }
-      ]
-    } : void 0;
+      ]);
+    }
+    if (search) {
+      anyOf.push([
+        { name: { $regex: search, $options: "i" } },
+        { email: { $regex: search, $options: "i" } },
+        { nric: { $regex: search, $options: "i" } },
+        { "plates.plateNumber": { $regex: search, $options: "i" } },
+        { contact: { $regex: makeContainsRegex(search) } },
+        { contacts: { $regex: makeContainsRegex(search) } },
+        { plateNumbers: { $regex: makeContainsRegex(search) } }
+      ]);
+    }
+    if (contact) {
+      anyOf.push([
+        { contact: { $regex: makeContainsRegex(contact) } },
+        { contacts: { $regex: makeContainsRegex(contact) } }
+      ]);
+    }
+    if (plateNumber) {
+      anyOf.push([
+        { "plates.plateNumber": { $regex: makeContainsRegex(plateNumber) } },
+        { plateNumbers: { $regex: makeContainsRegex(plateNumber) } }
+      ]);
+    }
     const query2 = {
       ...status && status !== "all" ? { status } : { status: { $nin: ["deleted", "rejected"] } },
       ...start && { start },
-      ...end,
-      ...search && {
-        $or: [
-          { name: { $regex: search, $options: "i" } },
-          { email: { $regex: search, $options: "i" } },
-          { nric: { $regex: search, $options: "i" } },
-          { "plates.plateNumber": { $regex: search, $options: "i" } },
-          { contact: { $regex: makeContainsRegex(search) } },
-          { contacts: { $regex: makeContainsRegex(search) } },
-          { plateNumbers: { $regex: makeContainsRegex(search) } }
-        ]
-      },
+      ...anyOf.length > 0 && { $and: anyOf.map(($or) => ({ $or })) },
       ...import_mongodb36.ObjectId.isValid(org) && { org: new import_mongodb36.ObjectId(org) },
       ...!import_mongodb36.ObjectId.isValid(org) && orgs && {
         org: { $in: orgs.filter(import_mongodb36.ObjectId.isValid).map((o) => new import_mongodb36.ObjectId(o)) }
       },
       ...import_mongodb36.ObjectId.isValid(site) && { site: new import_mongodb36.ObjectId(site) },
       ...PERSON_TYPES.includes(type) && { type },
-      ...nric && { nric: { $regex: makeContainsRegex(nric), $options: "i" } },
-      ...contact && {
-        $or: [
-          { contact: { $regex: makeContainsRegex(contact) } },
-          { contacts: { $regex: makeContainsRegex(contact) } }
-        ]
-      },
-      ...plateNumber && {
-        $or: [
-          { "plates.plateNumber": { $regex: makeContainsRegex(plateNumber) } },
-          { plateNumbers: { $regex: makeContainsRegex(plateNumber) } }
-        ]
-      }
+      ...nric && { nric: { $regex: makeContainsRegex(nric), $options: "i" } }
     };
     sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
     try {
@@ -50337,7 +50338,8 @@ function usePersonController() {
     getCompany: _getCompany,
     getPeopleByPlateNumber: _getPeopleByPlateNumber,
     getPeopleByNRIC: _getPeopleByNRIC,
-    getByUserId: _getByUserId
+    getByUserId: _getByUserId,
+    getById: _getById
   } = usePersonRepo();
   const {
     add: _add,
@@ -50345,6 +50347,24 @@ function usePersonController() {
     reviewResidentPerson: _reviewResidentPerson,
     suspendResidentById: _suspendResidentById
   } = usePersonService();
+  async function entitlePerson(req, _id) {
+    const actor = await resolveInviteActor(callerId(req));
+    if (actor.isSuperAdmin)
+      return actor;
+    const person = await _getById(_id);
+    if (!person)
+      throw new import_node_server_utils139.NotFoundError("Person not found.");
+    const site = person.site?.toString() ?? "";
+    if (site) {
+      await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
+      return actor;
+    }
+    const org = person.org?.toString() ?? "";
+    if (!org || !actor.orgIds.includes(org)) {
+      throw new import_node_server_utils139.UnauthorizedError("Not authorized.");
+    }
+    return actor;
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
@@ -50478,6 +50498,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -50497,6 +50518,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted visitor guest." });
       return;
@@ -50695,11 +50717,7 @@ function usePersonController() {
     }
   }
   async function reviewResidentPerson(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    req.body.approvedBy = cookies?.["user"] ? cookies["user"].toString() : req.body.approvedBy;
+    req.body.approvedBy = callerId(req) || req.body.approvedBy;
     const _id = req.params.id;
     const payload = { _id, ...req.body };
     const schema2 = import_joi68.default.object({
@@ -50716,6 +50734,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       req.body.approvedBy = { id: req.body.approvedBy, name: "" };
       const result = await _reviewResidentPerson(_id, req.body);
       res.status(200).json({ message: result });
@@ -50737,6 +50756,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       const result = await _suspendResidentById(_id);
       res.status(200).json({ message: result });
       return;