@7365admin1/core 3.47.1-staging.142 → 3.47.1-staging.143

package/.changeset/person-write-scope.md

@@ -0,0 +1,38 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the resident and visitor WRITES to a site the caller can actually reach.
+
+`PUT /api/people/id/:id` (edit), `PUT /api/people/:id` (delete),
+`PATCH /api/people/:id` (approve / reject / ask to resubmit) and the exported
+`suspendResidentById` identify the person by an id in the URL and carried
+`requireAuth` and nothing more. Any signed-in account on the platform — a
+resident, a cleaner, a guard at a different estate — could rename, delete,
+approve or reject any other client's resident. #1907 closed the read
+(`GET /api/people`); these are the writes behind it.
+
+The scope is resolved from the **stored record**, never from the request, and
+that is not a stylistic choice: **not one live caller sends a site.**
+`layer-common usePeople.deleteById` sends no body at all,
+`reviewResidentPerson` sends only `{ status, remarks }`, and both
+`web-app-property-management pages/[org]/[site]/people-mgmt/index.vue:915-917`
+and `components/PeopleFormMgmt.vue:618-620` explicitly `delete payload.site`
+before calling `updateById`. A guard that read the site out of the body would
+have refused every real caller and protected nobody.
+
+The rule is the site-reach rule the camera, HID and people-list already use —
+membership of the site, an org-wide membership at the site's owner, or an active
+`customer.sites` engagement — so an agency contracted to an estate keeps
+working. A record carrying an organisation but no site falls back to that
+organisation. Seven365 staff are unchanged.
+
+A resident resubmitting their own registration from the mobile app still works:
+`person.service.ts:155-166` writes a `members` row pinned to the site at
+sign-up, before any approval, so a rejected resident still reaches their own
+site. There is an end-to-end case for exactly that.
+
+Also: **who approved a resident now comes from the session.** It was read out of
+the `user` cookie the browser sends, falling back to whatever `approvedBy` the
+request body claimed, so an approval could be attributed to anybody. No caller
+sends `approvedBy`, so nothing is lost.

package/dist/index.js

@@ -50338,7 +50338,8 @@ function usePersonController() {
     getCompany: _getCompany,
     getPeopleByPlateNumber: _getPeopleByPlateNumber,
     getPeopleByNRIC: _getPeopleByNRIC,
-    getByUserId: _getByUserId
+    getByUserId: _getByUserId,
+    getById: _getById
   } = usePersonRepo();
   const {
     add: _add,
@@ -50346,6 +50347,24 @@ function usePersonController() {
     reviewResidentPerson: _reviewResidentPerson,
     suspendResidentById: _suspendResidentById
   } = usePersonService();
+  async function entitlePerson(req, _id) {
+    const actor = await resolveInviteActor(callerId(req));
+    if (actor.isSuperAdmin)
+      return actor;
+    const person = await _getById(_id);
+    if (!person)
+      throw new import_node_server_utils139.NotFoundError("Person not found.");
+    const site = person.site?.toString() ?? "";
+    if (site) {
+      await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
+      return actor;
+    }
+    const org = person.org?.toString() ?? "";
+    if (!org || !actor.orgIds.includes(org)) {
+      throw new import_node_server_utils139.UnauthorizedError("Not authorized.");
+    }
+    return actor;
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
@@ -50479,6 +50498,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -50498,6 +50518,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted visitor guest." });
       return;
@@ -50696,11 +50717,7 @@ function usePersonController() {
     }
   }
   async function reviewResidentPerson(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    req.body.approvedBy = cookies?.["user"] ? cookies["user"].toString() : req.body.approvedBy;
+    req.body.approvedBy = callerId(req) || req.body.approvedBy;
     const _id = req.params.id;
     const payload = { _id, ...req.body };
     const schema2 = import_joi68.default.object({
@@ -50717,6 +50734,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       req.body.approvedBy = { id: req.body.approvedBy, name: "" };
       const result = await _reviewResidentPerson(_id, req.body);
       res.status(200).json({ message: result });
@@ -50738,6 +50756,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       const result = await _suspendResidentById(_id);
       res.status(200).json({ message: result });
       return;