@7365admin1/core 3.47.1-staging.142 → 3.47.1-staging.144

package/.changeset/person-lookup-scope.md

@@ -0,0 +1,44 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the single-value people lookups to a site the caller can reach.
+
+Seven endpoints on `/api/people` carried `requireAuth` and nothing else and were
+not scoped at all:
+
+| Route | What it answered |
+|---|---|
+| `GET /nric/:nric` | a `findOne` on NRIC across the **whole platform** |
+| `GET /contact/:contact` | the same, on contact number |
+| `GET /plateNumber/:plateNumber` | every person with that plate, anywhere |
+| `GET /unit/:unit` | every person at that unit id |
+| `GET /user/:userId` | the person record behind any user id |
+| `GET /company` | company names aggregated across every client |
+| `GET /all-nric` | a paged NRIC list at a caller-named site |
+
+So any signed-in account could type an NRIC or a car plate and read the matching
+resident of any estate — name, unit, contact number, plates. #1907 scoped the
+paged list (`GET /api/people`); these are the lookups beside it.
+
+None of them takes a site — `layer-common usePeople.findPersonByNRIC`,
+`searchCompanyList` and `getPeopleByUnit` pass only the value being looked up —
+so the scope is decided **after** the read, on the record, with the same
+site-reach rule the camera, HID and people-list already use. A record the caller
+cannot reach is left out, which for these endpoints is exactly what "no such
+person" already looked like: `null`, or an empty list. **No client sees a new
+response shape or a new status code.** `entitleSite` is asked once per distinct
+site, not once per record.
+
+`/all-nric` requires a site in the query, so that one is checked before the read
+and answers `404` for a site the caller cannot reach — the same answer a site
+that does not exist gives, so ids cannot be probed.
+
+`/company` has no site or unit to scope on, so it is narrowed to the caller's
+own organisations — the fallback `getAll` already uses. `person.repo.getCompany`
+gains an optional `orgs` filter; absent means no restriction, which is what
+Seven365 staff get.
+
+`GET /user/:userId` also always answers about **your own** record, whatever your
+memberships say: the resident app reads it during sign-up and when resubmitting
+a rejected registration.

package/.changeset/person-write-scope.md

@@ -0,0 +1,38 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the resident and visitor WRITES to a site the caller can actually reach.
+
+`PUT /api/people/id/:id` (edit), `PUT /api/people/:id` (delete),
+`PATCH /api/people/:id` (approve / reject / ask to resubmit) and the exported
+`suspendResidentById` identify the person by an id in the URL and carried
+`requireAuth` and nothing more. Any signed-in account on the platform — a
+resident, a cleaner, a guard at a different estate — could rename, delete,
+approve or reject any other client's resident. #1907 closed the read
+(`GET /api/people`); these are the writes behind it.
+
+The scope is resolved from the **stored record**, never from the request, and
+that is not a stylistic choice: **not one live caller sends a site.**
+`layer-common usePeople.deleteById` sends no body at all,
+`reviewResidentPerson` sends only `{ status, remarks }`, and both
+`web-app-property-management pages/[org]/[site]/people-mgmt/index.vue:915-917`
+and `components/PeopleFormMgmt.vue:618-620` explicitly `delete payload.site`
+before calling `updateById`. A guard that read the site out of the body would
+have refused every real caller and protected nobody.
+
+The rule is the site-reach rule the camera, HID and people-list already use —
+membership of the site, an org-wide membership at the site's owner, or an active
+`customer.sites` engagement — so an agency contracted to an estate keeps
+working. A record carrying an organisation but no site falls back to that
+organisation. Seven365 staff are unchanged.
+
+A resident resubmitting their own registration from the mobile app still works:
+`person.service.ts:155-166` writes a `members` row pinned to the site at
+sign-up, before any approval, so a rejected resident still reaches their own
+site. There is an end-to-end case for exactly that.
+
+Also: **who approved a resident now comes from the session.** It was read out of
+the `user` cookie the browser sends, falling back to whatever `approvedBy` the
+request body claimed, so an approval could be attributed to anybody. No caller
+sends `approvedBy`, so nothing is lost.

package/dist/index.d.ts

@@ -4612,7 +4612,7 @@ declare function usePersonRepo(): {
         type?: ("resident" | "walk-in" | "drop-off" | "contractor" | "delivery" | "pick-up" | "guest" | "tenant")[] | undefined;
         unit?: string | undefined;
     }, session?: ClientSession) => Promise<TPerson[]>;
-    getCompany: (search?: string) => Promise<any[]>;
+    getCompany: (search?: string, orgs?: string[]) => Promise<any[]>;
     getPeopleByPlateNumber: (plateNumber: string) => Promise<TPerson[]>;
     getPeopleByNRIC: ({ page, limit, nric, sort, site, }: {
         page?: number | undefined;

package/dist/index.js

@@ -17735,7 +17735,7 @@ function usePersonRepo() {
       );
     }
   }
-  async function getCompany(search) {
+  async function getCompany(search, orgs) {
     try {
       const cacheKey = (0, import_node_server_utils40.makeCacheKey)(site_people_namespace_collection, {
         company: search
@@ -17747,6 +17747,11 @@ function usePersonRepo() {
       if (search) {
         query2.companyName = { $regex: search, $options: "i" };
       }
+      if (orgs) {
+        query2.org = {
+          $in: orgs.filter(import_mongodb36.ObjectId.isValid).map((o) => new import_mongodb36.ObjectId(o))
+        };
+      }
       let data = [];
       data = await collection.aggregate([
         { $match: query2 },
@@ -50338,7 +50343,8 @@ function usePersonController() {
     getCompany: _getCompany,
     getPeopleByPlateNumber: _getPeopleByPlateNumber,
     getPeopleByNRIC: _getPeopleByNRIC,
-    getByUserId: _getByUserId
+    getByUserId: _getByUserId,
+    getById: _getById
   } = usePersonRepo();
   const {
     add: _add,
@@ -50346,6 +50352,56 @@ function usePersonController() {
     reviewResidentPerson: _reviewResidentPerson,
     suspendResidentById: _suspendResidentById
   } = usePersonService();
+  async function entitlePerson(req, _id) {
+    const actor = await resolveInviteActor(callerId(req));
+    if (actor.isSuperAdmin)
+      return actor;
+    const person = await _getById(_id);
+    if (!person)
+      throw new import_node_server_utils139.NotFoundError("Person not found.");
+    const site = person.site?.toString() ?? "";
+    if (site) {
+      await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
+      return actor;
+    }
+    const org = person.org?.toString() ?? "";
+    if (!org || !actor.orgIds.includes(org)) {
+      throw new import_node_server_utils139.UnauthorizedError("Not authorized.");
+    }
+    return actor;
+  }
+  async function siteReach(req) {
+    const actor = await resolveInviteActor(callerId(req));
+    const reachable = /* @__PURE__ */ new Map();
+    function canReach(person) {
+      if (actor.isSuperAdmin)
+        return Promise.resolve(true);
+      if (!person)
+        return Promise.resolve(false);
+      const site = person.site?.toString() ?? "";
+      if (!site) {
+        const org = person.org?.toString() ?? "";
+        return Promise.resolve(Boolean(org) && actor.orgIds.includes(org));
+      }
+      if (!reachable.has(site)) {
+        reachable.set(
+          site,
+          useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
+            () => true,
+            () => false
+          )
+        );
+      }
+      return reachable.get(site);
+    }
+    async function only(people) {
+      if (actor.isSuperAdmin)
+        return people;
+      const verdicts = await Promise.all(people.map((p) => canReach(p)));
+      return people.filter((_, i) => verdicts[i]);
+    }
+    return { actor, canReach, only };
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
@@ -50479,6 +50535,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -50498,6 +50555,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted visitor guest." });
       return;
@@ -50518,7 +50576,8 @@ function usePersonController() {
     }
     try {
       const data = await _getByNRIC(nric);
-      res.json(data);
+      const { canReach } = await siteReach(req);
+      res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50537,7 +50596,8 @@ function usePersonController() {
     }
     try {
       const data = await _getPersonByPhoneNumber(contact);
-      res.json(data);
+      const { canReach } = await siteReach(req);
+      res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50581,7 +50641,8 @@ function usePersonController() {
         type,
         unit
       });
-      res.json(data);
+      const { only } = await siteReach(req);
+      res.json(await only(data));
       return;
     } catch (error) {
       import_node_server_utils138.logger.log({ level: "error", message: error.message });
@@ -50601,7 +50662,11 @@ function usePersonController() {
     }
     const { search } = value;
     try {
-      const data = await _getCompany(search);
+      const { actor } = await siteReach(req);
+      const data = await _getCompany(
+        search,
+        actor.isSuperAdmin ? void 0 : actor.orgIds
+      );
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -50621,7 +50686,8 @@ function usePersonController() {
     }
     try {
       const data = await _getPeopleByPlateNumber(plateNumber);
-      res.json({ data });
+      const { only } = await siteReach(req);
+      res.json({ data: await only(data) });
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50661,6 +50727,10 @@ function usePersonController() {
       }
     });
     try {
+      const { actor } = await siteReach(req);
+      if (!actor.isSuperAdmin) {
+        await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
+      }
       const data = await _getPeopleByNRIC({
         nric,
         page,
@@ -50687,7 +50757,9 @@ function usePersonController() {
     }
     try {
       const data = await _getByUserId(userId);
-      res.json(data);
+      const { actor, canReach } = await siteReach(req);
+      const isSelf = Boolean(actor.id) && data?.user?.toString() === actor.id;
+      res.json(isSelf || await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50696,11 +50768,7 @@ function usePersonController() {
     }
   }
   async function reviewResidentPerson(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    req.body.approvedBy = cookies?.["user"] ? cookies["user"].toString() : req.body.approvedBy;
+    req.body.approvedBy = callerId(req) || req.body.approvedBy;
     const _id = req.params.id;
     const payload = { _id, ...req.body };
     const schema2 = import_joi68.default.object({
@@ -50717,6 +50785,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       req.body.approvedBy = { id: req.body.approvedBy, name: "" };
       const result = await _reviewResidentPerson(_id, req.body);
       res.status(200).json({ message: result });
@@ -50738,6 +50807,7 @@ function usePersonController() {
       return;
     }
     try {
+      await entitlePerson(req, _id);
       const result = await _suspendResidentById(_id);
       res.status(200).json({ message: result });
       return;