@7365admin1/core 3.47.1-staging.143 → 3.47.1-staging.144

package/.changeset/person-lookup-scope.md

@@ -0,0 +1,44 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the single-value people lookups to a site the caller can reach.
+
+Seven endpoints on `/api/people` carried `requireAuth` and nothing else and were
+not scoped at all:
+
+| Route | What it answered |
+|---|---|
+| `GET /nric/:nric` | a `findOne` on NRIC across the **whole platform** |
+| `GET /contact/:contact` | the same, on contact number |
+| `GET /plateNumber/:plateNumber` | every person with that plate, anywhere |
+| `GET /unit/:unit` | every person at that unit id |
+| `GET /user/:userId` | the person record behind any user id |
+| `GET /company` | company names aggregated across every client |
+| `GET /all-nric` | a paged NRIC list at a caller-named site |
+
+So any signed-in account could type an NRIC or a car plate and read the matching
+resident of any estate — name, unit, contact number, plates. #1907 scoped the
+paged list (`GET /api/people`); these are the lookups beside it.
+
+None of them takes a site — `layer-common usePeople.findPersonByNRIC`,
+`searchCompanyList` and `getPeopleByUnit` pass only the value being looked up —
+so the scope is decided **after** the read, on the record, with the same
+site-reach rule the camera, HID and people-list already use. A record the caller
+cannot reach is left out, which for these endpoints is exactly what "no such
+person" already looked like: `null`, or an empty list. **No client sees a new
+response shape or a new status code.** `entitleSite` is asked once per distinct
+site, not once per record.
+
+`/all-nric` requires a site in the query, so that one is checked before the read
+and answers `404` for a site the caller cannot reach — the same answer a site
+that does not exist gives, so ids cannot be probed.
+
+`/company` has no site or unit to scope on, so it is narrowed to the caller's
+own organisations — the fallback `getAll` already uses. `person.repo.getCompany`
+gains an optional `orgs` filter; absent means no restriction, which is what
+Seven365 staff get.
+
+`GET /user/:userId` also always answers about **your own** record, whatever your
+memberships say: the resident app reads it during sign-up and when resubmitting
+a rejected registration.

package/dist/index.d.ts

@@ -4612,7 +4612,7 @@ declare function usePersonRepo(): {
         type?: ("resident" | "walk-in" | "drop-off" | "contractor" | "delivery" | "pick-up" | "guest" | "tenant")[] | undefined;
         unit?: string | undefined;
     }, session?: ClientSession) => Promise<TPerson[]>;
-    getCompany: (search?: string) => Promise<any[]>;
+    getCompany: (search?: string, orgs?: string[]) => Promise<any[]>;
     getPeopleByPlateNumber: (plateNumber: string) => Promise<TPerson[]>;
     getPeopleByNRIC: ({ page, limit, nric, sort, site, }: {
         page?: number | undefined;

package/dist/index.js

@@ -17735,7 +17735,7 @@ function usePersonRepo() {
       );
     }
   }
-  async function getCompany(search) {
+  async function getCompany(search, orgs) {
     try {
       const cacheKey = (0, import_node_server_utils40.makeCacheKey)(site_people_namespace_collection, {
         company: search
@@ -17747,6 +17747,11 @@ function usePersonRepo() {
       if (search) {
         query2.companyName = { $regex: search, $options: "i" };
       }
+      if (orgs) {
+        query2.org = {
+          $in: orgs.filter(import_mongodb36.ObjectId.isValid).map((o) => new import_mongodb36.ObjectId(o))
+        };
+      }
       let data = [];
       data = await collection.aggregate([
         { $match: query2 },
@@ -50365,6 +50370,38 @@ function usePersonController() {
     }
     return actor;
   }
+  async function siteReach(req) {
+    const actor = await resolveInviteActor(callerId(req));
+    const reachable = /* @__PURE__ */ new Map();
+    function canReach(person) {
+      if (actor.isSuperAdmin)
+        return Promise.resolve(true);
+      if (!person)
+        return Promise.resolve(false);
+      const site = person.site?.toString() ?? "";
+      if (!site) {
+        const org = person.org?.toString() ?? "";
+        return Promise.resolve(Boolean(org) && actor.orgIds.includes(org));
+      }
+      if (!reachable.has(site)) {
+        reachable.set(
+          site,
+          useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
+            () => true,
+            () => false
+          )
+        );
+      }
+      return reachable.get(site);
+    }
+    async function only(people) {
+      if (actor.isSuperAdmin)
+        return people;
+      const verdicts = await Promise.all(people.map((p) => canReach(p)));
+      return people.filter((_, i) => verdicts[i]);
+    }
+    return { actor, canReach, only };
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
@@ -50539,7 +50576,8 @@ function usePersonController() {
     }
     try {
       const data = await _getByNRIC(nric);
-      res.json(data);
+      const { canReach } = await siteReach(req);
+      res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50558,7 +50596,8 @@ function usePersonController() {
     }
     try {
       const data = await _getPersonByPhoneNumber(contact);
-      res.json(data);
+      const { canReach } = await siteReach(req);
+      res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50602,7 +50641,8 @@ function usePersonController() {
         type,
         unit
       });
-      res.json(data);
+      const { only } = await siteReach(req);
+      res.json(await only(data));
       return;
     } catch (error) {
       import_node_server_utils138.logger.log({ level: "error", message: error.message });
@@ -50622,7 +50662,11 @@ function usePersonController() {
     }
     const { search } = value;
     try {
-      const data = await _getCompany(search);
+      const { actor } = await siteReach(req);
+      const data = await _getCompany(
+        search,
+        actor.isSuperAdmin ? void 0 : actor.orgIds
+      );
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -50642,7 +50686,8 @@ function usePersonController() {
     }
     try {
       const data = await _getPeopleByPlateNumber(plateNumber);
-      res.json({ data });
+      const { only } = await siteReach(req);
+      res.json({ data: await only(data) });
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50682,6 +50727,10 @@ function usePersonController() {
       }
     });
     try {
+      const { actor } = await siteReach(req);
+      if (!actor.isSuperAdmin) {
+        await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
+      }
       const data = await _getPeopleByNRIC({
         nric,
         page,
@@ -50708,7 +50757,9 @@ function usePersonController() {
     }
     try {
       const data = await _getByUserId(userId);
-      res.json(data);
+      const { actor, canReach } = await siteReach(req);
+      const isSelf = Boolean(actor.id) && data?.user?.toString() === actor.id;
+      res.json(isSelf || await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });