@7365admin1/core 3.47.1-staging.143 → 3.47.1-staging.145

package/.changeset/access-management-site-scope.md

@@ -0,0 +1,59 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the access-management routes to a site the caller can reach.
+
+Every route on `/api/access-management` carried `requireAuth` and nothing more.
+`requireAuth` proves a session exists; it makes no organisation or site
+decision. So any signed-in account on the platform — a resident of a different
+estate, a cleaner, anybody with a login — could read another client's
+access-card inventory, its card holders, the residents behind a unit and the
+block/level/unit structure, and could ISSUE a physical NFC card into that
+estate, generate visitor QR passes for it and stamp QR tags onto its cards.
+These are the credentials that open that estate's doors and lifts.
+
+Twenty-eight handlers now decide from the site the request already names,
+before any work is done:
+
+- from the body — `addPhysicalCard`, `addNonPhysicalCard`, `acknowlegdeCard`,
+  `replaceCard`, `assignAccessCardToUnit`, `vmsgenerateQrCodes`,
+  `addVisitorAccessCard`;
+- from the query — `allAccessCardsCounts`, `availableAccessCards`,
+  `userTypeAccessCards`, `assignedAccessCards`, `assignedAccessCardsByUnit`,
+  `accessandLiftCards`, `doorAndLiftDropdown`, `visitorAccessCards`,
+  `bulkPhysicalAccessCard`, `getCardDetails`, `allQrTag`,
+  `availableCardContractors`, `getBlockLevelAndUnitList`, `getResidents`,
+  `userAccessCards`, `uploadTemplate`, `removeTemplate`, `qrCodeList`;
+- from the URL — `getCardReplacement`, `getAccessManagementSettings`, `addQrTag`.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`: a membership
+pinned to the site, an org-wide membership at the site's owning organisation, or
+an ACTIVE `customer.sites` engagement. The engagement branch is required, not
+incidental — access cards are administered from the security and
+property-management apps, whose users hold no membership in the estate's own
+organisation.
+
+The guard writes its own response instead of throwing. Every handler in this
+controller wraps its body in `try { ... } catch { res.status(400|500) }` rather
+than calling `next(error)`, so a thrown `UnauthorizedError`/`NotFoundError`
+would never reach the error handler and would have surfaced as a 400 with the
+guard's message inside it. It is placed AFTER each handler's Joi validation, so
+a malformed or missing site still answers 400 exactly as before, and only a
+well-formed site the caller cannot reach is refused. That refusal is 404 — what
+a site that does not exist already answers — so site ids cannot be enumerated by
+watching the difference.
+
+Six routes on the mount are deliberately NOT changed, because they carry no
+site at all and need per-record resolution:
+
+- `POST /sign-qr` and `PATCH /visitor-checkout` — both are called by shipped
+  mobile clients that cannot update in lockstep
+  (`resident-mobile-app src/actions/entrypass.ts:66`, `isecure365-mobile-app
+  src/features/visitors/entry-pass.service.ts:175` and `visitor.service.ts:194`).
+- `PATCH /nfc-status`, `PATCH /delete-card`, `POST /card-replacement`,
+  `POST /assign-user` — each identifies a card by id and would need the card's
+  own site loaded first.
+- `GET /door-access-levels`, `GET /lift-access-levels`, `GET /access-groups` and
+  `POST /settings` take an `acm_url` — an access-control device URL — so they
+  are a separate question from site reach and were not touched here.

package/.changeset/person-lookup-scope.md

@@ -0,0 +1,44 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the single-value people lookups to a site the caller can reach.
+
+Seven endpoints on `/api/people` carried `requireAuth` and nothing else and were
+not scoped at all:
+
+| Route | What it answered |
+|---|---|
+| `GET /nric/:nric` | a `findOne` on NRIC across the **whole platform** |
+| `GET /contact/:contact` | the same, on contact number |
+| `GET /plateNumber/:plateNumber` | every person with that plate, anywhere |
+| `GET /unit/:unit` | every person at that unit id |
+| `GET /user/:userId` | the person record behind any user id |
+| `GET /company` | company names aggregated across every client |
+| `GET /all-nric` | a paged NRIC list at a caller-named site |
+
+So any signed-in account could type an NRIC or a car plate and read the matching
+resident of any estate — name, unit, contact number, plates. #1907 scoped the
+paged list (`GET /api/people`); these are the lookups beside it.
+
+None of them takes a site — `layer-common usePeople.findPersonByNRIC`,
+`searchCompanyList` and `getPeopleByUnit` pass only the value being looked up —
+so the scope is decided **after** the read, on the record, with the same
+site-reach rule the camera, HID and people-list already use. A record the caller
+cannot reach is left out, which for these endpoints is exactly what "no such
+person" already looked like: `null`, or an empty list. **No client sees a new
+response shape or a new status code.** `entitleSite` is asked once per distinct
+site, not once per record.
+
+`/all-nric` requires a site in the query, so that one is checked before the read
+and answers `404` for a site the caller cannot reach — the same answer a site
+that does not exist gives, so ids cannot be probed.
+
+`/company` has no site or unit to scope on, so it is narrowed to the caller's
+own organisations — the fallback `getAll` already uses. `person.repo.getCompany`
+gains an optional `orgs` filter; absent means no restriction, which is what
+Seven365 staff get.
+
+`GET /user/:userId` also always answers about **your own** record, whatever your
+memberships say: the resident app reads it during sign-up and when resubmitting
+a rejected registration.

package/dist/index.d.ts

@@ -4612,7 +4612,7 @@ declare function usePersonRepo(): {
         type?: ("resident" | "walk-in" | "drop-off" | "contractor" | "delivery" | "pick-up" | "guest" | "tenant")[] | undefined;
         unit?: string | undefined;
     }, session?: ClientSession) => Promise<TPerson[]>;
-    getCompany: (search?: string) => Promise<any[]>;
+    getCompany: (search?: string, orgs?: string[]) => Promise<any[]>;
     getPeopleByPlateNumber: (plateNumber: string) => Promise<TPerson[]>;
     getPeopleByNRIC: ({ page, limit, nric, sort, site, }: {
         page?: number | undefined;
@@ -6491,35 +6491,35 @@ declare function UseAccessManagementRepo(): {
 };
 
 declare function useAccessManagementController(): {
-    addPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addNonPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    addPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addNonPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     doorAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     liftAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessGroups: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignedAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignedAccessCardsByUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignedAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignedAccessCardsByUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     removeAccessCard: ({ cardNo, staffNo, url, }: {
@@ -6527,15 +6527,15 @@ declare function useAccessManagementController(): {
         staffNo: string;
         url: string;
     }) => Promise<void>;
-    getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getTransactions: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     visitorCheckout: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    userAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    removeTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    qrCodeList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    userAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    removeTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    qrCodeList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     generateQrCodeWithExpiry: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
 };
 

package/dist/index.js

@@ -17735,7 +17735,7 @@ function usePersonRepo() {
       );
     }
   }
-  async function getCompany(search) {
+  async function getCompany(search, orgs) {
     try {
       const cacheKey = (0, import_node_server_utils40.makeCacheKey)(site_people_namespace_collection, {
         company: search
@@ -17747,6 +17747,11 @@ function usePersonRepo() {
       if (search) {
         query2.companyName = { $regex: search, $options: "i" };
       }
+      if (orgs) {
+        query2.org = {
+          $in: orgs.filter(import_mongodb36.ObjectId.isValid).map((o) => new import_mongodb36.ObjectId(o))
+        };
+      }
       let data = [];
       data = await collection.aggregate([
         { $match: query2 },
@@ -50365,6 +50370,38 @@ function usePersonController() {
     }
     return actor;
   }
+  async function siteReach(req) {
+    const actor = await resolveInviteActor(callerId(req));
+    const reachable = /* @__PURE__ */ new Map();
+    function canReach(person) {
+      if (actor.isSuperAdmin)
+        return Promise.resolve(true);
+      if (!person)
+        return Promise.resolve(false);
+      const site = person.site?.toString() ?? "";
+      if (!site) {
+        const org = person.org?.toString() ?? "";
+        return Promise.resolve(Boolean(org) && actor.orgIds.includes(org));
+      }
+      if (!reachable.has(site)) {
+        reachable.set(
+          site,
+          useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
+            () => true,
+            () => false
+          )
+        );
+      }
+      return reachable.get(site);
+    }
+    async function only(people) {
+      if (actor.isSuperAdmin)
+        return people;
+      const verdicts = await Promise.all(people.map((p) => canReach(p)));
+      return people.filter((_, i) => verdicts[i]);
+    }
+    return { actor, canReach, only };
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
@@ -50539,7 +50576,8 @@ function usePersonController() {
     }
     try {
       const data = await _getByNRIC(nric);
-      res.json(data);
+      const { canReach } = await siteReach(req);
+      res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50558,7 +50596,8 @@ function usePersonController() {
     }
     try {
       const data = await _getPersonByPhoneNumber(contact);
-      res.json(data);
+      const { canReach } = await siteReach(req);
+      res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50602,7 +50641,8 @@ function usePersonController() {
         type,
         unit
       });
-      res.json(data);
+      const { only } = await siteReach(req);
+      res.json(await only(data));
       return;
     } catch (error) {
       import_node_server_utils138.logger.log({ level: "error", message: error.message });
@@ -50622,7 +50662,11 @@ function usePersonController() {
     }
     const { search } = value;
     try {
-      const data = await _getCompany(search);
+      const { actor } = await siteReach(req);
+      const data = await _getCompany(
+        search,
+        actor.isSuperAdmin ? void 0 : actor.orgIds
+      );
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -50642,7 +50686,8 @@ function usePersonController() {
     }
     try {
       const data = await _getPeopleByPlateNumber(plateNumber);
-      res.json({ data });
+      const { only } = await siteReach(req);
+      res.json({ data: await only(data) });
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -50682,6 +50727,10 @@ function usePersonController() {
       }
     });
     try {
+      const { actor } = await siteReach(req);
+      if (!actor.isSuperAdmin) {
+        await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
+      }
       const data = await _getPeopleByNRIC({
         nric,
         page,
@@ -50708,7 +50757,9 @@ function usePersonController() {
     }
     try {
       const data = await _getByUserId(userId);
-      res.json(data);
+      const { actor, canReach } = await siteReach(req);
+      const isSelf = Boolean(actor.id) && data?.user?.toString() === actor.id;
+      res.json(isSelf || await canReach(data) ? data : null);
       return;
     } catch (error2) {
       import_node_server_utils138.logger.log({ level: "error", message: error2.message });
@@ -63736,6 +63787,16 @@ function useAccessManagementSvc() {
 
 // src/controllers/access-management.controller.ts
 function useAccessManagementController() {
+  const refuseUnreachableSite = async (req, res, site) => {
+    try {
+      await requireSiteReach(req, site);
+      return false;
+    } catch (error) {
+      const status = Number(error?.statusCode) || 401;
+      res.status(status).json({ data: null, message: error.message });
+      return true;
+    }
+  };
   const {
     addPhysicalCardSvc,
     addNonPhysicalCardSvc,
@@ -63812,6 +63873,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ data: null, message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, payload.site))
+        return;
       const result = await addPhysicalCardSvc(payload);
       return res.status(201).json({
         data: result,
@@ -63880,6 +63943,8 @@ function useAccessManagementController() {
       if (error) {
         throw new Error(`${error.message}`);
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await addNonPhysicalCardSvc({
         site,
         quantity,
@@ -63980,6 +64045,8 @@ function useAccessManagementController() {
       if (error) {
         throw new Error(`${error.message}`);
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await allAccessCardsCountsSvc({ site, userType });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64002,6 +64069,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await availableAccessCardsSvc({ site, userType, type });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64040,6 +64109,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await userTypeAccessCardsSvc({
         page,
         limit,
@@ -64085,6 +64156,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await assignedAccessCardsSvc({
         site,
         userType,
@@ -64127,6 +64200,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await assignedAccessCardsByUnitSvc({
         site,
         unitId,
@@ -64154,6 +64229,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await acknowlegdeCardSvc({ userId, cardId, site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64189,6 +64266,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await accessandLiftCardsSvc({
         accessLevel,
         liftAccessLevel,
@@ -64217,6 +64296,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await replaceCardSvc({ userId, cardId, site, acm_url });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64263,6 +64344,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await doorAndLiftDropdownSvc({ site, type, userType });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64327,6 +64410,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await visitorAccessCardsSvc({
         site,
         page,
@@ -64374,6 +64459,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await getCardReplacementSvc({
         site,
         page,
@@ -64401,6 +64488,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await getAccessManagementSettingsSvc({ site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64417,6 +64506,8 @@ function useAccessManagementController() {
         throw new Error("File is required!");
       const xlsData = await convertBufferFile(req.file.buffer);
       const dataJson = JSON.stringify(xlsData);
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await bulkPhysicalAccessCardSvc({ dataJson, site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64458,6 +64549,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await assignAccessCardToUnitSvc({
         units,
         quantity,
@@ -64506,6 +64599,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await getCardDetailsSvc({ siteId, cardId });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64534,6 +64629,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await addQrTagSvc({ payload, site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64553,6 +64650,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await allQrTagSvc({ site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64582,6 +64681,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await availableCardContractorsSvc({
         siteId,
         unitId,
@@ -64614,6 +64715,8 @@ function useAccessManagementController() {
         return res.status(400).json({ message: error.message });
       }
       const normalizedUnitId = [unitId];
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await vmsgenerateQrCodesSvc({
         site,
         unitId,
@@ -64665,6 +64768,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await addVisitorAccessCardSvc({
         site,
         unitId,
@@ -64741,6 +64846,8 @@ function useAccessManagementController() {
       if (!site || typeof site !== "string") {
         throw new Error("Site is required");
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await getBlockLevelAndUnitListSvc({ site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64836,6 +64943,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await uploadTemplateSvc({ site, id, name });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64857,6 +64966,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await getResidentsSvc({ orgId, siteId, unitId });
       return res.status(200).json({ data: result });
     } catch (error) {
@@ -64880,6 +64991,8 @@ function useAccessManagementController() {
         return res.status(400).json({ message: error.message });
       }
       const isLiftCardBool = isLiftCard === "true";
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await userAccessCardsSvc({
         userId,
         siteId,
@@ -64904,6 +65017,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await removeTemplateSvc({ site });
       return res.status(200).json({ data: result });
     } catch (error) {
@@ -64937,6 +65052,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await qrCodeListSvc({
         type,
         site,