@7365admin1/core 3.47.1-staging.144 → 3.47.1-staging.145

package/.changeset/access-management-site-scope.md

@@ -0,0 +1,59 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the access-management routes to a site the caller can reach.
+
+Every route on `/api/access-management` carried `requireAuth` and nothing more.
+`requireAuth` proves a session exists; it makes no organisation or site
+decision. So any signed-in account on the platform — a resident of a different
+estate, a cleaner, anybody with a login — could read another client's
+access-card inventory, its card holders, the residents behind a unit and the
+block/level/unit structure, and could ISSUE a physical NFC card into that
+estate, generate visitor QR passes for it and stamp QR tags onto its cards.
+These are the credentials that open that estate's doors and lifts.
+
+Twenty-eight handlers now decide from the site the request already names,
+before any work is done:
+
+- from the body — `addPhysicalCard`, `addNonPhysicalCard`, `acknowlegdeCard`,
+  `replaceCard`, `assignAccessCardToUnit`, `vmsgenerateQrCodes`,
+  `addVisitorAccessCard`;
+- from the query — `allAccessCardsCounts`, `availableAccessCards`,
+  `userTypeAccessCards`, `assignedAccessCards`, `assignedAccessCardsByUnit`,
+  `accessandLiftCards`, `doorAndLiftDropdown`, `visitorAccessCards`,
+  `bulkPhysicalAccessCard`, `getCardDetails`, `allQrTag`,
+  `availableCardContractors`, `getBlockLevelAndUnitList`, `getResidents`,
+  `userAccessCards`, `uploadTemplate`, `removeTemplate`, `qrCodeList`;
+- from the URL — `getCardReplacement`, `getAccessManagementSettings`, `addQrTag`.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`: a membership
+pinned to the site, an org-wide membership at the site's owning organisation, or
+an ACTIVE `customer.sites` engagement. The engagement branch is required, not
+incidental — access cards are administered from the security and
+property-management apps, whose users hold no membership in the estate's own
+organisation.
+
+The guard writes its own response instead of throwing. Every handler in this
+controller wraps its body in `try { ... } catch { res.status(400|500) }` rather
+than calling `next(error)`, so a thrown `UnauthorizedError`/`NotFoundError`
+would never reach the error handler and would have surfaced as a 400 with the
+guard's message inside it. It is placed AFTER each handler's Joi validation, so
+a malformed or missing site still answers 400 exactly as before, and only a
+well-formed site the caller cannot reach is refused. That refusal is 404 — what
+a site that does not exist already answers — so site ids cannot be enumerated by
+watching the difference.
+
+Six routes on the mount are deliberately NOT changed, because they carry no
+site at all and need per-record resolution:
+
+- `POST /sign-qr` and `PATCH /visitor-checkout` — both are called by shipped
+  mobile clients that cannot update in lockstep
+  (`resident-mobile-app src/actions/entrypass.ts:66`, `isecure365-mobile-app
+  src/features/visitors/entry-pass.service.ts:175` and `visitor.service.ts:194`).
+- `PATCH /nfc-status`, `PATCH /delete-card`, `POST /card-replacement`,
+  `POST /assign-user` — each identifies a card by id and would need the card's
+  own site loaded first.
+- `GET /door-access-levels`, `GET /lift-access-levels`, `GET /access-groups` and
+  `POST /settings` take an `acm_url` — an access-control device URL — so they
+  are a separate question from site reach and were not touched here.

package/dist/index.d.ts

@@ -6491,35 +6491,35 @@ declare function UseAccessManagementRepo(): {
 };
 
 declare function useAccessManagementController(): {
-    addPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addNonPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    addPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addNonPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     doorAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     liftAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessGroups: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignedAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignedAccessCardsByUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignedAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignedAccessCardsByUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     removeAccessCard: ({ cardNo, staffNo, url, }: {
@@ -6527,15 +6527,15 @@ declare function useAccessManagementController(): {
         staffNo: string;
         url: string;
     }) => Promise<void>;
-    getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getTransactions: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     visitorCheckout: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    userAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    removeTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    qrCodeList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    userAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    removeTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    qrCodeList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     generateQrCodeWithExpiry: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
 };
 

package/dist/index.js

@@ -63787,6 +63787,16 @@ function useAccessManagementSvc() {
 
 // src/controllers/access-management.controller.ts
 function useAccessManagementController() {
+  const refuseUnreachableSite = async (req, res, site) => {
+    try {
+      await requireSiteReach(req, site);
+      return false;
+    } catch (error) {
+      const status = Number(error?.statusCode) || 401;
+      res.status(status).json({ data: null, message: error.message });
+      return true;
+    }
+  };
   const {
     addPhysicalCardSvc,
     addNonPhysicalCardSvc,
@@ -63863,6 +63873,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ data: null, message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, payload.site))
+        return;
       const result = await addPhysicalCardSvc(payload);
       return res.status(201).json({
         data: result,
@@ -63931,6 +63943,8 @@ function useAccessManagementController() {
       if (error) {
         throw new Error(`${error.message}`);
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await addNonPhysicalCardSvc({
         site,
         quantity,
@@ -64031,6 +64045,8 @@ function useAccessManagementController() {
       if (error) {
         throw new Error(`${error.message}`);
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await allAccessCardsCountsSvc({ site, userType });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64053,6 +64069,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await availableAccessCardsSvc({ site, userType, type });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64091,6 +64109,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await userTypeAccessCardsSvc({
         page,
         limit,
@@ -64136,6 +64156,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await assignedAccessCardsSvc({
         site,
         userType,
@@ -64178,6 +64200,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await assignedAccessCardsByUnitSvc({
         site,
         unitId,
@@ -64205,6 +64229,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await acknowlegdeCardSvc({ userId, cardId, site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64240,6 +64266,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await accessandLiftCardsSvc({
         accessLevel,
         liftAccessLevel,
@@ -64268,6 +64296,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await replaceCardSvc({ userId, cardId, site, acm_url });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64314,6 +64344,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await doorAndLiftDropdownSvc({ site, type, userType });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64378,6 +64410,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await visitorAccessCardsSvc({
         site,
         page,
@@ -64425,6 +64459,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await getCardReplacementSvc({
         site,
         page,
@@ -64452,6 +64488,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await getAccessManagementSettingsSvc({ site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64468,6 +64506,8 @@ function useAccessManagementController() {
         throw new Error("File is required!");
       const xlsData = await convertBufferFile(req.file.buffer);
       const dataJson = JSON.stringify(xlsData);
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await bulkPhysicalAccessCardSvc({ dataJson, site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64509,6 +64549,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await assignAccessCardToUnitSvc({
         units,
         quantity,
@@ -64557,6 +64599,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await getCardDetailsSvc({ siteId, cardId });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64585,6 +64629,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await addQrTagSvc({ payload, site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64604,6 +64650,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await allQrTagSvc({ site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64633,6 +64681,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await availableCardContractorsSvc({
         siteId,
         unitId,
@@ -64665,6 +64715,8 @@ function useAccessManagementController() {
         return res.status(400).json({ message: error.message });
       }
       const normalizedUnitId = [unitId];
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await vmsgenerateQrCodesSvc({
         site,
         unitId,
@@ -64716,6 +64768,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await addVisitorAccessCardSvc({
         site,
         unitId,
@@ -64792,6 +64846,8 @@ function useAccessManagementController() {
       if (!site || typeof site !== "string") {
         throw new Error("Site is required");
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await getBlockLevelAndUnitListSvc({ site });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64887,6 +64943,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await uploadTemplateSvc({ site, id, name });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -64908,6 +64966,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await getResidentsSvc({ orgId, siteId, unitId });
       return res.status(200).json({ data: result });
     } catch (error) {
@@ -64931,6 +64991,8 @@ function useAccessManagementController() {
         return res.status(400).json({ message: error.message });
       }
       const isLiftCardBool = isLiftCard === "true";
+      if (await refuseUnreachableSite(req, res, siteId))
+        return;
       const result = await userAccessCardsSvc({
         userId,
         siteId,
@@ -64955,6 +65017,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await removeTemplateSvc({ site });
       return res.status(200).json({ data: result });
     } catch (error) {
@@ -64988,6 +65052,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableSite(req, res, site))
+        return;
       const result = await qrCodeListSvc({
         type,
         site,