@7365admin1/core 3.47.1-staging.144 → 3.47.1-staging.146

package/.changeset/access-management-site-scope.md

@@ -0,0 +1,59 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the access-management routes to a site the caller can reach.
+
+Every route on `/api/access-management` carried `requireAuth` and nothing more.
+`requireAuth` proves a session exists; it makes no organisation or site
+decision. So any signed-in account on the platform — a resident of a different
+estate, a cleaner, anybody with a login — could read another client's
+access-card inventory, its card holders, the residents behind a unit and the
+block/level/unit structure, and could ISSUE a physical NFC card into that
+estate, generate visitor QR passes for it and stamp QR tags onto its cards.
+These are the credentials that open that estate's doors and lifts.
+
+Twenty-eight handlers now decide from the site the request already names,
+before any work is done:
+
+- from the body — `addPhysicalCard`, `addNonPhysicalCard`, `acknowlegdeCard`,
+  `replaceCard`, `assignAccessCardToUnit`, `vmsgenerateQrCodes`,
+  `addVisitorAccessCard`;
+- from the query — `allAccessCardsCounts`, `availableAccessCards`,
+  `userTypeAccessCards`, `assignedAccessCards`, `assignedAccessCardsByUnit`,
+  `accessandLiftCards`, `doorAndLiftDropdown`, `visitorAccessCards`,
+  `bulkPhysicalAccessCard`, `getCardDetails`, `allQrTag`,
+  `availableCardContractors`, `getBlockLevelAndUnitList`, `getResidents`,
+  `userAccessCards`, `uploadTemplate`, `removeTemplate`, `qrCodeList`;
+- from the URL — `getCardReplacement`, `getAccessManagementSettings`, `addQrTag`.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`: a membership
+pinned to the site, an org-wide membership at the site's owning organisation, or
+an ACTIVE `customer.sites` engagement. The engagement branch is required, not
+incidental — access cards are administered from the security and
+property-management apps, whose users hold no membership in the estate's own
+organisation.
+
+The guard writes its own response instead of throwing. Every handler in this
+controller wraps its body in `try { ... } catch { res.status(400|500) }` rather
+than calling `next(error)`, so a thrown `UnauthorizedError`/`NotFoundError`
+would never reach the error handler and would have surfaced as a 400 with the
+guard's message inside it. It is placed AFTER each handler's Joi validation, so
+a malformed or missing site still answers 400 exactly as before, and only a
+well-formed site the caller cannot reach is refused. That refusal is 404 — what
+a site that does not exist already answers — so site ids cannot be enumerated by
+watching the difference.
+
+Six routes on the mount are deliberately NOT changed, because they carry no
+site at all and need per-record resolution:
+
+- `POST /sign-qr` and `PATCH /visitor-checkout` — both are called by shipped
+  mobile clients that cannot update in lockstep
+  (`resident-mobile-app src/actions/entrypass.ts:66`, `isecure365-mobile-app
+  src/features/visitors/entry-pass.service.ts:175` and `visitor.service.ts:194`).
+- `PATCH /nfc-status`, `PATCH /delete-card`, `POST /card-replacement`,
+  `POST /assign-user` — each identifies a card by id and would need the card's
+  own site loaded first.
+- `GET /door-access-levels`, `GET /lift-access-levels`, `GET /access-groups` and
+  `POST /settings` take an `acm_url` — an access-control device URL — so they
+  are a separate question from site reach and were not touched here.

package/dist/index.d.ts

@@ -2654,6 +2654,7 @@ declare function useVehicleRepo(): {
     }>;
     getSeasonPassTypes: (site: string | ObjectId) => Promise<bson.Document[]>;
     getVehicleById: (_id: string | ObjectId) => Promise<bson.Document>;
+    getVehicleSite: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateVehicleById: (_id: string | ObjectId, value: TVehicleUpdate, session?: ClientSession) => Promise<number>;
     deleteVehicle: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;
     getByPlaceNumber: (value: string) => Promise<mongodb.WithId<bson.Document>>;
@@ -6491,35 +6492,35 @@ declare function UseAccessManagementRepo(): {
 };
 
 declare function useAccessManagementController(): {
-    addPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addNonPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    addPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addNonPhysicalCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     doorAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     liftAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessGroups: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignedAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignedAccessCardsByUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignedAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignedAccessCardsByUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     removeAccessCard: ({ cardNo, staffNo, url, }: {
@@ -6527,15 +6528,15 @@ declare function useAccessManagementController(): {
         staffNo: string;
         url: string;
     }) => Promise<void>;
-    getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getTransactions: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     visitorCheckout: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    userAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    removeTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    qrCodeList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    userAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    removeTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    qrCodeList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     generateQrCodeWithExpiry: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
 };