@7365admin1/core 3.47.1-staging.145 → 3.47.1-staging.147

package/dist/index.d.ts

@@ -2654,6 +2654,7 @@ declare function useVehicleRepo(): {
     }>;
     getSeasonPassTypes: (site: string | ObjectId) => Promise<bson.Document[]>;
     getVehicleById: (_id: string | ObjectId) => Promise<bson.Document>;
+    getVehicleSite: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateVehicleById: (_id: string | ObjectId, value: TVehicleUpdate, session?: ClientSession) => Promise<number>;
     deleteVehicle: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;
     getByPlaceNumber: (value: string) => Promise<mongodb.WithId<bson.Document>>;
@@ -5471,6 +5472,7 @@ declare function useDocumentManagementRepo(): {
         pageRange: string;
     } | TDocumentManagement>;
     getDocumentById: (_id: string | ObjectId) => Promise<bson.Document>;
+    getDocumentScope: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateDocumentById: (_id: string | ObjectId, value: TDocumentManagement) => Promise<number>;
     updateFolderById: (_id: string | ObjectId, value: TFolderUpdate) => Promise<number>;
     deleteDocumentById: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;

package/dist/index.js

@@ -29008,7 +29008,10 @@ function useVehicleRepo() {
             recNo: 1,
             nric: 1,
             status: 1,
-            type: 1
+            type: 1,
+            // needed by the caller to drop rows on sites it cannot reach;
+            // this lookup takes an NRIC and names no site of its own.
+            site: 1
           }
         }
       ]).toArray();
@@ -29239,6 +29242,19 @@ function useVehicleRepo() {
       throw error;
     }
   }
+  async function getVehicleSite(_id) {
+    let id;
+    try {
+      id = new import_mongodb60.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils90.BadRequestError("Invalid vehicle ID format.");
+    }
+    const doc = await collection.findOne(
+      { _id: id },
+      { projection: { site: 1, org: 1 } }
+    );
+    return doc ?? null;
+  }
   return {
     createIndex,
     createTextIndex,
@@ -29246,6 +29262,7 @@ function useVehicleRepo() {
     getVehicles,
     getSeasonPassTypes,
     getVehicleById,
+    getVehicleSite,
     updateVehicleById,
     deleteVehicle,
     getByPlaceNumber,
@@ -37327,6 +37344,38 @@ async function requireSiteReach(req, site) {
     return;
   await useCameraViewService().entitleSite({ siteId, userId: actor.id });
 }
+async function siteReachOf(req) {
+  const actor = await resolveInviteActor(callerId(req));
+  const reachable = /* @__PURE__ */ new Map();
+  function canReach(record) {
+    if (actor.isSuperAdmin)
+      return Promise.resolve(true);
+    if (!record)
+      return Promise.resolve(false);
+    const site = record.site?.toString() ?? "";
+    if (!site) {
+      const org = record.org?.toString() ?? "";
+      return Promise.resolve(Boolean(org) && actor.orgIds.includes(org));
+    }
+    if (!reachable.has(site)) {
+      reachable.set(
+        site,
+        useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
+          () => true,
+          () => false
+        )
+      );
+    }
+    return reachable.get(site);
+  }
+  async function only(records) {
+    if (actor.isSuperAdmin)
+      return records;
+    const verdicts = await Promise.all(records.map((r) => canReach(r)));
+    return records.filter((_, i) => verdicts[i]);
+  }
+  return { actor, canReach, only };
+}
 
 // src/controllers/building.controller.ts
 var import_exceljs = __toESM(require("exceljs"));
@@ -38324,8 +38373,13 @@ function useVehicleController() {
     getVehiclesByNRIC: _getVehiclesByNRIC,
     getAllVehiclesByUnitId: _getAllVehiclesByUnitId,
     getSpecificVehicleById: _getSpecificVehicleById,
-    getBlocklistedVehicles: _getBlocklistedVehicles
+    getBlocklistedVehicles: _getBlocklistedVehicles,
+    getVehicleSite: _getVehicleSite
   } = useVehicleRepo();
+  async function requireVehicleReach(req, _id) {
+    const vehicle = await _getVehicleSite(_id);
+    await requireSiteReach(req, vehicle?.site);
+  }
   function normalizeRow(row) {
     return Object.fromEntries(
       Object.entries(row).map(([key, value]) => [
@@ -38518,6 +38572,7 @@ function useVehicleController() {
       return;
     }
     try {
+      await requireSiteReach(req, value.site);
       const user = req.user?.user || req.user?._id;
       const data = await _add(value, void 0, user);
       res.status(201).json({
@@ -38561,6 +38616,8 @@ function useVehicleController() {
       };
     }
     try {
+      if (site)
+        await requireSiteReach(req, site);
       const data = await _getVehicles({
         search,
         page,
@@ -38595,6 +38652,7 @@ function useVehicleController() {
     }
     const { site } = value;
     try {
+      await requireSiteReach(req, site);
       const data = await _getSeasonPassTypes(site);
       res.json(data);
       return;
@@ -38620,6 +38678,7 @@ function useVehicleController() {
     }
     const { _id } = value;
     try {
+      await requireVehicleReach(req, _id);
       const site = await _getVehicleById(_id);
       res.json(site);
       return;
@@ -38645,6 +38704,7 @@ function useVehicleController() {
     }
     const { _id } = value;
     try {
+      await requireVehicleReach(req, _id);
       const site = await _getSpecificVehicleById(_id);
       res.json(site);
       return;
@@ -38688,12 +38748,15 @@ function useVehicleController() {
         return;
       }
       const { _id, ...rest } = value;
+      await requireVehicleReach(req, _id);
       await _updateVehicleById(_id, rest);
       res.json({ message: "Successfully updated vehicle." });
       return;
     } catch (error) {
       import_node_server_utils112.logger.log({ level: "error", message: error.message });
-      if (error?.message) {
+      if (error?.statusCode) {
+        next(error);
+      } else if (error?.message) {
         next(new import_node_server_utils112.BadRequestError(error?.message));
       } else {
         next(error);
@@ -38721,6 +38784,7 @@ function useVehicleController() {
     }
     const { recno, site, type, bypass, _id } = value;
     try {
+      await requireVehicleReach(req, _id);
       const data = await _deleteVehicle(_id, recno, site, type, bypass);
       res.json({
         message: "Vehicle deleted successfully.",
@@ -38748,6 +38812,7 @@ function useVehicleController() {
         return;
       }
       const { _id, org, site } = value;
+      await requireVehicleReach(req, _id);
       await _approveVehicleById(_id, org, site);
       res.json({ message: "Successfully approved and updated vehicle." });
       return;
@@ -38793,6 +38858,8 @@ function useVehicleController() {
         limit,
         sort: sortObj
       });
+      const { only } = await siteReachOf(req);
+      data.items = await only(data.items ?? []);
       res.json(data);
       return;
     } catch (error2) {
@@ -38818,6 +38885,7 @@ function useVehicleController() {
     }
     const { _id, org, site } = value;
     try {
+      await requireVehicleReach(req, _id);
       const data = await _reactivateVehicleById(_id, org, site);
       res.status(200).json({
         message: data
@@ -38859,6 +38927,8 @@ function useVehicleController() {
         limit,
         sort: sortObj
       });
+      const { only } = await siteReachOf(req);
+      data.items = await only(data.items ?? []);
       res.json(data);
       return;
     } catch (error2) {
@@ -38885,6 +38955,8 @@ function useVehicleController() {
     }
     const { search, page, limit, site } = value;
     try {
+      if (site)
+        await requireSiteReach(req, site);
       const data = await _getBlocklistedVehicles({
         search,
         page,
@@ -38921,6 +38993,7 @@ function useVehicleController() {
         return;
       }
       const { _id, ...rest } = value;
+      await requireVehicleReach(req, _id);
       await _blocklistVehicles(_id, rest);
       res.json({ message: "Successfully blocked vehicle." });
       return;
@@ -38952,6 +39025,7 @@ function useVehicleController() {
         return;
       }
       const { _id, ...rest } = value;
+      await requireVehicleReach(req, _id);
       await _removeFromBlocklist(_id, rest);
       res.json({ message: "Successfully removed vehicle from blocklist." });
       return;
@@ -50370,38 +50444,6 @@ function usePersonController() {
     }
     return actor;
   }
-  async function siteReach(req) {
-    const actor = await resolveInviteActor(callerId(req));
-    const reachable = /* @__PURE__ */ new Map();
-    function canReach(person) {
-      if (actor.isSuperAdmin)
-        return Promise.resolve(true);
-      if (!person)
-        return Promise.resolve(false);
-      const site = person.site?.toString() ?? "";
-      if (!site) {
-        const org = person.org?.toString() ?? "";
-        return Promise.resolve(Boolean(org) && actor.orgIds.includes(org));
-      }
-      if (!reachable.has(site)) {
-        reachable.set(
-          site,
-          useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
-            () => true,
-            () => false
-          )
-        );
-      }
-      return reachable.get(site);
-    }
-    async function only(people) {
-      if (actor.isSuperAdmin)
-        return people;
-      const verdicts = await Promise.all(people.map((p) => canReach(p)));
-      return people.filter((_, i) => verdicts[i]);
-    }
-    return { actor, canReach, only };
-  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
@@ -50576,7 +50618,7 @@ function usePersonController() {
     }
     try {
       const data = await _getByNRIC(nric);
-      const { canReach } = await siteReach(req);
+      const { canReach } = await siteReachOf(req);
       res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
@@ -50596,7 +50638,7 @@ function usePersonController() {
     }
     try {
       const data = await _getPersonByPhoneNumber(contact);
-      const { canReach } = await siteReach(req);
+      const { canReach } = await siteReachOf(req);
       res.json(await canReach(data) ? data : null);
       return;
     } catch (error2) {
@@ -50641,7 +50683,7 @@ function usePersonController() {
         type,
         unit
       });
-      const { only } = await siteReach(req);
+      const { only } = await siteReachOf(req);
       res.json(await only(data));
       return;
     } catch (error) {
@@ -50662,7 +50704,7 @@ function usePersonController() {
     }
     const { search } = value;
     try {
-      const { actor } = await siteReach(req);
+      const { actor } = await siteReachOf(req);
       const data = await _getCompany(
         search,
         actor.isSuperAdmin ? void 0 : actor.orgIds
@@ -50686,7 +50728,7 @@ function usePersonController() {
     }
     try {
       const data = await _getPeopleByPlateNumber(plateNumber);
-      const { only } = await siteReach(req);
+      const { only } = await siteReachOf(req);
       res.json({ data: await only(data) });
       return;
     } catch (error2) {
@@ -50727,7 +50769,7 @@ function usePersonController() {
       }
     });
     try {
-      const { actor } = await siteReach(req);
+      const { actor } = await siteReachOf(req);
       if (!actor.isSuperAdmin) {
         await useCameraViewService().entitleSite({ siteId: site, userId: actor.id });
       }
@@ -50757,7 +50799,7 @@ function usePersonController() {
     }
     try {
       const data = await _getByUserId(userId);
-      const { actor, canReach } = await siteReach(req);
+      const { actor, canReach } = await siteReachOf(req);
       const isSelf = Boolean(actor.id) && data?.user?.toString() === actor.id;
       res.json(isSelf || await canReach(data) ? data : null);
       return;
@@ -55438,12 +55480,25 @@ function useDocumentManagementRepo() {
       throw error;
     }
   }
+  async function getDocumentScope(_id) {
+    let id;
+    try {
+      id = new import_mongodb102.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils164.BadRequestError("Invalid document ID format.");
+    }
+    return await collection.findOne(
+      { _id: id },
+      { projection: { site: 1, org: 1 } }
+    );
+  }
   return {
     createIndex,
     createTextIndex,
     add,
     getAll,
     getDocumentById,
+    getDocumentScope,
     updateDocumentById,
     updateFolderById,
     deleteDocumentById,
@@ -55698,8 +55753,24 @@ function useDocumentManagementController() {
     updateFolderById: _updateFolderById,
     deleteDocumentById: _deleteDocumentById,
     deleteFolderById: _deleteFolderById,
-    getDocumentManagementBySiteId: _getDocumentManagementBySiteId
+    getDocumentManagementBySiteId: _getDocumentManagementBySiteId,
+    getDocumentScope: _getDocumentScope
   } = useDocumentManagementRepo();
+  async function requireDocumentReach(req, _id) {
+    const doc = await _getDocumentScope(_id);
+    const site = doc?.site?.toString() ?? "";
+    if (site) {
+      await requireSiteReach(req, site);
+      return;
+    }
+    const actor = await resolveInviteActor(callerId(req));
+    if (actor.isSuperAdmin)
+      return;
+    const org = doc?.org?.toString() ?? "";
+    if (!org || !actor.orgIds.includes(org)) {
+      throw new import_node_server_utils166.NotFoundError("Document not found.");
+    }
+  }
   async function add(req, res, next) {
     const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
       (acc, [key, value]) => ({ ...acc, [key]: value }),
@@ -55792,6 +55863,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       const data = await _getDocumentById(_id);
       res.json(data);
       return;
@@ -55833,6 +55905,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _updateDocumentById(_id, payload);
       res.json({ message: "Successfully updated document." });
       return;
@@ -55865,6 +55938,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _updateFolderById(_id, payload);
       res.json({ message: "Successfully updated folder." });
       return;
@@ -55884,6 +55958,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _deleteDocumentById(_id);
       res.json({ message: "Successfully deleted document." });
       return;
@@ -55903,6 +55978,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireDocumentReach(req, _id);
       await _deleteFolderById(_id);
       res.json({ message: "Successfully deleted folder." });
       return;
@@ -55923,6 +55999,7 @@ function useDocumentManagementController() {
       return;
     }
     try {
+      await requireSiteReach(req, _id);
       const data = await _getDocumentManagementBySiteId(_id, type);
       res.json(data);
       return;