@7365admin1/core 3.48.1-staging.151 → 3.48.1-staging.153

package/.changeset/incident-report-site-scope.md

@@ -0,0 +1,40 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the incident report routes to the estate the report was written at.
+
+Every route on `/api/incident-reports` carried `requireAuth` and nothing more, so
+being signed in anywhere on the platform was enough to page another estate's
+incident log — complainant name, contact, NRIC, unit, the guard's narrative and
+the photographs — and to open, rewrite, approve, reject or delete any single
+report, or file one at any estate.
+
+All eight now go through `requireSiteReach`, the rule `/api/vehicles`,
+`/api/documents` and `/api/service-providers` already use:
+
+- the two lists (`GET /`, `GET /incident-report`) and the two creates
+  (`POST /`, `POST /summary`) name a site in the request; that site is checked
+  before it is used.
+- the four id routes (`GET /id/:id`, `PUT /id/:id`, `PUT /review/:id`,
+  `PUT /:id`) name only a record, so the site is read off the **stored** record.
+  `PUT /id/:id` carries a `site` of its own in the body, and authorising on that
+  would have let a caller quote their own estate beside another estate's report
+  id — the shape already found on `/api/vehicles`.
+
+`requireSiteReach` matters more here than anywhere else: a contracted security
+agency holds no membership in the estate's organisation and reaches its own site
+through `customer.sites` — and the agency's guards are who **write** these
+reports. A flat organisation check would have locked them out of their own work.
+
+A report the caller cannot reach answers exactly as one that does not exist
+(404), so ids cannot be enumerated from the difference. Guards sit after each
+handler's Joi validation, so a malformed id still answers 400 exactly as today.
+
+Note on the count: the route inventory listed six handlers on this mount as
+unguarded. There are eight, and `POST /` and `GET /` were open too — the
+controller contains no authorization identifier of any kind at the `staging` tip.
+All eight are closed here.
+
+Nothing changes for a permitted caller: same response shape, same fields, same
+status.

package/.changeset/service-provider-record-scope.md

@@ -0,0 +1,39 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the service provider record routes to the site the engagement works on.
+
+A `site.service-providers` row is an ENGAGEMENT: a provider organisation attached
+to one client's site. Two routes took its id straight out of the URL with
+`requireAuth` and nothing more, so any signed-in account could use them against
+any client:
+
+- `GET /api/service-providers/:id` returned any client's engagement — provider
+  name, category, contact email and the site it works on.
+- `PATCH /api/service-providers/:id/status` suspended or reactivated it.
+  Suspending an engagement stops that provider's guards and cleaners reaching the
+  estate; reactivating one puts them back.
+
+Both now decide from the **site stored on the row**, through the existing
+`requireSiteReach` rule that `/api/vehicles` and `/api/documents` already use.
+That rule admits both sides of the engagement: the client, and the contracted
+provider whose reach comes from `customer.sites` rather than from a membership in
+the client's organisation.
+
+An engagement the caller cannot reach answers exactly as one that does not exist
+(404), so ids cannot be enumerated from the difference. A row carrying no site at
+all is refused, not waved through. Guards sit after each handler's Joi
+validation, so a malformed id or status still answers 400 exactly as today.
+
+Scope note — deliberately NOT changed here: the four list routes
+(`GET /api/service-providers`, `/name`, `/category`,
+`/org/:serviceProviderOrgId/type/:type`) and `GET /provider/:provider/org/:org`.
+Their `orgId`, `siteId` and `serviceProviderOrgId` are optional filters the
+caller sends, and `layer-common useServiceProvider.ts` defaults every one of them
+to an empty string, so it is not yet established which callers depend on the
+unfiltered list. That is the same open question as the site-less
+`GET /api/vehicles` and needs a product decision rather than a guess.
+
+Nothing changes for a permitted caller: same response shape, same fields, same
+status.

package/dist/index.d.ts

@@ -7210,6 +7210,25 @@ declare function useIncidentReportService(): {
     reviewIncidentReport: (id: string | ObjectId, value: Partial<TIncidentReport>) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, a security incident record.
+ *
+ * Every route on this mount was `requireAuth` and nothing more, so being signed
+ * in anywhere on the platform was enough to read another estate's incident
+ * reports — names, unit numbers, photographs and the guard's narrative — and to
+ * edit, review or delete them.
+ *
+ * The estate is the scope. Where the request names a site (the two lists, the
+ * two creates) that site is checked before it is used; where it names only a
+ * record id, the site is read off the STORED record, so a caller-supplied site
+ * can never stand in for the real one.
+ *
+ * `requireSiteReach` is the rule `/api/vehicles`, `/api/documents` and
+ * `/api/service-providers` already use, so a contracted security agency — which
+ * holds no membership in the estate's organisation — reaches its own site
+ * through `customer.sites` exactly as it does everywhere else. That matters more
+ * here than anywhere: the agency's guards are who WRITE these reports.
+ */
 declare function useIncidentReportController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -32562,6 +32562,7 @@ function useServiceProviderController() {
     }
     try {
       const data = await _getServiceProviderById(_id);
+      await requireSiteReach(req, data?.siteId?.toString());
       res.json(data);
       return;
     } catch (error2) {
@@ -32625,6 +32626,8 @@ function useServiceProviderController() {
       return;
     }
     try {
+      const existing = await _getServiceProviderById(value.id);
+      await requireSiteReach(req, existing?.siteId?.toString());
       await _updateStatusById(value.id, value.status);
       res.json({ message: "Service provider status updated successfully." });
       return;
@@ -70393,6 +70396,7 @@ function useIncidentReportController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json({ data });
       return;
@@ -70441,6 +70445,7 @@ function useIncidentReportController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -70497,6 +70502,7 @@ function useIncidentReportController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAllForVirtualPatrolLogs({
         search,
         page,
@@ -70525,6 +70531,7 @@ function useIncidentReportController() {
     }
     try {
       const data = await _getIncidentReportById(_id);
+      await requireSiteReach(req, data?.site);
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -70546,6 +70553,8 @@ function useIncidentReportController() {
       return;
     }
     try {
+      const existing = await _getIncidentReportById(_id);
+      await requireSiteReach(req, existing?.site);
       const result = await _updateIncidentReportById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -70565,6 +70574,8 @@ function useIncidentReportController() {
       return;
     }
     try {
+      const existing = await _getIncidentReportById(_id);
+      await requireSiteReach(req, existing?.site);
       await _deleteIncidentReportById(_id);
       res.status(200).json({ message: "Successfully deleted incident report." });
       return;
@@ -70586,6 +70597,7 @@ function useIncidentReportController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       delete payload._id;
       delete payload.createdAt;
       delete payload.reasonForReject;
@@ -70620,6 +70632,8 @@ function useIncidentReportController() {
       return;
     }
     try {
+      const existing = await _getIncidentReportById(_id);
+      await requireSiteReach(req, existing?.site);
       const result = await _reviewIncidentReport(_id, req.body);
       res.status(200).json({ message: result });
       return;