@7365admin1/core 3.48.1-staging.152 → 3.48.1-staging.154

package/.changeset/incident-report-site-scope.md

@@ -0,0 +1,40 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the incident report routes to the estate the report was written at.
+
+Every route on `/api/incident-reports` carried `requireAuth` and nothing more, so
+being signed in anywhere on the platform was enough to page another estate's
+incident log — complainant name, contact, NRIC, unit, the guard's narrative and
+the photographs — and to open, rewrite, approve, reject or delete any single
+report, or file one at any estate.
+
+All eight now go through `requireSiteReach`, the rule `/api/vehicles`,
+`/api/documents` and `/api/service-providers` already use:
+
+- the two lists (`GET /`, `GET /incident-report`) and the two creates
+  (`POST /`, `POST /summary`) name a site in the request; that site is checked
+  before it is used.
+- the four id routes (`GET /id/:id`, `PUT /id/:id`, `PUT /review/:id`,
+  `PUT /:id`) name only a record, so the site is read off the **stored** record.
+  `PUT /id/:id` carries a `site` of its own in the body, and authorising on that
+  would have let a caller quote their own estate beside another estate's report
+  id — the shape already found on `/api/vehicles`.
+
+`requireSiteReach` matters more here than anywhere else: a contracted security
+agency holds no membership in the estate's organisation and reaches its own site
+through `customer.sites` — and the agency's guards are who **write** these
+reports. A flat organisation check would have locked them out of their own work.
+
+A report the caller cannot reach answers exactly as one that does not exist
+(404), so ids cannot be enumerated from the difference. Guards sit after each
+handler's Joi validation, so a malformed id still answers 400 exactly as today.
+
+Note on the count: the route inventory listed six handlers on this mount as
+unguarded. There are eight, and `POST /` and `GET /` were open too — the
+controller contains no authorization identifier of any kind at the `staging` tip.
+All eight are closed here.
+
+Nothing changes for a permitted caller: same response shape, same fields, same
+status.

package/.changeset/manpower-monitoring-site-scope.md

@@ -0,0 +1,37 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the manpower monitoring settings routes to the site they belong to.
+
+Every route on `/api/manpower-monitoring` carried `requireAuth` and nothing more,
+so being signed in anywhere on the platform was enough to read another client's
+shift pattern and alert email recipients, to re-time their late-check-in alert, or
+to switch their monitoring off entirely — which silences the alert that tells a
+client nobody turned up for a shift.
+
+Five of the six now go through `requireSiteReach`, the rule `/api/vehicles`,
+`/api/documents`, `/api/service-providers` and `/api/incident-reports` already
+use:
+
+- `POST /`, `GET /sites/:id/:serviceProviderId` and `POST /multiple` name a site
+  in the request; that site is checked before it is used. `POST /multiple`
+  upserts **by** each item's own `siteId`, so every item is checked before any of
+  them is written.
+- `PUT /:id` names only a record, so the site is read off the **stored** row —
+  a `siteId` in the caller's own body cannot stand in for it.
+- `GET /search` names no site at all and returned every client's row on one page.
+  It is narrowed after the read, the way the people and vehicle lookups are.
+
+`requireSiteReach` matters here because the contracted agency that actually runs
+these shifts holds no membership in the estate's organisation and reaches its own
+site through `customer.sites`.
+
+`GET /sites/active` is deliberately unchanged. It reads nothing from our database
+— it authenticates to the external HRM Labs directory and returns that system's
+own site tree — and the only web caller sends a hard-coded service provider id
+rather than the signed-in one, so scoping it on that id would close the screen for
+its real users. It needs a product decision, not a guard chosen here.
+
+A settings row the caller cannot reach answers exactly as one that does not exist,
+so site ids cannot be enumerated by watching the difference.

package/dist/index.d.ts

@@ -7210,6 +7210,25 @@ declare function useIncidentReportService(): {
     reviewIncidentReport: (id: string | ObjectId, value: Partial<TIncidentReport>) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, a security incident record.
+ *
+ * Every route on this mount was `requireAuth` and nothing more, so being signed
+ * in anywhere on the platform was enough to read another estate's incident
+ * reports — names, unit numbers, photographs and the guard's narrative — and to
+ * edit, review or delete them.
+ *
+ * The estate is the scope. Where the request names a site (the two lists, the
+ * two creates) that site is checked before it is used; where it names only a
+ * record id, the site is read off the STORED record, so a caller-supplied site
+ * can never stand in for the real one.
+ *
+ * `requireSiteReach` is the rule `/api/vehicles`, `/api/documents` and
+ * `/api/service-providers` already use, so a contracted security agency — which
+ * holds no membership in the estate's organisation — reaches its own site
+ * through `customer.sites` exactly as it does everywhere else. That matters more
+ * here than anywhere: the agency's guards are who WRITE these reports.
+ */
 declare function useIncidentReportController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -7874,6 +7893,7 @@ declare function useManpowerMonitoringRepo(): {
         pageRange: string;
     }>;
     getManpowerSettingsBySiteId: (_id: string | ObjectId, serviceProviderId?: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
+    getManpowerSettingsById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateManpowerMonitoringSettings: (_id: string | ObjectId, value: TManpowerMonitoringUpdate) => Promise<number>;
     multipleManpowerMonitoringSettings: (value: TManpowerMonitoring[]) => Promise<{
         updated: number;
@@ -7889,6 +7909,25 @@ declare function useManpowerMonitoringSrvc(): {
     createManpowerMonitoringSettings: (payload: any) => Promise<mongodb.InsertOneResult<bson.Document>>;
 };
 
+/**
+ * Who may see, or change, a site's manpower monitoring settings.
+ *
+ * Every route on this mount carried `requireAuth` and nothing else, so being
+ * signed in anywhere on the platform was enough to read another client's shift
+ * pattern and alert recipients, to re-time their late-check-in alerts, or to
+ * switch their monitoring off entirely — which silences the alert that tells a
+ * client nobody turned up for a shift.
+ *
+ * The estate is the scope. Where the request names a site (`POST /`,
+ * `GET /sites/:id/:serviceProviderId`, `POST /multiple`) that site is checked
+ * before it is used; `PUT /:id` names only a record, so the site is read off
+ * the STORED row and a `siteId` in the body cannot stand in for it.
+ *
+ * `requireSiteReach` is the rule `/api/vehicles`, `/api/documents`,
+ * `/api/service-providers` and `/api/incident-reports` already use, so the
+ * contracted agency that actually runs these shifts reaches its own site
+ * through `customer.sites` exactly as it does everywhere else.
+ */
 declare function useManpowerMonitoringCtrl(): {
     createManpowerMonitoringSettings: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
     getAllManpowerSettings: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;

package/dist/index.js

@@ -70396,6 +70396,7 @@ function useIncidentReportController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json({ data });
       return;
@@ -70444,6 +70445,7 @@ function useIncidentReportController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -70500,6 +70502,7 @@ function useIncidentReportController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAllForVirtualPatrolLogs({
         search,
         page,
@@ -70528,6 +70531,7 @@ function useIncidentReportController() {
     }
     try {
       const data = await _getIncidentReportById(_id);
+      await requireSiteReach(req, data?.site);
       res.status(200).json(data);
       return;
     } catch (error2) {
@@ -70549,6 +70553,8 @@ function useIncidentReportController() {
       return;
     }
     try {
+      const existing = await _getIncidentReportById(_id);
+      await requireSiteReach(req, existing?.site);
       const result = await _updateIncidentReportById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -70568,6 +70574,8 @@ function useIncidentReportController() {
       return;
     }
     try {
+      const existing = await _getIncidentReportById(_id);
+      await requireSiteReach(req, existing?.site);
       await _deleteIncidentReportById(_id);
       res.status(200).json({ message: "Successfully deleted incident report." });
       return;
@@ -70589,6 +70597,7 @@ function useIncidentReportController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       delete payload._id;
       delete payload.createdAt;
       delete payload.reasonForReject;
@@ -70623,6 +70632,8 @@ function useIncidentReportController() {
       return;
     }
     try {
+      const existing = await _getIncidentReportById(_id);
+      await requireSiteReach(req, existing?.site);
       const result = await _reviewIncidentReport(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -75048,6 +75059,14 @@ function useManpowerMonitoringRepo() {
       throw error;
     }
   }
+  async function getManpowerSettingsById(_id) {
+    try {
+      _id = new import_mongodb144.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils230.BadRequestError("Invalid ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateManpowerMonitoringSettings(_id, value) {
     try {
       _id = new import_mongodb144.ObjectId(_id);
@@ -75158,6 +75177,7 @@ function useManpowerMonitoringRepo() {
     createManpowerMonitoringSettings,
     getAllManpowerSettings,
     getManpowerSettingsBySiteId,
+    getManpowerSettingsById,
     updateManpowerMonitoringSettings,
     multipleManpowerMonitoringSettings,
     getAllSites,
@@ -75470,6 +75490,7 @@ function useManpowerMonitoringCtrl() {
   const {
     getAllManpowerSettings: _getAllManpowerSettings,
     getManpowerSettingsBySiteId: _getManpowerSettingsBySiteId,
+    getManpowerSettingsById: _getManpowerSettingsById,
     updateManpowerMonitoringSettings: _updateManpowerMonitoringSettings,
     multipleManpowerMonitoringSettings: _multipleManpowerMonitoringSettings,
     getAllSites: _getAllSites
@@ -75485,6 +75506,7 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils233.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, payload.siteId);
       const result = await _createManpowerMonitoringSettings(payload);
       return res.json(result);
     } catch (error) {
@@ -75511,7 +75533,17 @@ function useManpowerMonitoringCtrl() {
         limit: Number(limit),
         search
       });
-      return res.json(result);
+      const { only } = await siteReachOf(req);
+      const items = await only(
+        (result?.items ?? []).map((row) => ({
+          row,
+          site: row?.siteId
+        }))
+      );
+      return res.json({
+        ...result,
+        items: items.map((entry) => entry.row)
+      });
     } catch (error) {
       import_node_server_utils233.logger.log({ level: "error", message: error.message });
       next(error);
@@ -75531,6 +75563,7 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils233.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, _id);
       const result = await _getManpowerSettingsBySiteId(_id, serviceProviderId);
       return res.json(result);
     } catch (error) {
@@ -75558,6 +75591,8 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils233.BadRequestError(error.message));
         return;
       }
+      const existing = await _getManpowerSettingsById(_id);
+      await requireSiteReach(req, existing?.siteId);
       const result = await _updateManpowerMonitoringSettings(_id, payload);
       return res.json(result);
     } catch (error) {
@@ -75575,6 +75610,9 @@ function useManpowerMonitoringCtrl() {
         next(new import_node_server_utils233.BadRequestError(error.message));
         return;
       }
+      for (const item of payload) {
+        await requireSiteReach(req, item?.siteId);
+      }
       const result = await _multipleManpowerMonitoringSettings(payload);
       return res.json(result);
     } catch (error) {