@7365admin1/core 3.48.1-staging.154 → 3.48.1-staging.156

package/.changeset/attendance-site-and-identity-scope.md

@@ -0,0 +1,32 @@
+---
+"@7365admin1/core": minor
+---
+
+Take the attendance caller's identity from the session, and scope every attendance
+route to its estate.
+
+Two separate defects, both on every route of `/api/attendances`.
+
+**The caller's identity came from a cookie the caller writes.** Every handler read
+`user` out of the raw `Cookie` header. That cookie is set by the browser itself
+(`layer-common/composables/useLocalAuth.ts`, `setSession`) and by the mobile
+clients from their own stored id; the server never compared it to the session.
+`requireAuth` validates `sid` against Redis and puts the real caller on `req.user`
+— which this controller ignored. A signed-in account could send
+`Cookie: user=<somebody else>` and clock that person in, read their shift history
+and check-in photo, or clock them out; and because check-out `$set`s `user` from
+the request, checking somebody out also re-attributed their shift. The identity
+now comes from `callerId(req)`, as the rest of the codebase resolves it.
+
+**The estate was never checked.** All five routes now go through
+`requireSiteReach`, the rule `/api/vehicles`, `/api/documents`,
+`/api/service-providers` and `/api/incident-reports` already use. The four that
+name a site in the URL check it before using it; `GET /id/:id` and
+`PUT /id/:id/check-out` name only a record, so the site is read off the **stored**
+row. The `customer.sites` branch matters here — the contracted agency whose staff
+actually work these shifts holds no membership in the estate's organisation.
+
+Every existing client already sends its own id in that cookie, so nothing
+legitimate changes. A bare `Authorization: Bearer` call that sends no cookie at
+all used to fail Joi's `user is required` with a 400 and now succeeds, which is
+the only behaviour that gets looser rather than tighter.

package/.changeset/manpower-remark-site-scope.md

@@ -0,0 +1,41 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the manpower remarks routes to the site the remarks belong to.
+
+A remarks row is the shift-attendance exception record for one site on one day:
+which named guards were late or absent, and whether the estate has acknowledged
+it. Every route on `/api/remarks` carried `requireAuth` and nothing more — the
+controller held no authorization identifier of any kind — so being signed in
+anywhere on the platform was enough to read another client's daily manning
+failures, to write an acknowledgement into their record in a name of the
+caller's choosing, or to switch a row to `inactive` so the estate's own console
+stops listing it.
+
+All five routes now go through `requireSiteReach`, the rule
+`/api/manpower-monitoring`, `/api/attendances`, `/api/vehicles`,
+`/api/documents` and `/api/incident-reports` already use:
+
+- `GET /:id/:serviceProviderId` names the site in the URL, so it is checked
+  before the read.
+- `PUT /:id` and `PATCH /:id` name only a record, so the site is read off the
+  **stored** row — a `siteId` in the caller's own body cannot stand in for it.
+- `GET /` names no site at all. Its only filter is a `serviceProviderId` the
+  caller supplies, which is not a claim about the caller, and one agency works
+  for several clients — so the page came back holding every one of those
+  clients' rows. It is narrowed after the read, the way
+  `/api/manpower-monitoring`'s own `GET /search` is. The count in the envelope
+  stays the unfiltered one, as it does there; both callers read it only for the
+  pager.
+- `POST /` writes a row for whatever `siteId` the body carries. It has no caller
+  in any web app or mobile app — the rows are written internally by
+  `manpower-monitoring.service.ts` when a site's monitoring settings are created
+  — and it is guarded all the same rather than left open.
+
+`requireSiteReach` matters here because the contracted agency that actually runs
+these shifts holds no membership in the estate's organisation and reaches its
+own site through `customer.sites`.
+
+A row the caller cannot reach answers exactly as one that does not exist, so
+site ids cannot be enumerated by watching the difference.

package/dist/index.d.ts

@@ -4144,6 +4144,33 @@ declare function useAttendanceRepository(): {
     deleteAttendance: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;
 };
 
+/**
+ * Whose attendance this is, and which estate it was worked at.
+ *
+ * Two separate holes, both on every route of this mount.
+ *
+ * **1. The caller's identity came from a cookie the caller writes.** Every
+ * handler here read `user` out of the raw `Cookie` header. That cookie is set by
+ * the browser itself (`layer-common/composables/useLocalAuth.ts`, `setSession`)
+ * and by the mobile clients from their own stored id; the server never checked
+ * it against the session. `requireAuth` validates `sid` against Redis and puts
+ * the real caller on `req.user` — which this controller ignored. So a signed-in
+ * account could send `Cookie: user=<somebody else>` and check IN as them, read
+ * THEIR shift history, or check them out. `checkOutAttendance` also `$set`s
+ * `user` from the request, so checking somebody else out re-attributed their
+ * shift to whoever asked.
+ *
+ * The identity now comes from `callerId(req)`, the session, exactly as the rest
+ * of the codebase resolves it. Every honest client already sends its own id in
+ * that cookie, so nothing legitimate changes.
+ *
+ * **2. The estate was never checked.** Four of the five name a site in the URL
+ * and used it without asking; `GET /id/:id` and `PUT /id/:id/check-out` name only
+ * a record, so the site is read off the STORED row. `requireSiteReach` is the
+ * rule `/api/vehicles`, `/api/documents`, `/api/service-providers` and
+ * `/api/incident-reports` already use, so the contracted agency whose staff
+ * actually work these shifts reaches its own site through `customer.sites`.
+ */
 declare function useAttendanceController(): {
     checkInAttendance: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllAttendances: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -8342,11 +8369,45 @@ declare function useManpowerRemarksRepo(): {
         pageRange: string;
     }>;
     getManpowerRemarksBySiteId: (_id: string | ObjectId, date: string, serviceProviderId?: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
+    getManpowerRemarksById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateManpowerRemarks: (_id: string | ObjectId, value: TManpowerRemarksUpdate) => Promise<number>;
     updateRemarksStatus: (_id: string | ObjectId, value: TManpowerRemarksStatusUpdate) => Promise<number>;
     createIndexes: () => Promise<string>;
 };
 
+/**
+ * Who may see, or change, a site's manpower remarks.
+ *
+ * A remarks row is the shift-attendance exception record for one site on one
+ * day: which named guards were late or absent, and whether the estate has
+ * acknowledged it. Every route on this mount carried `requireAuth` and NOTHING
+ * else — this controller held no authorization identifier of any kind — so
+ * being signed in anywhere on the platform was enough to read another client's
+ * daily manning failures, to write an acknowledgement into their record in
+ * somebody else's name, or to switch a row to `inactive` so the estate stops
+ * seeing it.
+ *
+ * The estate is the scope, the same rule `/api/manpower-monitoring`,
+ * `/api/attendances`, `/api/vehicles`, `/api/documents` and
+ * `/api/incident-reports` already use, so the contracted agency that actually
+ * runs these shifts reaches its own sites through `customer.sites` and needs no
+ * membership in the estate's own organisation.
+ *
+ * Three shapes, because the routes ask three different questions:
+ *  - `GET /:id/:serviceProviderId` names the site in the URL, so it is checked
+ *    BEFORE the read.
+ *  - `PUT /:id` and `PATCH /:id` name only a record, so the site is read off
+ *    the STORED row (`requireRemarkReach`) and a `siteId` in the body cannot
+ *    stand in for it.
+ *  - `GET /` names no site at all — its only filter is a `serviceProviderId`
+ *    the caller supplies — so the page has to be narrowed AFTER the read, the
+ *    way `/api/manpower-monitoring`'s own `GET /search` is.
+ *
+ * `POST /` writes a row for whatever `siteId` the body carries. It has no
+ * caller in any web app or mobile app; the rows are written internally by
+ * `manpower-monitoring.service.ts` when a site's monitoring settings are
+ * created. It is guarded all the same rather than left open.
+ */
 declare function useManpowerRemarkCtrl(): {
     createManpowerRemark: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
     getManpowerRemarksAllSite: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;

package/dist/index.js

@@ -40904,6 +40904,7 @@ function useAttendanceController() {
     getAllAttendances: _getAllAttendances,
     getAttendanceByUser: _getAttendanceByUser,
     getAttendanceById: _getAttendanceById,
+    getRawAttendanceById: _getRawAttendanceById,
     deleteAttendance: _deleteAttendance
   } = useAttendanceRepository();
   const {
@@ -40911,11 +40912,7 @@ function useAttendanceController() {
     checkOutAttendance: _checkOutAttendance
   } = useAttendanceService();
   async function checkInAttendance(req, res, next) {
-    const cookies = req.headers.cookie ? req.headers.cookie.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    ) : {};
-    const user = cookies["user"] || "";
+    const user = callerId(req);
     const payload = { ...req.body, ...req.params, user };
     const { error } = attendanceSchema.validate(payload);
     if (error) {
@@ -40924,6 +40921,7 @@ function useAttendanceController() {
       return;
     }
     try {
+      await requireSiteReach(req, req.params.site);
       const id = await _checkInAttendance(payload);
       res.status(201).json({ message: "Attendance created successfully.", id });
       return;
@@ -40958,6 +40956,7 @@ function useAttendanceController() {
     const startDate = req.query.dateFrom ?? "";
     const endDate = req.query.dateTo ?? "";
     try {
+      await requireSiteReach(req, site);
       const data = await _getAllAttendances({
         page,
         limit,
@@ -40976,11 +40975,7 @@ function useAttendanceController() {
     }
   }
   async function getAttendanceByUser(req, res, next) {
-    const cookies = req.headers.cookie ? req.headers.cookie.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    ) : {};
-    const user = cookies["user"] || "";
+    const user = callerId(req);
     const query2 = { ...req.query, ...req.params, user };
     const validation = import_joi62.default.object({
       page: import_joi62.default.number().min(1).optional().allow("", null),
@@ -41006,6 +41001,7 @@ function useAttendanceController() {
     const startDate = req.query.dateFrom ?? "";
     const endDate = req.query.dateTo ?? "";
     try {
+      await requireSiteReach(req, site);
       const data = await _getAttendanceByUser({
         page,
         limit,
@@ -41034,6 +41030,8 @@ function useAttendanceController() {
       return;
     }
     try {
+      const existing = await _getRawAttendanceById(_id);
+      await requireSiteReach(req, existing?.site);
       const data = await _getAttendanceById(_id);
       res.json(data);
       return;
@@ -41044,11 +41042,7 @@ function useAttendanceController() {
     }
   }
   async function checkOutAttendance(req, res, next) {
-    const cookies = req.headers.cookie ? req.headers.cookie.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    ) : {};
-    const user = cookies["user"] || "";
+    const user = callerId(req);
     const payload = { id: req.params.id, ...req.body, user };
     const validation = import_joi62.default.object({
       id: import_joi62.default.string().hex().required(),
@@ -41070,6 +41064,8 @@ function useAttendanceController() {
     }
     try {
       const { id, ...value } = payload;
+      const existing = await _getRawAttendanceById(id);
+      await requireSiteReach(req, existing?.site);
       await _checkOutAttendance(id, value);
       res.json({ message: "Attendance updated successfully." });
       return;
@@ -75339,6 +75335,14 @@ function useManpowerRemarksRepo() {
       throw error;
     }
   }
+  async function getManpowerRemarksById(_id) {
+    try {
+      _id = new import_mongodb146.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils231.BadRequestError("Invalid ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateManpowerRemarks(_id, value) {
     try {
       _id = new import_mongodb146.ObjectId(_id);
@@ -75386,6 +75390,7 @@ function useManpowerRemarksRepo() {
     createManpowerRemarks,
     getManpowerRemarksAllSite,
     getManpowerRemarksBySiteId,
+    getManpowerRemarksById,
     updateManpowerRemarks,
     updateRemarksStatus,
     createIndexes
@@ -77353,8 +77358,13 @@ function useManpowerRemarkCtrl() {
     getManpowerRemarksAllSite: _getManpowerRemarksAllSite,
     updateRemarksStatus: _updateRemarksStatus,
     getManpowerRemarksBySiteId: _getManpowerRemarksBySiteId,
+    getManpowerRemarksById: _getManpowerRemarksById,
     updateManpowerRemarks: _updateManpowerRemarks
   } = useManpowerRemarksRepo();
+  async function requireRemarkReach(req, _id) {
+    const remark = await _getManpowerRemarksById(_id);
+    await requireSiteReach(req, remark?.siteId);
+  }
   async function createManpowerRemark(req, res, next) {
     try {
       const payload = { ...req.body };
@@ -77363,6 +77373,7 @@ function useManpowerRemarkCtrl() {
         next(new import_node_server_utils244.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, payload.siteId);
       const result = await _createManpowerRemarks(payload);
       return res.json(result);
     } catch (error) {
@@ -77402,7 +77413,17 @@ function useManpowerRemarkCtrl() {
         status: status?.toString() || "",
         date: date?.toString() || ""
       });
-      return res.json(result);
+      const { only } = await siteReachOf(req);
+      const items = await only(
+        (result?.items ?? []).map((row) => ({
+          row,
+          site: row?.siteId
+        }))
+      );
+      return res.json({
+        ...result,
+        items: items.map((entry) => entry.row)
+      });
     } catch (error) {
       import_node_server_utils244.logger.log({ level: "error", message: error.message });
       next(error);
@@ -77427,6 +77448,7 @@ function useManpowerRemarkCtrl() {
         next(new import_node_server_utils244.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, id);
       const result = await _getManpowerRemarksBySiteId(
         id,
         date,
@@ -77454,6 +77476,7 @@ function useManpowerRemarkCtrl() {
         next(new import_node_server_utils244.BadRequestError(error.message));
         return;
       }
+      await requireRemarkReach(req, _id);
       const result = await _updateManpowerRemarks(_id, payload);
       return res.json(result);
     } catch (error) {
@@ -77475,6 +77498,7 @@ function useManpowerRemarkCtrl() {
         next(new import_node_server_utils244.BadRequestError(error.message));
         return;
       }
+      await requireRemarkReach(req, _id);
       const result = await _updateRemarksStatus(_id, payload);
       return res.json(result);
     } catch (error) {