@7365admin1/core 3.48.1-staging.156 → 3.48.1-staging.158

package/.changeset/feedback-site-scope.md

@@ -0,0 +1,51 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the feedback routes to the estate the feedback was raised at, and take the
+author's identity from the session.
+
+A feedback row is a resident's complaint about their own estate: the subject,
+the free-text description, the location inside the block, the attachments and
+the name of the person who raised it. Every route on `/api/feedbacks` carried
+`requireAuth` and nothing more, and the controller held no authorization
+identifier of any kind, so being signed in anywhere on the platform was enough
+to read another client's complaints, rewrite them, re-route them to a different
+service line, close them, or delete them.
+
+`DELETE /:id` is the sharp one, twice over. It is the **only** route on this
+mount with a live caller — `layer-common`'s `useFeedback().deleteFeedback`,
+wired to the delete button in `FeedbackDetail.vue` and `FeedbackMain.vue`, which
+every web app draws — and it does not write to the v1 table at all. It writes to
+`feedbacks2`, the authoritative table every client reads. So the one reachable
+route on the legacy mount was an unguarded delete against live data. It is now
+checked against the `feedbacks2` row it actually touches, not the v1 row that
+happens to share the id.
+
+All eight routes go through `requireSiteReach`, the rule
+`/api/manpower-monitoring`, `/api/attendances`, `/api/remarks`,
+`/api/vehicles`, `/api/documents` and `/api/incident-reports` already use:
+
+- `GET /site/:site/status/:status` names the site in the URL, so it is checked
+  before the read.
+- The six record routes name only a record, so the site is read off the
+  **stored** row and a `site` in the caller's own body cannot stand in for it.
+  Two readers are needed, because the two tables are not the same shape: v1
+  `feedbacks` rows keep the site at `metadata.site`, `feedbacks2` rows keep it
+  at the top level.
+- `POST /` took the author from a `user` cookie the caller writes and never
+  compared it to the session, so a complaint could be filed in somebody else's
+  name. It comes from `callerId(req)` now, which also removes a latent crash:
+  `cookies?.["user"].toString()` short-circuits only on `cookies` being nullish
+  and threw on any request carrying cookies but no `user` cookie.
+
+`requireSiteReach` matters here because the contracted service provider that
+answers these complaints holds no membership in the estate's organisation and
+reaches it through `customer.sites`.
+
+Not fixed here, and reported separately: `POST /api/feedbacks` cannot succeed
+and could not before this change either. `feedback.service.ts` replaces
+`createdBy` with an `ObjectId` and `MFeedback` then re-validates the document
+against a schema where `createdBy` is `Joi.string().hex()`, so the create always
+answers 400. No client calls it — every client creates through
+`/api/feedbacks2`.

package/.changeset/site-entrypass-settings-scope.md

@@ -0,0 +1,53 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the entry pass settings routes to their site, and take the writer's
+identity from the session.
+
+These rows decide how a site issues visitor passes: whether passes are on at
+all, whether a physical or NFC pass is used, which USB printer model the
+gatehouse drives, and the header, disclaimer and URL printed on the pass a
+visitor is handed at the gate. All seven routes on
+`/api/site-entrypass-settings` carried `requireAuth` and nothing more — the
+controller held no authorization identifier of any kind.
+
+Two defects were fixed, not one.
+
+**No scope.** `GET /` returned every row on the platform: it accepts `org` and
+`site` query parameters and the repository never applies them, so a filter that
+looked like scoping was not one. The record routes took an id and no site.
+`GET|PUT /site/:site` took a site straight off the URL. All seven now go through
+`requireSiteReach`, the rule `/api/access-management`,
+`/api/manpower-monitoring`, `/api/attendances`, `/api/vehicles`,
+`/api/documents` and `/api/incident-reports` already use:
+
+- `POST /` and `GET|PUT /site/:site` name a site in the request; it is checked
+  before it is used.
+- `GET|PUT|DELETE /:id` name only a record, so the site is read off the
+  **stored** row — a `site` in the caller's own body cannot stand in for it.
+- `PUT /:id` and `PUT /site/:site` can also **move** a row, because the body's
+  `site` is `$set`, so the destination is checked as well as the origin.
+- `GET /` is narrowed after the read. It cannot be narrowed in the repository:
+  the page is cached under a key built only from page/limit/status/sort, so a
+  per-caller filter there would be served to the next caller. The count in the
+  envelope stays the unfiltered one, as it does on the sibling lists.
+
+**The writer's identity came from a cookie the caller writes.** `add`,
+`updateEntryPassSettingsById` and `updateEntryPassSettingsBySiteId` each parsed
+the raw `Cookie` header for a `user` value and stored it as `createdBy` /
+`updatedBy` without ever comparing it to the session, so the audit trail on
+these rows was whatever the caller typed. It now comes from `callerId(req)`.
+That also removes a latent crash: `cookies?.["user"].toString()` short-circuits
+only on `cookies` being nullish, so any request carrying cookies but no `user`
+cookie called `.toString()` on `undefined` and threw.
+
+`requireSiteReach` matters here because the contracted agency that runs the
+gatehouse holds no membership in the estate's organisation and reaches its own
+site through `customer.sites`.
+
+Nothing on this mount has a live caller: `layer-common`'s
+`useSiteEntryPassSettings` binds only `GET /:id` and no component calls it, and
+the entry-pass screens read and write `/api/access-management/settings`, a
+different mount over a different collection. The routes are guarded rather than
+removed; whether this mount should exist at all is a product decision.

package/dist/index.d.ts

@@ -1621,6 +1621,8 @@ declare function useFeedbackRepo(): {
         pageRange: string;
     }>;
     getFeedbackById: (_id: string | ObjectId) => Promise<bson.Document>;
+    getRawFeedbackById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
+    getRawFeedback2ById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateFeedback: (_id: string | ObjectId, value: TFeedbackUpdate) => Promise<number>;
     updateFeedbackStatus: (_id: string | ObjectId, value: TFeedbackUpdateStatus) => Promise<number>;
     updateFeedbackCreatedByName: (_id: string | ObjectId, value: string | ObjectId, session?: ClientSession) => Promise<number>;
@@ -1649,6 +1651,46 @@ declare function useFeedbackService(): {
     }>;
 };
 
+/**
+ * Who may see, or change, a site's feedback.
+ *
+ * A feedback row is a resident's complaint about their own estate - the
+ * subject, the free-text description, the location inside the block, the
+ * attachments, and the name of the person who raised it. Every route on
+ * `/api/feedbacks` carried `requireAuth` and nothing more, and this controller
+ * held no authorization identifier of any kind, so being signed in anywhere on
+ * the platform was enough to read another client's complaints, re-categorise
+ * them, mark them completed, or delete them.
+ *
+ * `DELETE /:id` is the sharp one, for two reasons. It is the ONLY route on this
+ * mount with a live caller - `layer-common`'s `useFeedback().deleteFeedback`,
+ * wired to the delete button in `FeedbackDetail.vue` and `FeedbackMain.vue`,
+ * which every web app draws - and it does not write to the v1 table at all. It
+ * writes to `feedbacks2`, the authoritative one every client reads. So the one
+ * reachable route on the legacy mount was an unguarded delete against live
+ * data. It is guarded here against the row it actually touches.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule
+ * `/api/manpower-monitoring`, `/api/attendances`, `/api/remarks`,
+ * `/api/vehicles`, `/api/documents` and `/api/incident-reports` already use, so
+ * the contracted agency that answers these complaints reaches the estate
+ * through `customer.sites` and needs no membership in its organisation.
+ *
+ *  - `GET /site/:site/status/:status` names the site in the URL, so it is
+ *    checked before the read.
+ *  - The six record routes name only a record, so the site is read off the
+ *    STORED row and a `site` in the caller's own body cannot stand in for it.
+ *  - `POST /` took the author's identity from a `user` cookie the caller writes
+ *    and never compared it to the session, so a feedback could be filed in
+ *    somebody else's name. It comes from `callerId(req)` now - which also
+ *    removes a latent crash, because `cookies?.["user"].toString()`
+ *    short-circuits only on `cookies` being nullish and threw on any request
+ *    that carried cookies but no `user` cookie.
+ *
+ * Two readers, not one, because the two tables are not the same shape: v1
+ * `feedbacks` rows keep the site at `metadata.site`, `feedbacks2` rows keep it
+ * at the top level.
+ */
 declare function useFeedbackController(): {
     createFeedback: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getFeedbacks: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -6954,6 +6996,7 @@ declare function MEntryPassSettings(value: TEntryPassSettings): {
 };
 
 declare function useEntryPassSettingsRepo(): {
+    getRawEntryPassSettingsById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     add: (value: TEntryPassSettings, session?: ClientSession) => Promise<ObjectId>;
     getAll: ({ search, page, limit, sort, status, org, site, }: {
         search?: string | undefined;
@@ -6976,6 +7019,51 @@ declare function useEntryPassSettingsRepo(): {
     updateEntryPassSettingsBySiteId: (site: string | ObjectId, value: TEntryPassSettings) => Promise<number>;
 };
 
+/**
+ * Who may see, or change, a site's entry-pass settings.
+ *
+ * These rows decide how a site issues visitor passes: whether passes are on at
+ * all, whether a physical or NFC pass is used, which USB printer model the
+ * gatehouse drives, and the header, disclaimer and URL printed on the pass
+ * itself. All seven routes carried `requireAuth` and nothing more - the
+ * controller held no authorization identifier of any kind - so being signed in
+ * anywhere on the platform was enough to read every client's configuration, to
+ * turn another estate's passes off, or to rewrite the text and URL printed on a
+ * pass a visitor is handed at the gate.
+ *
+ * Two defects, not one:
+ *
+ *  1. **No scope.** `GET /` returns every row on the platform: it accepts `org`
+ *     and `site` query parameters and the repository never applies them, so a
+ *     filter that looks like scoping is not one. The record routes take an id
+ *     and no site. `GET|PUT /site/:site` take a site straight off the URL.
+ *  2. **The writer's identity came from a cookie the caller writes.** `add`,
+ *     `updateEntryPassSettingsById` and `updateEntryPassSettingsBySiteId` each
+ *     parsed the raw `Cookie` header for a `user` value and stored it as
+ *     `createdBy` / `updatedBy` without ever comparing it to the session, so
+ *     the audit trail on these rows was whatever the caller typed. It now comes
+ *     from `callerId(req)`, the session, as the rest of the platform does. That
+ *     also removes a latent crash: `cookies?.["user"].toString()` threw a
+ *     TypeError on any request that carried cookies but no `user` cookie.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule
+ * `/api/access-management`, `/api/manpower-monitoring`, `/api/attendances`,
+ * `/api/vehicles`, `/api/documents` and `/api/incident-reports` already use, so
+ * the contracted agency that runs the gatehouse reaches its own site through
+ * `customer.sites` and needs no membership in the estate's own organisation.
+ *
+ * Where a write can also MOVE a row - the body carries `site`, and the
+ * repository `$set`s it - the destination is checked as well as the origin, so
+ * a row cannot be re-parented into an estate the caller cannot reach.
+ *
+ * Nothing on this mount has a live caller. `layer-common`'s
+ * `useSiteEntryPassSettings` binds only `GET /:id`, and no component calls it;
+ * the entry-pass screens read and write `/api/access-management/settings`,
+ * which is a different mount over a different collection
+ * (`entrypass-settings`, not `site.entrypass-settings`). The routes are guarded
+ * rather than removed - whether this mount should exist at all is a product
+ * decision, not one to take inside an authorization fix.
+ */
 declare function useEntryPassSettingsController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -7188,6 +7188,22 @@ function useFeedbackRepo() {
       throw error;
     }
   }
+  async function getRawFeedbackById(_id) {
+    try {
+      _id = new import_mongodb4.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils5.BadRequestError("Invalid feedback ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
+  async function getRawFeedback2ById(_id) {
+    try {
+      _id = new import_mongodb4.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils5.BadRequestError("Invalid feedback ID format.");
+    }
+    return await feedbacks2Collection.findOne({ _id });
+  }
   async function updateFeedback(_id, value) {
     try {
       _id = new import_mongodb4.ObjectId(_id);
@@ -7414,6 +7430,8 @@ function useFeedbackRepo() {
     createFeedback,
     getFeedbacks,
     getFeedbackById,
+    getRawFeedbackById,
+    getRawFeedback2ById,
     updateFeedback,
     updateFeedbackStatus,
     updateFeedbackCreatedByName,
@@ -31708,18 +31726,24 @@ function useFeedbackController() {
   const { createFeedback: _createFeedback, getFeedbacks: _getFeedbacks } = useFeedbackService();
   const {
     getFeedbackById: _getFeedbackById,
+    getRawFeedbackById: _getRawFeedbackById,
+    getRawFeedback2ById: _getRawFeedback2ById,
     updateFeedback: _updateFeedback,
     updateFeedbackStatus: _updateFeedbackStatus,
     updateFeedbackCategory: _updateFeedbackCategory,
     updateFeedbackToCompleted: _updateFeedbackToCompleted,
     deleteFeedback: _deleteFeedback
   } = useFeedbackRepo();
+  async function requireFeedbackReach(req, _id) {
+    const row = await _getRawFeedbackById(_id);
+    await requireSiteReach(req, row?.metadata?.site ?? row?.site);
+  }
+  async function requireFeedback2Reach(req, _id) {
+    const row = await _getRawFeedback2ById(_id);
+    await requireSiteReach(req, row?.site ?? row?.metadata?.site);
+  }
   async function createFeedback(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const createdBy = cookies?.["user"].toString() ?? "";
+    const createdBy = callerId(req);
     const payload = { ...req.body, createdBy };
     const { error } = feedbackSchema.validate(payload);
     if (error) {
@@ -31728,6 +31752,7 @@ function useFeedbackController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.metadata?.site ?? payload.site);
       await _createFeedback(payload);
       res.status(201).json({ message: "Successfully created feedback." });
       return;
@@ -31768,6 +31793,7 @@ function useFeedbackController() {
     const to = req.query.to ?? "";
     const category = req.query.category ?? "";
     try {
+      await requireSiteReach(req, site);
       const data = await _getFeedbacks({
         search,
         page,
@@ -31797,6 +31823,7 @@ function useFeedbackController() {
       return;
     }
     try {
+      await requireFeedbackReach(req, _id);
       const data = await _getFeedbackById(_id);
       res.json(data);
       return;
@@ -31825,6 +31852,7 @@ function useFeedbackController() {
       return;
     }
     try {
+      await requireFeedbackReach(req, _id);
       await _updateFeedback(_id, payload);
       res.json({ message: "Successfully updated feedback." });
       return;
@@ -31849,6 +31877,7 @@ function useFeedbackController() {
     const _id = req.params.id;
     const status = req.params.status;
     try {
+      await requireFeedbackReach(req, _id);
       await _updateFeedbackStatus(_id, { status });
       res.json({ message: "Successfully updated feedback status." });
       return;
@@ -31872,6 +31901,7 @@ function useFeedbackController() {
       return;
     }
     try {
+      await requireFeedbackReach(req, _id);
       await _updateFeedbackCategory(_id, { category });
       res.json({ message: "Successfully updated feedback category." });
       return;
@@ -31897,6 +31927,7 @@ function useFeedbackController() {
       return;
     }
     try {
+      await requireFeedbackReach(req, _id);
       await _updateFeedbackToCompleted(_id, payload);
       res.json({ message: "Successfully updated feedback to completed." });
       return;
@@ -31916,6 +31947,7 @@ function useFeedbackController() {
       return;
     }
     try {
+      await requireFeedback2Reach(req, _id);
       await _deleteFeedback(_id);
       res.json({ message: "Successfully deleted feedback." });
       return;
@@ -68316,6 +68348,14 @@ function useEntryPassSettingsRepo() {
       throw error;
     }
   }
+  async function getRawEntryPassSettingsById(_id) {
+    try {
+      _id = new import_mongodb129.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils203.BadRequestError("Invalid entry pass settings ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateEntryPassSettingsById(_id, value) {
     try {
       _id = new import_mongodb129.ObjectId(_id);
@@ -68473,6 +68513,7 @@ function useEntryPassSettingsRepo() {
     }
   }
   return {
+    getRawEntryPassSettingsById,
     add,
     getAll,
     getEntryPassSettingsById,
@@ -68492,17 +68533,18 @@ function useEntryPassSettingsController() {
     add: _add,
     getAll: _getAll,
     getEntryPassSettingsById: _getEntryPassSettingsById,
+    getRawEntryPassSettingsById: _getRawEntryPassSettingsById,
     updateEntryPassSettingsById: _updateEntryPassSettingsById,
     deleteEntryPassSettingsById: _deleteEntryPassSettingsById,
     getEntryPassSettingsBySiteId: _getEntryPassSettingsBySiteId,
     updateEntryPassSettingsBySiteId: _updateEntryPassSettingsBySiteId
   } = useEntryPassSettingsRepo();
+  async function requireEntryPassReach(req, _id) {
+    const row = await _getRawEntryPassSettingsById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const createdBy = cookies?.["user"].toString() ?? "";
+    const createdBy = callerId(req);
     const payload = { ...req.body, createdBy };
     const { error } = schemaEntryPassSettings.validate(payload, {
       abortEarly: false
@@ -68514,6 +68556,7 @@ function useEntryPassSettingsController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json({ message: data });
       return;
@@ -68548,7 +68591,9 @@ function useEntryPassSettingsController() {
     const site = req.query.site ?? "";
     try {
       const data = await _getAll({ search, page, limit, status, org, site });
-      res.json(data);
+      const { only } = await siteReachOf(req);
+      const items = await only(data?.items ?? []);
+      res.json({ ...data, items });
       return;
     } catch (error2) {
       import_node_server_utils204.logger.log({ level: "error", message: error2.message });
@@ -68566,6 +68611,7 @@ function useEntryPassSettingsController() {
       return;
     }
     try {
+      await requireEntryPassReach(req, _id);
       const data = await _getEntryPassSettingsById(_id);
       res.json(data);
       return;
@@ -68593,11 +68639,7 @@ function useEntryPassSettingsController() {
       status: import_joi106.default.string().optional().allow("", null),
       updatedBy: import_joi106.default.string().hex().optional().allow("", null)
     });
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const updatedBy = cookies?.["user"].toString() ?? "";
+    const updatedBy = callerId(req);
     const _id = req.params.id;
     const payload = { ...req.body, updatedBy };
     const { error } = validation.validate({ _id, ...payload });
@@ -68607,6 +68649,9 @@ function useEntryPassSettingsController() {
       return;
     }
     try {
+      await requireEntryPassReach(req, _id);
+      if (payload.site)
+        await requireSiteReach(req, payload.site);
       await _updateEntryPassSettingsById(_id, payload);
       res.json({ message: "Successfully updated entry pass settings." });
       return;
@@ -68626,6 +68671,7 @@ function useEntryPassSettingsController() {
       return;
     }
     try {
+      await requireEntryPassReach(req, _id);
       await _deleteEntryPassSettingsById(_id);
       res.json({ message: "Successfully deleted entry pass settings." });
       return;
@@ -68645,6 +68691,7 @@ function useEntryPassSettingsController() {
       return;
     }
     try {
+      await requireSiteReach(req, _id);
       const data = await _getEntryPassSettingsBySiteId(_id);
       res.json(data);
       return;
@@ -68671,11 +68718,7 @@ function useEntryPassSettingsController() {
       status: import_joi106.default.string().optional().allow("", null),
       updatedBy: import_joi106.default.string().hex().optional().allow("", null)
     });
-    const cookies = req.headers.cookie?.split(";").map((cookie) => cookie.trim().split("=")).reduce(
-      (acc, [key, value]) => ({ ...acc, [key]: value }),
-      {}
-    );
-    const updatedBy = cookies?.["user"].toString() ?? "";
+    const updatedBy = callerId(req);
     const _id = req.params.site;
     const payload = { ...req.body, updatedBy };
     const { error } = validation.validate({ ...payload });
@@ -68685,6 +68728,9 @@ function useEntryPassSettingsController() {
       return;
     }
     try {
+      await requireSiteReach(req, _id);
+      if (payload.site)
+        await requireSiteReach(req, payload.site);
       await _updateEntryPassSettingsBySiteId(_id, payload);
       res.json({ message: "Successfully updated entry pass settings." });
       return;