@7365admin1/core 3.48.1-staging.159 → 3.48.1-staging.161

package/.changeset/occurrence-book-site-scope.md

@@ -0,0 +1,50 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the daily occurrence book routes to the estate the book belongs to.
+
+The daily occurrence book is one estate's security log for one day — the record
+the guards write every shift, and the record an estate is asked to produce when
+something goes wrong. Every route on `/api/occurrence-books` carried
+`requireAuth` and nothing more, and `occurrence-book.controller.ts` held no
+authorization identifier of any kind. `requireAuth` proves a session exists; it
+makes no organisation or site decision. So being signed in anywhere on the
+platform was enough to read another client's log, re-date it, re-open or close
+it, or delete the day outright.
+
+All five handlers now decide before any work is done. The route count was
+verified at the registration site — `occurrence-book.route.ts` mounts **five**
+routes, not the three the earlier inventory recorded.
+
+- `POST /` and `GET /` already REQUIRE a site (in the body and the query
+  respectively), so the guard checks a site the request already names and no
+  caller's contract changes.
+- `GET /id/:id`, `PUT /id/:id` and `DELETE /id/:id` name only a record, so the
+  site is read off the STORED row through the new `requireOccurrenceBookReach`.
+  A `site` in the caller's own body or query cannot stand in for it.
+
+`requireOccurrenceBookReach` is built on a new raw reader,
+`getRawOccurrenceBookById`. The existing `getOccurrenceBookById` is CACHED and
+throws `NotFoundError`, so a reach check built on it would have decided who may
+touch a book from a cache entry, and would have answered 404 with the wrong
+message before the guard ever ran.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`, already used
+by `/api/feedbacks`, `/api/work-orders`, `/api/manpower-monitoring`,
+`/api/attendances`, `/api/remarks`, `/api/vehicles`, `/api/documents` and
+`/api/incident-reports`. The `customer.sites` branch is load-bearing here: the
+guards who WRITE this book are the contracted security agency's staff and hold
+no membership in the estate's own organisation, so a flat organisation check
+would lock the security app out of the log it exists to keep.
+
+Each guard sits AFTER the handler's own Joi validation, so a malformed id still
+answers 400 exactly as before. A row that does not exist has no site, and
+`requireSiteReach` refuses a missing site, so an id matching nothing is refused
+rather than falling through.
+
+`PUT /id/:id` cannot MOVE a book — `schemaUpdateOccurrenceBook` does not accept
+`site` at all — so there is no destination to check.
+
+`/api/occurrence-entries` and `/api/occurrence-subjects` are separate mounts and
+are not touched here; each gets its own change.

package/.changeset/occurrence-entry-site-scope.md

@@ -0,0 +1,58 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the occurrence entry routes to the estate the entry belongs to.
+
+An occurrence entry is a single line the guards write into an estate's daily
+security log — the time, the subject, the free-text account of what happened, the
+signature of the guard who wrote it, and any incident report attached to it.
+Every route on `/api/occurrence-entries` carried `requireAuth` and nothing more,
+and `occurrence-entry.controller.ts` held no authorization identifier of any
+kind. `requireAuth` proves a session exists; it makes no organisation or site
+decision. So being signed in anywhere on the platform was enough to read another
+client's log line by line, rewrite what an entry says, or delete an entry from
+the record.
+
+All six handlers now decide before any work is done. The route count was
+verified at the registration site — `occurrence-entry.route.ts` mounts **six**
+routes, not the four the earlier inventory recorded.
+
+- `POST /` and `GET /` already REQUIRE a site (in the body and the query
+  respectively), so the guard checks a site the request already names and no
+  caller's contract changes.
+- `GET /id/:id`, `PUT /id/:id` and `DELETE /id/:id` name only a record, so the
+  site is read off the STORED row through the new `requireOccurrenceEntryReach`,
+  built on a new raw reader `getRawOccurrenceEntryById` (the existing
+  `getOccurrenceEntryById` is CACHED).
+- `GET /count/bookId/:id` is the one shape not seen on the earlier mounts: the
+  id identifies a **book**, not an entry. Its scope therefore comes from the
+  BOOK's row, through `requireOccurrenceBookSiteReach`.
+
+That last one matters. Deriving reach from "some entry carrying this book id"
+would have refused the FIRST entry of every new day, because a freshly opened
+book has no entries to read — the security app calls this route to work out the
+next serial number before writing that first line. There is a regression case
+for exactly that.
+
+`requireOccurrenceBookSiteReach` deliberately uses the book repository's
+ordinary (cached) reader. A book's `site` is immutable — no route on
+`/api/occurrence-books` accepts `site` on update — so a cached row cannot carry
+a site that differs from the stored one, and the usual objection to deciding
+reach from a cache does not apply here.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`. The
+`customer.sites` branch is load-bearing: the guards who WRITE these entries are
+the contracted security agency's staff and hold no membership in the estate's
+own organisation.
+
+Each guard sits AFTER the handler's own Joi validation, so a malformed id still
+answers 400 exactly as before. A row that does not exist has no site, and
+`requireSiteReach` refuses a missing site, so an id matching nothing is refused
+rather than falling through.
+
+`PUT /id/:id` cannot MOVE an entry — `schemaUpdateOccurrenceEntry` does not
+accept `site` at all — so there is no destination to check.
+
+`/api/occurrence-books` and `/api/occurrence-subjects` are separate mounts and
+are not touched here; each gets its own change.

package/dist/index.d.ts

@@ -6810,6 +6810,7 @@ declare function useOccurrenceBookRepo(): {
         pageRange: string;
     } | TOccurrenceBook>;
     getOccurrenceBookById: (_id: string | ObjectId, session?: ClientSession) => Promise<mongodb.WithId<bson.Document> | TOccurrenceBook>;
+    getRawOccurrenceBookById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateOccurrenceBookById: (_id: ObjectId | string, value: Partial<TOccurrenceBook>, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     deleteOccurrenceBookById: (_id: string | ObjectId) => Promise<number>;
     closeOccurrenceBooks: (session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
@@ -6827,6 +6828,35 @@ declare function useOccurrenceBookService(): {
     processCloseDOB: () => Promise<void>;
 };
 
+/**
+ * Who may see, or change, a site's daily occurrence book.
+ *
+ * The daily occurrence book is one estate's security log for one day - the
+ * record the guards write every shift, and the record an estate is asked to
+ * produce when something goes wrong. Every route on `/api/occurrence-books`
+ * carried `requireAuth` and nothing more, and this controller held no
+ * authorization identifier of any kind, so being signed in anywhere on the
+ * platform was enough to read another client's log, re-date it, re-open or
+ * close it, or delete the day outright.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule `/api/feedbacks`,
+ * `/api/work-orders`, `/api/manpower-monitoring`, `/api/attendances`,
+ * `/api/remarks`, `/api/vehicles`, `/api/documents` and `/api/incident-reports`
+ * already use, so the contracted security agency that keeps this log reaches
+ * the estate through `customer.sites` and needs no membership in its
+ * organisation. That branch is not incidental here - the guards who write the
+ * book are the agency's staff, not the estate's.
+ *
+ *  - `POST /` and `GET /` already REQUIRE a site, in the body and the query
+ *    respectively, so the guard checks the site the request already names and
+ *    no caller's contract changes.
+ *  - The three record routes name only a record, so the site is read off the
+ *    STORED row via `requireOccurrenceBookReach` and a `site` in the caller's
+ *    own body cannot stand in for it.
+ *
+ * `PUT /id/:id` cannot MOVE a book: `schemaUpdateOccurrenceBook` does not
+ * accept `site` at all, so there is no destination to check.
+ */
 declare function useOccurrenceBookController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -7551,6 +7581,7 @@ declare function useOccurrenceEntryRepo(): {
         pageRange: string;
     } | TOccurrenceEntry>;
     getOccurrenceEntryById: (_id: string | ObjectId, session?: ClientSession) => Promise<bson.Document>;
+    getRawOccurrenceEntryById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     getOccurrenceEntryByBookId: (dailyOccurrenceBookId: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateOccurrenceEntryById: (_id: ObjectId | string, value: Partial<TOccurrenceEntry>, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     updateUserNameBySignatureId: (_id: string | ObjectId, value: string | ObjectId, session?: ClientSession) => Promise<number>;
@@ -7567,6 +7598,39 @@ declare function useOccurrenceEntryService(): {
     updateOccurrenceEntryById: (id: string | ObjectId, value: TOccurrenceEntry) => Promise<"Successfully updated occurrence entry (incident report)." | "Successfully updated daily occurrence entry.">;
 };
 
+/**
+ * Who may see, or change, one line of a site's occurrence book.
+ *
+ * An occurrence entry is a single line the guards write into an estate's daily
+ * security log - the time, the subject, the free-text account of what happened,
+ * the signature of the guard who wrote it, and any incident report attached to
+ * it. Every route on `/api/occurrence-entries` carried `requireAuth` and
+ * nothing more, and this controller held no authorization identifier of any
+ * kind, so being signed in anywhere on the platform was enough to read another
+ * client's log line by line, rewrite what an entry says, or delete an entry
+ * from the record.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule `/api/feedbacks`,
+ * `/api/work-orders`, `/api/occurrence-books`, `/api/manpower-monitoring`,
+ * `/api/attendances`, `/api/remarks`, `/api/vehicles`, `/api/documents` and
+ * `/api/incident-reports` already use. The `customer.sites` branch is
+ * load-bearing here: the guards who WRITE these entries are the contracted
+ * security agency's staff and hold no membership in the estate's organisation.
+ *
+ *  - `POST /` and `GET /` already REQUIRE a site, in the body and the query
+ *    respectively, so the guard checks the site the request already names and
+ *    no caller's contract changes.
+ *  - `GET /id/:id`, `PUT /id/:id` and `DELETE /id/:id` name only a record, so
+ *    the site is read off the STORED row via `requireOccurrenceEntryReach`.
+ *  - `GET /count/bookId/:id` is the one different shape on this mount: `:id`
+ *    identifies a BOOK, not an entry. Its scope therefore comes from the BOOK's
+ *    row, not from an entry - `requireOccurrenceBookSiteReach` below. Deriving
+ *    it from "some entry with this book id" would refuse the FIRST entry of
+ *    every new day, because a freshly opened book has no entries to read.
+ *
+ * `PUT /id/:id` cannot MOVE an entry: `schemaUpdateOccurrenceEntry` does not
+ * accept `site` at all, so there is no destination to check.
+ */
 declare function useOccurrenceEntryController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -8551,6 +8551,14 @@ function useOccurrenceEntryRepo() {
       throw error;
     }
   }
+  async function getRawOccurrenceEntryById(_id) {
+    try {
+      _id = new import_mongodb8.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils9.BadRequestError("Invalid occurrence entry ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   async function getOccurrenceEntryByBookId(dailyOccurrenceBookId) {
     try {
       dailyOccurrenceBookId = new import_mongodb8.ObjectId(dailyOccurrenceBookId);
@@ -8770,6 +8778,7 @@ function useOccurrenceEntryRepo() {
     add,
     getAll,
     getOccurrenceEntryById,
+    getRawOccurrenceEntryById,
     getOccurrenceEntryByBookId,
     updateOccurrenceEntryById,
     updateUserNameBySignatureId,
@@ -66160,6 +66169,14 @@ function useOccurrenceBookRepo() {
       throw error;
     }
   }
+  async function getRawOccurrenceBookById(_id) {
+    try {
+      _id = new import_mongodb122.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils192.BadRequestError("Invalid occurrence book ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateOccurrenceBookById(_id, value, session) {
     value.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
@@ -66296,6 +66313,7 @@ function useOccurrenceBookRepo() {
     add,
     getAll,
     getOccurrenceBookById,
+    getRawOccurrenceBookById,
     updateOccurrenceBookById,
     deleteOccurrenceBookById,
     closeOccurrenceBooks,
@@ -66428,8 +66446,13 @@ function useOccurrenceBookController() {
   const {
     getAll: _getAll,
     getOccurrenceBookById: _getOccurrenceBookById,
+    getRawOccurrenceBookById: _getRawOccurrenceBookById,
     deleteOccurrenceBookById: _deleteOccurrenceBookById
   } = useOccurrenceBookRepo();
+  async function requireOccurrenceBookReach(req, _id) {
+    const row = await _getRawOccurrenceBookById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaOccurrenceBook.validate(payload, {
@@ -66442,6 +66465,7 @@ function useOccurrenceBookController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json(data);
       return;
@@ -66493,6 +66517,7 @@ function useOccurrenceBookController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -66520,6 +66545,7 @@ function useOccurrenceBookController() {
       return;
     }
     try {
+      await requireOccurrenceBookReach(req, _id);
       const data = await _getOccurrenceBookById(_id);
       res.status(200).json(data);
       return;
@@ -66542,6 +66568,7 @@ function useOccurrenceBookController() {
       return;
     }
     try {
+      await requireOccurrenceBookReach(req, _id);
       const result = await _updateOccurrenceBookById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -66561,6 +66588,7 @@ function useOccurrenceBookController() {
       return;
     }
     try {
+      await requireOccurrenceBookReach(req, _id);
       await _deleteOccurrenceBookById(_id);
       res.status(200).json({ message: "Successfully deleted occurrence book." });
       return;
@@ -71467,9 +71495,19 @@ function useOccurrenceEntryController() {
   const {
     getAll: _getAll,
     getOccurrenceEntryById: _getOccurrenceEntryById,
+    getRawOccurrenceEntryById: _getRawOccurrenceEntryById,
     deleteOccurrenceEntryById: _deleteOccurrenceEntryById,
     getLatestSerialNumber: _getLatestSerialNumber
   } = useOccurrenceEntryRepo();
+  const { getOccurrenceBookById: _getOccurrenceBookById } = useOccurrenceBookRepo();
+  async function requireOccurrenceEntryReach(req, _id) {
+    const row = await _getRawOccurrenceEntryById(_id);
+    await requireSiteReach(req, row?.site);
+  }
+  async function requireOccurrenceBookSiteReach(req, bookId) {
+    const book = await _getOccurrenceBookById(bookId);
+    await requireSiteReach(req, book?.site);
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaOccurrenceEntry.validate(req.body, {
@@ -71481,6 +71519,7 @@ function useOccurrenceEntryController() {
         next(new import_node_server_utils220.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -71514,6 +71553,7 @@ function useOccurrenceEntryController() {
       const sortObj = {
         [sort ? sort : "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
       };
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -71542,6 +71582,7 @@ function useOccurrenceEntryController() {
         return;
       }
       const { _id } = value;
+      await requireOccurrenceEntryReach(req, _id);
       const data = await _getOccurrenceEntryById(_id);
       res.status(200).json(data);
       return;
@@ -71564,6 +71605,7 @@ function useOccurrenceEntryController() {
         return;
       }
       const { _id, ...rest } = value;
+      await requireOccurrenceEntryReach(req, _id);
       const result = await _updateOccurrenceEntryById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -71585,6 +71627,7 @@ function useOccurrenceEntryController() {
         return;
       }
       const { _id } = value;
+      await requireOccurrenceEntryReach(req, _id);
       await _deleteOccurrenceEntryById(_id);
       res.status(200).json({ message: "Successfully deleted occurrence entry." });
       return;
@@ -71604,6 +71647,7 @@ function useOccurrenceEntryController() {
       return;
     }
     try {
+      await requireOccurrenceBookSiteReach(req, _id);
       const data = await _getLatestSerialNumber(_id);
       res.status(200).json({ count: data });
       return;