@7365admin1/core 3.48.1-staging.161 → 3.48.1-staging.163

package/.changeset/nfc-patrol-log-site-scope.md

@@ -0,0 +1,56 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the NFC patrol log routes to the estate the round was walked at, and take
+the author from the session.
+
+An NFC patrol log is the proof that a round was actually walked: the route, the
+day, each checkpoint the guard tapped a tag against, the ones that were skipped
+and why, and the signature that closes the round off. It is the document a
+client is shown when they ask whether their estate was patrolled.
+
+Every route on `/api/nfc-patrol-log` carried `requireAuth` and nothing more, and
+`nfc-patrol-log.controller.ts` held no authorization identifier of any kind.
+`requireAuth` proves a session exists; it makes no organisation or site
+decision. So being signed in anywhere on the platform was enough to read another
+client's patrol history, **mark a checkpoint on another estate's round as
+completed**, or **sign that round off as done** — falsifying the patrol proof,
+not merely reading it.
+
+All five handlers now decide before any work is done. The route count was
+verified at the registration site — `nfc-patrol-log.route.ts` mounts **five**
+routes, not the four the earlier inventory recorded.
+
+- `POST /` and `GET /` already REQUIRE a site (`schemaCreateNfcPatrolLog` and
+  the query schema both have `site` required), so the guard checks a site the
+  request already names and no caller's contract changes. The repository does
+  genuinely apply that `site` — it is the first term of the aggregation match,
+  not a parameter it accepts and ignores.
+- `PATCH /:id/checkpoint`, `GET /:id` and `PATCH /:id/sign` name only a record,
+  so the site is read off the STORED log through `requireNfcPatrolLogReach`.
+  `getById` on this repository is NOT cached, so no separate raw reader was
+  needed here, unlike the occurrence mounts.
+- `POST /`'s `createdBy` came from the request body and was never compared to
+  the session. It comes from `callerId(req)` now. The field is still accepted,
+  so no caller starts to 400; it is simply ignored.
+
+None of the three record routes can MOVE a log: `updateCheckpoint` sets only the
+checkpoint fields and `sign` sets only the signature fields, so there is no
+destination to check.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`. The
+`customer.sites` branch is load-bearing here more than on any other mount: the
+people who walk these rounds are the contracted security agency's guards and
+hold no membership in the estate's own organisation.
+
+`GET /:id` previously answered **200 with `null`** for an id matching nothing,
+because the handler passed the repository's `null` straight to `res.json`. It
+now refuses — a log that does not exist has no site, and `requireSiteReach`
+refuses a missing site.
+
+Sibling mounts on the same family — `/nfc-patrol-tag`, `/nfc-patrol-settings`,
+`/nfc-patrol-route` and `/patrol-routes` — are NOT touched here. The first three
+carry `/public` routes behind `requireSessionOrLegacyToken`, which is inert
+while `ENFORCE_NFC_PUBLIC_AUTH` is off, so guarding their shared handlers would
+refuse a live legacy screen. That needs the SEC-028 decision first.

package/.changeset/occurrence-subject-site-scope.md

@@ -0,0 +1,58 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the occurrence subject routes to the estate the subject belongs to, and
+take the author from the session.
+
+An occurrence subject is one of the named headings the guards pick from when
+they write a line into an estate's daily security log — "Lift breakdown",
+"Trespasser", "Fire alarm". The list belongs to one site. Every route on
+`/api/occurrence-subjects` carried `requireAuth` and nothing more, and
+`occurrence-subject.controller.ts` held no authorization identifier of any kind.
+`requireAuth` proves a session exists; it makes no organisation or site
+decision. So being signed in anywhere on the platform was enough to read another
+client's subject list, add a heading to it, rename one, or delete one out from
+under the guards who are picking from it.
+
+Two defects, not one:
+
+1. **No scope.** All five handlers now decide before any work is done. The route
+   count was verified at the registration site — `occurrence-subject.route.ts`
+   mounts **five** routes, not the three the earlier inventory recorded.
+2. **Identity from the caller's body.** `POST /` took `addedBy` straight out of
+   the request body and never compared it to the session, so a heading could be
+   filed under somebody else's name. It comes from `callerId(req)` now. The
+   shipped mobile client's own comment records the old behaviour — "`addedBy` is
+   sent because the model stores it; the server does not take it from the
+   session". Same defect already fixed on `/api/attendances`,
+   `/api/site-entrypass-settings` and `/api/feedbacks`.
+
+- `POST /` and `GET /` already REQUIRE a site (`schemaOccurrenceSubject` and the
+  query schema both have `site` required), so the guard checks a site the
+  request already names and no caller's contract changes.
+- `GET /id/:id`, `PUT /id/:id` and `DELETE /id/:id` name only a record, so the
+  site is read off the STORED row through the new
+  `requireOccurrenceSubjectReach`, built on a new raw reader
+  `getRawOccurrenceSubjectById` (the existing `getOccurrenceSubjectById` is
+  CACHED, so a guard built on it would decide reach from a cache entry).
+
+`GET /`'s `site` is genuinely applied by the repository — it is part of the
+`baseQuery` and of the cache key — so the list needed a reach check on the site
+it names, not a narrowing pass after the read.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`. The
+`customer.sites` branch is load-bearing: the guards who maintain this list are
+the contracted security agency's staff and hold no membership in the estate's
+own organisation.
+
+Each guard sits AFTER the handler's own Joi validation, so a malformed id still
+answers 400 exactly as before. A row that does not exist has no site, and
+`requireSiteReach` refuses a missing site, so an id matching nothing is refused
+rather than falling through.
+
+`PUT /id/:id` cannot MOVE a subject — `schemaUpdateOccurrenceSubject` accepts
+only `_id` and `subject` — so there is no destination to check.
+
+This closes the occurrence-book family: `/occurrence-books`,
+`/occurrence-entries` and `/occurrence-subjects`.

package/dist/index.d.ts

@@ -7765,6 +7765,7 @@ declare function useOccurrenceSubjectRepo(): {
         pageRange: string;
     } | TOccurrenceSubject>;
     getOccurrenceSubjectById: (_id: string | ObjectId, session?: ClientSession) => Promise<mongodb.WithId<bson.Document> | TOccurrenceSubject>;
+    getRawOccurrenceSubjectById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     updateOccurrenceSubjectById: (_id: ObjectId | string, value: Partial<TOccurrenceSubject>, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     deleteOccurrenceSubjectById: (_id: string | ObjectId) => Promise<number>;
     createIndexes: () => Promise<void>;
@@ -7776,6 +7777,41 @@ declare function useOccurrenceSubjectService(): {
     updateOccurrenceSubjectById: (id: string | ObjectId, value: Partial<TOccurrenceSubject>) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, the list of subjects an estate logs against.
+ *
+ * An occurrence subject is one of the named headings the guards pick from when
+ * they write a line into the estate's daily security log - "Lift breakdown",
+ * "Trespasser", "Fire alarm". The list belongs to one site. Every route on
+ * `/api/occurrence-subjects` carried `requireAuth` and nothing more, and this
+ * controller held no authorization identifier of any kind, so being signed in
+ * anywhere on the platform was enough to read another client's subject list,
+ * add a heading to it, rename one, or delete one out from under the guards
+ * who are picking from it.
+ *
+ * Two defects, not one:
+ *
+ *  1. **No scope.** The estate is the scope, and the rule is the existing
+ *     `requireSiteReach` -> `entitleSite` that `/api/occurrence-books`,
+ *     `/api/occurrence-entries`, `/api/work-orders`, `/api/feedbacks` and the
+ *     rest already use. The `customer.sites` branch is load-bearing: the guards
+ *     who maintain this list are the contracted security agency's staff and
+ *     hold no membership in the estate's own organisation.
+ *  2. **Identity from the caller's body.** `POST /` took `addedBy` straight out
+ *     of the request body and never compared it to the session, so a subject
+ *     could be filed under somebody else's name. It comes from `callerId(req)`
+ *     now. This is the same defect already fixed on `/api/attendances`,
+ *     `/api/site-entrypass-settings` and `/api/feedbacks`.
+ *
+ *  - `POST /` and `GET /` already REQUIRE a site (`schemaOccurrenceSubject` and
+ *    the query schema both have `site` required), so the guard checks a site
+ *    the request already names and no caller's contract changes.
+ *  - `GET /id/:id`, `PUT /id/:id` and `DELETE /id/:id` name only a record, so
+ *    the site is read off the STORED row via `requireOccurrenceSubjectReach`.
+ *
+ * `PUT /id/:id` cannot MOVE a subject: `schemaUpdateOccurrenceSubject` accepts
+ * only `_id` and `subject`, so there is no destination to check.
+ */
 declare function useOccurrenceSubjectController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -7880,6 +7916,40 @@ declare function useNfcPatrolLogService(): {
     sign: (id: string, value: TSignNfcPatrolLog) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's guard-patrol record.
+ *
+ * An NFC patrol log is the proof that a round was actually walked: the route,
+ * the day, each checkpoint the guard tapped a tag against, the ones that were
+ * skipped and why, and the signature that closes the round off. It is the
+ * document a client is shown when they ask whether their estate was patrolled.
+ *
+ * Every route on `/api/nfc-patrol-log` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind.
+ * `requireAuth` proves a session exists; it makes no organisation or site
+ * decision. So being signed in anywhere on the platform was enough to read
+ * another client's patrol record, mark a checkpoint on it as completed or
+ * skipped, or sign a round off as done - which is falsifying the estate's
+ * patrol proof, not merely reading it.
+ *
+ * The estate is the scope, and the rule is the existing `requireSiteReach` ->
+ * `entitleSite` that `/api/occurrence-books`, `/api/occurrence-entries`,
+ * `/api/occurrence-subjects`, `/api/work-orders`, `/api/feedbacks` and the rest
+ * already use. The `customer.sites` branch is load-bearing here more than
+ * anywhere: the people who walk these rounds are the contracted security
+ * agency's guards and hold no membership in the estate's own organisation.
+ *
+ *  - `POST /` and `GET /` already REQUIRE a site (`schemaCreateNfcPatrolLog`
+ *    and the query schema both have `site` required), so the guard checks a
+ *    site the request already names and no caller's contract changes.
+ *  - `PATCH /:id/checkpoint`, `GET /:id` and `PATCH /:id/sign` name only a
+ *    record, so the site is read off the STORED log via
+ *    `requireNfcPatrolLogReach`.
+ *
+ * None of the three record routes can MOVE a log: `updateCheckpoint` sets only
+ * the checkpoint fields and `sign` sets only the signature fields, so there is
+ * no destination to check.
+ */
 declare function useNfcPatrolLogController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllBySite: (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;

package/dist/index.js

@@ -71298,6 +71298,14 @@ function useOccurrenceSubjectRepo() {
       throw error;
     }
   }
+  async function getRawOccurrenceSubjectById(_id) {
+    try {
+      _id = new import_mongodb137.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils218.BadRequestError("Invalid occurrence subject ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   async function updateOccurrenceSubjectById(_id, value, session) {
     value.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
@@ -71362,6 +71370,7 @@ function useOccurrenceSubjectRepo() {
     add,
     getAll,
     getOccurrenceSubjectById,
+    getRawOccurrenceSubjectById,
     updateOccurrenceSubjectById,
     deleteOccurrenceSubjectById,
     createIndexes,
@@ -72268,8 +72277,13 @@ function useOccurrenceSubjectController() {
   const {
     getAll: _getAll,
     getOccurrenceSubjectById: _getOccurrenceSubjectById,
+    getRawOccurrenceSubjectById: _getRawOccurrenceSubjectById,
     deleteOccurrenceSubjectById: _deleteOccurrenceSubjectById
   } = useOccurrenceSubjectRepo();
+  async function requireOccurrenceSubjectReach(req, _id) {
+    const row = await _getRawOccurrenceSubjectById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaOccurrenceSubject.validate(req.body, {
@@ -72281,7 +72295,8 @@ function useOccurrenceSubjectController() {
         next(new import_node_server_utils224.BadRequestError(messages));
         return;
       }
-      const data = await _add(value);
+      await requireSiteReach(req, value.site);
+      const data = await _add({ ...value, addedBy: callerId(req) });
       res.status(201).json(data);
       return;
     } catch (error) {
@@ -72310,6 +72325,7 @@ function useOccurrenceSubjectController() {
         return;
       }
       const { search, page, limit, site, sort, order } = value;
+      await requireSiteReach(req, site);
       const sortObj = {
         [sort ? sort : "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
       };
@@ -72340,6 +72356,7 @@ function useOccurrenceSubjectController() {
         return;
       }
       const { _id } = value;
+      await requireOccurrenceSubjectReach(req, _id);
       const data = await _getOccurrenceSubjectById(_id);
       res.status(200).json(data);
       return;
@@ -72364,6 +72381,7 @@ function useOccurrenceSubjectController() {
         return;
       }
       const { _id, ...rest } = value;
+      await requireOccurrenceSubjectReach(req, _id);
       const result = await _updateOccurrenceSubjectById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -72383,6 +72401,7 @@ function useOccurrenceSubjectController() {
       return;
     }
     try {
+      await requireOccurrenceSubjectReach(req, _id);
       await _deleteOccurrenceSubjectById(_id);
       res.status(200).json({ message: "Successfully deleted occurrence subject." });
       return;
@@ -72769,6 +72788,10 @@ var import_joi119 = __toESM(require("joi"));
 function useNfcPatrolLogController() {
   const { add: _add, completeCheckpoint: _completeCheckpoint, sign: _sign } = useNfcPatrolLogService();
   const { getAllBySite: _getAllBySite, getById: _getById } = useNfcPatrolLogRepo();
+  async function requireNfcPatrolLogReach(req, id) {
+    const log = await _getById(id);
+    await requireSiteReach(req, log?.site);
+  }
   async function add(req, res, next) {
     try {
       const payload = req.body;
@@ -72776,7 +72799,8 @@ function useNfcPatrolLogController() {
       if (error) {
         return next(new import_node_server_utils227.BadRequestError(error.message));
       }
-      const data = await _add(value);
+      await requireSiteReach(req, value.site);
+      const data = await _add({ ...value, createdBy: callerId(req) });
       res.status(201).json(data);
       return;
     } catch (error) {
@@ -72825,6 +72849,7 @@ function useNfcPatrolLogController() {
       );
     }
     try {
+      await requireSiteReach(req, value.site);
       const data = await _getAllBySite({
         page: value.page,
         limit: value.limit,
@@ -72847,6 +72872,7 @@ function useNfcPatrolLogController() {
       skippedRemarks: req.body.skippedRemarks
     };
     try {
+      await requireNfcPatrolLogReach(req, id);
       const data = await _completeCheckpoint(id, payload);
       res.status(200).json(data);
       return;
@@ -72857,6 +72883,7 @@ function useNfcPatrolLogController() {
   }
   async function getLog(req, res, next) {
     try {
+      await requireNfcPatrolLogReach(req, req.params.id);
       const log = await _getById(req.params.id);
       res.json(log);
     } catch (error) {
@@ -72866,6 +72893,7 @@ function useNfcPatrolLogController() {
   async function sign(req, res, next) {
     try {
       const value = await schemaSignNfcPatrolLog.validateAsync(req.body);
+      await requireNfcPatrolLogReach(req, req.params.id);
       const result = await _sign(
         req.params.id,
         value