@7365admin1/core 3.48.1-staging.162 → 3.48.1-staging.164

package/.changeset/nfc-patrol-log-site-scope.md

@@ -0,0 +1,56 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the NFC patrol log routes to the estate the round was walked at, and take
+the author from the session.
+
+An NFC patrol log is the proof that a round was actually walked: the route, the
+day, each checkpoint the guard tapped a tag against, the ones that were skipped
+and why, and the signature that closes the round off. It is the document a
+client is shown when they ask whether their estate was patrolled.
+
+Every route on `/api/nfc-patrol-log` carried `requireAuth` and nothing more, and
+`nfc-patrol-log.controller.ts` held no authorization identifier of any kind.
+`requireAuth` proves a session exists; it makes no organisation or site
+decision. So being signed in anywhere on the platform was enough to read another
+client's patrol history, **mark a checkpoint on another estate's round as
+completed**, or **sign that round off as done** — falsifying the patrol proof,
+not merely reading it.
+
+All five handlers now decide before any work is done. The route count was
+verified at the registration site — `nfc-patrol-log.route.ts` mounts **five**
+routes, not the four the earlier inventory recorded.
+
+- `POST /` and `GET /` already REQUIRE a site (`schemaCreateNfcPatrolLog` and
+  the query schema both have `site` required), so the guard checks a site the
+  request already names and no caller's contract changes. The repository does
+  genuinely apply that `site` — it is the first term of the aggregation match,
+  not a parameter it accepts and ignores.
+- `PATCH /:id/checkpoint`, `GET /:id` and `PATCH /:id/sign` name only a record,
+  so the site is read off the STORED log through `requireNfcPatrolLogReach`.
+  `getById` on this repository is NOT cached, so no separate raw reader was
+  needed here, unlike the occurrence mounts.
+- `POST /`'s `createdBy` came from the request body and was never compared to
+  the session. It comes from `callerId(req)` now. The field is still accepted,
+  so no caller starts to 400; it is simply ignored.
+
+None of the three record routes can MOVE a log: `updateCheckpoint` sets only the
+checkpoint fields and `sign` sets only the signature fields, so there is no
+destination to check.
+
+The rule is the existing one, `requireSiteReach` -> `entitleSite`. The
+`customer.sites` branch is load-bearing here more than on any other mount: the
+people who walk these rounds are the contracted security agency's guards and
+hold no membership in the estate's own organisation.
+
+`GET /:id` previously answered **200 with `null`** for an id matching nothing,
+because the handler passed the repository's `null` straight to `res.json`. It
+now refuses — a log that does not exist has no site, and `requireSiteReach`
+refuses a missing site.
+
+Sibling mounts on the same family — `/nfc-patrol-tag`, `/nfc-patrol-settings`,
+`/nfc-patrol-route` and `/patrol-routes` — are NOT touched here. The first three
+carry `/public` routes behind `requireSessionOrLegacyToken`, which is inert
+while `ENFORCE_NFC_PUBLIC_AUTH` is off, so guarding their shared handlers would
+refuse a live legacy screen. That needs the SEC-028 decision first.

package/.changeset/patrol-route-site-scope.md

@@ -0,0 +1,27 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the virtual patrol route routes to the estate
+
+`/api/patrol-routes` carried `requireAuth` and nothing more on all six
+handlers, and `patrol-route.controller.ts` held no authorization identifier of
+any kind. Any signed-in account on the platform could read another client's
+patrol schedule, re-time it, re-assign it, point it at different cameras, move
+it to another estate, or delete it outright — and a deleted round simply stops
+appearing in `scheduled-routes`, so nobody is told to walk it and nothing looks
+wrong on the console.
+
+`GET /` and `GET /scheduled-routes` were worse than "unscoped": `site` was an
+OPTIONAL query parameter and the repository only applies it when it is a valid
+id, so a request that simply omitted it was answered with EVERY estate's patrol
+schedule in one page. `site` is now required, which is what both live callers
+already send.
+
+Adds `requirePatrolRouteReach`, built on the existing `requireSiteReach` rule,
+plus an uncached `getRawPatrolRouteById` so the check is not decided from a
+15-minute cache entry. `PUT /id/:id` checks BOTH ends, because
+`schemaUpdatePatrolRoute` accepts `site` and `updateById` writes it.
+
+Behaviour change: `GET /id/:id` used to answer 200 with `data: null` for an id
+matching nothing; it now refuses.

package/dist/index.d.ts

@@ -4966,9 +4966,47 @@ declare function usePatrolRouteRepo(): {
         day: number;
     }, session?: ClientSession) => Promise<{}>;
     getById: (_id: string | ObjectId, session?: ClientSession) => Promise<mongodb.WithId<bson.Document> | TPatrolRoute | null>;
+    getRawPatrolRouteById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     createIndexes: () => Promise<string>;
 };
 
+/**
+ * Who may see, or change, an estate's virtual patrol routes.
+ *
+ * A patrol route is the round a guard is required to walk: which cameras, in
+ * what order, at what times, on which days, and which staff are assigned to it.
+ * Every route on `/api/patrol-routes` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind, so being
+ * signed in ANYWHERE on the platform was enough to read another client's patrol
+ * schedule, re-time it, re-assign it, point it at different cameras, or delete
+ * it outright. Deleting a route is the sharp one: the round then simply stops
+ * appearing in `scheduled-routes`, so nobody is told to walk it and nothing
+ * looks wrong on the console.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule `/api/feedbacks`,
+ * `/api/work-orders`, `/api/occurrence-books`, `/api/nfc-patrol-log`,
+ * `/api/attendances`, `/api/remarks` and `/api/incident-reports` already use,
+ * so the contracted security agency that walks these rounds reaches the estate
+ * through `customer.sites` and needs no membership in its organisation. That
+ * branch is not incidental here - the assignees on a route are the agency's
+ * guards, not the estate's own staff.
+ *
+ *  - `POST /` already REQUIRES a site in the body, so the guard checks the site
+ *    the request already names.
+ *  - `GET /` and `GET /scheduled-routes` took `site` as an OPTIONAL query
+ *    parameter, and the repository only applies it when it is a valid id
+ *    (`ObjectId.isValid(site)`). Omitting it therefore returned EVERY estate's
+ *    routes in one page. `site` is now required, which is what both live
+ *    callers already send.
+ *  - The three record routes name only a record, so the site is read off the
+ *    STORED row via `requirePatrolRouteReach`, and a `site` in the caller's own
+ *    body cannot stand in for it.
+ *
+ * `PUT /id/:id` CAN move a route: `schemaUpdatePatrolRoute` accepts `site` and
+ * `updateById` writes it, so a caller who reaches site A could otherwise hand
+ * one of A's routes to site B. Both ends are checked - the route's current site
+ * and, when the body names one, the destination.
+ */
 declare function usePatrolRouteController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -7916,6 +7954,40 @@ declare function useNfcPatrolLogService(): {
     sign: (id: string, value: TSignNfcPatrolLog) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's guard-patrol record.
+ *
+ * An NFC patrol log is the proof that a round was actually walked: the route,
+ * the day, each checkpoint the guard tapped a tag against, the ones that were
+ * skipped and why, and the signature that closes the round off. It is the
+ * document a client is shown when they ask whether their estate was patrolled.
+ *
+ * Every route on `/api/nfc-patrol-log` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind.
+ * `requireAuth` proves a session exists; it makes no organisation or site
+ * decision. So being signed in anywhere on the platform was enough to read
+ * another client's patrol record, mark a checkpoint on it as completed or
+ * skipped, or sign a round off as done - which is falsifying the estate's
+ * patrol proof, not merely reading it.
+ *
+ * The estate is the scope, and the rule is the existing `requireSiteReach` ->
+ * `entitleSite` that `/api/occurrence-books`, `/api/occurrence-entries`,
+ * `/api/occurrence-subjects`, `/api/work-orders`, `/api/feedbacks` and the rest
+ * already use. The `customer.sites` branch is load-bearing here more than
+ * anywhere: the people who walk these rounds are the contracted security
+ * agency's guards and hold no membership in the estate's own organisation.
+ *
+ *  - `POST /` and `GET /` already REQUIRE a site (`schemaCreateNfcPatrolLog`
+ *    and the query schema both have `site` required), so the guard checks a
+ *    site the request already names and no caller's contract changes.
+ *  - `PATCH /:id/checkpoint`, `GET /:id` and `PATCH /:id/sign` name only a
+ *    record, so the site is read off the STORED log via
+ *    `requireNfcPatrolLogReach`.
+ *
+ * None of the three record routes can MOVE a log: `updateCheckpoint` sets only
+ * the checkpoint fields and `sign` sets only the signature fields, so there is
+ * no destination to check.
+ */
 declare function useNfcPatrolLogController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllBySite: (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;

package/dist/index.js

@@ -52217,6 +52217,14 @@ function usePatrolRouteRepo() {
       throw error;
     }
   }
+  async function getRawPatrolRouteById(_id) {
+    try {
+      _id = new import_mongodb92.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils149.BadRequestError("Invalid patrol route ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   return {
     createTextIndex,
     add,
@@ -52225,6 +52233,7 @@ function usePatrolRouteRepo() {
     deleteById,
     getScheduledRoute,
     getById,
+    getRawPatrolRouteById,
     createIndexes
   };
 }
@@ -52239,8 +52248,13 @@ function usePatrolRouteController() {
     updateById: _updateById,
     deleteById: _deleteById,
     getScheduledRoute: _getScheduledRoute,
-    getById: _getById
+    getById: _getById,
+    getRawPatrolRouteById: _getRawPatrolRouteById
   } = usePatrolRouteRepo();
+  async function requirePatrolRouteReach(req, _id) {
+    const row = await _getRawPatrolRouteById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
     const data = { ...req.body };
     const { error, value } = schemaPatrolRoute.validate(data);
@@ -52249,6 +52263,7 @@ function usePatrolRouteController() {
       return;
     }
     try {
+      await requireSiteReach(req, value.site);
       const question = await _add(value);
       res.status(201).json({
         message: "Patrol Route added successfully.",
@@ -52266,7 +52281,7 @@ function usePatrolRouteController() {
       sort: import_joi74.default.string().pattern(/^([a-zA-Z0-9_]+)(,[a-zA-Z0-9_]+)*$/).optional().allow("", ...allowedFields),
       status: import_joi74.default.string().optional().allow(null, ""),
       search: import_joi74.default.string().optional().allow(null, ""),
-      site: import_joi74.default.string().optional().allow(null, "")
+      site: import_joi74.default.string().hex().required()
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2, {
@@ -52293,6 +52308,7 @@ function usePatrolRouteController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -52322,6 +52338,9 @@ function usePatrolRouteController() {
       return;
     }
     try {
+      await requirePatrolRouteReach(req, _id);
+      if (req.body?.site)
+        await requireSiteReach(req, req.body.site);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -52341,6 +52360,7 @@ function usePatrolRouteController() {
       return;
     }
     try {
+      await requirePatrolRouteReach(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted patrol route." });
       return;
@@ -52358,7 +52378,7 @@ function usePatrolRouteController() {
       sort: import_joi74.default.string().pattern(/^([a-zA-Z0-9_]+)(,[a-zA-Z0-9_]+)*$/).optional().allow("", ...allowedFields),
       status: import_joi74.default.string().optional().allow(null, ""),
       search: import_joi74.default.string().optional().allow(null, ""),
-      site: import_joi74.default.string().optional().allow(null, ""),
+      site: import_joi74.default.string().hex().required(),
       start: import_joi74.default.string().optional().required(),
       day: import_joi74.default.string().optional().required()
     });
@@ -52389,6 +52409,7 @@ function usePatrolRouteController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getScheduledRoute({
         search,
         page,
@@ -52418,6 +52439,7 @@ function usePatrolRouteController() {
       return;
     }
     try {
+      await requirePatrolRouteReach(req, id);
       const routes = await _getById(id);
       res.json({
         message: "Successfully retrieved patrol routes.",
@@ -72788,6 +72810,10 @@ var import_joi119 = __toESM(require("joi"));
 function useNfcPatrolLogController() {
   const { add: _add, completeCheckpoint: _completeCheckpoint, sign: _sign } = useNfcPatrolLogService();
   const { getAllBySite: _getAllBySite, getById: _getById } = useNfcPatrolLogRepo();
+  async function requireNfcPatrolLogReach(req, id) {
+    const log = await _getById(id);
+    await requireSiteReach(req, log?.site);
+  }
   async function add(req, res, next) {
     try {
       const payload = req.body;
@@ -72795,7 +72821,8 @@ function useNfcPatrolLogController() {
       if (error) {
         return next(new import_node_server_utils227.BadRequestError(error.message));
       }
-      const data = await _add(value);
+      await requireSiteReach(req, value.site);
+      const data = await _add({ ...value, createdBy: callerId(req) });
       res.status(201).json(data);
       return;
     } catch (error) {
@@ -72844,6 +72871,7 @@ function useNfcPatrolLogController() {
       );
     }
     try {
+      await requireSiteReach(req, value.site);
       const data = await _getAllBySite({
         page: value.page,
         limit: value.limit,
@@ -72866,6 +72894,7 @@ function useNfcPatrolLogController() {
       skippedRemarks: req.body.skippedRemarks
     };
     try {
+      await requireNfcPatrolLogReach(req, id);
       const data = await _completeCheckpoint(id, payload);
       res.status(200).json(data);
       return;
@@ -72876,6 +72905,7 @@ function useNfcPatrolLogController() {
   }
   async function getLog(req, res, next) {
     try {
+      await requireNfcPatrolLogReach(req, req.params.id);
       const log = await _getById(req.params.id);
       res.json(log);
     } catch (error) {
@@ -72885,6 +72915,7 @@ function useNfcPatrolLogController() {
   async function sign(req, res, next) {
     try {
       const value = await schemaSignNfcPatrolLog.validateAsync(req.body);
+      await requireNfcPatrolLogReach(req, req.params.id);
       const result = await _sign(
         req.params.id,
         value