@7365admin1/core 3.48.1-staging.164 → 3.48.1-staging.165

package/.changeset/patrol-question-site-scope.md

@@ -0,0 +1,22 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the virtual patrol question routes to the estate
+
+`/api/patrol-questions` carried `requireAuth` and nothing more on all four
+handlers, and `patrol-question.controller.ts` held no authorization identifier
+of any kind. Any signed-in account on the platform could add a question to
+another client's estate, reword one, change the answers it accepts, or delete
+it. The reword is the quiet one: the guard's console still shows a question and
+still records an answer, so nothing looks wrong, but the estate is no longer
+checking what it believes it is checking.
+
+`GET /` was worse than "unscoped": `site` was an OPTIONAL query parameter and
+the repository only applies it when it is a valid id, so a request that simply
+omitted it was answered with EVERY estate's patrol questions in one page.
+`site` is now required, which is what both live callers already send.
+
+Adds `requirePatrolQuestionReach`, built on the existing `requireSiteReach`
+rule, plus an uncached `getRawPatrolQuestionById` so the check is not decided
+from a 15-minute cache entry.

package/dist/index.d.ts

@@ -4876,6 +4876,7 @@ declare function MPatrolQuestion(value: TPatrolQuestion): {
 };
 
 declare function usePatrolQuestionRepo(): {
+    getRawPatrolQuestionById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     createIndexes: () => Promise<string>;
     createTextIndex: () => Promise<string>;
     add: (value: TPatrolQuestion, session?: ClientSession) => Promise<ObjectId>;
@@ -4892,6 +4893,41 @@ declare function usePatrolQuestionRepo(): {
     getById: (_id: string | ObjectId, session?: ClientSession) => Promise<mongodb.WithId<bson.Document> | TPatrolQuestion | null>;
 };
 
+/**
+ * Who may see, or change, an estate's virtual patrol questions.
+ *
+ * A patrol question is what a guard is asked at a camera on their round - "Is
+ * the gate secured?", with the answers they may give. The questions are pinned
+ * to a route's cameras, so they are part of what the estate's patrol actually
+ * checks and what the log later shows was answered.
+ *
+ * All four routes on `/api/patrol-questions` carried `requireAuth` and nothing
+ * more, and this controller held no authorization identifier of any kind, so
+ * being signed in ANYWHERE on the platform was enough to add a question to
+ * another client's estate, reword one, change its allowed answers, or delete
+ * it. Rewording is the sharp one: the guard's console still shows a question
+ * and still records an answer, so nothing looks wrong, but the estate is no
+ * longer checking what it believes it is checking.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule `/api/patrol-routes`,
+ * `/api/feedbacks`, `/api/work-orders`, `/api/occurrence-books` and
+ * `/api/nfc-patrol-log` already use, so the contracted security agency that
+ * runs these rounds reaches the estate through `customer.sites` and needs no
+ * membership in its organisation.
+ *
+ *  - `POST /` already REQUIRES a site in the body, so the guard checks the site
+ *    the request already names.
+ *  - `GET /` took `site` as an OPTIONAL query parameter, and the repository
+ *    only applies it when it is a valid id (`ObjectId.isValid(site)`).
+ *    Omitting it therefore returned EVERY estate's questions in one page.
+ *    `site` is now required, which is what both live callers already send.
+ *  - The two record routes name only a record, so the site is read off the
+ *    STORED row via `requirePatrolQuestionReach`, and a `site` in the caller's
+ *    own body cannot stand in for it.
+ *
+ * `PUT /id/:id` cannot MOVE a question: `schemaUpdatePatrolQuestion` does not
+ * accept `site` at all, so there is no destination to check.
+ */
 declare function usePatrolQuestionController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -51575,7 +51575,16 @@ function usePatrolQuestionRepo() {
       });
     });
   }
+  async function getRawPatrolQuestionById(_id) {
+    try {
+      _id = new import_mongodb90.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils145.BadRequestError("Invalid patrol question ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   return {
+    getRawPatrolQuestionById,
     createIndexes,
     createTextIndex,
     add,
@@ -51594,8 +51603,13 @@ function usePatrolQuestionController() {
     add: _add,
     getAll: _getAll,
     updateById: _updateById,
-    deleteById: _deleteById
+    deleteById: _deleteById,
+    getRawPatrolQuestionById: _getRawPatrolQuestionById
   } = usePatrolQuestionRepo();
+  async function requirePatrolQuestionReach(req, _id) {
+    const row = await _getRawPatrolQuestionById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
     const data = req.body;
     const { error, value } = schemaPatrolQuestion.validate(data);
@@ -51604,6 +51618,7 @@ function usePatrolQuestionController() {
       return;
     }
     try {
+      await requireSiteReach(req, value.site);
       const question = await _add(value);
       res.status(201).json({
         message: "Patrol Question added successfully.",
@@ -51621,7 +51636,7 @@ function usePatrolQuestionController() {
       sort: import_joi72.default.string().pattern(/^([a-zA-Z0-9_]+)(,[a-zA-Z0-9_]+)*$/).optional().allow("", ...allowedFields),
       status: import_joi72.default.string().optional().allow(null, ""),
       search: import_joi72.default.string().optional().allow(null, ""),
-      site: import_joi72.default.string().optional().allow(null, "")
+      site: import_joi72.default.string().hex().required()
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2, {
@@ -51648,6 +51663,7 @@ function usePatrolQuestionController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -51677,6 +51693,7 @@ function usePatrolQuestionController() {
       return;
     }
     try {
+      await requirePatrolQuestionReach(req, _id);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -51696,6 +51713,7 @@ function usePatrolQuestionController() {
       return;
     }
     try {
+      await requirePatrolQuestionReach(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted patrol question." });
       return;