@7365admin1/core 3.48.1-staging.165 → 3.48.1-staging.167

package/.changeset/patrol-log-site-scope.md

@@ -0,0 +1,29 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the virtual patrol log routes to the estate, and take the author from the session
+
+`/api/patrol-logs` carried `requireAuth` and nothing more on all five handlers,
+and `patrol-log.controller.ts` held no authorization identifier of any kind. A
+patrol log is the proof a round was walked, so any signed-in account on the
+platform could read another client's patrol history, rewrite a round's outcome,
+detach its incident report, move it to another estate, or destroy it. The delete
+is a HARD delete (`collection.deleteOne`), so there is no tombstone to notice.
+
+`GET /` was worse than "unscoped": `site` was an OPTIONAL query parameter and
+the repository only applies it when it is a valid id, so a request that simply
+omitted it was answered with EVERY estate's patrol history in one page. `site`
+is now required, which is what both live callers already send.
+
+`createdBy` was accepted from the request body and never compared to the
+session, so a round could be filed under another guard's name. It now comes from
+`callerId(req)`.
+
+Adds `requirePatrolLogReach`, built on the existing `requireSiteReach` rule,
+plus an uncached `getRawPatrolLogById` so the check is not decided from a
+15-minute cache entry. `PUT /id/:id` checks BOTH ends, because
+`schemaUpdatePatrolLog` accepts `site` and `updateById` writes it.
+
+Behaviour change: `GET /id/:id` used to answer 200 with `data: null` for an id
+matching nothing; it now refuses.

package/dist/index.d.ts

@@ -5118,6 +5118,7 @@ declare function MPatrolLog(value: TPatrolLog): {
 };
 
 declare function usePatrolLogRepo(): {
+    getRawPatrolLogById: (_id: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     createIndexes: () => Promise<string>;
     createTextIndex: () => Promise<string>;
     add: (value: TPatrolLog, session?: ClientSession) => Promise<ObjectId>;
@@ -5139,6 +5140,52 @@ declare function usePatrolLogService(): {
     add: (value: TPatrolLog) => Promise<bson.ObjectId>;
 };
 
+/**
+ * Who may see, or change, an estate's virtual patrol logs.
+ *
+ * A patrol log is the PROOF a round was walked: the route, when it started and
+ * ended, who was assigned, every camera visited with the questions answered and
+ * the photos and videos attached, and whether it came back complete, late or
+ * incomplete. It is the document a client is shown when they ask whether their
+ * estate was patrolled, and it is what an incident report is attached to.
+ *
+ * All five routes on `/api/patrol-logs` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind, so being
+ * signed in ANYWHERE on the platform was enough to read another client's patrol
+ * history, rewrite a round's outcome, detach its incident report, or delete the
+ * proof outright.
+ *
+ * Two of those are sharp. `PUT /id/:id` can rewrite `status`, so a round that
+ * came back "incomplete" can be made to read "complete" and the console shows
+ * a clean patrol. `DELETE /id/:id` is a HARD delete - `collection.deleteOne`,
+ * not a status flag - so the proof is gone with no tombstone to notice.
+ *
+ * The estate is the scope. `requireSiteReach` is the rule `/api/patrol-routes`,
+ * `/api/patrol-questions`, `/api/feedbacks`, `/api/work-orders`,
+ * `/api/occurrence-books` and `/api/nfc-patrol-log` already use, so the
+ * contracted security agency whose guards walk these rounds reaches the estate
+ * through `customer.sites` and needs no membership in its organisation.
+ *
+ *  - `POST /` already REQUIRES a site in the body, so the guard checks the site
+ *    the request already names.
+ *  - `GET /` took `site` as an OPTIONAL query parameter, and the repository
+ *    only applies it when it is a valid id (`ObjectId.isValid(site)`).
+ *    Omitting it therefore returned EVERY estate's patrol history in one page.
+ *    `site` is now required, which is what both live callers already send.
+ *  - The three record routes name only a record, so the site is read off the
+ *    STORED row via `requirePatrolLogReach`, and a `site` in the caller's own
+ *    body cannot stand in for it.
+ *
+ * `PUT /id/:id` CAN move a log: `schemaUpdatePatrolLog` accepts `site` and
+ * `updateById` writes it, so a caller who reaches site A could otherwise file
+ * one of A's rounds under site B - or pull one of B's rounds into A. Both ends
+ * are checked.
+ *
+ * `createdBy` was also accepted from the request BODY and never compared to the
+ * session, so a caller could file a patrol under another guard's name. It now
+ * comes from `callerId(req)`. The field stays optional in the schema because
+ * existing clients do not send it.
+ */
 declare function usePatrolLogController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -52940,7 +52940,16 @@ function usePatrolLogRepo() {
       });
     });
   }
+  async function getRawPatrolLogById(_id) {
+    try {
+      _id = new import_mongodb94.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils152.BadRequestError("Invalid patrol log ID format.");
+    }
+    return await collection.findOne({ _id });
+  }
   return {
+    getRawPatrolLogById,
     createIndexes,
     createTextIndex,
     add,
@@ -53031,9 +53040,14 @@ function usePatrolLogController() {
     getAll: _getAll,
     updateById: _updateById,
     deleteById: _deleteById,
-    getById: _getById
+    getById: _getById,
+    getRawPatrolLogById: _getRawPatrolLogById
   } = usePatrolLogRepo();
   const { add: _add } = usePatrolLogService();
+  async function requirePatrolLogReach(req, _id) {
+    const row = await _getRawPatrolLogById(_id);
+    await requireSiteReach(req, row?.site);
+  }
   async function add(req, res, next) {
     const data = req.body;
     const { error, value } = schemaPatrolLog.validate(data);
@@ -53042,7 +53056,8 @@ function usePatrolLogController() {
       return;
     }
     try {
-      const question = await _add(value);
+      await requireSiteReach(req, value.site);
+      const question = await _add({ ...value, createdBy: callerId(req) });
       res.status(201).json({
         message: "Patrol Log added successfully.",
         data: question
@@ -53059,7 +53074,7 @@ function usePatrolLogController() {
       sort: import_joi76.default.string().pattern(/^([a-zA-Z0-9_]+)(,[a-zA-Z0-9_]+)*$/).optional().allow("", ...allowedFields),
       status: import_joi76.default.string().optional().allow(null, ""),
       search: import_joi76.default.string().optional().allow(null, ""),
-      site: import_joi76.default.string().optional().allow(null, ""),
+      site: import_joi76.default.string().hex().required(),
       dateFrom: import_joi76.default.string().optional().allow(null, "")
     });
     const query2 = { ...req.query };
@@ -53088,6 +53103,7 @@ function usePatrolLogController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -53118,6 +53134,9 @@ function usePatrolLogController() {
       return;
     }
     try {
+      await requirePatrolLogReach(req, _id);
+      if (req.body?.site)
+        await requireSiteReach(req, req.body.site);
       const result = await _updateById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -53137,6 +53156,7 @@ function usePatrolLogController() {
       return;
     }
     try {
+      await requirePatrolLogReach(req, _id);
       await _deleteById(_id);
       res.status(200).json({ message: "Successfully deleted patrol log." });
       return;
@@ -53157,6 +53177,7 @@ function usePatrolLogController() {
       return;
     }
     try {
+      await requirePatrolLogReach(req, id);
       const logs = await _getById(id);
       res.json({
         message: "Successfully retrieved patrol log.",