@7365admin1/core 3.48.1-staging.176 → 3.48.1-staging.178

package/.changeset/facility-booking-site-scope.md

@@ -0,0 +1,10 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the facility booking routes to the estate. `/api/facility-bookings` carried
+`requireAuth` and nothing else on all five routes: any signed-in account could book
+a facility at another estate, list another client's bookings, and read, rewrite or
+cancel any booking by id alone — including moving a booking to a different estate.
+Reach is now checked on the site named in the request, and on the stored row where
+the request names only an id.

package/.changeset/visitor-guest-scope.md

@@ -0,0 +1,12 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the visitor guest routes to the estate
+
+`/api/visitor-guests` carried `requireAuth` and nothing more on all four
+routes, so any signed-in account could add, read, edit or delete another
+estate's expected-visitor list. `site` was optional on the list query and the
+repository only applies it when valid, so omitting it returned every estate's
+visitor records at once. All four handlers now ask the existing site-reach
+rule, and `site` is required on the list query.

package/dist/index.d.ts

@@ -4693,6 +4693,7 @@ declare function useGuestManagementRepo(): {
         org?: string | undefined;
         site?: string | undefined;
     }, session?: ClientSession) => Promise<{}>;
+    getById: (_id: string | ObjectId, session?: ClientSession) => Promise<mongodb.WithId<bson.Document> | null>;
     updateVisitorGuestById: (_id: string | ObjectId, value: Partial<TGuestManagement>, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     deleteVisitorGuest: (_id: string | ObjectId) => Promise<number>;
     createTextIndex: () => Promise<void>;
@@ -4703,6 +4704,25 @@ declare function useGuestManagementService(): {
     updateVisitorGuestById: (id: string | ObjectId, value: TGuestManagement) => Promise<string>;
 };
 
+/**
+ * A visitor guest is a named person an estate expects at its gate: name,
+ * contact, NRIC, vehicle plate, and the block/level/unit they are visiting.
+ *
+ * All four routes carried `requireAuth` and nothing more, and this controller
+ * held no authorization identifier of any kind. `site` and `org` were read
+ * straight off the caller — the body on `POST`, the query on `GET` — and never
+ * compared to anything, and `PUT`/`DELETE` reached the row by id alone. Being
+ * signed in ANYWHERE on the platform was therefore enough to read, edit or
+ * delete any estate's guest list.
+ *
+ * The `GET` was the worst of the four: `site` and `org` were OPTIONAL, and the
+ * repository only applies them `ObjectId.isValid(...)`. Omitting both left the
+ * `$match` with no tenancy term at all, so one request returned every estate's
+ * visitor records on the platform — names, NRIC, contact numbers and plates.
+ *
+ * The rule is the existing one, `requireSiteReach` (i.e. `entitleSite`), not a
+ * second competing mechanism.
+ */
 declare function useGuestManagementController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -50372,6 +50372,14 @@ function useGuestManagementRepo() {
       throw error;
     }
   }
+  async function getById(_id, session) {
+    try {
+      _id = new import_mongodb86.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils135.BadRequestError("Invalid visitor guest ID format.");
+    }
+    return await collection.findOne({ _id }, { session });
+  }
   async function updateVisitorGuestById(_id, value, session) {
     try {
       _id = new import_mongodb86.ObjectId(_id);
@@ -50434,6 +50442,7 @@ function useGuestManagementRepo() {
   return {
     add,
     getAll,
+    getById,
     updateVisitorGuestById,
     deleteVisitorGuest,
     createTextIndex
@@ -50483,7 +50492,11 @@ var import_joi67 = __toESM(require("joi"));
 var import_node_server_utils137 = require("@7365admin1/node-server-utils");
 function useGuestManagementController() {
   const { add: _add, updateVisitorGuestById: _updateVisitorGuestById } = useGuestManagementService();
-  const { getAll: _getAll, deleteVisitorGuest: _deleteVisitorGuest } = useGuestManagementRepo();
+  const {
+    getAll: _getAll,
+    getById: _getById,
+    deleteVisitorGuest: _deleteVisitorGuest
+  } = useGuestManagementRepo();
   async function add(req, res, next) {
     const payload = { ...req.body };
     const { error } = schemaGuestManagement.validate(payload, {
@@ -50496,6 +50509,7 @@ function useGuestManagementController() {
       return;
     }
     try {
+      await requireSiteReach(req, payload.site);
       const data = await _add(payload);
       res.status(201).json({ message: data });
       return;
@@ -50516,7 +50530,9 @@ function useGuestManagementController() {
       dateFrom: import_joi67.default.date().iso().optional().allow(null, ""),
       dateTo: import_joi67.default.date().iso().optional().allow(null, ""),
       org: import_joi67.default.string().optional().allow(null, ""),
-      site: import_joi67.default.string().optional().allow(null, "")
+      // required, so the repository can never build a `$match` with no
+      // tenancy term and return the whole platform's guest list
+      site: import_joi67.default.string().hex().length(24).required()
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2, {
@@ -50546,6 +50562,7 @@ function useGuestManagementController() {
       }
     });
     try {
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -50578,6 +50595,8 @@ function useGuestManagementController() {
       return;
     }
     try {
+      const current = await _getById(_id);
+      await requireSiteReach(req, current?.site);
       const result = await _updateVisitorGuestById(_id, req.body);
       res.status(200).json({ message: result });
       return;
@@ -50597,6 +50616,8 @@ function useGuestManagementController() {
       return;
     }
     try {
+      const current = await _getById(_id);
+      await requireSiteReach(req, current?.site);
       await _deleteVisitorGuest(_id);
       res.status(200).json({ message: "Successfully deleted visitor guest." });
       return;
@@ -55676,6 +55697,14 @@ function useSiteFacilityBookingController() {
     getSiteFacilityBookingById: _getSiteFacilityBookingById,
     deleteSiteFacilityBookingById: _deleteSiteFacilityBookingById
   } = useSiteFacilityBookingRepo();
+  async function loadReachable(req, id) {
+    const booking = await _getSiteFacilityBookingById(id);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(booking)) {
+      throw new import_node_server_utils168.NotFoundError("Site facility booking not found.");
+    }
+    return booking;
+  }
   async function add(req, res, next) {
     try {
       const { error, value } = schemaSiteFacilityBooking.validate(req.body, {
@@ -55687,6 +55716,7 @@ function useSiteFacilityBookingController() {
         next(new import_node_server_utils168.BadRequestError(messages));
         return;
       }
+      await requireSiteReach(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -55720,6 +55750,7 @@ function useSiteFacilityBookingController() {
       const sortObj = {
         [sort]: order === "asc" /* ASC */ ? 1 : -1
       };
+      await requireSiteReach(req, site);
       const data = await _getAll({
         search,
         page,
@@ -55747,7 +55778,7 @@ function useSiteFacilityBookingController() {
         next(new import_node_server_utils168.BadRequestError(error.message));
         return;
       }
-      const data = await _getSiteFacilityBookingById(value._id);
+      const data = await loadReachable(req, value._id);
       res.status(200).json(data);
       return;
     } catch (error) {
@@ -55771,6 +55802,9 @@ function useSiteFacilityBookingController() {
     }
     const { _id, ...rest } = value;
     try {
+      await loadReachable(req, _id);
+      if (rest.site)
+        await requireSiteReach(req, rest.site);
       const result = await _updateSiteFacilityBookingById(_id, rest);
       res.status(200).json({ message: result });
       return;
@@ -55793,6 +55827,7 @@ function useSiteFacilityBookingController() {
     }
     const { _id } = value;
     try {
+      await loadReachable(req, _id);
       await _deleteSiteFacilityBookingById(_id);
       res.status(200).json({ message: "Successfully deleted site facility booking." });
       return;