@7365admin1/core 3.48.1-staging.180 → 3.48.1-staging.182

package/.changeset/hid-configuration-write-allowlist.md

@@ -0,0 +1,22 @@
+---
+"@7365admin1/core": patch
+---
+
+Constrain what a HID configuration write may contain, and stop storing password salts
+
+`PUT /readers/:readerId/configuration` is a passthrough to the reader's
+`set_configuration.fcgi`, and its body schema was `Joi.object().unknown(true)`.
+That reaches `monitor.hostname`, `monitor.port` and `monitor.path` — the block
+that decides which server receives every identification at that door — so one
+request could redirect a reader's entire event stream. Writes are now limited to
+the two modules the product actually writes, `pjsip` and `identifier`, which are
+the only two `setReaderConfiguration` call sites in `layer-common`. Module
+contents stay unvalidated (the vendor owns those keys), reading configuration is
+unchanged, and the monitor block is still managed by the server through
+`setReaderMonitor` and `configureReaderIntegration`, which do not use this
+schema.
+
+`sanitizeHidPayload` — the central redaction every `addEvent` already passes
+through — did not include `salt`, so a password salt was still being persisted
+beside the hash it belongs to. `salt`, `salt_value` and `saltvalue` are now
+redacted like the rest. This does not touch records already stored.

package/dist/index.d.ts

@@ -10450,6 +10450,7 @@ declare function useBuildingLevelRepo(): {
     getById: (_id: string | ObjectId, session?: ClientSession) => Promise<TBuildingLevel>;
     updateLevelById: (_id: string | ObjectId, value: TBuildingLevel, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     deleteById: (_id: string | ObjectId, session?: ClientSession) => Promise<string>;
+    deactivateByBuilding: (buildingId: string | ObjectId, levelIds?: (string | ObjectId)[], session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
     bulkWriteLevels: (levels: TBuildingLevel[], session?: ClientSession) => Promise<{
         insertedIds: {
             [key: number]: any;
@@ -10659,6 +10660,21 @@ declare const schemaUpdateHidSitePermissions: Joi.ObjectSchema<any>;
 declare const schemaHidAmicoExecuteActions: Joi.ObjectSchema<any>;
 declare const schemaHidAmicoIntercomCall: Joi.ObjectSchema<any>;
 declare const schemaHidAmicoConfiguration: Joi.ObjectSchema<any>;
+/**
+ * A configuration WRITE is a passthrough to `set_configuration.fcgi`, so an
+ * unrestricted body reaches `monitor.hostname`, `monitor.port` and
+ * `monitor.path` - the block that decides which server receives every
+ * identification at that door. A single request could redirect a reader's
+ * entire event stream.
+ *
+ * Writes are limited to the two modules the product actually writes, which are
+ * the only two `setReaderConfiguration` call sites in `layer-common`:
+ * `pjsip` (HidIntercomManagement.vue) and `identifier`
+ * (HidQrCodeConfiguration.vue). Module CONTENTS stay unvalidated - the vendor
+ * owns those keys - and READING configuration is unchanged. The monitor block
+ * is still managed by the server through `setReaderMonitor` and
+ * `configureReaderIntegration`, which do not go through this schema.
+ */
 declare const schemaHidAmicoSetConfiguration: Joi.ObjectSchema<any>;
 declare const schemaHidAmicoMonitor: Joi.ObjectSchema<any>;
 declare const schemaHidAmicoObjectOperation: Joi.ObjectSchema<any>;

package/dist/index.js

@@ -36906,6 +36906,34 @@ function useBuildingLevelRepo() {
       }
     }
   }
+  async function deactivateByBuilding(buildingId, levelIds = [], session) {
+    let bId;
+    try {
+      bId = new import_mongodb70.ObjectId(buildingId);
+    } catch {
+      throw new import_node_server_utils107.BadRequestError("Invalid building ID.");
+    }
+    const or = [
+      { blockId: bId },
+      { blockId: String(bId) }
+    ];
+    const refIds = (levelIds || []).map((id) => {
+      try {
+        return new import_mongodb70.ObjectId(id);
+      } catch {
+        return null;
+      }
+    }).filter((x) => x !== null);
+    if (refIds.length)
+      or.push({ _id: { $in: refIds } });
+    const res = await collection.updateMany(
+      { status: "active" /* ACTIVE */, $or: or },
+      { $set: { status: "deleted" /* DELETED */, deletedAt: /* @__PURE__ */ new Date() } },
+      { session }
+    );
+    delCachedData();
+    return res;
+  }
   async function bulkWriteLevels(levels, session) {
     try {
       const operations = levels.map((level) => {
@@ -37031,6 +37059,7 @@ function useBuildingLevelRepo() {
     getById,
     updateLevelById,
     deleteById,
+    deactivateByBuilding,
     bulkWriteLevels,
     batchUpdateByIds,
     getBuildingLevelList,
@@ -37057,7 +37086,8 @@ function useBuildingService() {
   const { deleteFile } = useFileService();
   const {
     bulkWriteLevels: _bulkWriteLevels,
-    getActiveLevelsByIds: _getActiveLevelsByIds
+    getActiveLevelsByIds: _getActiveLevelsByIds,
+    deactivateByBuilding: _deactivateLevelsByBuilding
   } = useBuildingLevelRepo();
   function normalizeImportKey(value) {
     return String(value ?? "").trim().replace(/\s+/g, " ").toLowerCase();
@@ -37212,17 +37242,29 @@ function useBuildingService() {
     }
   }
   async function deleteById(id) {
-    const building = await getByBuilding(id);
-    if (building) {
+    const existingUnit = await getByBuilding(id);
+    if (existingUnit) {
       throw new import_node_server_utils108.BadRequestError(
-        "Cannot delete building with existing room/facility. Please delete room/facility first."
+        "Cannot delete building with existing unit(s). Please delete the unit(s) first."
       );
     }
+    const session = import_node_server_utils108.useAtlas.getClient()?.startSession();
+    if (!session) {
+      throw new import_node_server_utils108.BadRequestError("Database session not available.");
+    }
     try {
-      await _deleteById(id);
+      session.startTransaction();
+      const building = await _getById(id);
+      const levelIds = building?.levels ?? [];
+      await _deleteById(id, session);
+      await _deactivateLevelsByBuilding(id, levelIds, session);
+      await session.commitTransaction();
       return "Building deleted successfully.";
     } catch (error) {
+      await session.abortTransaction();
       throw error;
+    } finally {
+      session.endSession();
     }
   }
   async function uploadSpreadsheetBuilding(data, site) {
@@ -43463,7 +43505,10 @@ var schemaHidAmicoIntercomCall = import_joi64.default.object({
   target: import_joi64.default.string().trim().min(1).max(255).pattern(/^(?:sip:)?[A-Za-z0-9_.+-]+(?:@[A-Za-z0-9.-]+(?::\d{1,5})?)?$/).required()
 }).unknown(true);
 var schemaHidAmicoConfiguration = import_joi64.default.object().pattern(import_joi64.default.string(), import_joi64.default.array().items(import_joi64.default.string())).min(1).unknown(true);
-var schemaHidAmicoSetConfiguration = import_joi64.default.object().unknown(true);
+var schemaHidAmicoSetConfiguration = import_joi64.default.object({
+  pjsip: import_joi64.default.object().unknown(true),
+  identifier: import_joi64.default.object().unknown(true)
+}).min(1).unknown(false);
 var schemaHidAmicoMonitor = import_joi64.default.object({
   enabled: import_joi64.default.boolean().required()
 });
@@ -43672,6 +43717,9 @@ var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
   "pin",
   "pin_value",
   "pinvalue",
+  "salt",
+  "salt_value",
+  "saltvalue",
   "card_value",
   "cardvalue",
   "cardno",