@7365admin1/core 3.48.1-staging.186 → 3.48.1-staging.188

package/.changeset/resident-self-signup-field-pinning.md

@@ -0,0 +1,53 @@
+---
+"@7365admin1/core": minor
+---
+
+Pin what a logged-out caller may set on the resident sign-up.
+
+`POST /api/people/resident/create` (`person.route.ts:37`) has no guard, and it
+shares the `add` handler with the guarded `POST /api/people/`. The handler
+spread the request body into `schemaPerson` and inserted it.
+
+`site.people` is the collection every site-reach decision on the platform reads
+its verdict from. On that schema `status` was a free-form string, and `_id`,
+`user`, `approvedBy`, `type`, `site` and `org` were all caller-supplied. So an
+anonymous caller could insert an APPROVED row at any client's site, pointing at
+an account they control, and be reachable into that estate from then on. That is
+the manufacture-access path, not a theoretical one.
+
+It cannot be closed with a session check: the only caller anywhere in the
+organisation is the resident app's registration wizard
+(`app/(auth)/createUser.tsx:449`), which by definition has no session yet. So
+the route is field-pinned instead.
+
+With no session the body is now validated against a new
+`schemaResidentSelfSignUp` — an explicit ALLOW-list of exactly what
+`createUser.tsx` sends, with `stripUnknown`, so `_id`, `user`, `approvedBy` and
+anything else are dropped rather than written. Two fields are then set
+server-side rather than accepted:
+
+- `status` is forced to `"pending"`, the literal the wizard hard-codes at
+  `createUser.tsx:151` and re-sets at `:237`.
+- `platform` is forced to `"mobile"`. This matters as much as `status`:
+  `person.service.ts:130` reads it to decide whether the USER ACCOUNT it creates
+  starts `"pending"` or `"active"`, so a caller who sent `platform: "web"` got a
+  live account with nobody reviewing them.
+
+`type` is narrowed to `resident` or `tenant` — the only two the wizard derives
+(`createUser.tsx:441`) — with `.valid(...)` and `.trim().lowercase()`, never
+`.allow(...)`, which accepts any non-empty string and would restrict nothing.
+This closes the `user` hole properly: the service only overwrites a
+caller-supplied `user` on the resident/tenant branch, so sending
+`type: "contractor"` was what left a nominated `user` standing.
+
+The guarded `POST /api/people/` is UNCHANGED and still accepts the full
+`schemaPerson` — staff legitimately create contractors and visitors, set their
+own statuses, and record `approvedBy`.
+
+`site`, `org`, `block`, `level`, `unit`, `isOwner`, `email`, `password`, `name`,
+`nric`, `contact` and the files are NOT pinnable: a genuine self-registration
+chooses its own estate and unit, so pinning any of them would block real
+residents.
+
+Covered by `test/e2e/resident-self-signup-pinning.e2e.test.mjs`. Both create
+routes are now mounted in the e2e harness, mirroring `person.route.ts`.

package/.changeset/user-email-lookup-no-credentials.md

@@ -0,0 +1,52 @@
+---
+"@7365admin1/core": minor
+---
+
+Stop the e-mail account lookup handing out the password hash and session id.
+
+`GET /api/users/user/:email` (`user.route.ts:25`) has no guard on it at all, and
+`GET /api/users/email/:email` next to it is the same handler behind
+`requireAuth`. Both answered `res.json(user)` on the raw stored document, and
+the users collection stores `password` — the hash — and `sid` — that account's
+CURRENT session id.
+
+So anyone at all, with no session, who knew or guessed an e-mail address got
+that account's password hash back in the response body, to crack offline at
+leisure, plus a live session id to reuse. On the authenticated twin, any signed
+in account could read the same two fields for any other account, including an
+administrator's.
+
+The unguarded route cannot simply be guarded. Its only callers anywhere in the
+organisation are pre-login signup screens — the resident app's e-mail check
+(`user-registration.ts:103`) and the four `web-app-main/pages/sign-up-invite/*`
+pages through `layer-common`'s `getUserByEmailV2` — so a session check would
+break registration. The fix is therefore not authentication, it is not handing
+out more than signup asks for.
+
+All five of those callers read NO field off the reply. The mobile check does
+`res !== null`; the four web pages do `if (response)`. So without a session the
+handler no longer loads the document: a new `userExistsByEmail` does a
+`findOne` with an explicit allow-list projection of `_id` alone and returns a
+boolean, and the route answers `{ exists: true }` or `null` exactly as before.
+An allow-list, deliberately — a deny-list would silently start leaking the next
+credential-shaped field somebody adds to the collection.
+
+`getUserByEmail` itself is UNCHANGED and still returns the whole document,
+because signing in genuinely needs the hash to compare against. Putting the
+projection on that function instead of beside it would have broken every login.
+
+With a session the reply keeps its existing shape, minus `password` and `sid`,
+via a small `withoutCredentials`. `_id` is the only field its callers read
+(`web-app-main pages/verify/email`, `web-app-org onboarding/getting-started`)
+and it survives. That path is narrowed by removal rather than by allow-list on
+purpose: it is consumed by screens across web and mobile that cannot all be
+enumerated from here, and removing two credential fields cannot break a
+legitimate one, because no screen renders a password hash or a session id.
+
+The v2 twin `GET /api/users/v2/email/:email` had the same leak — it is behind
+`requireAuth`, so it was never anonymous, but "signed in" is not "entitled to
+another account's credentials" — and is stripped the same way. v2 has no
+anonymous `/user/:email` route and no pre-login caller.
+
+Covered by `test/e2e/user-email-lookup-leak.e2e.test.mjs`, which asserts on the
+absence of the key and never on its value.

package/dist/index.d.ts

@@ -168,6 +168,7 @@ declare function useUserRepo(): {
         pageRange: string;
     }>;
     getUserByEmail: (email: string) => Promise<TUser | null>;
+    userExistsByEmail: (email: string) => Promise<boolean>;
     getUserByReferralCode: (referralCode: string) => Promise<TUser | null>;
     getByEmailApp: (email: string, app: string) => Promise<TUser | null>;
     getUserById: (_id: string | ObjectId) => Promise<TUser & {
@@ -4367,6 +4368,38 @@ declare const schemaPlate: Joi.ObjectSchema<any>;
 declare const schemaFiles: Joi.ObjectSchema<any>;
 declare const schemaApprover: Joi.ObjectSchema<any>;
 declare const schemaPerson: Joi.ObjectSchema<any>;
+/**
+ * What a logged-OUT person may set on themselves at sign-up.
+ *
+ * `POST /api/people/resident/create` (`person.route.ts:37`) has no guard, and
+ * it cannot be given one: its only caller anywhere in the organisation is the
+ * resident app's registration wizard (`app/(auth)/createUser.tsx:449`), which
+ * by definition has no session yet. It shares the `add` handler with the
+ * guarded `POST /api/people/`, which spread the request body straight into
+ * `schemaPerson` and inserted it.
+ *
+ * `site.people` is the collection every site-reach decision on the platform
+ * reads its verdict from. So an anonymous caller could insert a row at any
+ * site, with `status: "approved"`, and `user` pointed at an account they
+ * control — manufacturing reach into another client's estate. `status` was a
+ * free string, and `_id`, `user` and `approvedBy` were all caller-supplied.
+ *
+ * The answer is not a session check, it is to stop the route accepting more
+ * than a self-service sign-up needs. This is an ALLOW-list, validated with
+ * `stripUnknown` so anything not named here is dropped rather than written —
+ * a deny-list would silently start accepting the next field added to
+ * `schemaPerson`. `status` and `platform` are not listed at all because they
+ * are pinned server-side afterwards, not taken from the caller.
+ *
+ * Every field below is one `createUser.tsx` genuinely sends. `type` uses
+ * `.valid(...)` and NOT `.allow(...)` — `.allow()` accepts any non-empty
+ * string and would restrict nothing, which is the bug the camera `type` field
+ * had.
+ */
+declare const SELF_SIGNUP_STATUS = "pending";
+declare const SELF_SIGNUP_PLATFORM = "mobile";
+declare const SELF_SIGNUP_TYPES: readonly ["resident", "tenant"];
+declare const schemaResidentSelfSignUp: Joi.ObjectSchema<any>;
 declare const schemaUpdatePerson: Joi.ObjectSchema<any>;
 declare function MPerson(value: TPerson): {
     createdAt: string | Date;
@@ -12400,4 +12433,4 @@ declare function useNotificationPreferenceController(): {
     update: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
 
-export { ANPRMode, APP_BASE_URLS, AUDIT_VALUE_MAX_LENGTH, AccessTypeProps, AppKey, AppServiceType, AssignCardConfig, BidStatus, BidType, BuildingLevelStatus, BuildingStatus, BulkCardUpdate, BulletinOrder, BulletinRecipient, BulletinSort, BulletinStatus, BulletinVideoOrder, BulletinVideoSort, CAMERA_ANPR_PERMISSIONS, CAMERA_CAPABILITIES, CAMERA_CAPABILITY_REASONS, CAMERA_MANAGE_ANY_PERMISSIONS, CAMERA_NOT_PATROL_OR_CCTV, CAMERA_NO_SUB_STREAM_TTL_SECONDS, CAMERA_PTZ_PERMISSIONS, CAMERA_REQUEST_TIMEOUT_MS, CAMERA_RTSP_TIMEOUT_MS, CAMERA_SETUP_PERMISSIONS, CAMERA_SNAPSHOT_CACHE_SECONDS, CAMERA_SNAPSHOT_MAX_BYTES, CAMERA_TEST_MIN_INTERVAL_SECONDS, CAMERA_TEST_ROUND_LIMIT, CAMERA_TEST_ROUND_SECONDS, CAMERA_TYPE_ANPR, CAMERA_TYPE_IP, CAMERA_VIEW_PERMISSIONS, CLIENT_ACTIONS, CLOCK_DRIFT_WARN_SECONDS, CONSOLE_AUDIT_LABELS, CURRENT_TIME_ENDPOINT, Camera, CameraAddressInput, CameraCapability, CameraCapabilityContext, CameraCapabilityDescriptor, CameraCapabilityEntry, CameraCapabilityReason, CameraCapabilityState, CameraCapabilityTrace, CameraDevice, CameraFrame, CameraMembership, CameraStream, CameraTestStatus, CameraTransport, CameraType, ConsoleAuditAction, ConsoleAuditTarget, DEVICE_STATUS, DOBStatus, DUPLICATE_TERMS_VERSION_MESSAGE, DayOfWeek, DeviceHttpTarget, DeviceProbeResult, DynamicFormFields, EAccessCardTypes, EAccessCardUserTypes, EmailSender, EntryOrder, EntrySort, EventOrder, EventSort, EventStatus, EventType, FacilitySort, FacilityStatus, FormEntryStatus, GuestSort, GuestStatus, HID_CARD_VALUE_FACTOR, HID_PERMISSION_CATEGORIES, HID_UINT32_MAX, HID_UINT64_MAX, HidRawUint64, IAccessCard, IAccessCardTransaction, InviteActor, MAX_CAMERA_CHANNEL, MAccessCard, MAccessCardTransaction, MAddress, MAttendance, MAttendanceSettings, MBidPreloved, MBillingConfiguration, MBillingItem, MBuilding, MBuildingLevel, MBuildingUnit, MBulletinBoard, MBulletinVideo, MCategoryPreloved, MChannelPreloved, MChat, MChatPreloved, MConsoleAudit, MCustomer, MCustomerSite, MDocumentManagement, MEMBER_TYPES, MEntryPassSettings, MEventManagement, MFeedback, MFile, MFormEntry, MGuestManagement, MHidAmicoEvent, MHidAmicoIdentity, MHidAmicoReader, MHidSipAccount, MHidSitePermissions, MIncidentReport, MManpowerDesignations, MManpowerMonitoring, MManpowerRemarks, MManpowerSites, MMember, MNfcPatrolLog, MNfcPatrolRoute, MNfcPatrolSettings, MNfcPatrolSettingsUpdate, MNfcPatrolTag, MNotification, MNotificationPreference, MOccurrenceBook, MOccurrenceEntry, MOccurrenceSubject, MOnlineForm, MOrg, MOvernightParkingApprovalHours, MOvernightParkingRequest, MPatrolEmail, MPatrolLog, MPatrolQuestion, MPatrolRoute, MPerson, MPlatformTerms, MPost, MPostFavorite, MPromoCode, MRobot, MRole, MRoleV2, MServiceProvider, MServiceProviderBilling, MSession, MSite, MSiteCamera, MSiteFacility, MSiteFacilityBooking, MStatementOfAccount, MSubcategoryPreloved, MSubscription, MSubscriptionPlan, MUnitBilling, MUser, MVehicle, MVehicleTransaction, MVerification, MVerificationV2, MVisitorTransaction, MWorkOrder, NOTIFICATION_CATEGORIES, NOTIFICATION_CHANNELS, NOTIFICATION_CHANNEL_LABELS, NOTIFICATION_NAMESPACE, NotificationAppSlug, NotificationCategory, NotificationChannel, NotificationModule, NotificationPreferenceView, NotificationService, ORG_MARKETPLACE_VENDOR_FIELD, OrgNature, OvernightParkingRequestSort, OvernightParkingRequestStatus, PATROL_CCTV_CAMERA_FILTER, PATROL_EMAIL_MAX_LOGS, PATROL_EMAIL_MAX_RECIPIENTS, PERSON_TYPES, PLATFORM_STAFF_MEMBER_TYPE, PLATFORM_STAFF_ROLE_TYPE, PROPERTY_MANAGEMENT_MEMBER_TYPES, PStatus, PTZ_ALLOWED_ACTIONS, PTZ_ALLOWED_CODES, Period, PersonStatus, PersonType, PersonTypes, PlatformTermsStatus, PostOrder, PostSort, PostStatus, QrTagProps, REALTIME_MAX_FANOUT, ResidentAppModuleKey, SERVICE_PROVIDER_INVITE_LABELS, SERVICE_PROVIDER_INVITE_TRANSITIONS, SERVICE_PROVIDER_SIGN_IN_SUBJECT, SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_SUBJECT, SERVICE_PROVIDER_SIGN_UP_TYPE, SOFTWARE_VERSION_ENDPOINT, ServiceProviderInviteAction, ServiceProviderInviteDecision, ServiceProviderInviteFacts, SiteAddress, SiteCategories, SiteStatus, SortFields, SortOrder, Status, SubjectOrder, SubjectSort, SubscriptionBillingMode, SubscriptionType, TAccessMngmntSettings, TActionStatus, TAddress, TAffectedEntities, TAffectedInjured, TAppServiceType, TApprovedBy, TApprover, TAttendance, TAttendanceCheckIn, TAttendanceCheckOut, TAttendanceCheckTime, TAttendanceLocation, TAttendanceSettings, TAttendanceSettingsGetBySite, TAuthorities, TAuthoritiesCalled, TBidPreloved, TBilling, TBillingConfiguration, TBillingItem, TBuilding, TBuildingLevel, TBuildingUnit, TBulletinBoard, TBulletinVideo, TCamera, TCameraHealthClaim, TCategoryPreloved, TChannelPreloved, TChat, TChatPreloved, TCheckPoint$1 as TCheckPoint, TComplaintInfo, TComplaintReceivedTo, TConsoleAudit, TConsoleAuditQuery, TCounter, TCreateNfcPatrolLog, TCustomer, TCustomerSite, TCustomerSitePropertyField, TDayNumber, TDaySchedule, TDefaultAccessCard, TDesignations, TDocs, TDocumentCreate, TDocumentManagement, TEntryPassSettings, TEventManagement, TFeedback, TFeedbackMetadata, TFeedbackUpdate, TFeedbackUpdateCategory, TFeedbackUpdateServiceProvider, TFeedbackUpdateStatus, TFeedbackUpdateToCompleted, TFile, TFiles, TFolderUpdate, TFormEntry, TGetAttendancesByUserQuery, TGetAttendancesQuery, TGuestManagement, THidAmicoEvent, THidAmicoGatewayJob, THidAmicoIdentity, THidAmicoPhysicalCard, THidAmicoReader, THidPermissionAssignment, THidPermissionCategory, THidPhysicalCardInput, THidPhysicalCardType$1 as THidPhysicalCardType, THidSipAccount, THidSitePermissions, TIncidentInformation, TIncidentReport, TIncidentTypeAndTime, TInvoice, TKeyRef, TManpowerDesignations, TManpowerDesignationsUpdate, TManpowerMonitoring, TManpowerMonitoringUpdate, TManpowerRemarks, TManpowerRemarksStatusUpdate, TManpowerRemarksUpdate, TManpowerSearchFilter, TManpowerSites, TMember, TMemberUpdateStatus, TMessagePreloved, TMiniRole, TNfcPatrolLog, TNfcPatrolRoute, TNfcPatrolRouteEdit, TNfcPatrolSettings, TNfcPatrolSettingsGetBySite, TNfcPatrolSettingsUpdate, TNfcPatrolTag, TNfcPatrolTagConfigureReset, TNfcPatrolTagEdit, TNfcPatrolTagUpdateData, TNotification, TNotificationPreference, TNotificationPreferenceOff, TOccurrenceBook, TOccurrenceEntry, TOccurrenceSubject, TOnlineForm, TOrg, TOvernightParkingApprovalHours, TOvernightParkingRequest, TPatrolEmail, TPatrolEmailCreatedBy, TPatrolEmailLogRef, TPatrolLog, TPatrolQuestion, TPatrolRoute, TPerson, TPlaceOfIncident, TPlates, TPlatformTerms, TPost, TPostFavorite, TPrice, TPriceType, TPromoCode, TPromoCurrencyInput, TPromoTier, TRANSPORT_DEVICE_HTTP, TRANSPORT_RELAY_PLAYER, TRANSPORT_RTSP_FRAME, TRecipientOfComplaint, TRemarks, TResident, TResidentAppModules, TRobot, TRobotMetadata, TRole, TRoleV2, TRoute, TSOABillingItem, TSOAStatus, TServiceProvider, TServiceProviderBilling, TSession, TSessionCreate, TShifts, TSignNfcPatrolLog, TSite, TSiteCamera, TSiteFacility, TSiteFacilityBooking, TSiteInfo, TSiteInformation, TSiteMetadata, TSiteUpdateBlock, TStatementOfAccount, TSubcategoryPreloved, TSubmissionForm, TSubscription, TSubscriptionPlan, TSubscriptionPlanApplication, TUnitBilling, TUnits, TUpdateFormEntry, TUpdateName, TUser, TUserCreate, TVehicle, TVehicleTransaction, TVehicleUpdate, TVerification, TVerificationEvent, TVerificationMetadata, TVerificationMetadataV2, TVerificationV2, TVisitorTransaction, TWorkOrder, TWorkOrderMetadata, TWorkOrderUpdate, TWorkOrderUpdateStatus, TWorkOrderUpdateToCompleted, TanyoneDamageToProperty, UseAccessManagementRepo, UserStatus, VERIFICATION_OPEN_STATUSES, VehicleCategory, VehicleOrder, VehicleSort, VehicleStatus, VehicleType, VerificationLinkType, VerificationStatus, VerificationSubjectType, VerificationType, VisitorSort, VisitorStatus, addressSchema, allowedFieldsSite, allowedNatures, allowedPlanApplications, attendanceSchema, attendanceSettingsSchema, building_level_namespace_collection, building_units_namespace_collection, buildings_namespace_collection, bulletin_boards_namespace_collection, cameraBaseUrl, cameraCapabilitiesFor, cameraDevices, cameraGrant, cameraHealthClaim, cameraHealthSummary, cameraManagePermissions, cameraProbeCacheKey, cameraTransports, canRevokeRefreshTokenFamily, categoriesForPermissions, categorySupportsChannel, chatPrelovedEvents, chatSchema, clampPtzSpeed, clockDriftSeconds, console_audit_namespace_collection, createManpowerRemarksDaily, customerSchema, customerSitePropertyFields, decideServiceProviderInvite, decodeHidPacsCard, deriveCameraHost, describeCameraCapabilities, designationsSchema, deviceControlEnabled, deviceHttpEnabled, deviceHttpTargets, deviceHttpTimeoutMs, deviceProbeTtlSeconds, emitNotificationCreated, encodeHidPacsCard, events_namespace_collection, facility_bookings_namespace_collection, feedbackSchema, feedbacks2_namespace_collection, feedbacks_namespace_collection, ffmpegFrameArgs, ffmpegPath, formatCapabilityTrace, formatDahuaDate, getIO, getSessionIdFromRequest, grabWithSubStreamFallback, guests_namespace_collection, hasAnyCapability, hasAnyPermission, hidRawUint64, incidentReport, incidentReportLog, incidents_namespace_collection, isCameraEntitled, isDuplicateVersionError, isPatrolCctvCamera, isPlatformOwner, isPromoCodeExpired, isRelayPlayerUrl, isSafeRelativePath, isSuperAdmin, isTermsCurrent, logCamera, manpowerDesignationsSchema, manpowerEvents, manpowerMonitoringSchema, manpowerRemarksSchema, manpowerSitesSchema, mapWithLimit, nfcPatrolSettingsSchema, nfcPatrolSettingsSchemaUpdate, normalizeAcceptedTerms, normalizeHidCardValue, notificationCategory, notificationCategoryLabel, notificationEvents, notificationRoom, occurrence_book_namespace_collection, online_forms_namespace_collection, orgSchema, overnight_parking_requests_namespace_collection, parseCameraChannel, parseCameraHost, parseDahuaFind, parseDeviceTime, parseHidJsonLossless, parsePromoExpiry, parseSoftwareVersion, pickAuditFields, pickCustomerSiteProperties, platform_terms_namespace_collection, promoCodeRefusal, promoCodeSchema, promoCodeStatusSchema, promoCodeUpdate, promoCodeUpdateSchema, ptzEndpoint, publicCameraFields, recordConsoleAction, refuseServiceProviderInviteAction, registerCameraTransport, relayForRecorder, remarksSchema, renderPagePdf, resetCameraTransports, residentAppModuleKeys, residentFormEntry, resolutionRefusalReason, resolveCamera, resolveDeviceHttp, resolveHidPhysicalCardValue, resolveInviteActor, robotSchema, rtspUrl, schema, schemaAppSlugNotification, schemaApprovedBy, schemaApprover, schemaBidPreloved, schemaBilling, schemaBillingConfiguration, schemaBillingItem, schemaBuilding, schemaBuildingLevel, schemaBuildingUnit, schemaBuildingUpdateOptions, schemaBulletinBoard, schemaBulletinVideo, schemaCategoryPreloved, schemaChannelPreloved, schemaChatPreloved, schemaConsoleAudit, schemaCreateHidAmicoIdentity, schemaCreateNfcPatrolLog, schemaCreateNotification, schemaCustomerSite, schemaDiscoverHidAmicoReader, schemaDocumentManagement, schemaEntryPassSettings, schemaEventManagement, schemaFiles, schemaFormEntry, schemaGuestManagement, schemaHidAmicoAccessLogQuery, schemaHidAmicoAssignUserCard, schemaHidAmicoConfiguration, schemaHidAmicoEnrollUserCard, schemaHidAmicoEvent, schemaHidAmicoExecuteActions, schemaHidAmicoIdentity, schemaHidAmicoIdentityIdParams, schemaHidAmicoIdentityQuery, schemaHidAmicoIntercomCall, schemaHidAmicoLogQuery, schemaHidAmicoMonitor, schemaHidAmicoNotificationParams, schemaHidAmicoObjectOperation, schemaHidAmicoOperatingMode, schemaHidAmicoReader, schemaHidAmicoReaderIdParams, schemaHidAmicoReaderListQuery, schemaHidAmicoReaderUserQuery, schemaHidAmicoSetConfiguration, schemaHidAmicoSiteIdParams, schemaHidAmicoSync, schemaHidAmicoUserCardIdParams, schemaHidAmicoUserCardParams, schemaHidAmicoUserImageParams, schemaHidAmicoUserImageUploadQuery, schemaHidAmicoUserPin, schemaHidAmicoUserPinParams, schemaHidAmicoVisitorImageParams, schemaHidAmicoVisitorImageUploadQuery, schemaHidAmicoVisitorQr, schemaHidPermissionCandidateQuery, schemaHidPermissionScopeQuery, schemaHidSipAccountRequest, schemaIncidentReport, schemaListNotification, schemaMultipleDocumentManagement, schemaNfcPatrolLog, schemaNfcPatrolRoute, schemaNfcPatrolTag, schemaNfcPatrolTagUpdateData, schemaNotification, schemaNotificationPreference, schemaNotificationPreferenceOff, schemaOccurrenceBook, schemaOccurrenceEntry, schemaOccurrenceSubject, schemaOnlineForm, schemaOvernightParkingApprovalHours, schemaOvernightParkingRequest, schemaPatrolEmail, schemaPatrolEmailCreatedBy, schemaPatrolEmailLogRef, schemaPatrolLog, schemaPatrolQuestion, schemaPatrolRoute, schemaPerson, schemaPlate, schemaPlatformTerms, schemaPost, schemaPostFavorite, schemaSendPatrolEmail, schemaServiceProvider, schemaServiceProviderBilling, schemaSignNfcPatrolLog, schemaSiteCamera, schemaSiteFacility, schemaSiteFacilityBooking, schemaStatementOfAccount, schemaSubcategoryPreloved, schemaUnitBilling, schemaUpdateBidPreloved, schemaUpdateBuildingLevel, schemaUpdateBulletinBoard, schemaUpdateBulletinVideo, schemaUpdateCategoryPreloved, schemaUpdateChatPreloved, schemaUpdateDocumentManagement, schemaUpdateEntryPassSettings, schemaUpdateEventManagement, schemaUpdateFolderManagement, schemaUpdateFormEntry, schemaUpdateGuestManagement, schemaUpdateHidAmicoIdentity, schemaUpdateHidAmicoReader, schemaUpdateHidSitePermissions, schemaUpdateIncidentReport, schemaUpdateNotification, schemaUpdateNotificationPreference, schemaUpdateOccurrenceBook, schemaUpdateOccurrenceEntry, schemaUpdateOccurrenceSubject, schemaUpdateOnlineForm, schemaUpdateOptions, schemaUpdateOvernightParkingRequest, schemaUpdatePatrolLog, schemaUpdatePatrolQuestion, schemaUpdatePatrolRoute, schemaUpdatePerson, schemaUpdatePost, schemaUpdatePostFavorite, schemaUpdateServiceProviderBilling, schemaUpdateSiteBillingConfiguration, schemaUpdateSiteBillingItem, schemaUpdateSiteCamera, schemaUpdateSiteFacility, schemaUpdateSiteFacilityBooking, schemaUpdateSiteUnitBilling, schemaUpdateStatementOfAccount, schemaUpdateSubcategoryPreloved, schemaUpdateVisTrans, schemaVehicleTransaction, schemaVisitorTransaction, schemeCamera, schemeLogCamera, serviceProviderInviteLabel, sessionSchema, setIO, shiftSchema, siteSchema, site_people_namespace_collection, snapshotEndpoint, snapshotRefusalReason, stringifyHidJson, subscriptionPlanSchema, updateRemarksStatusEod, updateRemarksisAcknowledged, updateSiteSchema, useAccessManagementController, useAddressRepo, useAttendanceController, useAttendanceRepository, useAttendanceSettingsController, useAttendanceSettingsRepository, useAttendanceSettingsService, useAuthController, useAuthControllerV2, useAuthService, useAuthServiceV2, useBidPrelovedController, useBidPrelovedRepo, useBidPrelovedService, useBuildingController, useBuildingLevelController, useBuildingLevelRepo, useBuildingLevelService, useBuildingRepo, useBuildingService, useBuildingUnitController, useBuildingUnitRepo, useBuildingUnitService, useBulletinBoardController, useBulletinBoardRepo, useBulletinBoardService, useBulletinVideoController, useBulletinVideoRepo, useBulletinVideoService, useCameraViewController, useCameraViewService, useCategoryPrelovedController, useCategoryPrelovedRepo, useChannelPrelovedController, useChannelPrelovedRepo, useChatController, useChatPrelovedController, useChatPrelovedRepo, useChatPrelovedService, useChatRepo, useConsoleAuditController, useConsoleAuditRepo, useCounterModel, useCounterRepo, useCustomerController, useCustomerRepo, useCustomerSiteController, useCustomerSiteRepo, useCustomerSiteService, useDahuaService, useDashboardController, useDashboardRepo, useDocumentManagementController, useDocumentManagementRepo, useDocumentManagementService, useEntryPassSettingsController, useEntryPassSettingsRepo, useEventManagementController, useEventManagementRepo, useEventManagementService, useFeedbackController, useFeedbackRepo, useFeedbackService, useFileController, useFileRepo, useFileService, useFormEntryController, useFormEntryRepo, useGuestManagementController, useGuestManagementRepo, useGuestManagementService, useHidAmicoController, useHidAmicoRepo, useHidAmicoService, useHrmLabsAttendanceCtrl, useHrmLabsAttendanceSrvc, useIncidentReportController, useIncidentReportRepo, useIncidentReportService, useInvoiceController, useInvoiceModel, useInvoiceRepo, useManpowerDesignationCtrl, useManpowerDesignationRepo, useManpowerMonitoringCtrl, useManpowerMonitoringRepo, useManpowerMonitoringSrvc, useManpowerRemarkCtrl, useManpowerRemarksRepo, useManpowerSitesCtrl, useManpowerSitesRepo, useManpowerSitesSrvc, useMemberController, useMemberRepo, useMemberService, useNewDashboardController, useNewDashboardRepo, useNfcPatrolLogController, useNfcPatrolLogRepo, useNfcPatrolLogService, useNfcPatrolRouteController, useNfcPatrolRouteRepo, useNfcPatrolRouteService, useNfcPatrolSettingsController, useNfcPatrolSettingsRepository, useNfcPatrolSettingsService, useNfcPatrolTagController, useNfcPatrolTagRepo, useNfcPatrolTagService, useNotificationController, useNotificationPreferenceController, useNotificationPreferenceRepo, useNotificationPreferenceService, useNotificationRepo, useOccurrenceBookController, useOccurrenceBookRepo, useOccurrenceBookService, useOccurrenceEntryController, useOccurrenceEntryRepo, useOccurrenceEntryService, useOccurrenceSubjectController, useOccurrenceSubjectRepo, useOccurrenceSubjectService, useOnlineFormController, useOnlineFormRepo, useOrgController, useOrgControllerV2, useOrgRepo, useOvernightParkingController, useOvernightParkingRepo, useOvernightParkingRequestController, useOvernightParkingRequestRepo, useOvernightParkingRequestService, usePatrolEmailController, usePatrolEmailRepo, usePatrolEmailService, usePatrolLogController, usePatrolLogRepo, usePatrolLogService, usePatrolQuestionController, usePatrolQuestionRepo, usePatrolRouteController, usePatrolRouteRepo, usePersonController, usePersonRepo, usePlatformTermsController, usePlatformTermsRepo, usePlatformTermsService, usePostFavoriteController, usePostFavoriteRepo, usePostFavoriteService, usePostPrelovedController, usePostPrelovedRepo, usePriceController, usePriceModel, usePriceRepo, usePromoCodeController, usePromoCodeRepo, useRedDotPaymentController, useRedDotPaymentRepo, useRedDotPaymentSvc, useRobotController, useRobotRepo, useRobotService, useRoleController, useRoleControllerV2, useRoleRepo, useRoleRepoV2, useRoleServiceV2, useServiceProviderBillingController, useServiceProviderBillingRepo, useServiceProviderBillingService, useServiceProviderController, useServiceProviderInviteController, useServiceProviderInviteService, useServiceProviderRepo, useSessionRepo, useSiteBillingConfigurationController, useSiteBillingConfigurationRepo, useSiteBillingItemController, useSiteBillingItemRepo, useSiteCameraController, useSiteCameraRepo, useSiteCameraService, useSiteController, useSiteFacilityBookingController, useSiteFacilityBookingRepo, useSiteFacilityBookingService, useSiteFacilityController, useSiteFacilityRepo, useSiteFacilityService, useSiteRepo, useSiteService, useSiteUnitBillingController, useSiteUnitBillingRepo, useSiteUnitBillingService, useStatementOfAccountController, useStatementOfAccountRepo, useSubcategoryPrelovedController, useSubcategoryPrelovedRepo, useSubscriptionController, useSubscriptionPlanController, useSubscriptionPlanRepo, useSubscriptionRepo, useSubscriptionService, useUserController, useUserControllerV2, useUserRepo, useUserRepoV2, useUserService, useUserServiceV2, useVehicleController, useVehicleRepo, useVehicleService, useVerificationController, useVerificationControllerV2, useVerificationRepo, useVerificationRepoV2, useVerificationService, useVerificationServiceV2, useVisitorTransactionController, useVisitorTransactionRepo, useVisitorTransactionService, useWorkOrderController, useWorkOrderRepo, useWorkOrderService, userSchema, vehicleSchema, vehicles_namespace_collection, visitorPersonRepo, visitorPersonService, visitorType, visitors_namespace_collection, wallConfig, workOrderSchema, work_orders2_namespace_collection, work_orders_namespace_collection };
+export { ANPRMode, APP_BASE_URLS, AUDIT_VALUE_MAX_LENGTH, AccessTypeProps, AppKey, AppServiceType, AssignCardConfig, BidStatus, BidType, BuildingLevelStatus, BuildingStatus, BulkCardUpdate, BulletinOrder, BulletinRecipient, BulletinSort, BulletinStatus, BulletinVideoOrder, BulletinVideoSort, CAMERA_ANPR_PERMISSIONS, CAMERA_CAPABILITIES, CAMERA_CAPABILITY_REASONS, CAMERA_MANAGE_ANY_PERMISSIONS, CAMERA_NOT_PATROL_OR_CCTV, CAMERA_NO_SUB_STREAM_TTL_SECONDS, CAMERA_PTZ_PERMISSIONS, CAMERA_REQUEST_TIMEOUT_MS, CAMERA_RTSP_TIMEOUT_MS, CAMERA_SETUP_PERMISSIONS, CAMERA_SNAPSHOT_CACHE_SECONDS, CAMERA_SNAPSHOT_MAX_BYTES, CAMERA_TEST_MIN_INTERVAL_SECONDS, CAMERA_TEST_ROUND_LIMIT, CAMERA_TEST_ROUND_SECONDS, CAMERA_TYPE_ANPR, CAMERA_TYPE_IP, CAMERA_VIEW_PERMISSIONS, CLIENT_ACTIONS, CLOCK_DRIFT_WARN_SECONDS, CONSOLE_AUDIT_LABELS, CURRENT_TIME_ENDPOINT, Camera, CameraAddressInput, CameraCapability, CameraCapabilityContext, CameraCapabilityDescriptor, CameraCapabilityEntry, CameraCapabilityReason, CameraCapabilityState, CameraCapabilityTrace, CameraDevice, CameraFrame, CameraMembership, CameraStream, CameraTestStatus, CameraTransport, CameraType, ConsoleAuditAction, ConsoleAuditTarget, DEVICE_STATUS, DOBStatus, DUPLICATE_TERMS_VERSION_MESSAGE, DayOfWeek, DeviceHttpTarget, DeviceProbeResult, DynamicFormFields, EAccessCardTypes, EAccessCardUserTypes, EmailSender, EntryOrder, EntrySort, EventOrder, EventSort, EventStatus, EventType, FacilitySort, FacilityStatus, FormEntryStatus, GuestSort, GuestStatus, HID_CARD_VALUE_FACTOR, HID_PERMISSION_CATEGORIES, HID_UINT32_MAX, HID_UINT64_MAX, HidRawUint64, IAccessCard, IAccessCardTransaction, InviteActor, MAX_CAMERA_CHANNEL, MAccessCard, MAccessCardTransaction, MAddress, MAttendance, MAttendanceSettings, MBidPreloved, MBillingConfiguration, MBillingItem, MBuilding, MBuildingLevel, MBuildingUnit, MBulletinBoard, MBulletinVideo, MCategoryPreloved, MChannelPreloved, MChat, MChatPreloved, MConsoleAudit, MCustomer, MCustomerSite, MDocumentManagement, MEMBER_TYPES, MEntryPassSettings, MEventManagement, MFeedback, MFile, MFormEntry, MGuestManagement, MHidAmicoEvent, MHidAmicoIdentity, MHidAmicoReader, MHidSipAccount, MHidSitePermissions, MIncidentReport, MManpowerDesignations, MManpowerMonitoring, MManpowerRemarks, MManpowerSites, MMember, MNfcPatrolLog, MNfcPatrolRoute, MNfcPatrolSettings, MNfcPatrolSettingsUpdate, MNfcPatrolTag, MNotification, MNotificationPreference, MOccurrenceBook, MOccurrenceEntry, MOccurrenceSubject, MOnlineForm, MOrg, MOvernightParkingApprovalHours, MOvernightParkingRequest, MPatrolEmail, MPatrolLog, MPatrolQuestion, MPatrolRoute, MPerson, MPlatformTerms, MPost, MPostFavorite, MPromoCode, MRobot, MRole, MRoleV2, MServiceProvider, MServiceProviderBilling, MSession, MSite, MSiteCamera, MSiteFacility, MSiteFacilityBooking, MStatementOfAccount, MSubcategoryPreloved, MSubscription, MSubscriptionPlan, MUnitBilling, MUser, MVehicle, MVehicleTransaction, MVerification, MVerificationV2, MVisitorTransaction, MWorkOrder, NOTIFICATION_CATEGORIES, NOTIFICATION_CHANNELS, NOTIFICATION_CHANNEL_LABELS, NOTIFICATION_NAMESPACE, NotificationAppSlug, NotificationCategory, NotificationChannel, NotificationModule, NotificationPreferenceView, NotificationService, ORG_MARKETPLACE_VENDOR_FIELD, OrgNature, OvernightParkingRequestSort, OvernightParkingRequestStatus, PATROL_CCTV_CAMERA_FILTER, PATROL_EMAIL_MAX_LOGS, PATROL_EMAIL_MAX_RECIPIENTS, PERSON_TYPES, PLATFORM_STAFF_MEMBER_TYPE, PLATFORM_STAFF_ROLE_TYPE, PROPERTY_MANAGEMENT_MEMBER_TYPES, PStatus, PTZ_ALLOWED_ACTIONS, PTZ_ALLOWED_CODES, Period, PersonStatus, PersonType, PersonTypes, PlatformTermsStatus, PostOrder, PostSort, PostStatus, QrTagProps, REALTIME_MAX_FANOUT, ResidentAppModuleKey, SELF_SIGNUP_PLATFORM, SELF_SIGNUP_STATUS, SELF_SIGNUP_TYPES, SERVICE_PROVIDER_INVITE_LABELS, SERVICE_PROVIDER_INVITE_TRANSITIONS, SERVICE_PROVIDER_SIGN_IN_SUBJECT, SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_SUBJECT, SERVICE_PROVIDER_SIGN_UP_TYPE, SOFTWARE_VERSION_ENDPOINT, ServiceProviderInviteAction, ServiceProviderInviteDecision, ServiceProviderInviteFacts, SiteAddress, SiteCategories, SiteStatus, SortFields, SortOrder, Status, SubjectOrder, SubjectSort, SubscriptionBillingMode, SubscriptionType, TAccessMngmntSettings, TActionStatus, TAddress, TAffectedEntities, TAffectedInjured, TAppServiceType, TApprovedBy, TApprover, TAttendance, TAttendanceCheckIn, TAttendanceCheckOut, TAttendanceCheckTime, TAttendanceLocation, TAttendanceSettings, TAttendanceSettingsGetBySite, TAuthorities, TAuthoritiesCalled, TBidPreloved, TBilling, TBillingConfiguration, TBillingItem, TBuilding, TBuildingLevel, TBuildingUnit, TBulletinBoard, TBulletinVideo, TCamera, TCameraHealthClaim, TCategoryPreloved, TChannelPreloved, TChat, TChatPreloved, TCheckPoint$1 as TCheckPoint, TComplaintInfo, TComplaintReceivedTo, TConsoleAudit, TConsoleAuditQuery, TCounter, TCreateNfcPatrolLog, TCustomer, TCustomerSite, TCustomerSitePropertyField, TDayNumber, TDaySchedule, TDefaultAccessCard, TDesignations, TDocs, TDocumentCreate, TDocumentManagement, TEntryPassSettings, TEventManagement, TFeedback, TFeedbackMetadata, TFeedbackUpdate, TFeedbackUpdateCategory, TFeedbackUpdateServiceProvider, TFeedbackUpdateStatus, TFeedbackUpdateToCompleted, TFile, TFiles, TFolderUpdate, TFormEntry, TGetAttendancesByUserQuery, TGetAttendancesQuery, TGuestManagement, THidAmicoEvent, THidAmicoGatewayJob, THidAmicoIdentity, THidAmicoPhysicalCard, THidAmicoReader, THidPermissionAssignment, THidPermissionCategory, THidPhysicalCardInput, THidPhysicalCardType$1 as THidPhysicalCardType, THidSipAccount, THidSitePermissions, TIncidentInformation, TIncidentReport, TIncidentTypeAndTime, TInvoice, TKeyRef, TManpowerDesignations, TManpowerDesignationsUpdate, TManpowerMonitoring, TManpowerMonitoringUpdate, TManpowerRemarks, TManpowerRemarksStatusUpdate, TManpowerRemarksUpdate, TManpowerSearchFilter, TManpowerSites, TMember, TMemberUpdateStatus, TMessagePreloved, TMiniRole, TNfcPatrolLog, TNfcPatrolRoute, TNfcPatrolRouteEdit, TNfcPatrolSettings, TNfcPatrolSettingsGetBySite, TNfcPatrolSettingsUpdate, TNfcPatrolTag, TNfcPatrolTagConfigureReset, TNfcPatrolTagEdit, TNfcPatrolTagUpdateData, TNotification, TNotificationPreference, TNotificationPreferenceOff, TOccurrenceBook, TOccurrenceEntry, TOccurrenceSubject, TOnlineForm, TOrg, TOvernightParkingApprovalHours, TOvernightParkingRequest, TPatrolEmail, TPatrolEmailCreatedBy, TPatrolEmailLogRef, TPatrolLog, TPatrolQuestion, TPatrolRoute, TPerson, TPlaceOfIncident, TPlates, TPlatformTerms, TPost, TPostFavorite, TPrice, TPriceType, TPromoCode, TPromoCurrencyInput, TPromoTier, TRANSPORT_DEVICE_HTTP, TRANSPORT_RELAY_PLAYER, TRANSPORT_RTSP_FRAME, TRecipientOfComplaint, TRemarks, TResident, TResidentAppModules, TRobot, TRobotMetadata, TRole, TRoleV2, TRoute, TSOABillingItem, TSOAStatus, TServiceProvider, TServiceProviderBilling, TSession, TSessionCreate, TShifts, TSignNfcPatrolLog, TSite, TSiteCamera, TSiteFacility, TSiteFacilityBooking, TSiteInfo, TSiteInformation, TSiteMetadata, TSiteUpdateBlock, TStatementOfAccount, TSubcategoryPreloved, TSubmissionForm, TSubscription, TSubscriptionPlan, TSubscriptionPlanApplication, TUnitBilling, TUnits, TUpdateFormEntry, TUpdateName, TUser, TUserCreate, TVehicle, TVehicleTransaction, TVehicleUpdate, TVerification, TVerificationEvent, TVerificationMetadata, TVerificationMetadataV2, TVerificationV2, TVisitorTransaction, TWorkOrder, TWorkOrderMetadata, TWorkOrderUpdate, TWorkOrderUpdateStatus, TWorkOrderUpdateToCompleted, TanyoneDamageToProperty, UseAccessManagementRepo, UserStatus, VERIFICATION_OPEN_STATUSES, VehicleCategory, VehicleOrder, VehicleSort, VehicleStatus, VehicleType, VerificationLinkType, VerificationStatus, VerificationSubjectType, VerificationType, VisitorSort, VisitorStatus, addressSchema, allowedFieldsSite, allowedNatures, allowedPlanApplications, attendanceSchema, attendanceSettingsSchema, building_level_namespace_collection, building_units_namespace_collection, buildings_namespace_collection, bulletin_boards_namespace_collection, cameraBaseUrl, cameraCapabilitiesFor, cameraDevices, cameraGrant, cameraHealthClaim, cameraHealthSummary, cameraManagePermissions, cameraProbeCacheKey, cameraTransports, canRevokeRefreshTokenFamily, categoriesForPermissions, categorySupportsChannel, chatPrelovedEvents, chatSchema, clampPtzSpeed, clockDriftSeconds, console_audit_namespace_collection, createManpowerRemarksDaily, customerSchema, customerSitePropertyFields, decideServiceProviderInvite, decodeHidPacsCard, deriveCameraHost, describeCameraCapabilities, designationsSchema, deviceControlEnabled, deviceHttpEnabled, deviceHttpTargets, deviceHttpTimeoutMs, deviceProbeTtlSeconds, emitNotificationCreated, encodeHidPacsCard, events_namespace_collection, facility_bookings_namespace_collection, feedbackSchema, feedbacks2_namespace_collection, feedbacks_namespace_collection, ffmpegFrameArgs, ffmpegPath, formatCapabilityTrace, formatDahuaDate, getIO, getSessionIdFromRequest, grabWithSubStreamFallback, guests_namespace_collection, hasAnyCapability, hasAnyPermission, hidRawUint64, incidentReport, incidentReportLog, incidents_namespace_collection, isCameraEntitled, isDuplicateVersionError, isPatrolCctvCamera, isPlatformOwner, isPromoCodeExpired, isRelayPlayerUrl, isSafeRelativePath, isSuperAdmin, isTermsCurrent, logCamera, manpowerDesignationsSchema, manpowerEvents, manpowerMonitoringSchema, manpowerRemarksSchema, manpowerSitesSchema, mapWithLimit, nfcPatrolSettingsSchema, nfcPatrolSettingsSchemaUpdate, normalizeAcceptedTerms, normalizeHidCardValue, notificationCategory, notificationCategoryLabel, notificationEvents, notificationRoom, occurrence_book_namespace_collection, online_forms_namespace_collection, orgSchema, overnight_parking_requests_namespace_collection, parseCameraChannel, parseCameraHost, parseDahuaFind, parseDeviceTime, parseHidJsonLossless, parsePromoExpiry, parseSoftwareVersion, pickAuditFields, pickCustomerSiteProperties, platform_terms_namespace_collection, promoCodeRefusal, promoCodeSchema, promoCodeStatusSchema, promoCodeUpdate, promoCodeUpdateSchema, ptzEndpoint, publicCameraFields, recordConsoleAction, refuseServiceProviderInviteAction, registerCameraTransport, relayForRecorder, remarksSchema, renderPagePdf, resetCameraTransports, residentAppModuleKeys, residentFormEntry, resolutionRefusalReason, resolveCamera, resolveDeviceHttp, resolveHidPhysicalCardValue, resolveInviteActor, robotSchema, rtspUrl, schema, schemaAppSlugNotification, schemaApprovedBy, schemaApprover, schemaBidPreloved, schemaBilling, schemaBillingConfiguration, schemaBillingItem, schemaBuilding, schemaBuildingLevel, schemaBuildingUnit, schemaBuildingUpdateOptions, schemaBulletinBoard, schemaBulletinVideo, schemaCategoryPreloved, schemaChannelPreloved, schemaChatPreloved, schemaConsoleAudit, schemaCreateHidAmicoIdentity, schemaCreateNfcPatrolLog, schemaCreateNotification, schemaCustomerSite, schemaDiscoverHidAmicoReader, schemaDocumentManagement, schemaEntryPassSettings, schemaEventManagement, schemaFiles, schemaFormEntry, schemaGuestManagement, schemaHidAmicoAccessLogQuery, schemaHidAmicoAssignUserCard, schemaHidAmicoConfiguration, schemaHidAmicoEnrollUserCard, schemaHidAmicoEvent, schemaHidAmicoExecuteActions, schemaHidAmicoIdentity, schemaHidAmicoIdentityIdParams, schemaHidAmicoIdentityQuery, schemaHidAmicoIntercomCall, schemaHidAmicoLogQuery, schemaHidAmicoMonitor, schemaHidAmicoNotificationParams, schemaHidAmicoObjectOperation, schemaHidAmicoOperatingMode, schemaHidAmicoReader, schemaHidAmicoReaderIdParams, schemaHidAmicoReaderListQuery, schemaHidAmicoReaderUserQuery, schemaHidAmicoSetConfiguration, schemaHidAmicoSiteIdParams, schemaHidAmicoSync, schemaHidAmicoUserCardIdParams, schemaHidAmicoUserCardParams, schemaHidAmicoUserImageParams, schemaHidAmicoUserImageUploadQuery, schemaHidAmicoUserPin, schemaHidAmicoUserPinParams, schemaHidAmicoVisitorImageParams, schemaHidAmicoVisitorImageUploadQuery, schemaHidAmicoVisitorQr, schemaHidPermissionCandidateQuery, schemaHidPermissionScopeQuery, schemaHidSipAccountRequest, schemaIncidentReport, schemaListNotification, schemaMultipleDocumentManagement, schemaNfcPatrolLog, schemaNfcPatrolRoute, schemaNfcPatrolTag, schemaNfcPatrolTagUpdateData, schemaNotification, schemaNotificationPreference, schemaNotificationPreferenceOff, schemaOccurrenceBook, schemaOccurrenceEntry, schemaOccurrenceSubject, schemaOnlineForm, schemaOvernightParkingApprovalHours, schemaOvernightParkingRequest, schemaPatrolEmail, schemaPatrolEmailCreatedBy, schemaPatrolEmailLogRef, schemaPatrolLog, schemaPatrolQuestion, schemaPatrolRoute, schemaPerson, schemaPlate, schemaPlatformTerms, schemaPost, schemaPostFavorite, schemaResidentSelfSignUp, schemaSendPatrolEmail, schemaServiceProvider, schemaServiceProviderBilling, schemaSignNfcPatrolLog, schemaSiteCamera, schemaSiteFacility, schemaSiteFacilityBooking, schemaStatementOfAccount, schemaSubcategoryPreloved, schemaUnitBilling, schemaUpdateBidPreloved, schemaUpdateBuildingLevel, schemaUpdateBulletinBoard, schemaUpdateBulletinVideo, schemaUpdateCategoryPreloved, schemaUpdateChatPreloved, schemaUpdateDocumentManagement, schemaUpdateEntryPassSettings, schemaUpdateEventManagement, schemaUpdateFolderManagement, schemaUpdateFormEntry, schemaUpdateGuestManagement, schemaUpdateHidAmicoIdentity, schemaUpdateHidAmicoReader, schemaUpdateHidSitePermissions, schemaUpdateIncidentReport, schemaUpdateNotification, schemaUpdateNotificationPreference, schemaUpdateOccurrenceBook, schemaUpdateOccurrenceEntry, schemaUpdateOccurrenceSubject, schemaUpdateOnlineForm, schemaUpdateOptions, schemaUpdateOvernightParkingRequest, schemaUpdatePatrolLog, schemaUpdatePatrolQuestion, schemaUpdatePatrolRoute, schemaUpdatePerson, schemaUpdatePost, schemaUpdatePostFavorite, schemaUpdateServiceProviderBilling, schemaUpdateSiteBillingConfiguration, schemaUpdateSiteBillingItem, schemaUpdateSiteCamera, schemaUpdateSiteFacility, schemaUpdateSiteFacilityBooking, schemaUpdateSiteUnitBilling, schemaUpdateStatementOfAccount, schemaUpdateSubcategoryPreloved, schemaUpdateVisTrans, schemaVehicleTransaction, schemaVisitorTransaction, schemeCamera, schemeLogCamera, serviceProviderInviteLabel, sessionSchema, setIO, shiftSchema, siteSchema, site_people_namespace_collection, snapshotEndpoint, snapshotRefusalReason, stringifyHidJson, subscriptionPlanSchema, updateRemarksStatusEod, updateRemarksisAcknowledged, updateSiteSchema, useAccessManagementController, useAddressRepo, useAttendanceController, useAttendanceRepository, useAttendanceSettingsController, useAttendanceSettingsRepository, useAttendanceSettingsService, useAuthController, useAuthControllerV2, useAuthService, useAuthServiceV2, useBidPrelovedController, useBidPrelovedRepo, useBidPrelovedService, useBuildingController, useBuildingLevelController, useBuildingLevelRepo, useBuildingLevelService, useBuildingRepo, useBuildingService, useBuildingUnitController, useBuildingUnitRepo, useBuildingUnitService, useBulletinBoardController, useBulletinBoardRepo, useBulletinBoardService, useBulletinVideoController, useBulletinVideoRepo, useBulletinVideoService, useCameraViewController, useCameraViewService, useCategoryPrelovedController, useCategoryPrelovedRepo, useChannelPrelovedController, useChannelPrelovedRepo, useChatController, useChatPrelovedController, useChatPrelovedRepo, useChatPrelovedService, useChatRepo, useConsoleAuditController, useConsoleAuditRepo, useCounterModel, useCounterRepo, useCustomerController, useCustomerRepo, useCustomerSiteController, useCustomerSiteRepo, useCustomerSiteService, useDahuaService, useDashboardController, useDashboardRepo, useDocumentManagementController, useDocumentManagementRepo, useDocumentManagementService, useEntryPassSettingsController, useEntryPassSettingsRepo, useEventManagementController, useEventManagementRepo, useEventManagementService, useFeedbackController, useFeedbackRepo, useFeedbackService, useFileController, useFileRepo, useFileService, useFormEntryController, useFormEntryRepo, useGuestManagementController, useGuestManagementRepo, useGuestManagementService, useHidAmicoController, useHidAmicoRepo, useHidAmicoService, useHrmLabsAttendanceCtrl, useHrmLabsAttendanceSrvc, useIncidentReportController, useIncidentReportRepo, useIncidentReportService, useInvoiceController, useInvoiceModel, useInvoiceRepo, useManpowerDesignationCtrl, useManpowerDesignationRepo, useManpowerMonitoringCtrl, useManpowerMonitoringRepo, useManpowerMonitoringSrvc, useManpowerRemarkCtrl, useManpowerRemarksRepo, useManpowerSitesCtrl, useManpowerSitesRepo, useManpowerSitesSrvc, useMemberController, useMemberRepo, useMemberService, useNewDashboardController, useNewDashboardRepo, useNfcPatrolLogController, useNfcPatrolLogRepo, useNfcPatrolLogService, useNfcPatrolRouteController, useNfcPatrolRouteRepo, useNfcPatrolRouteService, useNfcPatrolSettingsController, useNfcPatrolSettingsRepository, useNfcPatrolSettingsService, useNfcPatrolTagController, useNfcPatrolTagRepo, useNfcPatrolTagService, useNotificationController, useNotificationPreferenceController, useNotificationPreferenceRepo, useNotificationPreferenceService, useNotificationRepo, useOccurrenceBookController, useOccurrenceBookRepo, useOccurrenceBookService, useOccurrenceEntryController, useOccurrenceEntryRepo, useOccurrenceEntryService, useOccurrenceSubjectController, useOccurrenceSubjectRepo, useOccurrenceSubjectService, useOnlineFormController, useOnlineFormRepo, useOrgController, useOrgControllerV2, useOrgRepo, useOvernightParkingController, useOvernightParkingRepo, useOvernightParkingRequestController, useOvernightParkingRequestRepo, useOvernightParkingRequestService, usePatrolEmailController, usePatrolEmailRepo, usePatrolEmailService, usePatrolLogController, usePatrolLogRepo, usePatrolLogService, usePatrolQuestionController, usePatrolQuestionRepo, usePatrolRouteController, usePatrolRouteRepo, usePersonController, usePersonRepo, usePlatformTermsController, usePlatformTermsRepo, usePlatformTermsService, usePostFavoriteController, usePostFavoriteRepo, usePostFavoriteService, usePostPrelovedController, usePostPrelovedRepo, usePriceController, usePriceModel, usePriceRepo, usePromoCodeController, usePromoCodeRepo, useRedDotPaymentController, useRedDotPaymentRepo, useRedDotPaymentSvc, useRobotController, useRobotRepo, useRobotService, useRoleController, useRoleControllerV2, useRoleRepo, useRoleRepoV2, useRoleServiceV2, useServiceProviderBillingController, useServiceProviderBillingRepo, useServiceProviderBillingService, useServiceProviderController, useServiceProviderInviteController, useServiceProviderInviteService, useServiceProviderRepo, useSessionRepo, useSiteBillingConfigurationController, useSiteBillingConfigurationRepo, useSiteBillingItemController, useSiteBillingItemRepo, useSiteCameraController, useSiteCameraRepo, useSiteCameraService, useSiteController, useSiteFacilityBookingController, useSiteFacilityBookingRepo, useSiteFacilityBookingService, useSiteFacilityController, useSiteFacilityRepo, useSiteFacilityService, useSiteRepo, useSiteService, useSiteUnitBillingController, useSiteUnitBillingRepo, useSiteUnitBillingService, useStatementOfAccountController, useStatementOfAccountRepo, useSubcategoryPrelovedController, useSubcategoryPrelovedRepo, useSubscriptionController, useSubscriptionPlanController, useSubscriptionPlanRepo, useSubscriptionRepo, useSubscriptionService, useUserController, useUserControllerV2, useUserRepo, useUserRepoV2, useUserService, useUserServiceV2, useVehicleController, useVehicleRepo, useVehicleService, useVerificationController, useVerificationControllerV2, useVerificationRepo, useVerificationRepoV2, useVerificationService, useVerificationServiceV2, useVisitorTransactionController, useVisitorTransactionRepo, useVisitorTransactionService, useWorkOrderController, useWorkOrderRepo, useWorkOrderService, userSchema, vehicleSchema, vehicles_namespace_collection, visitorPersonRepo, visitorPersonService, visitorType, visitors_namespace_collection, wallConfig, workOrderSchema, work_orders2_namespace_collection, work_orders_namespace_collection };

package/dist/index.js

@@ -6065,6 +6065,9 @@ __export(src_exports, {
   PostSort: () => PostSort,
   PostStatus: () => PostStatus,
   REALTIME_MAX_FANOUT: () => REALTIME_MAX_FANOUT,
+  SELF_SIGNUP_PLATFORM: () => SELF_SIGNUP_PLATFORM,
+  SELF_SIGNUP_STATUS: () => SELF_SIGNUP_STATUS,
+  SELF_SIGNUP_TYPES: () => SELF_SIGNUP_TYPES,
   SERVICE_PROVIDER_INVITE_LABELS: () => SERVICE_PROVIDER_INVITE_LABELS,
   SERVICE_PROVIDER_INVITE_TRANSITIONS: () => SERVICE_PROVIDER_INVITE_TRANSITIONS,
   SERVICE_PROVIDER_SIGN_IN_SUBJECT: () => SERVICE_PROVIDER_SIGN_IN_SUBJECT,
@@ -6308,6 +6311,7 @@ __export(src_exports, {
   schemaPlatformTerms: () => schemaPlatformTerms,
   schemaPost: () => schemaPost,
   schemaPostFavorite: () => schemaPostFavorite,
+  schemaResidentSelfSignUp: () => schemaResidentSelfSignUp,
   schemaSendPatrolEmail: () => schemaSendPatrolEmail,
   schemaServiceProvider: () => schemaServiceProvider,
   schemaServiceProviderBilling: () => schemaServiceProviderBilling,
@@ -8973,6 +8977,17 @@ function useUserRepo() {
       throw new import_node_server_utils11.InternalServerError("Failed to get user by email.");
     }
   }
+  async function userExistsByEmail(email) {
+    try {
+      const data = await collection.findOne(
+        { email: { $regex: `^${email}$`, $options: "i" } },
+        { projection: { _id: 1 } }
+      );
+      return Boolean(data);
+    } catch (error) {
+      throw new import_node_server_utils11.InternalServerError("Failed to get user by email.");
+    }
+  }
   async function getUserByEmailStatus(email) {
     try {
       const cacheOptions = {
@@ -9624,6 +9639,7 @@ function useUserRepo() {
     getAcceptedTerms,
     listTermsAcceptance,
     getUserByEmail,
+    userExistsByEmail,
     getUserByReferralCode,
     getByEmailApp,
     getUserById,
@@ -17171,6 +17187,29 @@ var schemaPerson = import_joi17.default.object({
   acceptedTerms: import_joi17.default.string().hex().length(24).optional().allow(null),
   acceptedTermsAt: import_joi17.default.string().optional().allow(null)
 });
+var SELF_SIGNUP_STATUS = "pending";
+var SELF_SIGNUP_PLATFORM = "mobile";
+var SELF_SIGNUP_TYPES = ["resident", "tenant"];
+var schemaResidentSelfSignUp = import_joi17.default.object({
+  name: import_joi17.default.string().required(),
+  email: import_joi17.default.string().email().required(),
+  password: import_joi17.default.string().required(),
+  type: import_joi17.default.string().trim().lowercase().valid(...SELF_SIGNUP_TYPES).required(),
+  isOwner: import_joi17.default.boolean().required(),
+  site: import_joi17.default.string().hex().length(24).optional().allow(null, ""),
+  org: import_joi17.default.string().hex().length(24).optional().allow(null, ""),
+  block: import_joi17.default.string().hex().length(24).optional().allow(null, ""),
+  level: import_joi17.default.string().hex().length(24).optional().allow(null, ""),
+  unit: import_joi17.default.string().hex().length(24).optional().allow(null, ""),
+  unitName: import_joi17.default.string().optional().allow(null, ""),
+  contact: import_joi17.default.string().optional().allow(null, ""),
+  countryCode: import_joi17.default.string().optional().allow(null, ""),
+  callingCode: import_joi17.default.string().optional().allow(null, ""),
+  nric: import_joi17.default.string().optional().allow(null, ""),
+  plateNumber: import_joi17.default.string().optional().allow(null, ""),
+  files: import_joi17.default.array().items(schemaFiles).optional().allow(null),
+  acceptedTerms: import_joi17.default.string().hex().length(24).optional().allow(null)
+});
 var schemaUpdatePerson = import_joi17.default.object({
   _id: import_joi17.default.string().hex().required(),
   name: import_joi17.default.string().optional().allow(null, ""),
@@ -18238,11 +18277,20 @@ async function requirePlatformOwner(req) {
   return id;
 }
 
+// src/utils/user-response.util.ts
+function withoutCredentials(user) {
+  if (!user || typeof user !== "object")
+    return user;
+  const { password, sid, ...rest } = user;
+  return rest;
+}
+
 // src/controllers/user.controller.ts
 function useUserController() {
   const {
     getUserById: _getById,
     getUserByEmail: _getByEmail,
+    userExistsByEmail: _existsByEmail,
     getUsers: _getUsers,
     updateBirthday: _updateBirthday,
     updateUserFieldById: _updateUserFieldById,
@@ -18320,8 +18368,13 @@ function useUserController() {
       return;
     }
     try {
+      if (!callerId(req)) {
+        const exists = await _existsByEmail(email);
+        res.json(exists ? { exists: true } : null);
+        return;
+      }
       const user = await _getByEmail(email);
-      res.json(user);
+      res.json(withoutCredentials(user));
       return;
     } catch (error2) {
       import_node_server_utils42.logger.log({ level: "error", message: `${error2.message}` });
@@ -50769,7 +50822,45 @@ function usePersonController() {
     }
     return actor;
   }
+  async function addResidentSelfSignUp(req, res, next) {
+    const { error, value } = schemaResidentSelfSignUp.validate(req.body, {
+      abortEarly: false,
+      stripUnknown: true
+    });
+    if (error) {
+      const messages = error.details.map((d) => d.message).join(", ");
+      import_node_server_utils138.logger.log({ level: "error", message: messages });
+      next(new import_node_server_utils138.BadRequestError(messages));
+      return;
+    }
+    const payload = {
+      ...value,
+      // Pinned, not accepted. The wizard hard-codes both
+      // (`createUser.tsx:151` and `:237` for status, `:150` for platform) and
+      // never sends anything else.
+      //
+      // `platform` matters as much as `status` here: `person.service.ts:130`
+      // reads it to decide whether the USER ACCOUNT it creates starts
+      // "pending" or "active", so a caller who sent `platform: "web"` got a
+      // live account without anyone reviewing them.
+      status: SELF_SIGNUP_STATUS,
+      platform: SELF_SIGNUP_PLATFORM
+    };
+    try {
+      const data = await _add(payload);
+      res.status(201).json({ message: data });
+      return;
+    } catch (err) {
+      import_node_server_utils138.logger.log({ level: "error", message: err.message });
+      next(err);
+      return;
+    }
+  }
   async function add(req, res, next) {
+    if (!callerId(req)) {
+      await addResidentSelfSignUp(req, res, next);
+      return;
+    }
     const payload = { ...req.body };
     const { error } = schemaPerson.validate(payload, {
       abortEarly: false
@@ -82167,7 +82258,7 @@ function useUserControllerV2() {
       return rejectValidation(error, next);
     try {
       const user = await _getUserByEmail(value);
-      res.json(user);
+      res.json(withoutCredentials(user));
       return;
     } catch (err) {
       import_node_server_utils267.logger.log({ level: "error", message: `${err.message}` });
@@ -87715,6 +87806,9 @@ function useNotificationPreferenceController() {
   PostSort,
   PostStatus,
   REALTIME_MAX_FANOUT,
+  SELF_SIGNUP_PLATFORM,
+  SELF_SIGNUP_STATUS,
+  SELF_SIGNUP_TYPES,
   SERVICE_PROVIDER_INVITE_LABELS,
   SERVICE_PROVIDER_INVITE_TRANSITIONS,
   SERVICE_PROVIDER_SIGN_IN_SUBJECT,
@@ -87958,6 +88052,7 @@ function useNotificationPreferenceController() {
   schemaPlatformTerms,
   schemaPost,
   schemaPostFavorite,
+  schemaResidentSelfSignUp,
   schemaSendPatrolEmail,
   schemaServiceProvider,
   schemaServiceProviderBilling,