@7365admin1/core 3.48.1-staging.199 → 3.48.1-staging.200

package/.changeset/hrmlabs-attendance-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the four manpower-attendance reads to the caller's sites and the attendance permission.

package/dist/index.js

@@ -25551,13 +25551,21 @@ var inFlightGrabs = 0;
 var LAST_FRAME_TTL_SECONDS = 60 * 60;
 
 // src/utils/site-reach.util.ts
-async function requireSiteReach(req, site) {
+async function requireSiteReach(req, site, permission) {
   const siteId = site?.toString?.() ?? "";
   if (!siteId)
     throw new import_node_server_utils55.UnauthorizedError("Not authorized.");
   const actor = await resolveInviteActor(callerId(req));
   if (actor.isSuperAdmin)
     return;
+  if (permission) {
+    await useCameraViewService().authorizeSite({
+      siteId,
+      userId: actor.id,
+      ...permission
+    });
+    return;
+  }
   await useCameraViewService().entitleSite({ siteId, userId: actor.id });
 }
 async function siteReachOf(req) {
@@ -78519,6 +78527,10 @@ function useHrmLabsAttendanceSrvc() {
 // src/controllers/hrmlabs-attendance.controller.ts
 var import_node_server_utils249 = require("@7365admin1/node-server-utils");
 var import_joi131 = __toESM(require("joi"));
+var ATTENDANCE_READ = {
+  permissions: ["manpower-monitoring:see-all-manpower-monitoring-attendance"],
+  message: "You do not have permission to view manpower attendance."
+};
 function useHrmLabsAttendanceCtrl() {
   const hrmLabsAttendanceSrvc = useHrmLabsAttendanceSrvc();
   async function getAttendanceData(req, res, next) {
@@ -78563,6 +78575,7 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils249.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getAttendanceData(req.body);
       return res.json(result);
     } catch (error) {
@@ -78592,6 +78605,7 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils249.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getAttendanceDataCount(
         req.body
       );
@@ -78635,6 +78649,7 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils249.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getAllAttendance(req.body);
       return res.json(result);
     } catch (error) {
@@ -78676,6 +78691,7 @@ function useHrmLabsAttendanceCtrl() {
         next(new import_node_server_utils249.BadRequestError(error.message));
         return;
       }
+      await requireSiteReach(req, siteId, ATTENDANCE_READ);
       const result = await hrmLabsAttendanceSrvc.getChartAttendanceData(
         req.body
       );