@7365admin1/core 3.48.1-staging.202 → 3.48.1-staging.203

package/.changeset/hrmlabs-attendance-location-name.md

@@ -0,0 +1,35 @@
+---
+"@7365admin1/core": patch
+---
+
+Decide the HRM Labs location server-side, so an entitled caller cannot read
+another site's roster.
+
+`requireSiteReach(req, siteId, ATTENDANCE_READ)` guards all four manpower-attendance
+reads, but `siteId` is not what selects the roster — it only picks the local
+`manpower-settings` row. The roster is selected by `locationName`, the field HRM Labs
+is asked for, and that came straight from the request body's `siteName` with nothing
+checking it against `siteId`.
+
+So the two could disagree. A caller entitled to site A could send site A's `siteId`,
+pass the guard, and pair it with **another** site's `siteName` — and read that site's
+employee roster back: names, staff numbers, job titles, NRICs
+(`identificationNumber`) and the check-in/check-out photographs. The exposure had been
+narrowed from anyone on the internet to any signed-in account; this closes it.
+
+The location now comes from `config.siteName`, the settings row the caller was already
+entitled to, via one `locationOf()` helper called in each of the four functions. That
+is the same source the screen reads from: the security app fills `siteId` and
+`siteName` from one HRM Labs site-list entry (`site.id` / `site.text`),
+`manpowerMonitoringSchema` makes `siteName` required on both write paths, and
+`TManpowerMonitoringUpdate` cannot change it — so for every legitimate row the pair
+already agreed and the server simply stops asking.
+
+A row with no stored name is refused rather than falling back to the body; a fallback
+would re-open the hole for exactly the rows an attacker would want to name for
+themselves.
+
+Nothing legitimate changes. The Joi schemas still accept `siteName`, so no client needs
+a coordinated release — it is accepted and ignored. The three internal callers
+(`manpower.event.ts` and the two `cron.util.ts` sweeps) get more reliable, not less:
+they were passing `manpower-remarks.siteName`, which that model marks optional.

package/dist/index.js

@@ -78089,6 +78089,15 @@ var {
   totalCountPerStatus: totalCountPerStatus2,
   chartCountData: chartCountData2
 } = hrmlabs_attendance_util_default;
+function locationOf(config2) {
+  const name = typeof config2?.siteName === "string" ? config2.siteName.trim() : "";
+  if (!name) {
+    throw new Error(
+      "Manpower monitoring settings for this site have no HRM Labs location name."
+    );
+  }
+  return name;
+}
 function useHrmLabsAttendanceSrvc() {
   const { getManpowerSettingsBySiteId: _getManpowerSettingsBySiteId } = useManpowerMonitoringRepo();
   const { getManpowerDesignationsBySiteId: _getManpowerDesignationsBySiteId } = useManpowerDesignationRepo();
@@ -78096,7 +78105,6 @@ function useHrmLabsAttendanceSrvc() {
     const {
       startDate,
       endDate,
-      siteName,
       siteId,
       shiftName,
       search,
@@ -78126,6 +78134,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const shiftType = config2.shiftType === "2-shifts" ? "2-shifts" : "3-shifts";
       const shiftData = config2.shifts[shiftType].find(
         (s) => s.name === shiftName
@@ -78195,7 +78204,7 @@ function useHrmLabsAttendanceSrvc() {
     }
   }
   async function getAttendanceDataCount(payload) {
-    const { startDate, endDate, siteName, siteId, search, serviceProviderId } = payload;
+    const { startDate, endDate, siteId, search, serviceProviderId } = payload;
     const username = process.env.HRMLABS_USERNAME;
     const domain = process.env.HRMLABS_DOMAIN;
     const password = process.env.HRMLABS_PASSWORD;
@@ -78218,6 +78227,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const shiftType = config2.shiftType;
       const shiftData = config2.shifts[shiftType];
       if (!shiftData) {
@@ -78308,7 +78318,7 @@ function useHrmLabsAttendanceSrvc() {
     }
   }
   async function getAllAttendance(payload) {
-    const { startDate, endDate, siteName, siteId, search, serviceProviderId } = payload;
+    const { startDate, endDate, siteId, search, serviceProviderId } = payload;
     let { shiftName } = payload;
     const username = process.env.HRMLABS_USERNAME;
     const domain = process.env.HRMLABS_DOMAIN;
@@ -78331,6 +78341,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const designationConfig = await _getManpowerDesignationsBySiteId(
         siteId,
         serviceProviderId
@@ -78482,7 +78493,6 @@ function useHrmLabsAttendanceSrvc() {
     const {
       startDate,
       endDate,
-      siteName,
       siteId,
       search,
       serviceProviderId,
@@ -78510,6 +78520,7 @@ function useHrmLabsAttendanceSrvc() {
           message: "Manpower monitoring settings not found for the provided site ID."
         };
       }
+      const siteName = locationOf(config2);
       const designationConfig = await _getManpowerDesignationsBySiteId(
         siteId,
         serviceProviderId