@7365admin1/core 3.48.1-staging.206 → 3.48.1-staging.208

package/.changeset/access-management-record-scope.md

@@ -0,0 +1,48 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the access-management routes that name a card, not a site.
+
+`access-management-site-scope` closed the routes whose request already carries
+an estate. Seven routes on the same mount carry none — they reach an access card
+(or a unit) by `_id` and nothing else — so there was nothing for that rule to
+read and they were left carrying `requireAuth` alone:
+
+- `POST /sign-qr` — mints a working door credential. The card number is
+  RSA-encrypted into a QR payload the reader accepts for up to 24 hours when
+  `purpose` is `"vms"`. Any signed-in account could hand itself a valid pass for
+  any card in any estate on the platform.
+- `PATCH /delete-card` — deactivates a card, which is what stops it opening a
+  door.
+- `PATCH /nfc-status` — flips a card's status and activation.
+- `PATCH /visitor-checkout` — releases a visitor's card and writes its history.
+- `POST /card-replacement` — retires a card and hands its replacement to a unit.
+- `POST /assign-user` — hands the cards on a unit to a list of people.
+- `POST /settings` — rewrites an estate's access-management settings, including
+  the address of the Entrypass controller it talks to. This one DOES carry the
+  estate, in the body, and the repository upserts on it; it was simply never
+  checked.
+
+For the six that name a record, the scope is now decided on the STORED row via
+`siteReachOf` — the same rule `requireBulletinVideoReach` and
+`requireEntryPassReach` already apply, and the same underlying `entitleSite`
+verdict as `requireSiteReach`. `POST /settings` uses `requireSiteReach` on the
+body's site, exactly as `GET /settings/:site` already does. No new mechanism and
+no new permission string: reaching the estate is the whole rule, so the
+contracted agency at the guardhouse, the org-wide manager and a resident reading
+their own pass are all unaffected.
+
+Where a write MOVES a card onto a unit (`card-replacement`, `assign-user`) the
+destination unit is checked as well as the card, so a card cannot be re-parented
+into an estate the caller cannot reach.
+
+"Not yours" and "does not exist" answer identically (404), so card ids cannot be
+enumerated. An id matching no row is refused rather than waved through, and a
+row naming no estate fails closed. The guards sit after each handler's Joi
+validation, so malformed input still answers 400 exactly as before.
+
+`GET /door-access-levels`, `GET /lift-access-levels` and `GET /access-groups`
+are deliberately NOT changed: they carry no estate and no record, only a
+caller-supplied `acm_url`, so there is nothing to scope against without changing
+their request contract. They are recorded as a separate piece of work.

package/.changeset/organization-and-promo-list-scope.md

@@ -0,0 +1,39 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the organisation list to the caller, and put the promo-code list behind the staff gate.
+
+`GET /api/organizations` and `GET /api/promo-codes` performed no authorization
+at all — `requireAuth` and nothing more — while every sibling handler in the
+same two files guarded. So any signed-in account on the platform, a resident or
+a cleaner included, could page through the name, e-mail, nature and status of
+**every Seven365 client**, and read off **every discount code** we have ever
+minted, with its rate and its expiry, and then redeem whichever is worth most.
+
+The two rules are different, because the callers are different.
+
+**`GET /api/organizations` is now a SCOPE, not a refusal.** Seven365 staff see
+every organisation exactly as before; anybody else sees the organisations they
+hold a live membership of, plus any registered under their own verified account
+e-mail. The e-mail half is not decoration: `web-app-main
+pages/verify/email/index.vue:322` — the org-owner self-signup — lists
+organisations to find the one it created a line earlier, at which point that
+brand-new client owner is a member of nothing. Refusing them would have traded
+the leak for a broken signup. The comparison is the one
+`getOrgsByEmail` already makes, against the address on the caller's own `users`
+row; nothing the caller sends takes part in it. It also removes a real bug from
+that flow: the page takes `items[0]` of a newest-first list, so two client
+owners signing up in the same moment could be handed each other's organisation
+as their `defaultOrg`.
+
+The scope is part of the Redis cache key as well as the query, so one caller's
+narrowed page is never replayed to the next, and `countDocuments` runs the
+scoped query so pagination cannot walk past the scope.
+
+**`GET /api/promo-codes` is Seven365 staff only,** together with
+`GET /api/promo-codes/id/:id`, which is the same disclosure one record at a
+time. Both are read solely by the staff console. A client at checkout is
+unaffected: `web-app-org pages/checkout.vue` and
+`subscription/manage-seats.vue` type a code and validate it through
+`GET /api/promo-codes/code`, which stays signed-in-only and is untouched.

package/dist/index.d.ts

@@ -702,13 +702,17 @@ declare function useOrgRepo(): {
     createUniqueIndex: () => Promise<void>;
     add: (value: TOrg, session?: ClientSession) => Promise<ObjectId>;
     update: (id: string, value: Partial<TOrg>, session?: ClientSession) => Promise<string>;
-    getAll: ({ search, page, limit, sort, status, nature, }: {
+    getAll: ({ search, page, limit, sort, status, nature, scope, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
         sort?: Record<string, number> | undefined;
         status?: string | undefined;
         nature?: string | undefined;
+        scope?: {
+            orgIds?: string[] | undefined;
+            email?: string | undefined;
+        } | undefined;
     }) => Promise<{
         items: any[];
         pages: number;
@@ -6854,6 +6858,8 @@ declare function UseAccessManagementRepo(): {
         insertedCount: number;
         insertedIds: Record<number, ObjectId>;
     }>;
+    cardSitesRepo: (cardIds: Array<string | ObjectId>) => Promise<mongodb.WithId<bson.Document>[]>;
+    unitSiteRepo: (unitId: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     accessManagementSettingsRepo: (params: TAccessMngmntSettings) => Promise<mongodb.UpdateResult<bson.Document>>;
     allAccessCardsCountsRepo: (params: {
         site: string;
@@ -7121,7 +7127,7 @@ declare function useAccessManagementController(): {
     doorAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     liftAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessGroups: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
@@ -7130,23 +7136,23 @@ declare function useAccessManagementController(): {
     acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     removeAccessCard: ({ cardNo, staffNo, url, }: {
         cardNo: string;
         staffNo: string;
@@ -7154,7 +7160,7 @@ declare function useAccessManagementController(): {
     }) => Promise<void>;
     getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getTransactions: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     visitorCheckout: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;

package/dist/index.js

@@ -11739,7 +11739,8 @@ function useOrgRepo() {
     limit = 10,
     sort = {},
     status = "active",
-    nature = ""
+    nature = "",
+    scope
   }) {
     const query2 = { status };
     sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
@@ -11749,6 +11750,22 @@ function useOrgRepo() {
       page,
       limit
     };
+    if (scope) {
+      const ids2 = Array.from(
+        new Set((scope.orgIds ?? []).filter((id) => import_mongodb19.ObjectId.isValid(id)))
+      ).sort();
+      const email = (scope.email ?? "").trim();
+      const reach = [];
+      if (ids2.length)
+        reach.push({ _id: { $in: ids2.map((id) => new import_mongodb19.ObjectId(id)) } });
+      if (email)
+        reach.push({ email });
+      if (!reach.length) {
+        return (0, import_node_server_utils21.paginate)([], page > 0 ? page - 1 : 0, limit, 0);
+      }
+      query2.$or = reach;
+      cacheOptions.scope = `${ids2.join(",")}|${email.toLowerCase()}`;
+    }
     if (search) {
       query2.$text = { $search: search };
       cacheOptions.search = search;
@@ -27890,11 +27907,19 @@ function useOrgController() {
     const limit = parseInt(req.query.limit ?? "10");
     const nature = req.query.nature ?? "";
     try {
+      const id = callerId(req);
+      const actor = await resolveInviteActor(id);
+      let scope;
+      if (!actor.isSuperAdmin) {
+        const self = await _getUserById(id).catch(() => null);
+        scope = { orgIds: actor.orgIds, email: self?.email ?? "" };
+      }
       const data = await _getAll({
         search,
         page,
         limit,
-        nature
+        nature,
+        scope
       });
       res.json(data);
       return;
@@ -31336,6 +31361,7 @@ function usePromoCodeController() {
       return;
     }
     try {
+      await requirePlatformStaff(req);
       const data = await _getById(_id);
       res.json(data);
       return;
@@ -31364,6 +31390,7 @@ function usePromoCodeController() {
     const limit = parseInt(req.query.limit ?? "10");
     const status = req.query.status ?? "active";
     try {
+      await requirePlatformStaff(req);
       const data = await _getPromoCodes({
         search,
         page,
@@ -62014,6 +62041,24 @@ function UseAccessManagementRepo() {
       throw new Error(error.message);
     }
   }
+  async function cardSitesRepo(cardIds) {
+    try {
+      const ids2 = cardIds.map((id) => new import_mongodb121.ObjectId(id));
+      return await collection().find({ _id: { $in: ids2 } }, { projection: { site: 1, org: 1 } }).toArray();
+    } catch (error) {
+      throw new Error(error.message);
+    }
+  }
+  async function unitSiteRepo(unitId) {
+    try {
+      return await collectionName("building-units").findOne(
+        { _id: new import_mongodb121.ObjectId(unitId) },
+        { projection: { site: 1, org: 1 } }
+      );
+    } catch (error) {
+      throw new Error(error.message);
+    }
+  }
   async function accessManagementSettingsRepo(params) {
     try {
       params.site = new import_mongodb121.ObjectId(params.site);
@@ -64696,6 +64741,8 @@ function UseAccessManagementRepo() {
     createIndexForEntrypass,
     addPhysicalCardRepo,
     addNonPhysicalCardRepo,
+    cardSitesRepo,
+    unitSiteRepo,
     accessManagementSettingsRepo,
     allAccessCardsCountsRepo,
     availableAccessCardsRepo,
@@ -64748,6 +64795,8 @@ function useAccessManagementSvc() {
   const {
     addPhysicalCardRepo,
     addNonPhysicalCardRepo,
+    cardSitesRepo,
+    unitSiteRepo,
     accessManagementSettingsRepo,
     allAccessCardsCountsRepo,
     availableAccessCardsRepo,
@@ -64888,6 +64937,20 @@ function useAccessManagementSvc() {
       throw new Error(err.message);
     }
   };
+  const cardSitesSvc = async (cardIds) => {
+    try {
+      return await cardSitesRepo(cardIds);
+    } catch (err) {
+      throw new Error(err.message);
+    }
+  };
+  const unitSiteSvc = async (unitId) => {
+    try {
+      return await unitSiteRepo(unitId);
+    } catch (err) {
+      throw new Error(err.message);
+    }
+  };
   const accessManagementSettingsSvc = async (settings) => {
     try {
       const response = await accessManagementSettingsRepo({ ...settings });
@@ -65249,6 +65312,8 @@ function useAccessManagementSvc() {
     accessGroupsSvc,
     setCache,
     getCache,
+    cardSitesSvc,
+    unitSiteSvc,
     accessManagementSettingsSvc,
     allAccessCardsCountsSvc,
     availableAccessCardsSvc,
@@ -65301,6 +65366,26 @@ function useAccessManagementController() {
       return true;
     }
   };
+  const refuseUnreachableCards = async (req, res, cardIds) => {
+    const ids2 = [...new Set(cardIds.map((id) => String(id)))];
+    const cards = await cardSitesSvc(ids2);
+    const { canReach } = await siteReachOf(req);
+    const reached = await Promise.all(cards.map((card) => canReach(card)));
+    if (cards.length !== ids2.length || reached.includes(false)) {
+      res.status(404).json({ data: null, message: "Card not found." });
+      return true;
+    }
+    return false;
+  };
+  const refuseUnreachableUnit = async (req, res, unitId) => {
+    const unit = await unitSiteSvc(unitId);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(unit)) {
+      res.status(404).json({ data: null, message: "Unit not found." });
+      return true;
+    }
+    return false;
+  };
   const {
     addPhysicalCardSvc,
     addNonPhysicalCardSvc,
@@ -65309,6 +65394,8 @@ function useAccessManagementController() {
     accessGroupsSvc,
     setCache,
     getCache,
+    cardSitesSvc,
+    unitSiteSvc,
     accessManagementSettingsSvc,
     allAccessCardsCountsSvc,
     availableAccessCardsSvc,
@@ -65528,6 +65615,8 @@ function useAccessManagementController() {
   const accessManagementSettings = async (req, res) => {
     try {
       const settings = req.body;
+      if (await refuseUnreachableSite(req, res, settings?.site))
+        return;
       const result = await accessManagementSettingsSvc(settings);
       return res.status(201).json({ message: "Success", data: result });
     } catch (error) {
@@ -65827,6 +65916,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, nfcList.map((nfc) => nfc._id)))
+        return;
       const result = await updateNFCStatusSvc({ nfcList, visitorId });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -65879,6 +65970,10 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, [cardId, issuedCardId]))
+        return;
+      if (await refuseUnreachableUnit(req, res, unitId))
+        return;
       const result = await cardReplacementSvc({
         cardId,
         remarks,
@@ -66083,6 +66178,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, [cardId]))
+        return;
       const result = await deleteCardSvc({ cardId, remarks });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -66302,6 +66399,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, [cardId]))
+        return;
       const result = await signQrCodeSvc({ cardId, purpose });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -66328,6 +66427,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, cards.map((card) => card.cardId)))
+        return;
       const result = await checkoutVisitorSvc({ cards });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -66407,6 +66508,10 @@ function useAccessManagementController() {
       if (error) {
         throw new Error(`${error.message}`);
       }
+      if (await refuseUnreachableUnit(req, res, unit))
+        return;
+      if (id && await refuseUnreachableCards(req, res, [id]))
+        return;
       const result = await assignMultipleCardsSvc({
         assignees,
         unit,