@7365admin1/core 3.48.1-staging.207 → 3.48.1-staging.209

package/.changeset/access-management-record-scope.md

@@ -0,0 +1,48 @@
+---
+"@7365admin1/core": minor
+---
+
+Scope the access-management routes that name a card, not a site.
+
+`access-management-site-scope` closed the routes whose request already carries
+an estate. Seven routes on the same mount carry none — they reach an access card
+(or a unit) by `_id` and nothing else — so there was nothing for that rule to
+read and they were left carrying `requireAuth` alone:
+
+- `POST /sign-qr` — mints a working door credential. The card number is
+  RSA-encrypted into a QR payload the reader accepts for up to 24 hours when
+  `purpose` is `"vms"`. Any signed-in account could hand itself a valid pass for
+  any card in any estate on the platform.
+- `PATCH /delete-card` — deactivates a card, which is what stops it opening a
+  door.
+- `PATCH /nfc-status` — flips a card's status and activation.
+- `PATCH /visitor-checkout` — releases a visitor's card and writes its history.
+- `POST /card-replacement` — retires a card and hands its replacement to a unit.
+- `POST /assign-user` — hands the cards on a unit to a list of people.
+- `POST /settings` — rewrites an estate's access-management settings, including
+  the address of the Entrypass controller it talks to. This one DOES carry the
+  estate, in the body, and the repository upserts on it; it was simply never
+  checked.
+
+For the six that name a record, the scope is now decided on the STORED row via
+`siteReachOf` — the same rule `requireBulletinVideoReach` and
+`requireEntryPassReach` already apply, and the same underlying `entitleSite`
+verdict as `requireSiteReach`. `POST /settings` uses `requireSiteReach` on the
+body's site, exactly as `GET /settings/:site` already does. No new mechanism and
+no new permission string: reaching the estate is the whole rule, so the
+contracted agency at the guardhouse, the org-wide manager and a resident reading
+their own pass are all unaffected.
+
+Where a write MOVES a card onto a unit (`card-replacement`, `assign-user`) the
+destination unit is checked as well as the card, so a card cannot be re-parented
+into an estate the caller cannot reach.
+
+"Not yours" and "does not exist" answer identically (404), so card ids cannot be
+enumerated. An id matching no row is refused rather than waved through, and a
+row naming no estate fails closed. The guards sit after each handler's Joi
+validation, so malformed input still answers 400 exactly as before.
+
+`GET /door-access-levels`, `GET /lift-access-levels` and `GET /access-groups`
+are deliberately NOT changed: they carry no estate and no record, only a
+caller-supplied `acm_url`, so there is nothing to scope against without changing
+their request contract. They are recorded as a separate piece of work.

package/dist/index.d.ts

@@ -6858,6 +6858,8 @@ declare function UseAccessManagementRepo(): {
         insertedCount: number;
         insertedIds: Record<number, ObjectId>;
     }>;
+    cardSitesRepo: (cardIds: Array<string | ObjectId>) => Promise<mongodb.WithId<bson.Document>[]>;
+    unitSiteRepo: (unitId: string | ObjectId) => Promise<mongodb.WithId<bson.Document> | null>;
     accessManagementSettingsRepo: (params: TAccessMngmntSettings) => Promise<mongodb.UpdateResult<bson.Document>>;
     allAccessCardsCountsRepo: (params: {
         site: string;
@@ -7125,7 +7127,7 @@ declare function useAccessManagementController(): {
     doorAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     liftAccessLevels: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     accessGroups: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    accessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     allAccessCardsCounts: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     availableAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     userTypeAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
@@ -7134,23 +7136,23 @@ declare function useAccessManagementController(): {
     acknowlegdeCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     accessandLiftCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     replaceCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    updateNFCStatus: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     doorAndLiftDropdown: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    cardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     visitorAccessCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getCardReplacement: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getAccessManagementSettings: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     bulkPhysicalAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     assignAccessCardToUnit: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    deleteCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getCardDetails: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     addQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     allQrTag: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     availableCardContractors: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     vmsgenerateQrCodes: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     addVisitorAccessCard: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
-    signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    signQrCode: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
+    checkoutVisitor: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     removeAccessCard: ({ cardNo, staffNo, url, }: {
         cardNo: string;
         staffNo: string;
@@ -7158,7 +7160,7 @@ declare function useAccessManagementController(): {
     }) => Promise<void>;
     getBlockLevelAndUnitList: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getTransactions: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
-    assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
+    assignMultipleCards: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     visitorCheckout: (req: Request, res: Response) => Promise<Response<any, Record<string, any>>>;
     uploadTemplate: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;
     getResidents: (req: Request, res: Response) => Promise<Response<any, Record<string, any>> | undefined>;

package/dist/index.js

@@ -61151,7 +61151,7 @@ async function requireOwnUnit(req, site, unitId) {
   const db2 = import_node_server_utils190.useAtlas.getDb();
   if (!db2)
     throw new Error("Unable to connect to server.");
-  const own = await db2.collection("people").findOne({
+  const own = await db2.collection("site.people").findOne({
     user: new import_mongodb119.ObjectId(actor.id),
     unit: new import_mongodb119.ObjectId(unit),
     site: new import_mongodb119.ObjectId(siteId),
@@ -62041,6 +62041,24 @@ function UseAccessManagementRepo() {
       throw new Error(error.message);
     }
   }
+  async function cardSitesRepo(cardIds) {
+    try {
+      const ids2 = cardIds.map((id) => new import_mongodb121.ObjectId(id));
+      return await collection().find({ _id: { $in: ids2 } }, { projection: { site: 1, org: 1 } }).toArray();
+    } catch (error) {
+      throw new Error(error.message);
+    }
+  }
+  async function unitSiteRepo(unitId) {
+    try {
+      return await collectionName("building-units").findOne(
+        { _id: new import_mongodb121.ObjectId(unitId) },
+        { projection: { site: 1, org: 1 } }
+      );
+    } catch (error) {
+      throw new Error(error.message);
+    }
+  }
   async function accessManagementSettingsRepo(params) {
     try {
       params.site = new import_mongodb121.ObjectId(params.site);
@@ -64723,6 +64741,8 @@ function UseAccessManagementRepo() {
     createIndexForEntrypass,
     addPhysicalCardRepo,
     addNonPhysicalCardRepo,
+    cardSitesRepo,
+    unitSiteRepo,
     accessManagementSettingsRepo,
     allAccessCardsCountsRepo,
     availableAccessCardsRepo,
@@ -64775,6 +64795,8 @@ function useAccessManagementSvc() {
   const {
     addPhysicalCardRepo,
     addNonPhysicalCardRepo,
+    cardSitesRepo,
+    unitSiteRepo,
     accessManagementSettingsRepo,
     allAccessCardsCountsRepo,
     availableAccessCardsRepo,
@@ -64915,6 +64937,20 @@ function useAccessManagementSvc() {
       throw new Error(err.message);
     }
   };
+  const cardSitesSvc = async (cardIds) => {
+    try {
+      return await cardSitesRepo(cardIds);
+    } catch (err) {
+      throw new Error(err.message);
+    }
+  };
+  const unitSiteSvc = async (unitId) => {
+    try {
+      return await unitSiteRepo(unitId);
+    } catch (err) {
+      throw new Error(err.message);
+    }
+  };
   const accessManagementSettingsSvc = async (settings) => {
     try {
       const response = await accessManagementSettingsRepo({ ...settings });
@@ -65276,6 +65312,8 @@ function useAccessManagementSvc() {
     accessGroupsSvc,
     setCache,
     getCache,
+    cardSitesSvc,
+    unitSiteSvc,
     accessManagementSettingsSvc,
     allAccessCardsCountsSvc,
     availableAccessCardsSvc,
@@ -65328,6 +65366,26 @@ function useAccessManagementController() {
       return true;
     }
   };
+  const refuseUnreachableCards = async (req, res, cardIds) => {
+    const ids2 = [...new Set(cardIds.map((id) => String(id)))];
+    const cards = await cardSitesSvc(ids2);
+    const { canReach } = await siteReachOf(req);
+    const reached = await Promise.all(cards.map((card) => canReach(card)));
+    if (cards.length !== ids2.length || reached.includes(false)) {
+      res.status(404).json({ data: null, message: "Card not found." });
+      return true;
+    }
+    return false;
+  };
+  const refuseUnreachableUnit = async (req, res, unitId) => {
+    const unit = await unitSiteSvc(unitId);
+    const { canReach } = await siteReachOf(req);
+    if (!await canReach(unit)) {
+      res.status(404).json({ data: null, message: "Unit not found." });
+      return true;
+    }
+    return false;
+  };
   const {
     addPhysicalCardSvc,
     addNonPhysicalCardSvc,
@@ -65336,6 +65394,8 @@ function useAccessManagementController() {
     accessGroupsSvc,
     setCache,
     getCache,
+    cardSitesSvc,
+    unitSiteSvc,
     accessManagementSettingsSvc,
     allAccessCardsCountsSvc,
     availableAccessCardsSvc,
@@ -65555,6 +65615,8 @@ function useAccessManagementController() {
   const accessManagementSettings = async (req, res) => {
     try {
       const settings = req.body;
+      if (await refuseUnreachableSite(req, res, settings?.site))
+        return;
       const result = await accessManagementSettingsSvc(settings);
       return res.status(201).json({ message: "Success", data: result });
     } catch (error) {
@@ -65854,6 +65916,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, nfcList.map((nfc) => nfc._id)))
+        return;
       const result = await updateNFCStatusSvc({ nfcList, visitorId });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -65906,6 +65970,10 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, [cardId, issuedCardId]))
+        return;
+      if (await refuseUnreachableUnit(req, res, unitId))
+        return;
       const result = await cardReplacementSvc({
         cardId,
         remarks,
@@ -66110,6 +66178,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, [cardId]))
+        return;
       const result = await deleteCardSvc({ cardId, remarks });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -66329,6 +66399,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, [cardId]))
+        return;
       const result = await signQrCodeSvc({ cardId, purpose });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -66355,6 +66427,8 @@ function useAccessManagementController() {
       if (error) {
         return res.status(400).json({ message: error.message });
       }
+      if (await refuseUnreachableCards(req, res, cards.map((card) => card.cardId)))
+        return;
       const result = await checkoutVisitorSvc({ cards });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {
@@ -66434,6 +66508,10 @@ function useAccessManagementController() {
       if (error) {
         throw new Error(`${error.message}`);
       }
+      if (await refuseUnreachableUnit(req, res, unit))
+        return;
+      if (id && await refuseUnreachableCards(req, res, [id]))
+        return;
       const result = await assignMultipleCardsSvc({
         assignees,
         unit,