@7365admin1/core 3.52.10 → 3.52.11-staging.259

package/.changeset/camera-grant-org-level-role.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Reconcile the camera site-reach rule with the site-list rule: an organisation-level role reaches every site of its own organisation even when its membership row also names a site.

package/.changeset/visitor-document-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the visitor-transaction list to the caller's own sites when none is named, and authorise the site the document list is given

package/dist/index.d.ts

@@ -5016,7 +5016,7 @@ declare function MVisitorTransaction(value: TVisitorTransaction): {
 declare const visitors_namespace_collection = "visitor.transactions";
 declare function useVisitorTransactionRepo(): {
     add: (value: TVisitorTransaction, session?: ClientSession, returnValue?: boolean) => Promise<any>;
-    getAll: ({ search, page, limit, sort, status, org, site, dateTo, dateFrom, type, checkedOut, plateNumber, tab, passOrKey, }: {
+    getAll: ({ search, page, limit, sort, status, org, site, dateTo, dateFrom, type, checkedOut, plateNumber, tab, passOrKey, siteScope, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
@@ -5034,6 +5034,16 @@ declare function useVisitorTransactionRepo(): {
             keyId: string;
             type: string;
         } | undefined;
+        /**
+         * The sites this caller may be shown, or `null` for no restriction. Set
+         * only when the request named NO site - see `entitledSites`. Applied inside
+         * the query so the page counts describe what the caller can actually see.
+         *
+         * An EMPTY array means "this caller reaches no site" and must still be
+         * applied: `$in: []` matches nothing, which is the fail-closed answer. It is
+         * deliberately not collapsed into the falsy branch alongside `null`.
+         */
+        siteScope?: string[] | null | undefined;
     }) => Promise<{
         items: any[];
         pages: number;

package/dist/index.js

@@ -20293,7 +20293,8 @@ function useVisitorTransactionRepo() {
     checkedOut,
     plateNumber = "",
     tab = "",
-    passOrKey
+    passOrKey,
+    siteScope
   }) {
     page = page > 0 ? page - 1 : 0;
     const skip = page * limit;
@@ -20314,6 +20315,11 @@ function useVisitorTransactionRepo() {
     const query2 = {
       ...import_mongodb40.ObjectId.isValid(org) && { org: new import_mongodb40.ObjectId(org) },
       ...import_mongodb40.ObjectId.isValid(site) && { site: new import_mongodb40.ObjectId(site) },
+      ...siteScope ? {
+        site: {
+          $in: siteScope.filter((id) => import_mongodb40.ObjectId.isValid(id)).map((id) => new import_mongodb40.ObjectId(id))
+        }
+      } : {},
       ...Object.keys(checkInFilter).length > 0 && { checkIn: checkInFilter },
       ...Object.keys(expectedCheckInFilter).length > 0 && {
         expectedCheckIn: expectedCheckInFilter
@@ -52400,7 +52406,7 @@ function useVisitorTransactionService() {
         unitName: unit?.name,
         org: inviter?.org?.toString(),
         site: inviter?.site.toString(),
-        status: value?.type === "contractor" ? isAutoApprovedInvitation ? "approved" /* APPROVED */ : "pending" /* PENDING */ : "pending" /* PENDING */,
+        status: value?.type === "contractor" ? isAutoApprovedInvitation ? "approved" /* APPROVED */ : "pending" /* PENDING */ : "approved" /* APPROVED */,
         inviterId: userId
       };
       const leadId = new import_mongodb86.ObjectId();
@@ -57020,12 +57026,16 @@ function useVisitorTransactionController() {
         tab,
         passOrKey
       } = value;
+      const siteScope = site ? null : await entitledSites(req);
+      if (site)
+        await requireSiteReach(req, site);
       const sortObj = {
         [sort ? sort : "_id" /* ID */]: order === "asc" /* ASC */ ? 1 : -1
       };
       const data = await _getAll({
         org,
         site,
+        siteScope,
         search,
         page,
         limit,
@@ -64388,6 +64398,7 @@ function useDocumentManagementController() {
     const site = req.query.site ?? "";
     const parentId = req.query.parentId ?? "";
     try {
+      await requireSiteReach(req, site);
       const data = await _getDocuments({
         search,
         page,