@7365admin1/core 3.52.11 → 3.52.12

package/dist/index.mjs

@@ -34468,7 +34468,17 @@ function useBuildingUnitRepo() {
     sort = {},
     site = "",
     building = "",
-    status = "active"
+    status = "active",
+    /**
+     * The sites this caller may be shown, or `null` for no restriction. Set only
+     * when the request named NO site — see `entitledSites`. Applied inside the
+     * query so the page counts describe what the caller can actually see, and
+     * folded into the cache key so one caller's page is never served to another.
+     *
+     * An EMPTY array means "this caller reaches no site" and must still be
+     * applied: `$in: []` matches nothing, which is the fail-closed answer.
+     */
+    siteScope = null
   } = {}) {
     page = page > 0 ? page - 1 : 0;
     const searchText = search.trim();
@@ -34493,6 +34503,11 @@ function useBuildingUnitRepo() {
       building_units_namespace_collection,
       cacheParams
     );
+    if (siteScope) {
+      const scoped = siteScope.filter((id) => ObjectId67.isValid(id));
+      query2.site = { $in: scoped.map((id) => new ObjectId67(id)) };
+      cacheParams.siteScope = scoped.length ? [...scoped].sort().join(",") : "no-site";
+    }
     logger62.log({
       level: "info",
       message: `Cache key for getAll building units: ${cacheKey}`
@@ -37286,7 +37301,17 @@ function useBuildingRepo() {
     limit = 10,
     sort = {},
     site = "",
-    status = "active" /* ACTIVE */
+    status = "active" /* ACTIVE */,
+    /**
+     * The sites this caller may be shown, or `null` for no restriction. Set only
+     * when the request named NO site — see `entitledSites`. Applied inside the
+     * query so the page counts describe what the caller can actually see, and
+     * folded into the cache key so one caller's page is never served to another.
+     *
+     * An EMPTY array means "this caller reaches no site" and must still be
+     * applied: `$in: []` matches nothing, which is the fail-closed answer.
+     */
+    siteScope = null
   } = {}) {
     page = page > 0 ? page - 1 : 0;
     let siteId;
@@ -37320,6 +37345,11 @@ function useBuildingRepo() {
       ...status && { status }
     };
     const cacheKey = makeCacheKey27(buildings_namespace_collection, cacheParams);
+    if (siteScope) {
+      const scoped = siteScope.filter((id) => ObjectId70.isValid(id));
+      query2.site = { $in: scoped.map((id) => new ObjectId70(id)) };
+      cacheParams.siteScope = scoped.length ? [...scoped].sort().join(",") : "no-site";
+    }
     logger69.log({
       level: "info",
       message: `Cache key for getAll buildings: ${cacheKey}`
@@ -37994,7 +38024,17 @@ function useBuildingLevelRepo() {
     limit = 10,
     sort = {},
     site = "",
-    status = "active"
+    status = "active",
+    /**
+     * The sites this caller may be shown, or `null` for no restriction. Set only
+     * when the request named NO site — see `entitledSites`. Applied inside the
+     * query so the page counts describe what the caller can actually see, and
+     * folded into the cache key so one caller's page is never served to another.
+     *
+     * An EMPTY array means "this caller reaches no site" and must still be
+     * applied: `$in: []` matches nothing, which is the fail-closed answer.
+     */
+    siteScope = null
   } = {}) {
     page = page > 0 ? page - 1 : 0;
     const query2 = {
@@ -38014,6 +38054,11 @@ function useBuildingLevelRepo() {
       building_level_namespace_collection,
       cacheParams
     );
+    if (siteScope) {
+      const scoped = siteScope.filter((id) => ObjectId72.isValid(id));
+      query2.site = { $in: scoped.map((id) => new ObjectId72(id)) };
+      cacheParams.siteScope = scoped.length ? [...scoped].sort().join(",") : "no-site";
+    }
     logger71.log({
       level: "info",
       message: `Cache key for getAll building levels: ${cacheKey}`
@@ -38991,13 +39036,17 @@ function useBuildingController() {
     const search = value.search ?? "";
     const sortObj = sort ? { [sort]: order === "asc" /* ASC */ ? 1 : -1 } : {};
     try {
+      const siteScope = site ? null : await entitledSites(req);
+      if (site)
+        await requireSiteReach(req, site);
       const buildings = await _getAll({
         page,
         limit,
         sort: sortObj,
         status,
         site,
-        search
+        search,
+        siteScope
       });
       res.json(buildings);
       return;
@@ -39634,6 +39683,9 @@ function useBuildingUnitController() {
       const site = value.site;
       const building = value.building;
       const search = value.search;
+      const siteScope = site ? null : await entitledSites(req);
+      if (site)
+        await requireSiteReach(req, site);
       const buildings = await _getAll({
         page,
         limit,
@@ -39641,7 +39693,8 @@ function useBuildingUnitController() {
         status,
         site,
         search,
-        building
+        building,
+        siteScope
       });
       res.json(buildings);
       return;
@@ -39755,6 +39808,7 @@ function useBuildingUnitController() {
     }
     const site = req.params.site;
     try {
+      await requireSiteReach(req, site);
       const data = await _getBuildingUnitsWithOwner(site);
       res.json(data);
       return;
@@ -90093,12 +90147,16 @@ function useBuildingLevelController() {
         return;
       }
       const { page, limit, status, site, search } = value;
+      const siteScope = site ? null : await entitledSites(req);
+      if (site)
+        await requireSiteReach(req, site);
       const result = await _getAll({
         page,
         limit,
         status,
         site,
-        search
+        search,
+        siteScope
       });
       res.json(result);
       return;