@7365admin1/core 3.52.2-staging.238 → 3.52.2

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @iservice365/core
 
+## 3.52.2
+
+### Patch Changes
+
+- cfd7739: Fix the mailer transport defaults: an unset or unparseable port no longer resolves to `NaN`, and `MAILER_TRANSPORT_SECURE` now defaults to match the port instead of a fixed `false`. Same `Number(...) ?? n` fix applied to `PORT` and `REDIS_PORT`.
+- eea5d0a: Self-service onboarding: email a contractor and every member their own pass link, and let them ask for it again (DV-0080).
+
+  Registration used to email `guest` submissions only. A contractor now gets the same mail — whether
+  the site auto-approved them or left them pending — and so does every member who supplied an email
+  address, each with their OWN pass link rather than the lead's. Members who arrive on a pending
+  group are emailed when staff approve it, through the same fan-out that creates their records.
+
+  The staff Approve/Reject notification was also `guest`-only and now covers a self-service
+  contractor group and its members, so nobody is left holding a link they do not know went live,
+  or one that no longer works. A group raised through the resident-app invite flow is deliberately
+  excluded — its members are already told by that flow's own invitation email, and they hold a
+  resident-app registration link rather than a self-service pass link.
+
+  `self-service-visitor.hbs` grew a contractor shape rather than a second template: Company and
+  Contractor Type on, passenger count, arrival time, duration and purpose off. Its context, its
+  subject line and the NRIC mask moved into `self-service-email.util.ts`, which all three senders
+  now share.
+
+  New public `resendSelfServicePass` controller, behind
+  `POST /api/visitor-transactions/self-service/resend/:id`. An address already on a record can never
+  be redirected — a supplied one is only accepted for a record whose `email` is blank, which is the
+  case the links card's inline field exists for — and a 60-second per-record cooldown sits on top of
+  the route's per-IP limiter. The route now only ever accepts self-service records: registration
+  stamps every lead and member row with `source: "self-service"`, and the resend lookup filters on
+  it, so a public caller can no longer read, re-address or resend a staff-created walk-in, delivery
+  or resident-app invite via a guessed or harvested id — a non-self-service id answers the same 404
+  as one that does not exist at all.
+
+  `schemaSelfServiceVisitor.members[]` accepts `email` and now requires it. Both the lead's and each
+  member's email in that schema deliberately validate with `tlds: { allow: false }` — the client-side
+  check and the resend route's own check both use a looser regex with no IANA TLD list, and a
+  mismatch would 400 an entire submission over a field the contractor can no longer see once the
+  members dialog has closed. The mail server stays the real judge of deliverability.
+
+- b59a636: Vehicle management: make deleting and editing a vehicle safe against the ANPR cameras.
+
+  Deleting a vehicle no longer reports success when the plate is still on a camera. `bypass` now defaults to false, `removePlateNumber` returns an explicit per-camera outcome instead of swallowing its error, and a delete that cannot be confirmed on every camera holding the plate is refused with the record left intact so it can be retried. A site with no ANPR camera has nothing to revoke and now deletes successfully instead of failing with "No site cameras found."
+
+  Each camera is asked for its own record id before the removal, because a Dahua `recNo` is a per-device sequence number and the one stored on the vehicle only matches whichever camera was written last. Editing only the vehicle's name now removes the old whitelist record before inserting the new one, instead of leaving the previous entry on the camera for good.
+
+  Also: `pullVehicleByRecNo` is scoped to the person or site the plate belongs to (it matched on the record id alone, which is not unique across devices), the paginated camera lookups no longer skip their last page, and editing or deleting a vehicle now requires `vehicle-mgmt:update-vehicle` / `vehicle-mgmt:delete-vehicle` on the server, matching the gate the apps already apply in the browser.
+
+- 643a92a: Vehicle ANPR: create now fails closed, an unregistered vehicle can be deleted, and camera errors are readable
+
+  - `add()` no longer reports "added to whitelist successfully" when nothing was written to a camera. Camera failures are collected per camera, any plate already written is taken back off, and the whole create is refused. A site with no active ANPR camera saves the vehicle but says plainly that the barrier does not know about it.
+  - Deleting a vehicle with a blank or missing `recno` is no longer rejected by request validation. The per-camera revoke guarantee is unchanged.
+  - Dahua's own reply (`Invalid Authority!`, `{"ErrorCode":...}`) is logged server-side and no longer put into the message the operator sees, on create, approve and edit.
+  - Editing a vehicle restores the previous plate on the camera if the re-insert fails, instead of leaving the resident locked out by a change the database then rolls back.
+
+- d904033: Vehicle management: a deleted plate is gone from every list, a plate with no camera record can be deleted, and a camera blip no longer raises an alarm
+
+  - Deleting a vehicle is a soft delete, and no read path filtered on it — so the row never disappeared from the vehicle list, still sat on the blocklist (still stopping the car at the barrier), still filled the by-unit lookup, the season-pass options and the row counts, and still blocked re-creating that plate number. `getVehicles`, `getBlocklistedVehicles`, `getBlocklistedVehicleByPlateNumber`, `getAllVehiclesByUnitId` and `getSeasonPassTypes` now exclude deleted records, and `getVehicleById` drops deleted sibling plates. An explicit `status=deleted` is still honoured, which is the only way to look at them.
+  - Creating a vehicle no longer refuses a plate number that only exists on a deleted record. A live duplicate is still refused.
+  - The two database writes at the end of a delete ran together on one session inside one transaction; they now run in order. The person-side failure no longer reports itself as an NRIC problem and logs its real cause.
+  - An ANPR camera alert now waits for the third consecutive failed reconnect instead of the first. Writing a plate to a camera drops that camera's own event stream while the device services the write, so a successful "add vehicle" raised "the camera is not responding — ask your site technician" at the exact moment it succeeded.
+
 ## 3.52.1
 
 ### Patch Changes

package/dist/index.js

@@ -18228,7 +18228,13 @@ function usePersonRepo() {
         { session }
       );
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to pull vehicle plates by nric.");
+      import_node_server_utils41.logger.log({
+        level: "error",
+        message: `pullVehicleByRecNo failed on ${matchKey} for ${owner ? "person" : "site"} ${String(owner ?? site)}: ${error?.message ?? error}`
+      });
+      throw new import_node_server_utils41.InternalServerError(
+        "Could not take the plate off the resident's record."
+      );
     }
   }
   async function getByUserId(userId) {
@@ -21273,6 +21279,7 @@ function useVehicleRepo() {
     throw new import_node_server_utils50.InternalServerError("Unable to connect to server.");
   }
   const collection = db2.collection(vehicles_namespace_collection);
+  const NOT_DELETED = { status: { $ne: "deleted" /* DELETED */ } };
   async function createIndex() {
     try {
       await collection.createIndexes([
@@ -21329,7 +21336,10 @@ function useVehicleRepo() {
   }) {
     page = page > 0 ? page - 1 : 0;
     const baseQuery = {
-      ...status && { status },
+      // An explicit `status` is still honoured as it was - including
+      // `status=deleted`, which is the only way to see deleted plates and is
+      // what an audit view would ask for.
+      ...status ? { status } : NOT_DELETED,
       ...type && { type },
       ...category && { category },
       ...site && { site: new import_mongodb42.ObjectId(site) }
@@ -21540,7 +21550,7 @@ function useVehicleRepo() {
     }
     try {
       const categories = await collection.aggregate([
-        { $match: { site } },
+        { $match: { site, ...NOT_DELETED } },
         {
           $group: {
             _id: "$seasonPassType",
@@ -21715,7 +21725,19 @@ function useVehicleRepo() {
                       cond: {
                         $and: [
                           { $ne: ["$$plate.plateNumber", null] },
-                          { $ne: ["$$plate.plateNumber", ""] }
+                          { $ne: ["$$plate.plateNumber", ""] },
+                          // The plate that was ASKED for is always returned,
+                          // deleted or not - Restore, Approve and Blocklist
+                          // all read the record by its own id. Its deleted
+                          // SIBLINGS are dropped, so the Preview dialog of a
+                          // live resident stops offering actions on plates
+                          // that have been deleted.
+                          {
+                            $or: [
+                              { $eq: ["$$plate._id", "$$vehicleId"] },
+                              { $ne: ["$$plate.status", "deleted"] }
+                            ]
+                          }
                         ]
                       }
                     }
@@ -21983,7 +22005,8 @@ function useVehicleRepo() {
     try {
       const unit = (0, import_node_server_utils50.toObjectId)(unitId);
       const query2 = {
-        unit
+        unit,
+        ...NOT_DELETED
       };
       const items = await collection.find(query2, {
         projection: {
@@ -22084,6 +22107,7 @@ function useVehicleRepo() {
     page = page > 0 ? page - 1 : 0;
     const baseQuery = {
       type: "blocklist" /* BLOCKLIST */,
+      ...NOT_DELETED,
       ...site && {
         site: typeof site === "string" ? new import_mongodb42.ObjectId(site) : site
       }
@@ -22150,6 +22174,8 @@ function useVehicleRepo() {
     const baseQuery = {
       type: "blocklist" /* BLOCKLIST */,
       plateNumber,
+      // A blocklist entry that was deleted must stop blocking the car.
+      ...NOT_DELETED,
       ...site && {
         site: typeof site === "string" ? new import_mongodb42.ObjectId(site) : site
       }
@@ -22360,7 +22386,7 @@ function cameraCredentialsMessage(camera) {
 function cameraNotAuthorisedMessage(camera) {
   return `${describeCamera(camera)} rejected our connection, so it cannot read plates. This usually means its account is not allowed to use the plate-reading feed. Please ask your site technician or the security-system installer to check the camera's account permissions.`;
 }
-var CAMERA_ALERT_AT_ATTEMPT = [1, 6, 30, 90];
+var CAMERA_ALERT_AT_ATTEMPT = [3, 6, 30, 90];
 var CAMERA_ALERT_EVERY_AFTER = 90;
 function shouldAlertOnFailure(consecutiveFailures) {
   if (!Number.isInteger(consecutiveFailures) || consecutiveFailures < 1)
@@ -35298,7 +35324,11 @@ function useVehicleService() {
         };
         if (vehicleValue.status && vehicleValue.status !== "pending" /* PENDING */) {
           const siteObjectId = new import_mongodb67.ObjectId(vehicleValue.site);
-          const existingPlateNumber = await findOne({ plateNumber, site: siteObjectId });
+          const existingPlateNumber = await findOne({
+            plateNumber,
+            site: siteObjectId,
+            status: { $ne: "deleted" /* DELETED */ }
+          });
           if (existingPlateNumber) {
             throw new import_node_server_utils99.BadRequestError(`Vehicle plate number ${plateNumber} already exists.`);
           }
@@ -35472,17 +35502,12 @@ function useVehicleService() {
           throw new import_node_server_utils99.BadRequestError(message);
         import_node_server_utils99.logger.warn(`deleteVehicle bypassed a failed ANPR revoke: ${message}`);
       }
-      await Promise.all([
-        _deleteVehicle(_id, session),
-        // `plateNumber` is the fallback key. Pulling on an EMPTY `recNo` would
-        // match every other unregistered plate on the same person or site -
-        // five vehicles share the blank value on staging today.
-        _pullVehicleByRecNo(
-          recno,
-          { peopleId: vehicle?.peopleId, site, plateNumber },
-          session
-        )
-      ]);
+      await _deleteVehicle(_id, session);
+      await _pullVehicleByRecNo(
+        recno,
+        { peopleId: vehicle?.peopleId, site, plateNumber },
+        session
+      );
       await session.commitTransaction();
       return `Vehicle plate number deleted from ${type} record successfully.`;
     } catch (error) {