@7365admin1/core 3.52.2-staging.239 → 3.52.2

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @iservice365/core
 
+## 3.52.2
+
+### Patch Changes
+
+- cfd7739: Fix the mailer transport defaults: an unset or unparseable port no longer resolves to `NaN`, and `MAILER_TRANSPORT_SECURE` now defaults to match the port instead of a fixed `false`. Same `Number(...) ?? n` fix applied to `PORT` and `REDIS_PORT`.
+- eea5d0a: Self-service onboarding: email a contractor and every member their own pass link, and let them ask for it again (DV-0080).
+
+  Registration used to email `guest` submissions only. A contractor now gets the same mail — whether
+  the site auto-approved them or left them pending — and so does every member who supplied an email
+  address, each with their OWN pass link rather than the lead's. Members who arrive on a pending
+  group are emailed when staff approve it, through the same fan-out that creates their records.
+
+  The staff Approve/Reject notification was also `guest`-only and now covers a self-service
+  contractor group and its members, so nobody is left holding a link they do not know went live,
+  or one that no longer works. A group raised through the resident-app invite flow is deliberately
+  excluded — its members are already told by that flow's own invitation email, and they hold a
+  resident-app registration link rather than a self-service pass link.
+
+  `self-service-visitor.hbs` grew a contractor shape rather than a second template: Company and
+  Contractor Type on, passenger count, arrival time, duration and purpose off. Its context, its
+  subject line and the NRIC mask moved into `self-service-email.util.ts`, which all three senders
+  now share.
+
+  New public `resendSelfServicePass` controller, behind
+  `POST /api/visitor-transactions/self-service/resend/:id`. An address already on a record can never
+  be redirected — a supplied one is only accepted for a record whose `email` is blank, which is the
+  case the links card's inline field exists for — and a 60-second per-record cooldown sits on top of
+  the route's per-IP limiter. The route now only ever accepts self-service records: registration
+  stamps every lead and member row with `source: "self-service"`, and the resend lookup filters on
+  it, so a public caller can no longer read, re-address or resend a staff-created walk-in, delivery
+  or resident-app invite via a guessed or harvested id — a non-self-service id answers the same 404
+  as one that does not exist at all.
+
+  `schemaSelfServiceVisitor.members[]` accepts `email` and now requires it. Both the lead's and each
+  member's email in that schema deliberately validate with `tlds: { allow: false }` — the client-side
+  check and the resend route's own check both use a looser regex with no IANA TLD list, and a
+  mismatch would 400 an entire submission over a field the contractor can no longer see once the
+  members dialog has closed. The mail server stays the real judge of deliverability.
+
+- b59a636: Vehicle management: make deleting and editing a vehicle safe against the ANPR cameras.
+
+  Deleting a vehicle no longer reports success when the plate is still on a camera. `bypass` now defaults to false, `removePlateNumber` returns an explicit per-camera outcome instead of swallowing its error, and a delete that cannot be confirmed on every camera holding the plate is refused with the record left intact so it can be retried. A site with no ANPR camera has nothing to revoke and now deletes successfully instead of failing with "No site cameras found."
+
+  Each camera is asked for its own record id before the removal, because a Dahua `recNo` is a per-device sequence number and the one stored on the vehicle only matches whichever camera was written last. Editing only the vehicle's name now removes the old whitelist record before inserting the new one, instead of leaving the previous entry on the camera for good.
+
+  Also: `pullVehicleByRecNo` is scoped to the person or site the plate belongs to (it matched on the record id alone, which is not unique across devices), the paginated camera lookups no longer skip their last page, and editing or deleting a vehicle now requires `vehicle-mgmt:update-vehicle` / `vehicle-mgmt:delete-vehicle` on the server, matching the gate the apps already apply in the browser.
+
+- 643a92a: Vehicle ANPR: create now fails closed, an unregistered vehicle can be deleted, and camera errors are readable
+
+  - `add()` no longer reports "added to whitelist successfully" when nothing was written to a camera. Camera failures are collected per camera, any plate already written is taken back off, and the whole create is refused. A site with no active ANPR camera saves the vehicle but says plainly that the barrier does not know about it.
+  - Deleting a vehicle with a blank or missing `recno` is no longer rejected by request validation. The per-camera revoke guarantee is unchanged.
+  - Dahua's own reply (`Invalid Authority!`, `{"ErrorCode":...}`) is logged server-side and no longer put into the message the operator sees, on create, approve and edit.
+  - Editing a vehicle restores the previous plate on the camera if the re-insert fails, instead of leaving the resident locked out by a change the database then rolls back.
+
+- d904033: Vehicle management: a deleted plate is gone from every list, a plate with no camera record can be deleted, and a camera blip no longer raises an alarm
+
+  - Deleting a vehicle is a soft delete, and no read path filtered on it — so the row never disappeared from the vehicle list, still sat on the blocklist (still stopping the car at the barrier), still filled the by-unit lookup, the season-pass options and the row counts, and still blocked re-creating that plate number. `getVehicles`, `getBlocklistedVehicles`, `getBlocklistedVehicleByPlateNumber`, `getAllVehiclesByUnitId` and `getSeasonPassTypes` now exclude deleted records, and `getVehicleById` drops deleted sibling plates. An explicit `status=deleted` is still honoured, which is the only way to look at them.
+  - Creating a vehicle no longer refuses a plate number that only exists on a deleted record. A live duplicate is still refused.
+  - The two database writes at the end of a delete ran together on one session inside one transaction; they now run in order. The person-side failure no longer reports itself as an NRIC problem and logs its real cause.
+  - An ANPR camera alert now waits for the third consecutive failed reconnect instead of the first. Writing a plate to a camera drops that camera's own event stream while the device services the write, so a successful "add vehicle" raised "the camera is not responding — ask your site technician" at the exact moment it succeeded.
+
 ## 3.52.1
 
 ### Patch Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.2-staging.239",
+  "version": "3.52.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/.changeset/mailer-transport-defaults.md

@@ -1,5 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Fix the mailer transport defaults: an unset or unparseable port no longer resolves to `NaN`, and `MAILER_TRANSPORT_SECURE` now defaults to match the port instead of a fixed `false`. Same `Number(...) ?? n` fix applied to `PORT` and `REDIS_PORT`.

package/.changeset/self-service-contractor-emails-and-resend.md

@@ -1,37 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Self-service onboarding: email a contractor and every member their own pass link, and let them ask for it again (DV-0080).
-
-Registration used to email `guest` submissions only. A contractor now gets the same mail — whether
-the site auto-approved them or left them pending — and so does every member who supplied an email
-address, each with their OWN pass link rather than the lead's. Members who arrive on a pending
-group are emailed when staff approve it, through the same fan-out that creates their records.
-
-The staff Approve/Reject notification was also `guest`-only and now covers a self-service
-contractor group and its members, so nobody is left holding a link they do not know went live,
-or one that no longer works. A group raised through the resident-app invite flow is deliberately
-excluded — its members are already told by that flow's own invitation email, and they hold a
-resident-app registration link rather than a self-service pass link.
-
-`self-service-visitor.hbs` grew a contractor shape rather than a second template: Company and
-Contractor Type on, passenger count, arrival time, duration and purpose off. Its context, its
-subject line and the NRIC mask moved into `self-service-email.util.ts`, which all three senders
-now share.
-
-New public `resendSelfServicePass` controller, behind
-`POST /api/visitor-transactions/self-service/resend/:id`. An address already on a record can never
-be redirected — a supplied one is only accepted for a record whose `email` is blank, which is the
-case the links card's inline field exists for — and a 60-second per-record cooldown sits on top of
-the route's per-IP limiter. The route now only ever accepts self-service records: registration
-stamps every lead and member row with `source: "self-service"`, and the resend lookup filters on
-it, so a public caller can no longer read, re-address or resend a staff-created walk-in, delivery
-or resident-app invite via a guessed or harvested id — a non-self-service id answers the same 404
-as one that does not exist at all.
-
-`schemaSelfServiceVisitor.members[]` accepts `email` and now requires it. Both the lead's and each
-member's email in that schema deliberately validate with `tlds: { allow: false }` — the client-side
-check and the resend route's own check both use a looser regex with no IANA TLD list, and a
-mismatch would 400 an entire submission over a field the contractor can no longer see once the
-members dialog has closed. The mail server stays the real judge of deliverability.

package/.changeset/vehicle-anpr-revoke-safety.md

@@ -1,11 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Vehicle management: make deleting and editing a vehicle safe against the ANPR cameras.
-
-Deleting a vehicle no longer reports success when the plate is still on a camera. `bypass` now defaults to false, `removePlateNumber` returns an explicit per-camera outcome instead of swallowing its error, and a delete that cannot be confirmed on every camera holding the plate is refused with the record left intact so it can be retried. A site with no ANPR camera has nothing to revoke and now deletes successfully instead of failing with "No site cameras found."
-
-Each camera is asked for its own record id before the removal, because a Dahua `recNo` is a per-device sequence number and the one stored on the vehicle only matches whichever camera was written last. Editing only the vehicle's name now removes the old whitelist record before inserting the new one, instead of leaving the previous entry on the camera for good.
-
-Also: `pullVehicleByRecNo` is scoped to the person or site the plate belongs to (it matched on the record id alone, which is not unique across devices), the paginated camera lookups no longer skip their last page, and editing or deleting a vehicle now requires `vehicle-mgmt:update-vehicle` / `vehicle-mgmt:delete-vehicle` on the server, matching the gate the apps already apply in the browser.

package/.changeset/vehicle-create-fail-closed.md

@@ -1,10 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Vehicle ANPR: create now fails closed, an unregistered vehicle can be deleted, and camera errors are readable
-
-- `add()` no longer reports "added to whitelist successfully" when nothing was written to a camera. Camera failures are collected per camera, any plate already written is taken back off, and the whole create is refused. A site with no active ANPR camera saves the vehicle but says plainly that the barrier does not know about it.
-- Deleting a vehicle with a blank or missing `recno` is no longer rejected by request validation. The per-camera revoke guarantee is unchanged.
-- Dahua's own reply (`Invalid Authority!`, `{"ErrorCode":...}`) is logged server-side and no longer put into the message the operator sees, on create, approve and edit.
-- Editing a vehicle restores the previous plate on the camera if the re-insert fails, instead of leaving the resident locked out by a change the database then rolls back.

package/.changeset/vehicle-deleted-plates-and-alert-pacing.md

@@ -1,10 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Vehicle management: a deleted plate is gone from every list, a plate with no camera record can be deleted, and a camera blip no longer raises an alarm
-
-- Deleting a vehicle is a soft delete, and no read path filtered on it — so the row never disappeared from the vehicle list, still sat on the blocklist (still stopping the car at the barrier), still filled the by-unit lookup, the season-pass options and the row counts, and still blocked re-creating that plate number. `getVehicles`, `getBlocklistedVehicles`, `getBlocklistedVehicleByPlateNumber`, `getAllVehiclesByUnitId` and `getSeasonPassTypes` now exclude deleted records, and `getVehicleById` drops deleted sibling plates. An explicit `status=deleted` is still honoured, which is the only way to look at them.
-- Creating a vehicle no longer refuses a plate number that only exists on a deleted record. A live duplicate is still refused.
-- The two database writes at the end of a delete ran together on one session inside one transaction; they now run in order. The person-side failure no longer reports itself as an NRIC problem and logs its real cause.
-- An ANPR camera alert now waits for the third consecutive failed reconnect instead of the first. Writing a plate to a camera drops that camera's own event stream while the device services the write, so a successful "add vehicle" raised "the camera is not responding — ask your site technician" at the exact moment it succeeded.