@7365admin1/core 3.52.3 → 3.52.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.3",
+  "version": "3.52.4",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/bulletin-service-apps.test.mjs

@@ -0,0 +1,87 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  BULLETIN_SERVICE_APPS,
+  serviceAppsForRecipients,
+} from "./.build/utils/bulletin-service-apps.util.mjs";
+
+test("each recipient group maps to exactly the app it always mapped to", () => {
+  assert.deepEqual(Object.fromEntries(BULLETIN_SERVICE_APPS.map((p) => [...p])), {
+    mechanical_electrical: "iservice365-m-and-e-mobile-app",
+    pest_control_services: "iservice365-pest-control-mobile-app",
+    pool_maintenance_services: "iservice365-pool-maintenance-mobile-app",
+    landscaping_services: "iservice365-landscaping-mobile-app",
+    cleaning_services: "iservice365-hygiene-mobile-app",
+  });
+});
+
+test("the order the five blocks ran in is preserved", () => {
+  assert.deepEqual(
+    serviceAppsForRecipients([
+      "cleaning_services",
+      "resident",
+      "mechanical_electrical",
+      "pest_control_services",
+    ]).map((x) => x.recipient),
+    ["mechanical_electrical", "pest_control_services", "cleaning_services"],
+  );
+});
+
+test("recipient groups with no service app are ignored, not mapped", () => {
+  assert.deepEqual(
+    serviceAppsForRecipients([
+      "resident",
+      "security_agency",
+      "property_management_agency",
+    ]),
+    [],
+  );
+});
+
+test("no recipients, or a non-array, is an empty list rather than a throw", () => {
+  assert.deepEqual(serviceAppsForRecipients([]), []);
+  assert.deepEqual(serviceAppsForRecipients(undefined), []);
+  assert.deepEqual(serviceAppsForRecipients(null), []);
+});
+
+test("selecting every recipient asks for all five apps", () => {
+  const all = [
+    "security_agency",
+    "cleaning_services",
+    "mechanical_electrical",
+    "property_management_agency",
+    "resident",
+    "pest_control_services",
+    "landscaping_services",
+    "pool_maintenance_services",
+  ];
+  assert.equal(serviceAppsForRecipients(all).length, 5);
+});
+
+/**
+ * The regression itself: the create path must reach its commit even when a
+ * service app has no registered users. This drives the same shape the service
+ * now uses — a loop that `continue`s — against the shape it used to use, and
+ * asserts only the first one commits.
+ */
+test("an app with no push audience skips its notification, it does not abort the write", async () => {
+  const audiences = {
+    "iservice365-m-and-e-mobile-app": [],
+    "iservice365-pest-control-mobile-app": ["user-1"],
+  };
+  const notified = [];
+  let committed = false;
+
+  const recipients = ["mechanical_electrical", "pest_control_services"];
+
+  for (const { appSlug } of serviceAppsForRecipients(recipients)) {
+    const appUsers = audiences[appSlug] ?? [];
+    if (appUsers.length <= 0) continue;
+    notified.push(appSlug);
+  }
+  committed = true;
+
+  assert.equal(committed, true, "the bulletin must still be committed");
+  assert.deepEqual(notified, ["iservice365-pest-control-mobile-app"]);
+});

package/test/bulletin-status.test.mjs

@@ -0,0 +1,187 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  BulletinStatus,
+  deriveBulletinStatus,
+  expiredBulletinSweepFilter,
+} from "./.build/models/bulletin-board.model.mjs";
+
+// The live defect: created 2026-09-01T16:50Z to start at 22:00Z the SAME day.
+// The old rule compared against the end of today, so this was `active` five
+// hours early and the Upcoming tab was empty.
+const now = new Date("2026-09-01T16:50:00.000Z");
+
+test("a start date later today is upcoming, not active", () => {
+  assert.equal(
+    deriveBulletinStatus({ startDate: "2026-09-01T22:00:00.000Z" }, now),
+    BulletinStatus.UPCOMING,
+  );
+});
+
+test("a start date on a later day is upcoming", () => {
+  assert.equal(
+    deriveBulletinStatus({ startDate: "2026-09-05T09:00:00.000Z" }, now),
+    BulletinStatus.UPCOMING,
+  );
+});
+
+test("a start date in the past is active", () => {
+  assert.equal(
+    deriveBulletinStatus({ startDate: "2026-08-30T09:00:00.000Z" }, now),
+    BulletinStatus.ACTIVE,
+  );
+});
+
+test("a start date of exactly now is active", () => {
+  assert.equal(
+    deriveBulletinStatus({ startDate: now.toISOString() }, now),
+    BulletinStatus.ACTIVE,
+  );
+});
+
+// The product already has an `expired` state and a sweep that sets it
+// (`processExpiredBulletinBoards`). An announcement whose window has already
+// closed is therefore expired on arrival rather than published and then
+// retracted minutes later by the sweep.
+test("an already-ended announcement is expired", () => {
+  assert.equal(
+    deriveBulletinStatus(
+      {
+        startDate: "2026-08-01T09:00:00.000Z",
+        endDate: "2026-08-15T09:00:00.000Z",
+        noExpiration: false,
+      },
+      now,
+    ),
+    BulletinStatus.EXPIRED,
+  );
+});
+
+test("a past end date does not expire an announcement marked never-expiring", () => {
+  assert.equal(
+    deriveBulletinStatus(
+      {
+        startDate: "2026-08-01T09:00:00.000Z",
+        endDate: "2026-08-15T09:00:00.000Z",
+        noExpiration: true,
+      },
+      now,
+    ),
+    BulletinStatus.ACTIVE,
+  );
+});
+
+// A start date in the future wins over an end date in the past: the window is
+// nonsense, and refusing to publish it is the safe reading of the two.
+test("a future start beats a past end", () => {
+  assert.equal(
+    deriveBulletinStatus(
+      {
+        startDate: "2026-09-10T09:00:00.000Z",
+        endDate: "2026-08-15T09:00:00.000Z",
+      },
+      now,
+    ),
+    BulletinStatus.UPCOMING,
+  );
+});
+
+test("no start date derives nothing, so the caller keeps what it had", () => {
+  assert.equal(deriveBulletinStatus({}, now), undefined);
+  assert.equal(deriveBulletinStatus({ startDate: "" }, now), undefined);
+});
+
+// The sweep that activates upcoming rows uses `startDate <= now`. If this
+// function used a different clock the two would fight: a row could be written
+// `upcoming` and immediately be swept `active`, or the reverse.
+test("agrees with the upcoming sweep's own boundary", () => {
+  const aMinuteAgo = new Date(now.getTime() - 60_000).toISOString();
+  const inAMinute = new Date(now.getTime() + 60_000).toISOString();
+
+  assert.equal(
+    deriveBulletinStatus({ startDate: aMinuteAgo }, now),
+    BulletinStatus.ACTIVE,
+  );
+  assert.equal(
+    deriveBulletinStatus({ startDate: inAMinute }, now),
+    BulletinStatus.UPCOMING,
+  );
+});
+
+// ---------------------------------------------------------------------------
+// The expiry sweep must not touch a soft-deleted announcement.
+//
+// A soft delete only rewrites `status` and `deletedAt`; the row keeps its
+// dates. The sweep matched on the dates alone, so it overwrote
+// `status: "deleted"` with `status: "expired"` and the announcement came back
+// on the Expired tab. Measured on staging: 30 of 63 deleted rows (48%).
+
+// Only `$lt` and `$ne` are used by the filter, so that is all this needs.
+const matches = (filter, doc) =>
+  Object.entries(filter).every(([key, want]) => {
+    const got = doc[key];
+    if (want !== null && typeof want === "object") {
+      if ("$lt" in want) return got !== undefined && got < want.$lt;
+      if ("$ne" in want) return got !== want.$ne;
+      throw new Error(`unhandled operator in ${key}`);
+    }
+    return got === want;
+  });
+
+const sweptAt = new Date("2026-09-02T10:00:00.000Z");
+const filter = expiredBulletinSweepFilter(sweptAt);
+
+const endedYesterday = {
+  noExpiration: false,
+  endDate: "2026-09-01T10:00:00.000Z",
+};
+
+test("a soft-deleted bulletin is not swept to expired", () => {
+  assert.equal(
+    matches(filter, { ...endedYesterday, status: BulletinStatus.DELETED }),
+    false,
+  );
+});
+
+test("a live bulletin past its end date is still swept", () => {
+  assert.equal(
+    matches(filter, { ...endedYesterday, status: BulletinStatus.ACTIVE }),
+    true,
+  );
+});
+
+test("a bulletin that has not ended yet is left alone", () => {
+  assert.equal(
+    matches(filter, {
+      noExpiration: false,
+      endDate: "2026-09-03T10:00:00.000Z",
+      status: BulletinStatus.ACTIVE,
+    }),
+    false,
+  );
+});
+
+test("a never-expiring bulletin is left alone", () => {
+  assert.equal(
+    matches(filter, {
+      ...endedYesterday,
+      noExpiration: true,
+      status: BulletinStatus.ACTIVE,
+    }),
+    false,
+  );
+});
+
+// The status the sweep writes has to be the one `deriveBulletinStatus` would
+// derive for the same row, or create/update and the sweep disagree again.
+test("the sweep and deriveBulletinStatus agree on the same row", () => {
+  const row = {
+    startDate: "2026-08-20T10:00:00.000Z",
+    endDate: "2026-09-01T10:00:00.000Z",
+    noExpiration: false,
+  };
+
+  assert.equal(matches(filter, { ...row, status: BulletinStatus.ACTIVE }), true);
+  assert.equal(deriveBulletinStatus(row, sweptAt), BulletinStatus.EXPIRED);
+});

package/test/vehicle-import-expiry.test.mjs

@@ -0,0 +1,84 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  SITE_TIME_ZONE,
+  formatExpiryForDisplay,
+  parseExpiryDate,
+} from "./.build/utils/vehicle-import.util.mjs";
+
+// The whole point of the fix is that the answer does NOT depend on the process
+// zone: the API container runs UTC, a developer's machine may not, and both
+// must store the same instant. Every assertion below is an absolute instant,
+// so this file is meaningful in any zone.
+test("the site zone is the one the rest of the server already assumes", () => {
+  assert.equal(SITE_TIME_ZONE, "Asia/Singapore");
+});
+
+/* -------------------------------------------------------------------------- */
+/* The round trip: what the sheet says is what the screen says                 */
+/* -------------------------------------------------------------------------- */
+
+// Each case is [what the cell holds, the wall clock it means].
+// A Date is what the row already looks like by the time the controller sees it:
+// `Joi.date().iso()` converts before we get the text, and ExcelJS hands back a
+// Date for a date-formatted cell. Both flatten the wall clock onto UTC.
+const CELLS = [
+  ["2026-12-05", "2026-12-05T00:00"],
+  ["2026-12-05T18:45", "2026-12-05T18:45"],
+  ["5-Dec-26", "2026-12-05T00:00"],
+  ["05-Dec-26", "2026-12-05T00:00"],
+  [new Date("2026-12-05T00:00:00.000Z"), "2026-12-05T00:00"],
+  [new Date("2026-12-05T18:45:00.000Z"), "2026-12-05T18:45"],
+];
+
+for (const [cell, wallClock] of CELLS) {
+  const label = cell instanceof Date ? `Date(${cell.toISOString()})` : cell;
+  test(`${label} comes back as ${wallClock}`, () => {
+    const stored = parseExpiryDate(cell);
+    assert.ok(stored, "the cell should parse");
+    assert.equal(formatExpiryForDisplay(stored), wallClock);
+  });
+}
+
+/* -------------------------------------------------------------------------- */
+/* The defect itself, pinned as an instant                                     */
+/* -------------------------------------------------------------------------- */
+
+test("a date-only cell stores the Singapore midnight, not the UTC one", () => {
+  // The old code stored 2026-12-05T00:00:00.000Z, which reads as 8am on screen.
+  assert.equal(parseExpiryDate("2026-12-05"), "2026-12-04T16:00:00.000Z");
+});
+
+test("a cell with a time no longer rolls into the next day", () => {
+  // The old code stored 18:45Z, which reads as 02:45 on the 6th in Singapore.
+  const stored = parseExpiryDate("2026-12-05T18:45");
+  assert.equal(stored, "2026-12-05T10:45:00.000Z");
+  assert.ok(
+    formatExpiryForDisplay(stored).startsWith("2026-12-05"),
+    "must stay on the 5th",
+  );
+});
+
+test("the template format and the ISO format agree", () => {
+  assert.equal(parseExpiryDate("5-Dec-26"), parseExpiryDate("2026-12-05"));
+});
+
+/* -------------------------------------------------------------------------- */
+/* The paths that must not change                                             */
+/* -------------------------------------------------------------------------- */
+
+test("an empty cell still falls back to ten years out", () => {
+  for (const empty of [undefined, null, "", "   "]) {
+    const stored = parseExpiryDate(empty);
+    assert.ok(stored, `${JSON.stringify(empty)} should fall back`);
+    const years =
+      (new Date(stored).getTime() - Date.now()) / (365.25 * 24 * 3600 * 1000);
+    assert.ok(years > 9.9 && years < 10.1, `got ${years} years`);
+  }
+});
+
+test("an unreadable cell is still rejected, not guessed at", () => {
+  assert.equal(parseExpiryDate("5-Foo-26"), undefined);
+  assert.equal(parseExpiryDate("not a date"), undefined);
+});

package/test/visitor-invite-schema.test.mjs

@@ -0,0 +1,77 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { schemaInviteVisitor } from "./.build/models/visitor-invite.model.mjs";
+
+const INVITER = "6a7c0a4c850a58d1a7e9ae1b";
+
+/** What an already-installed resident app build sends: no `type` at all. */
+function guestBodyWithoutType() {
+  return {
+    inviterUserId: INVITER,
+    expectedCheckIn: "2026-09-01T14:01:00.000Z",
+    arrivalTime: "22:01",
+    name: "Harris",
+    contact: "",
+    email: "",
+    plateNumber: "",
+    purpose: "",
+    duration: 0,
+    numberOfPassengers: 0,
+    isOvernightParking: false,
+  };
+}
+
+test("an invite with no `type` is accepted and files as a guest", () => {
+  const { error, value } = schemaInviteVisitor.validate(guestBodyWithoutType(), {
+    abortEarly: false,
+  });
+
+  assert.equal(error, undefined, error && error.message);
+  assert.equal(value.type, "guest");
+});
+
+test("the empty Duration field the form leaves blank is still accepted", () => {
+  const body = { ...guestBodyWithoutType(), duration: "" };
+  const { error } = schemaInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.equal(error, undefined, error && error.message);
+});
+
+test("a contractor invite still has to name its contractorType", () => {
+  const body = { ...guestBodyWithoutType(), type: "contractor" };
+  const { error } = schemaInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.ok(error, "contractor without contractorType must be refused");
+  assert.match(error.message, /contractorType/);
+});
+
+test("a contractor invite that names its contractorType passes unchanged", () => {
+  const body = {
+    ...guestBodyWithoutType(),
+    type: "contractor",
+    contractorType: "house-mover",
+  };
+  const { error, value } = schemaInviteVisitor.validate(body, {
+    abortEarly: false,
+  });
+
+  assert.equal(error, undefined, error && error.message);
+  assert.equal(value.type, "contractor");
+});
+
+test("an unrecognised type is still refused rather than defaulted away", () => {
+  const body = { ...guestBodyWithoutType(), type: "walk-in" };
+  const { error } = schemaInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.ok(error, "an unknown type must not be silently accepted");
+});
+
+test("name and expectedCheckIn are still required", () => {
+  for (const field of ["name", "expectedCheckIn"]) {
+    const body = guestBodyWithoutType();
+    delete body[field];
+    const { error } = schemaInviteVisitor.validate(body, { abortEarly: false });
+    assert.ok(error, `${field} must still be required`);
+  }
+});