@7365admin1/core 3.52.4 → 3.52.5-staging.250

package/.changeset/expired-vehicle-cron-per-site-fail-closed.md

@@ -0,0 +1,27 @@
+---
+"@7365admin1/core": patch
+---
+
+Revoke each expired vehicle's plate only from its own site's cameras, and fail closed
+
+The hourly expired-vehicle sweep declared its `siteCameras` array outside the
+per-vehicle loop and only ever pushed to it, so the list grew as the run went
+on: the second vehicle was revoked from its own site's cameras AND from the
+first vehicle's. `recNo` is a per-device sequence number, so those extra calls
+did not simply miss - they addressed whatever record carried that number on the
+other site's camera and took an unrelated, still-valid plate off the barrier.
+Cameras are now resolved per vehicle, cached by site id so each site is still
+paged only once per run.
+
+The sweep also marked every expired vehicle deleted with one blanket
+`updateMany`, regardless of what the cameras answered, so a record could read
+"deleted" while its plate still opened the gate. Only vehicles whose every
+camera confirmed are now marked deleted; the rest are left expired, logged at
+error level naming the vehicle, plate, site and camera, and retried on the next
+hourly run. `deleteExpiredVehicles` now requires the list of ids.
+
+Also: each camera is asked for its own record id before the removal (the same
+thing manual delete does), the ANPR list is chosen from the vehicle's type
+instead of always TRAFFIC_REDLIST, a site with no ANPR camera no longer aborts
+the whole run, and the transaction that wrapped nothing - the only write was
+issued without the session - has been removed.

package/.changeset/visitor-dahua-cron-fail-closed.md

@@ -0,0 +1,27 @@
+---
+"@7365admin1/core": patch
+---
+
+Fail closed in the visitor ANPR sweep, and remove the dead invitation transaction
+
+`processTransactionDahuaStatus`, the hourly job that takes an expired or
+checked-out visitor's plate off the site's ANPR camera, marked the transaction
+`dahuaSyncStatus: "removed"` on the line after the camera call and only skipped
+on a thrown error. `removePlateNumber` does not throw for a device failure - it
+returns an outcome object - so a camera answering 401 or 500, or not answering
+at all, still had the transaction recorded as removed while the visitor's plate
+was still on the barrier. Nothing retried it either, because the query that
+feeds the sweep skips anything already marked removed.
+
+It now uses the same decision logic as the expired-vehicle sweep: only a
+transaction every camera confirmed is marked removed, and the rest are logged at
+error level naming the plate, the site and the camera, then retried on the next
+run. Each camera is also asked for its own record id before the removal, which
+is what the old "not found" message sniff was reaching for and what stops a
+transaction whose record is already gone from being retried for ever.
+
+`checkExpiredInvitation` opened a session and a transaction and then issued
+every write without that session, never committing: the transaction protected no
+write and the rollback rolled back nothing. Each invitation is independent, so
+there is no invariant spanning them and nothing for a transaction to protect -
+it is removed rather than wired up.

package/dist/index.d.ts

@@ -2818,7 +2818,7 @@ declare function useVehicleRepo(): {
         pages: number;
         pageRange: string;
     }>;
-    deleteExpiredVehicles: (session?: ClientSession) => Promise<number>;
+    deleteExpiredVehicles: (ids: Array<string | ObjectId>, session?: ClientSession) => Promise<number>;
     getAllVehiclesByUnitId: ({ unitId, page, limit, sort, }: {
         unitId: string | ObjectId;
         page?: number | undefined;

package/dist/index.js

@@ -16202,27 +16202,21 @@ function useVerificationService() {
     }
   }
   async function checkExpiredInvitation() {
-    const session = import_node_server_utils34.useAtlas.getClient()?.startSession();
-    session?.startTransaction();
     try {
       const verifications = await _getByStatus("pending");
+      const now = Date.now();
       for (const verification of verifications) {
-        const expiration = new Date(verification.expireAt).getTime();
-        const now = (/* @__PURE__ */ new Date()).getTime();
-        if (now > expiration) {
+        if (now > new Date(verification.expireAt).getTime()) {
           await _updateStatusById(verification._id.toString(), "expired");
         }
       }
       return "Successfully checked for expired invitations.";
     } catch (error) {
-      await session?.abortTransaction();
       import_node_server_utils34.logger.log({
         level: "info",
         message: `Error checking expired user invitation: ${error}`
       });
       throw error;
-    } finally {
-      session?.endSession();
     }
   }
   return {
@@ -22041,11 +22035,15 @@ function useVehicleRepo() {
       throw error;
     }
   }
-  async function deleteExpiredVehicles(session) {
+  async function deleteExpiredVehicles(ids2, session) {
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
+      const _ids = (ids2 ?? []).map((id) => (0, import_node_server_utils50.toObjectId)(id)).filter((id) => Boolean(id));
+      if (!_ids.length)
+        return 0;
       const res = await collection.updateMany(
         {
+          _id: { $in: _ids },
           status: { $ne: "deleted" },
           end: { $exists: true, $lte: now }
           // check only end
@@ -22528,6 +22526,10 @@ function anprRevokeThrew(error) {
     detail: message || "the request threw with no message"
   };
 }
+var ANPR_NOTHING_TO_REVOKE = {
+  ok: true,
+  reason: ""
+};
 function cameraFailureSentence(options) {
   const { failures, operation, outcome, consequence } = options;
   return `The plate number could not be ${operation} ${cameraCount(failures.length)}: ${cameraDetail(failures)}. The vehicle has NOT been ${outcome} \u2014 ${consequence}. Please check the ${failures.length === 1 ? "camera" : "cameras"} and try again.`;
@@ -23340,7 +23342,7 @@ function useDahuaService() {
     }
     try {
       value.owner = String(value.owner ?? "").replace(/['"]/g, "").replace(/[\/\\]/g, " - ").substring(0, 15).trim() || "unknown";
-      const formatDahuaDate2 = (dateStr, fallbackYearsAhead = 0) => {
+      const formatDahuaDate3 = (dateStr, fallbackYearsAhead = 0) => {
         const date = dateStr ? new Date(dateStr) : /* @__PURE__ */ new Date();
         if (!dateStr) {
           date.setMinutes(date.getMinutes() - 10);
@@ -23351,8 +23353,8 @@ function useDahuaService() {
         const pad = (num) => String(num).padStart(2, "0");
         return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
       };
-      const formattedStart = formatDahuaDate2(value.start);
-      const formattedEnd = formatDahuaDate2(value.end, 10);
+      const formattedStart = formatDahuaDate3(value.start);
+      const formattedEnd = formatDahuaDate3(value.end, 10);
       const beginTime = encodeURIComponent(formattedStart);
       const cancelTime = encodeURIComponent(formattedEnd);
       const plateNumber = encodeURIComponent(value.plateNumber);
@@ -35317,6 +35319,70 @@ function useBuildingUnitRepo() {
   };
 }
 
+// src/utils/expired-vehicle-sweep.util.ts
+async function sweepExpiredVehicles(vehicles, deps) {
+  const { camerasForSite, revoke, cameraLabel: cameraLabel2 } = deps;
+  const deletableIds = [];
+  const skipped = [];
+  const bySite = /* @__PURE__ */ new Map();
+  for (const vehicle of vehicles) {
+    const id = String(vehicle?._id ?? "");
+    const site = String(vehicle?.site ?? "");
+    const plateNumber = String(vehicle?.plateNumber ?? "");
+    if (!site) {
+      skipped.push({
+        id,
+        site,
+        plateNumber,
+        failures: [
+          { camera: "unknown", reason: "the vehicle has no site on record" }
+        ]
+      });
+      continue;
+    }
+    let cameras = bySite.get(site);
+    if (!cameras) {
+      try {
+        cameras = await camerasForSite(site);
+      } catch (error) {
+        skipped.push({
+          id,
+          site,
+          plateNumber,
+          failures: [
+            {
+              camera: "unknown",
+              reason: "the site's cameras could not be listed"
+            }
+          ]
+        });
+        continue;
+      }
+      bySite.set(site, cameras);
+    }
+    const failures = [];
+    for (const camera of cameras) {
+      const outcome = await revoke(camera, vehicle);
+      if (!outcome?.ok) {
+        failures.push({
+          camera: cameraLabel2(camera),
+          reason: outcome?.reason || "the camera could not be reached"
+        });
+      }
+    }
+    if (failures.length) {
+      skipped.push({ id, site, plateNumber, failures });
+      continue;
+    }
+    deletableIds.push(id);
+  }
+  return { deletableIds, skipped };
+}
+function sweepSkipLine(entry) {
+  const detail = entry.failures.map((failure) => `${failure.camera} (${failure.reason})`).join(", ");
+  return `processDeletingExpiredVehicles NOT deleting vehicle ${entry.id} (plate ${JSON.stringify(entry.plateNumber)}, site ${entry.site}): ${detail}. The plate may still open the barrier, so the record is left expired and will be retried on the next run.`;
+}
+
 // src/services/vehicle.service.ts
 function formatDahuaDate(date) {
   const pad = (n) => String(n).padStart(2, "0");
@@ -35793,17 +35859,10 @@ function useVehicleService() {
     }
   }
   async function processDeletingExpiredVehicles() {
-    const session = import_node_server_utils99.useAtlas.getClient()?.startSession();
-    if (!session) {
-      throw new Error("Unable to start session for vehicle service.");
-    }
-    try {
-      session.startTransaction();
-      const vehicles = await _getAllExpiredVehicles();
-      let siteCameras = [];
-      for (const vehicle of vehicles) {
-        const site = vehicle.site;
-        const recno = vehicle.recNo;
+    const vehicles = await _getAllExpiredVehicles();
+    const { deletableIds, skipped } = await sweepExpiredVehicles(vehicles, {
+      camerasForSite: async (site) => {
+        const cameras = [];
         let page = 1;
         let pages = 1;
         const limit = 20;
@@ -35811,44 +35870,72 @@ function useVehicleService() {
           const siteCameraReq = await _getAllSiteCameras({
             site,
             type: "anpr",
-            direction: ["both", "entry"],
             page,
             limit
           });
           pages = siteCameraReq.pages || 1;
-          siteCameras.push(...siteCameraReq.items);
+          cameras.push(...siteCameraReq.items);
           page++;
         } while (page <= pages);
-        if (!siteCameras.length) {
-          throw new import_node_server_utils99.BadRequestError("No site cameras found.");
+        return cameras;
+      },
+      revoke: async (camera, vehicle) => {
+        const host = camera.host;
+        const username = camera.username;
+        const password = camera.password;
+        const mode = vehicle?.type !== "whitelist" /* WHITELIST */ ? "TrafficBlackList" /* TRAFFIC_BLACKLIST */ : "TrafficRedList" /* TRAFFIC_REDLIST */;
+        const plateNumber = String(vehicle?.plateNumber ?? "");
+        let recnoForCamera = String(vehicle?.recNo ?? "");
+        if (plateNumber) {
+          try {
+            const found = parseDahuaFind(
+              await _getPlateNumber({
+                host,
+                username,
+                password,
+                mode,
+                plateNumber,
+                requireOk: true
+              }) ?? ""
+            );
+            if (!found.exists)
+              return ANPR_NOTHING_TO_REVOKE;
+            if (found.recNo)
+              recnoForCamera = found.recNo;
+          } catch (error) {
+            const outcome2 = anprRevokeThrew(error);
+            logCameraFailure("expiredVehicle lookup", camera, outcome2.detail);
+            return outcome2;
+          }
         }
-        for (const camera of siteCameras) {
-          const host = camera.host;
-          const username = camera.username;
-          const password = camera.password;
-          const dahuaPayload = {
-            host,
-            username,
-            password,
-            recno,
-            mode: "TrafficRedList" /* TRAFFIC_REDLIST */
-          };
-          await _removePlateNumber(dahuaPayload);
+        if (!recnoForCamera)
+          return ANPR_NOTHING_TO_REVOKE;
+        const outcome = await _removePlateNumber({
+          host,
+          username,
+          password,
+          recno: recnoForCamera,
+          mode
+        }).catch((error) => anprRevokeThrew(error));
+        if (!outcome?.ok) {
+          logCameraFailure(
+            "expiredVehicle revoke",
+            camera,
+            outcome?.detail ?? "no outcome returned"
+          );
         }
-      }
-      await _deleteExpiredVehicles();
-      await session.commitTransaction();
-      return `Expired Vehicle plate numbers deleted successfully.`;
-    } catch (error) {
-      import_node_server_utils99.logger.error(
-        "Error in vehicle service process deleting expired vehicles:",
-        error
-      );
-      await session.abortTransaction();
-      throw error;
-    } finally {
-      session.endSession();
+        return outcome ?? anprRevokeThrew("no outcome returned");
+      },
+      cameraLabel
+    });
+    for (const entry of skipped) {
+      import_node_server_utils99.logger.error(sweepSkipLine(entry));
     }
+    const deleted = deletableIds.length ? await _deleteExpiredVehicles(deletableIds) : 0;
+    import_node_server_utils99.logger.info(
+      `processDeletingExpiredVehicles: ${vehicles.length} expired, ${deleted} deleted, ${skipped.length} left for the next run.`
+    );
+    return `Expired Vehicle plate numbers deleted successfully.`;
   }
   async function reactivateVehicleById(id, orgId, siteId) {
     const session = import_node_server_utils99.useAtlas.getClient()?.startSession();
@@ -51921,42 +52008,55 @@ function useVisitorTransactionService() {
           );
           if (!transactions.length)
             continue;
-          const successfulIds = [];
-          const batchSize = 5;
-          for (let i = 0; i < transactions.length; i += batchSize) {
-            const batch = transactions.slice(i, i + batchSize);
-            await Promise.all(
-              batch.map(async (transaction) => {
-                try {
-                  const dahuaPayload = {
-                    host: camera.host,
-                    username: camera.username,
-                    password: camera.password,
-                    mode: "TrafficRedList" /* TRAFFIC_REDLIST */,
-                    recno: transaction.recNo
-                  };
-                  await _removePlateNumber(dahuaPayload);
-                  successfulIds.push(transaction._id);
-                } catch (error) {
-                  const message = String(error?.message || "").toLowerCase();
-                  const isNotFound = message.includes("not found") || message.includes("does not exist") || message.includes("no record");
-                  if (isNotFound) {
-                    import_node_server_utils134.logger.warn(
-                      `Dahua record already missing for transaction ${transaction._id}, marking as removed.`
+          const { deletableIds, skipped } = await sweepExpiredVehicles(
+            transactions,
+            {
+              camerasForSite: async () => [camera],
+              revoke: async (anprCamera, transaction) => {
+                const credentials = {
+                  host: anprCamera.host,
+                  username: anprCamera.username,
+                  password: anprCamera.password,
+                  mode: "TrafficRedList" /* TRAFFIC_REDLIST */
+                };
+                let recno = String(transaction?.recNo ?? "");
+                const plateNumber = String(transaction?.plateNumber ?? "");
+                if (plateNumber) {
+                  try {
+                    const found = parseDahuaFind(
+                      await _getPlateNumber({
+                        ...credentials,
+                        plateNumber,
+                        requireOk: true
+                      }) ?? ""
                     );
-                    successfulIds.push(transaction._id);
-                    return;
+                    if (!found.exists)
+                      return ANPR_NOTHING_TO_REVOKE;
+                    if (found.recNo)
+                      recno = found.recNo;
+                  } catch (error) {
+                    return anprRevokeThrew(error);
                   }
-                  import_node_server_utils134.logger.error(
-                    `Failed to remove plate for transaction ${transaction._id}`,
-                    error
-                  );
                 }
-              })
+                if (!recno)
+                  return ANPR_NOTHING_TO_REVOKE;
+                return await _removePlateNumber({
+                  ...credentials,
+                  recno
+                }).catch((error) => anprRevokeThrew(error));
+              },
+              cameraLabel
+            }
+          );
+          for (const entry of skipped) {
+            import_node_server_utils134.logger.error(
+              `processTransactionDahuaStatus NOT marking transaction ${entry.id} removed (plate ${JSON.stringify(
+                entry.plateNumber
+              )}, site ${entry.site}): ` + entry.failures.map((failure) => `${failure.camera} (${failure.reason})`).join(", ") + `. The plate may still open the barrier, so the record is left unsynced and will be retried on the next run.`
             );
           }
-          if (successfulIds.length > 0) {
-            await _updateManyDahuaSyncStatus(successfulIds, "removed");
+          if (deletableIds.length > 0) {
+            await _updateManyDahuaSyncStatus(deletableIds, "removed");
           }
         }
         page++;