@7365admin1/core 3.52.5 → 3.52.6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.5",
+  "version": "3.52.6",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/bulk-upsert-fail-closed.test.mjs

@@ -0,0 +1,134 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { sweepExpiredVehicles } from "./.build/utils/expired-vehicle-sweep.util.mjs";
+
+/**
+ * The production defect this covers: `bulkUpsertVehicles` (spreadsheet import)
+ * wrote EVERY row to the database whatever the cameras answered. The only thing
+ * read from the device reply was a `recNo`, which is simply `undefined` on a
+ * 401/500/no-answer — so an imported BLOCKLIST plate that no camera ever
+ * accepted was saved as blocked while the car still opened the barrier.
+ *
+ * The service now runs the rows through `sweepExpiredVehicles` — the same
+ * all-cameras-must-confirm decision manual delete, the expired-vehicle cron and
+ * the visitor sweep already share — with the device call being ADD instead of
+ * REMOVE, and saves only the rows it returns as confirmed.
+ *
+ * These tests drive that exact composition: light {index, site, plate} rows in,
+ * a savable/skipped partition out, re-associated to the real rows by index.
+ */
+
+const cameraLabel = (camera) => camera.name;
+
+/** How the service builds the sweep rows: the index is the join key. */
+const sweepRowsFor = (values, site) =>
+  values.map((value, index) => ({
+    _id: String(index),
+    site,
+    plateNumber: value.plateNumber,
+  }));
+
+/** How the service picks what to save. */
+const savableFrom = (values, savableIds) => {
+  const savable = new Set(savableIds);
+  return values.filter((_, index) => savable.has(String(index)));
+};
+
+test("a row no camera accepted is NOT saved", async () => {
+  const values = [
+    { plateNumber: "GOOD111", type: "whitelist" },
+    { plateNumber: "BAD222", type: "blocklist" },
+  ];
+  const cameras = [{ name: "entry" }];
+
+  const { deletableIds, skipped } = await sweepExpiredVehicles(
+    sweepRowsFor(values, "siteA"),
+    {
+      camerasForSite: async () => cameras,
+      cameraLabel,
+      revoke: async (_camera, row) =>
+        values[Number(row._id)].plateNumber === "BAD222"
+          ? { ok: false, reason: "the camera could not be reached" }
+          : { ok: true, reason: "" },
+    },
+  );
+
+  assert.deepEqual(
+    savableFrom(values, deletableIds).map((v) => v.plateNumber),
+    ["GOOD111"],
+  );
+  assert.equal(skipped.length, 1);
+  assert.equal(skipped[0].plateNumber, "BAD222");
+  assert.deepEqual(skipped[0].failures, [
+    { camera: "entry", reason: "the camera could not be reached" },
+  ]);
+});
+
+test("one camera refusing is enough to hold the whole row back", async () => {
+  const values = [{ plateNumber: "AAA111", type: "blocklist" }];
+
+  const { deletableIds, skipped } = await sweepExpiredVehicles(
+    sweepRowsFor(values, "siteA"),
+    {
+      camerasForSite: async () => [{ name: "entry" }, { name: "exit" }],
+      cameraLabel,
+      revoke: async (camera) =>
+        camera.name === "exit"
+          ? { ok: false, reason: "the camera could not be reached" }
+          : { ok: true, reason: "" },
+    },
+  );
+
+  assert.deepEqual(deletableIds, []);
+  assert.deepEqual(savableFrom(values, deletableIds), []);
+  // The camera that DID take it is the one the service then rolls back, so the
+  // plate is not left live on a barrier with no record of it anywhere.
+  assert.equal(skipped[0].failures.length, 1);
+  assert.equal(skipped[0].failures[0].camera, "exit");
+});
+
+test("the failed row does not shift the rows around it", async () => {
+  const values = [
+    { plateNumber: "AAA111" },
+    { plateNumber: "BBB222" },
+    { plateNumber: "CCC333" },
+  ];
+
+  const { deletableIds, skipped } = await sweepExpiredVehicles(
+    sweepRowsFor(values, "siteA"),
+    {
+      camerasForSite: async () => [{ name: "entry" }],
+      cameraLabel,
+      revoke: async (_camera, row) =>
+        row._id === "1"
+          ? { ok: false, reason: "the camera could not be reached" }
+          : { ok: true, reason: "" },
+    },
+  );
+
+  assert.deepEqual(
+    savableFrom(values, deletableIds).map((v) => v.plateNumber),
+    ["AAA111", "CCC333"],
+  );
+  assert.deepEqual(
+    skipped.map((entry) => entry.plateNumber),
+    ["BBB222"],
+  );
+});
+
+test("every camera confirming saves every row", async () => {
+  const values = [{ plateNumber: "AAA111" }, { plateNumber: "BBB222" }];
+
+  const { deletableIds, skipped } = await sweepExpiredVehicles(
+    sweepRowsFor(values, "siteA"),
+    {
+      camerasForSite: async () => [{ name: "entry" }],
+      cameraLabel,
+      revoke: async () => ({ ok: true, reason: "" }),
+    },
+  );
+
+  assert.equal(savableFrom(values, deletableIds).length, 2);
+  assert.deepEqual(skipped, []);
+});

package/test/expired-vehicle-filter.test.mjs

@@ -0,0 +1,114 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  expiredVehicleSweepFilter,
+  MVehicle,
+  VehicleStatus,
+} from "./.build/models/vehicle.model.mjs";
+
+// The live defect. `end` is written as a BSON Date, but both sweep queries
+// compared it against `new Date().toISOString()` - a String. String sorts
+// before Date in BSON type order, so a Date is never `$lte` a String: the
+// hourly cron selected NOTHING and an expired season pass kept opening the
+// barrier. Measured read-only on staging on 2026-09-02: the old query returned
+// 0 rows while 3 vehicles with a real past `end` were still live.
+const sweptAt = new Date("2026-09-02T10:00:00.000Z");
+const filter = expiredVehicleSweepFilter(sweptAt);
+
+// Enough of a matcher for the operators this filter uses. `$type: "date"` is
+// the whole point of the fix, so it is checked the way Mongo checks it: on the
+// stored BSON type, not on whether the value looks like a date.
+const bsonType = (v) => {
+  if (v === undefined) return "missing";
+  if (v === null) return "null";
+  if (v instanceof Date) return "date";
+  return typeof v === "string" ? "string" : typeof v;
+};
+
+const matches = (query, doc) =>
+  Object.entries(query).every(([key, want]) => {
+    const got = doc[key];
+    if (want && typeof want === "object" && !(want instanceof Date)) {
+      if ("$type" in want && bsonType(got) !== want.$type) return false;
+      if ("$lte" in want && !(got !== undefined && got !== null && got <= want.$lte))
+        return false;
+      if ("$ne" in want && got === want.$ne) return false;
+      return true;
+    }
+    return got === want;
+  });
+
+const live = { status: VehicleStatus.ACTIVE };
+
+test("a genuinely expired vehicle IS selected by the sweep", () => {
+  assert.equal(
+    matches(filter, { ...live, end: new Date("2026-06-24T23:59:00.000Z") }),
+    true,
+  );
+});
+
+test("a vehicle whose expiry is in the future is NOT selected", () => {
+  assert.equal(
+    matches(filter, { ...live, end: new Date("2026-12-31T23:59:00.000Z") }),
+    false,
+  );
+});
+
+test("a vehicle with a blank expiry is NOT selected", () => {
+  // These are the ONLY rows the broken query ever matched - nine were deleted
+  // at one site in a single run on 2026-09-01. A vehicle with no expiry date
+  // is not an expired vehicle.
+  assert.equal(matches(filter, { ...live, end: "" }), false);
+});
+
+test("a vehicle with a missing expiry is NOT selected", () => {
+  assert.equal(matches(filter, { ...live }), false);
+  assert.equal(matches(filter, { ...live, end: null }), false);
+});
+
+test("a blank expiry is not selected even when it sorts before the sweep time", () => {
+  // The regression guard proper: under the old string comparison `"" <= now`
+  // was true, which is exactly how the nine rows were swept up.
+  assert.equal("" <= sweptAt.toISOString(), true);
+  assert.equal(matches(filter, { ...live, end: "" }), false);
+});
+
+test("an already-deleted vehicle is not swept again", () => {
+  assert.equal(
+    matches(filter, {
+      status: VehicleStatus.DELETED,
+      end: new Date("2026-06-24T23:59:00.000Z"),
+    }),
+    false,
+  );
+});
+
+// The other half of the same defect: where the `end: ""` rows came from.
+const base = {
+  plateNumber: "SGZ680",
+  type: "whitelist",
+  category: "resident",
+  site: "6923d6664150ca6a69b9f2b2",
+};
+
+test("a blank expiry is stored as a Date, never as an empty string", () => {
+  // `value.end ?? expiredDate` kept `""`, because `??` only falls through on
+  // null/undefined. That put a String into a Date field, which is what the
+  // broken query then matched.
+  const v = MVehicle({ ...base, end: "" });
+  assert.ok(v.end instanceof Date);
+  assert.equal(v.end.getUTCFullYear(), new Date().getUTCFullYear() + 10);
+  assert.equal(matches(filter, { ...v, status: VehicleStatus.ACTIVE }), false);
+});
+
+test("a null or absent expiry still takes the ten-year sentinel", () => {
+  assert.ok(MVehicle({ ...base, end: null }).end instanceof Date);
+  assert.ok(MVehicle({ ...base }).end instanceof Date);
+});
+
+test("a real expiry is still honoured verbatim", () => {
+  const v = MVehicle({ ...base, end: "2026-06-24T23:59:00.000Z" });
+  assert.equal(v.end.toISOString(), "2026-06-24T23:59:00.000Z");
+  assert.equal(matches(filter, { ...v, status: VehicleStatus.ACTIVE }), true);
+});