@7365admin1/core 3.52.6-staging.252 → 3.52.7-staging.253

package/.changeset/nfc-patrol-site-scope.md

@@ -0,0 +1,15 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the NFC patrol tag, route and settings endpoints to the caller's own estate.
+
+`/api/nfc-patrol-tag`, `/api/nfc-patrol-route` and `/api/nfc-patrol-settings`
+carried `requireAuth` and nothing more, and their three controllers held no
+authorization identifier of any kind, so any signed-in account on the platform
+could read and CHANGE another client's checkpoint register, patrol rounds and
+patrol settings. They now ask the same `requireSiteReach` -> `entitleSite`
+question the already-scoped `/api/nfc-patrol-log` and the rest of the
+site-scoped modules ask, and answer `404 Site not found.` The five `/public`
+mounts, which are reached without a credential while `ENFORCE_NFC_PUBLIC_AUTH`
+is off, are unchanged.

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @iservice365/core
 
+## 3.52.6
+
+### Patch Changes
+
+- 3c13b1f: Spreadsheet vehicle import is fail-closed. `bulkUpsertVehicles` wrote every row to the database whatever the ANPR cameras answered, so an imported blocklist plate that no camera accepted was saved as blocked while the car still opened the barrier. Rows are now run through the shared `sweepExpiredVehicles` decision — every camera must confirm — and only confirmed rows are saved; the rest are rolled back off any camera that did take them and returned in `failedRows` with the camera and the reason.
+- 33d649a: Fix the expired-vehicle sweep never matching a genuine expiry
+
+  `vehicles.end` is written as a BSON Date, but both `getAllExpiredVehicles` and
+  `deleteExpiredVehicles` compared it against `new Date().toISOString()` - a
+  String. String sorts before Date in BSON canonical type order, so a Date is
+  never `$lte` a String: the hourly cron has never selected a genuinely expired
+  vehicle, and a season pass that expired kept opening the barrier indefinitely.
+  Measured read-only on staging: the old query returned 0 rows while 3 vehicles
+  whose `end` had passed were still live.
+
+  The only rows it ever did match were the ones whose `end` was the string `""` -
+  no expiry at all - which is the opposite of the rule. Nine such rows were
+  deleted at one site in a single run on 2026-09-01.
+
+  Both queries now share `expiredVehicleSweepFilter(now)` in `vehicle.model.ts`,
+  which compares a Date with a Date and requires `$type: "date"`, so a blank or
+  missing expiry is never swept. `MVehicle` also no longer stores a blank expiry
+  as `""`: `value.end ?? expiredDate` kept the empty string because `??` only
+  falls through on null/undefined, which is where the non-Date values came from.
+  A blank expiry now takes the same createdAt + 10 years sentinel as a null one.
+
+  No backfill: existing rows are unchanged.
+
 ## 3.52.5
 
 ### Patch Changes

package/dist/index.d.ts

@@ -7662,6 +7662,41 @@ declare function useNfcPatrolTagService(): {
     updateNfcPatrolTagBySite: (updateType: "Configure" | "Reset" | "Edit", data: TNfcPatrolTagUpdateData) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's patrol TAGS.
+ *
+ * An NFC patrol tag is the physical disc screwed to a wall at a checkpoint. The
+ * row here is what maps the disc's UID to the checkpoint it stands for, so it is
+ * what turns a guard's tap into proof that they were at that spot.
+ *
+ * Every route on `/api/nfc-patrol-tag` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind, so being
+ * signed in anywhere on the platform was enough to list another client's
+ * checkpoint register, read one outright, add a tag to their estate, or - the
+ * sharp one - `Configure`/`Reset`/`Edit` an existing tag. Re-pointing a tag is
+ * not a read: the disc on the wall now stands for a different checkpoint, so a
+ * guard who walks the whole round is recorded as having missed part of it, or a
+ * guard who never left the lobby is recorded as having walked it.
+ *
+ * The estate is the scope and the rule is the existing `requireSiteReach` ->
+ * `entitleSite` that `/api/nfc-patrol-log` and the rest already use. No new
+ * mechanism.
+ *
+ *  - `POST /` names its site in the body (required by the schema it validates).
+ *  - `GET /` names its site in the query (required).
+ *  - `GET /:id` names only a record, so the site is read off the STORED tag.
+ *  - `PUT /` names its site in the body (`schemaNfcPatrolTagUpdateData` has
+ *    `site` required) and the site is part of the repository's FILTER in all
+ *    three update types (`{ site, tagID }` for Configure and Reset, `{ _id,
+ *    site }` for Edit), so a caller cannot name their own site and reach
+ *    somebody else's row: checking the body's site is the whole of it.
+ *
+ * `GET /` and `PUT /` are ALSO mounted at `/public` behind
+ * `requireSessionOrLegacyToken`, which is why they use
+ * `requireSiteReachIfSignedIn` - see that function for what stays open until
+ * `ENFORCE_NFC_PUBLIC_AUTH` is turned on. On the `requireAuth` mounts, which
+ * always populate `req.user`, it is the unconditional check.
+ */
 declare function useNfcPatrolTagController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -8200,6 +8235,46 @@ declare function useNfcPatrolRouteService(): {
     updateById: (id: string, data: TNfcPatrolRouteEdit) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's patrol ROUTES.
+ *
+ * A patrol route is the round itself: which checkpoints a guard must tap, in
+ * what order, on which days, starting at what times, and how many minutes late
+ * counts as late. It is the instruction the guard app reads and the standard the
+ * patrol log is graded against.
+ *
+ * Every route on `/api/nfc-patrol-route` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind.
+ * `requireAuth` proves a session exists; it makes no organisation or site
+ * decision. So being signed in anywhere on the platform was enough to read
+ * another client's rounds, add a round to their estate, or rewrite an existing
+ * one - and rewriting a round is not a read: drop its checkpoints and the
+ * estate's guards stop walking past the places the client is paying to have
+ * watched, while every patrol log still reports a clean sheet.
+ *
+ * The estate is the scope, and the rule is the existing `requireSiteReach` ->
+ * `entitleSite` that `/api/nfc-patrol-log`, `/api/occurrence-books`,
+ * `/api/work-orders`, `/api/feedbacks` and the rest already use. No new
+ * mechanism is introduced. The `customer.sites` branch is load-bearing here as
+ * it is on the patrol log: the people who walk and supervise these rounds are
+ * the contracted security agency's staff and hold no membership in the estate's
+ * own organisation.
+ *
+ *  - `POST /` names its site in the body (`schemaNfcPatrolRoute` has `site`
+ *    required), so the guard checks a site the request already names.
+ *  - `GET /` names its site in the query (required by the query schema).
+ *  - `GET /id/:id` names only a record, so the site is read off the STORED
+ *    route.
+ *  - `PATCH /id/:id` is checked TWICE, because `$set: value` includes `site`
+ *    and the filter is `{ _id }` alone - so this route can MOVE a round to
+ *    another estate. Both the round's current site and the destination site in
+ *    the body must be reachable, or a caller could park their own site's round
+ *    on somebody else's estate (or drag one of theirs onto ours).
+ *
+ * The two reads use `requireSiteReachIfSignedIn` because they are mounted
+ * behind `requireSessionOrLegacyToken`, not `requireAuth` - see that function
+ * for why, and for what stays open until `ENFORCE_NFC_PUBLIC_AUTH` is turned on.
+ */
 declare function useNfcPatrolRouteController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllBySite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -8496,6 +8571,27 @@ declare function useNfcPatrolSettingsService(): {
     updateNfcPatrolSettings: (site: string | ObjectId, value: TNfcPatrolSettingsUpdate) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's patrol SETTINGS.
+ *
+ * These settings decide how the estate's rounds are supervised: the reporting
+ * addresses the patrol summaries go to, and the thresholds a round is graded
+ * against. Both routes on `/api/nfc-patrol-settings` take the site straight out
+ * of the URL and neither made any organisation or site decision, so being signed
+ * in anywhere on the platform was enough to read another client's supervision
+ * settings, or to rewrite them - which is a quiet way to stop an estate's patrol
+ * reporting reaching the people who read it.
+ *
+ * The rule is the existing `requireSiteReach` -> `entitleSite` used by
+ * `/api/nfc-patrol-log` and the rest. No new mechanism. Both routes name their
+ * site in the URL, so the guard checks a site the request already names and no
+ * legitimate caller's contract changes.
+ *
+ * The read uses `requireSiteReachIfSignedIn` because it is mounted behind
+ * `requireSessionOrLegacyToken` rather than `requireAuth` - see that function
+ * for what stays open until `ENFORCE_NFC_PUBLIC_AUTH` is turned on. The WRITE is
+ * behind `requireAuth`, so it is scoped unconditionally.
+ */
 declare function useNfcPatrolSettingsController(): {
     getNfcPatrolSettingsBySite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateNfcPatrolSettings: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -26426,6 +26426,11 @@ async function siteReachOf(req) {
   }
   return { actor, canReach, only };
 }
+async function requireSiteReachIfSignedIn(req, site) {
+  if (!req.user)
+    return;
+  await requireSiteReach(req, site);
+}
 
 // src/controllers/member.controller.ts
 async function requireMemberOrg(req, org) {
@@ -70236,6 +70241,7 @@ function useNfcPatrolTagController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -70265,6 +70271,7 @@ function useNfcPatrolTagController() {
     const limit = parseInt(req.query.limit ?? "10");
     const site = req.query.site ?? "";
     try {
+      await requireSiteReachIfSignedIn(req, site);
       const data = await _getAll({
         page,
         limit,
@@ -70295,6 +70302,7 @@ function useNfcPatrolTagController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, payload.site);
       const { updateType, ...restBody } = payload;
       const result = await _updateNfcPatrolTagBySite(
         payload.updateType,
@@ -70323,6 +70331,7 @@ function useNfcPatrolTagController() {
     }
     try {
       const tag = await _getById(req.params.id);
+      await requireSiteReachIfSignedIn(req, tag?.site);
       res.status(200).json(tag);
       return;
     } catch (error2) {
@@ -73745,6 +73754,7 @@ function useNfcPatrolRouteController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -73778,6 +73788,7 @@ function useNfcPatrolRouteController() {
     const search = req.query.search ?? "";
     const filter = req.query.filter ?? "";
     try {
+      await requireSiteReachIfSignedIn(req, site);
       const data = await _getAllBySite({
         page,
         limit,
@@ -73810,6 +73821,7 @@ function useNfcPatrolRouteController() {
     }
     try {
       const nfcPatrolRoute = await _getById(value?.id, value?.isStart);
+      await requireSiteReachIfSignedIn(req, nfcPatrolRoute?.site);
       if (!nfcPatrolRoute) {
         throw new import_node_server_utils218.NotFoundError("NFC Patrol Route not found.");
       }
@@ -73831,6 +73843,9 @@ function useNfcPatrolRouteController() {
     ) : {};
     value.updatedBy = cookies["user"] || "";
     try {
+      const existing = await _getById(id);
+      await requireSiteReachIfSignedIn(req, existing?.site);
+      await requireSiteReachIfSignedIn(req, value?.site);
       const result = await _updateById(id, value);
       res.json(result);
       return;
@@ -75425,6 +75440,7 @@ function useNfcPatrolSettingsController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, site);
       const data = await _getNfcPatrolSettingsBySite(site);
       res.json(data);
       return;
@@ -75444,6 +75460,7 @@ function useNfcPatrolSettingsController() {
     const updatedBy = cookies["user"] || "";
     payload.updatedBy = updatedBy;
     try {
+      await requireSiteReachIfSignedIn(req, site);
       await _updateNfcPatrolSettings(site, payload);
       res.json({ message: "NFC patrol settings updated successfully." });
       return;