@7365admin1/core 3.52.6 → 3.52.7-staging.253

package/.changeset/nfc-patrol-site-scope.md

@@ -0,0 +1,15 @@
+---
+"@7365admin1/core": patch
+---
+
+Scope the NFC patrol tag, route and settings endpoints to the caller's own estate.
+
+`/api/nfc-patrol-tag`, `/api/nfc-patrol-route` and `/api/nfc-patrol-settings`
+carried `requireAuth` and nothing more, and their three controllers held no
+authorization identifier of any kind, so any signed-in account on the platform
+could read and CHANGE another client's checkpoint register, patrol rounds and
+patrol settings. They now ask the same `requireSiteReach` -> `entitleSite`
+question the already-scoped `/api/nfc-patrol-log` and the rest of the
+site-scoped modules ask, and answer `404 Site not found.` The five `/public`
+mounts, which are reached without a credential while `ENFORCE_NFC_PUBLIC_AUTH`
+is off, are unchanged.

package/dist/index.d.ts

@@ -7662,6 +7662,41 @@ declare function useNfcPatrolTagService(): {
     updateNfcPatrolTagBySite: (updateType: "Configure" | "Reset" | "Edit", data: TNfcPatrolTagUpdateData) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's patrol TAGS.
+ *
+ * An NFC patrol tag is the physical disc screwed to a wall at a checkpoint. The
+ * row here is what maps the disc's UID to the checkpoint it stands for, so it is
+ * what turns a guard's tap into proof that they were at that spot.
+ *
+ * Every route on `/api/nfc-patrol-tag` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind, so being
+ * signed in anywhere on the platform was enough to list another client's
+ * checkpoint register, read one outright, add a tag to their estate, or - the
+ * sharp one - `Configure`/`Reset`/`Edit` an existing tag. Re-pointing a tag is
+ * not a read: the disc on the wall now stands for a different checkpoint, so a
+ * guard who walks the whole round is recorded as having missed part of it, or a
+ * guard who never left the lobby is recorded as having walked it.
+ *
+ * The estate is the scope and the rule is the existing `requireSiteReach` ->
+ * `entitleSite` that `/api/nfc-patrol-log` and the rest already use. No new
+ * mechanism.
+ *
+ *  - `POST /` names its site in the body (required by the schema it validates).
+ *  - `GET /` names its site in the query (required).
+ *  - `GET /:id` names only a record, so the site is read off the STORED tag.
+ *  - `PUT /` names its site in the body (`schemaNfcPatrolTagUpdateData` has
+ *    `site` required) and the site is part of the repository's FILTER in all
+ *    three update types (`{ site, tagID }` for Configure and Reset, `{ _id,
+ *    site }` for Edit), so a caller cannot name their own site and reach
+ *    somebody else's row: checking the body's site is the whole of it.
+ *
+ * `GET /` and `PUT /` are ALSO mounted at `/public` behind
+ * `requireSessionOrLegacyToken`, which is why they use
+ * `requireSiteReachIfSignedIn` - see that function for what stays open until
+ * `ENFORCE_NFC_PUBLIC_AUTH` is turned on. On the `requireAuth` mounts, which
+ * always populate `req.user`, it is the unconditional check.
+ */
 declare function useNfcPatrolTagController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -8200,6 +8235,46 @@ declare function useNfcPatrolRouteService(): {
     updateById: (id: string, data: TNfcPatrolRouteEdit) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's patrol ROUTES.
+ *
+ * A patrol route is the round itself: which checkpoints a guard must tap, in
+ * what order, on which days, starting at what times, and how many minutes late
+ * counts as late. It is the instruction the guard app reads and the standard the
+ * patrol log is graded against.
+ *
+ * Every route on `/api/nfc-patrol-route` carried `requireAuth` and nothing more,
+ * and this controller held no authorization identifier of any kind.
+ * `requireAuth` proves a session exists; it makes no organisation or site
+ * decision. So being signed in anywhere on the platform was enough to read
+ * another client's rounds, add a round to their estate, or rewrite an existing
+ * one - and rewriting a round is not a read: drop its checkpoints and the
+ * estate's guards stop walking past the places the client is paying to have
+ * watched, while every patrol log still reports a clean sheet.
+ *
+ * The estate is the scope, and the rule is the existing `requireSiteReach` ->
+ * `entitleSite` that `/api/nfc-patrol-log`, `/api/occurrence-books`,
+ * `/api/work-orders`, `/api/feedbacks` and the rest already use. No new
+ * mechanism is introduced. The `customer.sites` branch is load-bearing here as
+ * it is on the patrol log: the people who walk and supervise these rounds are
+ * the contracted security agency's staff and hold no membership in the estate's
+ * own organisation.
+ *
+ *  - `POST /` names its site in the body (`schemaNfcPatrolRoute` has `site`
+ *    required), so the guard checks a site the request already names.
+ *  - `GET /` names its site in the query (required by the query schema).
+ *  - `GET /id/:id` names only a record, so the site is read off the STORED
+ *    route.
+ *  - `PATCH /id/:id` is checked TWICE, because `$set: value` includes `site`
+ *    and the filter is `{ _id }` alone - so this route can MOVE a round to
+ *    another estate. Both the round's current site and the destination site in
+ *    the body must be reachable, or a caller could park their own site's round
+ *    on somebody else's estate (or drag one of theirs onto ours).
+ *
+ * The two reads use `requireSiteReachIfSignedIn` because they are mounted
+ * behind `requireSessionOrLegacyToken`, not `requireAuth` - see that function
+ * for why, and for what stays open until `ENFORCE_NFC_PUBLIC_AUTH` is turned on.
+ */
 declare function useNfcPatrolRouteController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllBySite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -8496,6 +8571,27 @@ declare function useNfcPatrolSettingsService(): {
     updateNfcPatrolSettings: (site: string | ObjectId, value: TNfcPatrolSettingsUpdate) => Promise<string>;
 };
 
+/**
+ * Who may see, or change, one estate's patrol SETTINGS.
+ *
+ * These settings decide how the estate's rounds are supervised: the reporting
+ * addresses the patrol summaries go to, and the thresholds a round is graded
+ * against. Both routes on `/api/nfc-patrol-settings` take the site straight out
+ * of the URL and neither made any organisation or site decision, so being signed
+ * in anywhere on the platform was enough to read another client's supervision
+ * settings, or to rewrite them - which is a quiet way to stop an estate's patrol
+ * reporting reaching the people who read it.
+ *
+ * The rule is the existing `requireSiteReach` -> `entitleSite` used by
+ * `/api/nfc-patrol-log` and the rest. No new mechanism. Both routes name their
+ * site in the URL, so the guard checks a site the request already names and no
+ * legitimate caller's contract changes.
+ *
+ * The read uses `requireSiteReachIfSignedIn` because it is mounted behind
+ * `requireSessionOrLegacyToken` rather than `requireAuth` - see that function
+ * for what stays open until `ENFORCE_NFC_PUBLIC_AUTH` is turned on. The WRITE is
+ * behind `requireAuth`, so it is scoped unconditionally.
+ */
 declare function useNfcPatrolSettingsController(): {
     getNfcPatrolSettingsBySite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateNfcPatrolSettings: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -26426,6 +26426,11 @@ async function siteReachOf(req) {
   }
   return { actor, canReach, only };
 }
+async function requireSiteReachIfSignedIn(req, site) {
+  if (!req.user)
+    return;
+  await requireSiteReach(req, site);
+}
 
 // src/controllers/member.controller.ts
 async function requireMemberOrg(req, org) {
@@ -70236,6 +70241,7 @@ function useNfcPatrolTagController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -70265,6 +70271,7 @@ function useNfcPatrolTagController() {
     const limit = parseInt(req.query.limit ?? "10");
     const site = req.query.site ?? "";
     try {
+      await requireSiteReachIfSignedIn(req, site);
       const data = await _getAll({
         page,
         limit,
@@ -70295,6 +70302,7 @@ function useNfcPatrolTagController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, payload.site);
       const { updateType, ...restBody } = payload;
       const result = await _updateNfcPatrolTagBySite(
         payload.updateType,
@@ -70323,6 +70331,7 @@ function useNfcPatrolTagController() {
     }
     try {
       const tag = await _getById(req.params.id);
+      await requireSiteReachIfSignedIn(req, tag?.site);
       res.status(200).json(tag);
       return;
     } catch (error2) {
@@ -73745,6 +73754,7 @@ function useNfcPatrolRouteController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, value.site);
       const data = await _add(value);
       res.status(201).json(data);
       return;
@@ -73778,6 +73788,7 @@ function useNfcPatrolRouteController() {
     const search = req.query.search ?? "";
     const filter = req.query.filter ?? "";
     try {
+      await requireSiteReachIfSignedIn(req, site);
       const data = await _getAllBySite({
         page,
         limit,
@@ -73810,6 +73821,7 @@ function useNfcPatrolRouteController() {
     }
     try {
       const nfcPatrolRoute = await _getById(value?.id, value?.isStart);
+      await requireSiteReachIfSignedIn(req, nfcPatrolRoute?.site);
       if (!nfcPatrolRoute) {
         throw new import_node_server_utils218.NotFoundError("NFC Patrol Route not found.");
       }
@@ -73831,6 +73843,9 @@ function useNfcPatrolRouteController() {
     ) : {};
     value.updatedBy = cookies["user"] || "";
     try {
+      const existing = await _getById(id);
+      await requireSiteReachIfSignedIn(req, existing?.site);
+      await requireSiteReachIfSignedIn(req, value?.site);
       const result = await _updateById(id, value);
       res.json(result);
       return;
@@ -75425,6 +75440,7 @@ function useNfcPatrolSettingsController() {
       return;
     }
     try {
+      await requireSiteReachIfSignedIn(req, site);
       const data = await _getNfcPatrolSettingsBySite(site);
       res.json(data);
       return;
@@ -75444,6 +75460,7 @@ function useNfcPatrolSettingsController() {
     const updatedBy = cookies["user"] || "";
     payload.updatedBy = updatedBy;
     try {
+      await requireSiteReachIfSignedIn(req, site);
       await _updateNfcPatrolSettings(site, payload);
       res.json({ message: "NFC patrol settings updated successfully." });
       return;