@7365admin1/core 3.52.7-staging.255 → 3.52.8

package/CHANGELOG.md

@@ -1,5 +1,101 @@
 # @iservice365/core
 
+## 3.52.8
+
+### Patch Changes
+
+- 8ef43c8: Scope `GET /api/customer-sites` to the sites the caller may actually reach
+
+  The endpoint authorised the caller at ORGANISATION level (`requireOrgAccess`)
+  and then returned every site that organisation has. One call fills the site
+  switcher in all seven vertical web apps' layouts, the MA and iSecure365 site
+  pickers and the resident app, so a user invited to a SINGLE site opened the
+  switcher and read the client's entire estate by name.
+
+  The list now applies the same rule the access side already applies
+  (`cameraGrant`, owner decision 2026-08-10), expressed as `orgSiteScope`: a
+  membership carrying no site is an org-wide role and keeps the whole list, and a
+  membership pinned to a site is offered that site alone. Seven365 staff are
+  answered before the question is asked, so the client console's
+  cross-organisation reads are unchanged.
+
+  The restriction is applied inside the query and is part of the cache key, so
+  paging counts describe what the caller can see and one caller's page is never
+  served to another.
+
+  Org-level roles are exempt from the narrowing. Owner decision, 2026-09-02: "Org
+  -level roles see all sites." A membership whose ROLE is organisation-level — the
+  `roles` document carries no `site` of its own — keeps the whole estate EVEN IF
+  the membership row also names a site, because that stray `siteId` is a data
+  artefact and not a demotion. On staging that is the difference between narrowing
+  204 and narrowing 109 `(user, org)` pairs: 95 pairs, overwhelmingly `Org Owner`,
+  sit on an org-level role attached to a site row. An unresolvable or soft-deleted
+  role is treated as site-level, so the exemption fails closed.
+
+- 8ef43c8: Revoke each expired vehicle's plate only from its own site's cameras, and fail closed
+
+  The hourly expired-vehicle sweep declared its `siteCameras` array outside the
+  per-vehicle loop and only ever pushed to it, so the list grew as the run went
+  on: the second vehicle was revoked from its own site's cameras AND from the
+  first vehicle's. `recNo` is a per-device sequence number, so those extra calls
+  did not simply miss - they addressed whatever record carried that number on the
+  other site's camera and took an unrelated, still-valid plate off the barrier.
+  Cameras are now resolved per vehicle, cached by site id so each site is still
+  paged only once per run.
+
+  The sweep also marked every expired vehicle deleted with one blanket
+  `updateMany`, regardless of what the cameras answered, so a record could read
+  "deleted" while its plate still opened the gate. Only vehicles whose every
+  camera confirmed are now marked deleted; the rest are left expired, logged at
+  error level naming the vehicle, plate, site and camera, and retried on the next
+  hourly run. `deleteExpiredVehicles` now requires the list of ids.
+
+  Also: each camera is asked for its own record id before the removal (the same
+  thing manual delete does), the ANPR list is chosen from the vehicle's type
+  instead of always TRAFFIC_REDLIST, a site with no ANPR camera no longer aborts
+  the whole run, and the transaction that wrapped nothing - the only write was
+  issued without the session - has been removed.
+
+- 8ef43c8: Fail closed in the visitor ANPR sweep, and remove the dead invitation transaction
+
+  `processTransactionDahuaStatus`, the hourly job that takes an expired or
+  checked-out visitor's plate off the site's ANPR camera, marked the transaction
+  `dahuaSyncStatus: "removed"` on the line after the camera call and only skipped
+  on a thrown error. `removePlateNumber` does not throw for a device failure - it
+  returns an outcome object - so a camera answering 401 or 500, or not answering
+  at all, still had the transaction recorded as removed while the visitor's plate
+  was still on the barrier. Nothing retried it either, because the query that
+  feeds the sweep skips anything already marked removed.
+
+  It now uses the same decision logic as the expired-vehicle sweep: only a
+  transaction every camera confirmed is marked removed, and the rest are logged at
+  error level naming the plate, the site and the camera, then retried on the next
+  run. Each camera is also asked for its own record id before the removal, which
+  is what the old "not found" message sniff was reaching for and what stops a
+  transaction whose record is already gone from being retried for ever.
+
+  `checkExpiredInvitation` opened a session and a transaction and then issued
+  every write without that session, never committing: the transaction protected no
+  write and the rollback rolled back nothing. Each invitation is independent, so
+  there is no invariant spanning them and nothing for a transaction to protect -
+  it is removed rather than wired up.
+
+## 3.52.7
+
+### Patch Changes
+
+- 4d8be2a: Scope the NFC patrol tag, route and settings endpoints to the caller's own estate.
+
+  `/api/nfc-patrol-tag`, `/api/nfc-patrol-route` and `/api/nfc-patrol-settings`
+  carried `requireAuth` and nothing more, and their three controllers held no
+  authorization identifier of any kind, so any signed-in account on the platform
+  could read and CHANGE another client's checkpoint register, patrol rounds and
+  patrol settings. They now ask the same `requireSiteReach` -> `entitleSite`
+  question the already-scoped `/api/nfc-patrol-log` and the rest of the
+  site-scoped modules ask, and answer `404 Site not found.` The five `/public`
+  mounts, which are reached without a credential while `ENFORCE_NFC_PUBLIC_AUTH`
+  is off, are unchanged.
+
 ## 3.52.6
 
 ### Patch Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.7-staging.255",
+  "version": "3.52.8",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/.changeset/customer-site-list-site-scope.md

@@ -1,31 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Scope `GET /api/customer-sites` to the sites the caller may actually reach
-
-The endpoint authorised the caller at ORGANISATION level (`requireOrgAccess`)
-and then returned every site that organisation has. One call fills the site
-switcher in all seven vertical web apps' layouts, the MA and iSecure365 site
-pickers and the resident app, so a user invited to a SINGLE site opened the
-switcher and read the client's entire estate by name.
-
-The list now applies the same rule the access side already applies
-(`cameraGrant`, owner decision 2026-08-10), expressed as `orgSiteScope`: a
-membership carrying no site is an org-wide role and keeps the whole list, and a
-membership pinned to a site is offered that site alone. Seven365 staff are
-answered before the question is asked, so the client console's
-cross-organisation reads are unchanged.
-
-The restriction is applied inside the query and is part of the cache key, so
-paging counts describe what the caller can see and one caller's page is never
-served to another.
-
-Org-level roles are exempt from the narrowing. Owner decision, 2026-09-02: "Org
--level roles see all sites." A membership whose ROLE is organisation-level — the
-`roles` document carries no `site` of its own — keeps the whole estate EVEN IF
-the membership row also names a site, because that stray `siteId` is a data
-artefact and not a demotion. On staging that is the difference between narrowing
-204 and narrowing 109 `(user, org)` pairs: 95 pairs, overwhelmingly `Org Owner`,
-sit on an org-level role attached to a site row. An unresolvable or soft-deleted
-role is treated as site-level, so the exemption fails closed.

package/.changeset/expired-vehicle-cron-per-site-fail-closed.md

@@ -1,27 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Revoke each expired vehicle's plate only from its own site's cameras, and fail closed
-
-The hourly expired-vehicle sweep declared its `siteCameras` array outside the
-per-vehicle loop and only ever pushed to it, so the list grew as the run went
-on: the second vehicle was revoked from its own site's cameras AND from the
-first vehicle's. `recNo` is a per-device sequence number, so those extra calls
-did not simply miss - they addressed whatever record carried that number on the
-other site's camera and took an unrelated, still-valid plate off the barrier.
-Cameras are now resolved per vehicle, cached by site id so each site is still
-paged only once per run.
-
-The sweep also marked every expired vehicle deleted with one blanket
-`updateMany`, regardless of what the cameras answered, so a record could read
-"deleted" while its plate still opened the gate. Only vehicles whose every
-camera confirmed are now marked deleted; the rest are left expired, logged at
-error level naming the vehicle, plate, site and camera, and retried on the next
-hourly run. `deleteExpiredVehicles` now requires the list of ids.
-
-Also: each camera is asked for its own record id before the removal (the same
-thing manual delete does), the ANPR list is chosen from the vehicle's type
-instead of always TRAFFIC_REDLIST, a site with no ANPR camera no longer aborts
-the whole run, and the transaction that wrapped nothing - the only write was
-issued without the session - has been removed.

package/.changeset/nfc-patrol-site-scope.md

@@ -1,15 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Scope the NFC patrol tag, route and settings endpoints to the caller's own estate.
-
-`/api/nfc-patrol-tag`, `/api/nfc-patrol-route` and `/api/nfc-patrol-settings`
-carried `requireAuth` and nothing more, and their three controllers held no
-authorization identifier of any kind, so any signed-in account on the platform
-could read and CHANGE another client's checkpoint register, patrol rounds and
-patrol settings. They now ask the same `requireSiteReach` -> `entitleSite`
-question the already-scoped `/api/nfc-patrol-log` and the rest of the
-site-scoped modules ask, and answer `404 Site not found.` The five `/public`
-mounts, which are reached without a credential while `ENFORCE_NFC_PUBLIC_AUTH`
-is off, are unchanged.

package/.changeset/visitor-dahua-cron-fail-closed.md

@@ -1,27 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Fail closed in the visitor ANPR sweep, and remove the dead invitation transaction
-
-`processTransactionDahuaStatus`, the hourly job that takes an expired or
-checked-out visitor's plate off the site's ANPR camera, marked the transaction
-`dahuaSyncStatus: "removed"` on the line after the camera call and only skipped
-on a thrown error. `removePlateNumber` does not throw for a device failure - it
-returns an outcome object - so a camera answering 401 or 500, or not answering
-at all, still had the transaction recorded as removed while the visitor's plate
-was still on the barrier. Nothing retried it either, because the query that
-feeds the sweep skips anything already marked removed.
-
-It now uses the same decision logic as the expired-vehicle sweep: only a
-transaction every camera confirmed is marked removed, and the rest are logged at
-error level naming the plate, the site and the camera, then retried on the next
-run. Each camera is also asked for its own record id before the removal, which
-is what the old "not found" message sniff was reaching for and what stops a
-transaction whose record is already gone from being retried for ever.
-
-`checkExpiredInvitation` opened a session and a transaction and then issued
-every write without that session, never committing: the transaction protected no
-write and the rollback rolled back nothing. Each invitation is independent, so
-there is no invariant spanning them and nothing for a transaction to protect -
-it is removed rather than wired up.