@7365admin1/core 3.52.7 → 3.52.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.7",
+  "version": "3.52.8",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/camera-view.util.test.mjs

@@ -13,6 +13,7 @@ import {
   hasAnyPermission,
   isCameraEntitled,
   cameraGrant,
+  orgSiteScope,
   parseDeviceTime,
   parseSoftwareVersion,
   ptzEndpoint,
@@ -934,3 +935,170 @@ test("a write is scoped to the caller's own sites, not just to any signed-in use
   // Signed in, but a member of nothing.
   assert.equal(isCameraEntitled({ cameraSite: site, memberships: [] }), false);
 });
+
+/*
+ * `orgSiteScope` — which sites of ONE organisation a caller may be OFFERED.
+ *
+ * The listing half of `cameraGrant`. `GET /api/customer-sites?org=` authorised
+ * at organisation level and then returned the organisation's whole estate, so a
+ * user invited to a single site saw every site in the client in the switcher.
+ */
+const SCOPE_ORG = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const SCOPE_OTHER_ORG = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const SCOPE_SITE_A = "cccccccccccccccccccccccc";
+const SCOPE_SITE_B = "dddddddddddddddddddddddd";
+
+test("orgSiteScope: an org-wide membership keeps the whole list", () => {
+  // The half a careless narrowing breaks. An org owner/admin holds a membership
+  // with no site, and must still see every site in their organisation.
+  assert.equal(
+    orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: "" }], org: SCOPE_ORG }),
+    null,
+  );
+  assert.equal(
+    orgSiteScope({ memberships: [{ org: SCOPE_ORG }], org: SCOPE_ORG }),
+    null,
+  );
+  // One org-wide membership wins even alongside pinned ones.
+  assert.equal(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
+        { org: SCOPE_ORG, siteId: "" },
+      ],
+      org: SCOPE_ORG,
+    }),
+    null,
+  );
+});
+
+test("orgSiteScope: a site-pinned membership is offered that site alone", () => {
+  assert.deepEqual(
+    orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }], org: SCOPE_ORG }),
+    [SCOPE_SITE_A],
+  );
+  // Two pins in the same organisation are both offered, de-duplicated.
+  assert.deepEqual(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_B },
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
+      ],
+      org: SCOPE_ORG,
+    }),
+    [SCOPE_SITE_A, SCOPE_SITE_B],
+  );
+});
+
+test("orgSiteScope: another organisation's memberships do not widen this one", () => {
+  // The reported defect in one line: pinned to one site here, org-wide
+  // somewhere else. The org-wide row must not unlock this organisation.
+  assert.deepEqual(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
+        { org: SCOPE_OTHER_ORG, siteId: "" },
+      ],
+      org: SCOPE_ORG,
+    }),
+    [SCOPE_SITE_A],
+  );
+  // No membership in this organisation at all: fail closed, not "show all".
+  assert.deepEqual(
+    orgSiteScope({ memberships: [{ org: SCOPE_OTHER_ORG, siteId: "" }], org: SCOPE_ORG }),
+    [],
+  );
+});
+
+test("orgSiteScope: ObjectId and hex-string ids are the same id", () => {
+  assert.deepEqual(
+    orgSiteScope({
+      memberships: [{ org: { toString: () => SCOPE_ORG }, siteId: { toString: () => SCOPE_SITE_A } }],
+      org: SCOPE_ORG,
+    }),
+    [SCOPE_SITE_A],
+  );
+});
+
+test("orgSiteScope: no organisation asked about means no restriction", () => {
+  assert.equal(orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }] }), null);
+});
+
+/**
+ * The owner's rule of 2026-09-02: "Org-level roles see all sites."
+ *
+ * The first cut of this change keyed only on the membership's `siteId`, which
+ * narrowed 95 `(user, org)` pairs on staging whose role is organisation-level
+ * (`Org Owner` in most cases) but whose membership row also happens to name a
+ * site. These three tests are the three shapes the rule has to get right.
+ */
+test("orgSiteScope: a site-LEVEL role pinned to a site sees only that site", () => {
+  assert.deepEqual(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
+      ],
+      org: SCOPE_ORG,
+    }),
+    [SCOPE_SITE_A],
+  );
+});
+
+test("orgSiteScope: an ORG-level role carrying a siteId still sees every site", () => {
+  assert.equal(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: true },
+      ],
+      org: SCOPE_ORG,
+    }),
+    null,
+  );
+
+  // and it widens the whole organisation, not just its own row
+  assert.equal(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_B, orgLevelRole: true },
+      ],
+      org: SCOPE_ORG,
+    }),
+    null,
+  );
+});
+
+test("orgSiteScope: an ORG-level role with no siteId sees every site", () => {
+  assert.equal(
+    orgSiteScope({
+      memberships: [{ org: SCOPE_ORG, siteId: "", orgLevelRole: true }],
+      org: SCOPE_ORG,
+    }),
+    null,
+  );
+});
+
+test("orgSiteScope: an org-level role in ANOTHER organisation does not widen this one", () => {
+  assert.deepEqual(
+    orgSiteScope({
+      memberships: [
+        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
+        { org: SCOPE_OTHER_ORG, siteId: "", orgLevelRole: true },
+      ],
+      org: SCOPE_ORG,
+    }),
+    [SCOPE_SITE_A],
+  );
+});
+
+test("orgSiteScope: an unresolved role fails closed — it does not widen", () => {
+  // `orgLevelRole` absent is how a missing or soft-deleted role arrives.
+  assert.deepEqual(
+    orgSiteScope({
+      memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }],
+      org: SCOPE_ORG,
+    }),
+    [SCOPE_SITE_A],
+  );
+});

package/test/site-timezone.test.mjs

@@ -0,0 +1,69 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  DEFAULT_SITE_TIMEZONE,
+  resolveSiteTimezone,
+  siteDayBounds,
+} from "./.build/utils/site-timezone.util.mjs";
+
+/**
+ * A visitor invitation is valid for one calendar day in the SITE's timezone —
+ * 00:00:00.000 through 23:59:59.999 — never a rolling 24 hours from whatever
+ * instant happened to be stored.
+ */
+test("a bare date maps onto exact site-local day boundaries", () => {
+  const day = siteDayBounds("2026-09-02", "Asia/Singapore");
+
+  assert.equal(day.start.toISOString(), "2026-09-01T16:00:00.000Z");
+  assert.equal(day.end.toISOString(), "2026-09-02T15:59:59.999Z");
+  assert.equal(day.date, "2026-09-02");
+});
+
+test("the day is recovered from a legacy expectedCheckIn instant", () => {
+  // What the mobile app writes today: midday on the resident's own device.
+  const day = siteDayBounds(new Date("2026-09-02T04:00:00.000Z"), "Asia/Singapore");
+
+  assert.equal(day.date, "2026-09-02");
+  assert.equal(day.start.toISOString(), "2026-09-01T16:00:00.000Z");
+});
+
+test("arrivalDate holds the day when the inviter is in a distant zone", () => {
+  // A resident in UTC-5 picking the 2nd pins midday THERE: 17:00Z. Read back in
+  // the site's zone that instant is already the 3rd — which is exactly why the
+  // bare date is preferred over the instant.
+  assert.equal(siteDayBounds("2026-09-02", "Asia/Singapore").date, "2026-09-02");
+  assert.equal(
+    siteDayBounds(new Date("2026-09-02T17:00:00.000Z"), "Asia/Singapore").date,
+    "2026-09-03",
+  );
+});
+
+test("a DST transition day is bounded by its real local edges", () => {
+  // 2026-03-08 is the US spring-forward: a 23-hour calendar day.
+  const day = siteDayBounds("2026-03-08", "America/New_York");
+
+  assert.equal(day.start.toISOString(), "2026-03-08T05:00:00.000Z");
+  assert.equal(day.end.toISOString(), "2026-03-09T03:59:59.999Z");
+  assert.equal((day.end.getTime() - day.start.getTime() + 1) / 3_600_000, 23);
+});
+
+test("unusable input yields null rather than a bogus window", () => {
+  assert.equal(siteDayBounds(null, "Asia/Singapore"), null);
+  assert.equal(siteDayBounds(undefined, "Asia/Singapore"), null);
+  assert.equal(siteDayBounds("not-a-date", "Asia/Singapore"), null);
+});
+
+test("an unusable site timezone falls back to the default", () => {
+  assert.equal(
+    siteDayBounds("2026-09-02", "Mars/Olympus").start.toISOString(),
+    "2026-09-01T16:00:00.000Z",
+  );
+  assert.equal(resolveSiteTimezone(null), DEFAULT_SITE_TIMEZONE);
+  assert.equal(resolveSiteTimezone({}), DEFAULT_SITE_TIMEZONE);
+  assert.equal(resolveSiteTimezone({ timezone: "nonsense" }), DEFAULT_SITE_TIMEZONE);
+});
+
+test("a valid site timezone is used as given", () => {
+  assert.equal(resolveSiteTimezone({ timezone: "Asia/Manila" }), "Asia/Manila");
+});

package/test/visitor-invite-schema.test.mjs

@@ -75,3 +75,44 @@ test("name and expectedCheckIn are still required", () => {
     assert.ok(error, `${field} must still be required`);
   }
 });
+
+/**
+ * `arrivalDate` — the calendar day the invitation is valid for.
+ *
+ * It is deliberately OPTIONAL. Builds already in the stores send only
+ * `expectedCheckIn`, and the invite service derives the day from it in the
+ * site's zone; requiring the field here would 400 every one of those users on
+ * a form that never showed them the field, the same trap `type` fell into.
+ */
+test("a bare YYYY-MM-DD arrivalDate is accepted and preserved", () => {
+  const body = { ...guestBodyWithoutType(), arrivalDate: "2026-09-02" };
+  const { error, value } = schemaInviteVisitor.validate(body, {
+    abortEarly: false,
+  });
+
+  assert.equal(error, undefined, error && error.message);
+  assert.equal(value.arrivalDate, "2026-09-02");
+});
+
+test("an invite without arrivalDate is still accepted", () => {
+  const { error } = schemaInviteVisitor.validate(guestBodyWithoutType(), {
+    abortEarly: false,
+  });
+
+  assert.equal(error, undefined, error && error.message);
+});
+
+test("arrivalDate refuses anything that is not a bare calendar date", () => {
+  for (const bad of [
+    "02/09/2026",
+    "2026-9-2",
+    "2026-09-02T04:00:00.000Z",
+    "tomorrow",
+  ]) {
+    const body = { ...guestBodyWithoutType(), arrivalDate: bad };
+    const { error } = schemaInviteVisitor.validate(body, { abortEarly: false });
+
+    assert.ok(error, `${bad} must not be accepted as an arrivalDate`);
+    assert.match(error.message, /arrivalDate must be in YYYY-MM-DD format/);
+  }
+});