@7365admin1/core 3.53.1 → 3.53.2

package/dist/index.mjs

@@ -16237,6 +16237,8 @@ var MFile = class {
     this.size = value.size ?? 0;
     this.status = value.status ?? "draft";
     this.createdAt = value.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+    if (value.createdBy)
+      this.createdBy = value.createdBy.toString();
   }
 };
 
@@ -21988,13 +21990,14 @@ function useFileService() {
     bucket: SPACES_BUCKET,
     forcePathStyle: true
   });
-  async function createFile(value, folder = "default") {
+  async function createFile(value, folder = "default", createdBy) {
     const session = useAtlas29.getClient()?.startSession();
     session?.startTransaction();
     const file = {
       name: value.originalname,
       size: value.size ?? (value.buffer ? value.buffer.length : 0),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...createdBy ? { createdBy } : {}
     };
     try {
       const id = await _createFile(file, session);
@@ -27078,8 +27081,55 @@ function useVerificationController() {
 }
 
 // src/controllers/file.controller.ts
-import { BadRequestError as BadRequestError50, logger as logger35 } from "@7365admin1/node-server-utils";
+import {
+  BadRequestError as BadRequestError50,
+  UnauthorizedError as UnauthorizedError7,
+  logger as logger35
+} from "@7365admin1/node-server-utils";
 import Joi27 from "joi";
+
+// src/utils/file-owner.util.ts
+function fileOwnerId(file) {
+  return file?.createdBy?.toString?.() ?? "";
+}
+function mayDeleteFile(params) {
+  if (!params.ownerId)
+    return true;
+  if (!params.callerId)
+    return false;
+  if (params.callerId === params.ownerId)
+    return true;
+  if (params.callerIsSuperAdmin)
+    return true;
+  const ownerOrgs = new Set((params.ownerOrgIds ?? []).map(String));
+  return (params.callerOrgIds ?? []).some((org) => ownerOrgs.has(String(org)));
+}
+
+// src/controllers/file.controller.ts
+async function requireFileDelete(req, file) {
+  const ownerId = fileOwnerId(file);
+  if (!ownerId)
+    return;
+  const caller = callerId(req);
+  if (!caller)
+    throw new UnauthorizedError7("Not authorized.");
+  if (caller === ownerId)
+    return;
+  const [me, owner] = await Promise.all([
+    resolveInviteActor(caller),
+    resolveInviteActor(ownerId)
+  ]);
+  if (mayDeleteFile({
+    ownerId,
+    callerId: caller,
+    callerIsSuperAdmin: me.isSuperAdmin,
+    callerOrgIds: me.orgIds,
+    ownerOrgIds: owner.orgIds
+  })) {
+    return;
+  }
+  throw new UnauthorizedError7("Not authorized.");
+}
 function useFileController() {
   const { createFile, deleteFile: _deleteFile } = useFileService();
   const { getFileById: _getFileById } = useFileRepo();
@@ -27089,7 +27139,7 @@ function useFileController() {
       return;
     }
     try {
-      const id = await createFile(req.file);
+      const id = await createFile(req.file, "default", callerId(req) || void 0);
       res.status(201).json({ message: "Successfully uploaded file", id });
       return;
     } catch (error) {
@@ -27108,6 +27158,7 @@ function useFileController() {
       return;
     }
     try {
+      await requireFileDelete(req, await _getFileById(_id));
       const message = await _deleteFile(_id);
       res.json({ message });
       return;
@@ -27150,7 +27201,7 @@ import {
   BadRequestError as BadRequestError54,
   logger as logger38,
   NotFoundError as NotFoundError17,
-  UnauthorizedError as UnauthorizedError7
+  UnauthorizedError as UnauthorizedError8
 } from "@7365admin1/node-server-utils";
 import Joi31 from "joi";
 
@@ -28423,7 +28474,7 @@ function useOrgController() {
     try {
       const createdBy = callerId(req);
       if (!createdBy)
-        throw new UnauthorizedError7("Not authorized.");
+        throw new UnauthorizedError8("Not authorized.");
       const _id = await _add({ ...req.body, createdBy });
       const data = await _getById(_id);
       res.status(201).json({
@@ -30924,7 +30975,7 @@ function useSubscriptionService() {
 import Joi36 from "joi";
 import {
   BadRequestError as BadRequestError70,
-  UnauthorizedError as UnauthorizedError8,
+  UnauthorizedError as UnauthorizedError9,
   logger as logger48
 } from "@7365admin1/node-server-utils";
 
@@ -31345,7 +31396,7 @@ function useSubscriptionController() {
     try {
       const subscription = await _getSubscriptionById(subscriptionId);
       if (!subscription) {
-        throw new UnauthorizedError8("Not authorized.");
+        throw new UnauthorizedError9("Not authorized.");
       }
       await requireOrgAccess(req, subscription.org?.toString());
       const _res = await _updateSubscriptionSeats({
@@ -41677,7 +41728,7 @@ function useCustomerSiteService() {
 import Joi59 from "joi";
 import {
   BadRequestError as BadRequestError106,
-  UnauthorizedError as UnauthorizedError9,
+  UnauthorizedError as UnauthorizedError10,
   logger as logger78
 } from "@7365admin1/node-server-utils";
 async function requireEitherOrg(req, ...orgs) {
@@ -41686,7 +41737,7 @@ async function requireEitherOrg(req, ...orgs) {
   if (actor.isSuperAdmin)
     return;
   if (wanted.length === 0 || !wanted.some((org) => actor.orgIds.includes(org))) {
-    throw new UnauthorizedError9("Not authorized.");
+    throw new UnauthorizedError10("Not authorized.");
   }
 }
 function useCustomerSiteController() {
@@ -44899,7 +44950,7 @@ import {
   BadRequestError as BadRequestError120,
   InternalServerError as InternalServerError42,
   NotFoundError as NotFoundError34,
-  UnauthorizedError as UnauthorizedError10,
+  UnauthorizedError as UnauthorizedError11,
   logger as logger90
 } from "@7365admin1/node-server-utils";
 
@@ -48433,8 +48484,8 @@ function useHidAmicoService() {
         await siteAccess.authorizeSite({ siteId, userId: value.userId, permissions });
       }
     } catch (error) {
-      if (error instanceof UnauthorizedError10) {
-        throw new UnauthorizedError10("You do not have permission to manage HID access at this site.");
+      if (error instanceof UnauthorizedError11) {
+        throw new UnauthorizedError11("You do not have permission to manage HID access at this site.");
       }
       throw error;
     }
@@ -48458,7 +48509,7 @@ function useHidAmicoService() {
     try {
       await authorizeSiteForCaller(String(reader.site || ""), userId);
     } catch (error) {
-      if (error instanceof UnauthorizedError10)
+      if (error instanceof UnauthorizedError11)
         throw error;
       throw new NotFoundError34(HID_READER_NOT_FOUND);
     }
@@ -48510,10 +48561,10 @@ function useHidAmicoService() {
   async function assertUserReaderPermission(reader, userId, options = {}) {
     const permission = await getReaderPermissionForUser(reader, userId);
     if (!permission.granted) {
-      throw new UnauthorizedError10("You do not have HID access permission for this reader.");
+      throw new UnauthorizedError11("You do not have HID access permission for this reader.");
     }
     if (options.intercom && !permission.intercom) {
-      throw new UnauthorizedError10("You do not have HID intercom permission for this reader.");
+      throw new UnauthorizedError11("You do not have HID intercom permission for this reader.");
     }
     return permission;
   }
@@ -49851,10 +49902,10 @@ function useHidAmicoService() {
     const hasActiveMembership = memberships.some((membership) => membership.status !== "deleted" && membership.status !== "inactive");
     const resolvedIssuer = issuer || (hasResidentMembership ? "resident" : "property_management");
     if (resolvedIssuer === "resident" && !hasResidentMembership) {
-      throw new UnauthorizedError10("Only a Resident account can issue a Resident visitor QR code.");
+      throw new UnauthorizedError11("Only a Resident account can issue a Resident visitor QR code.");
     }
     if (resolvedIssuer === "property_management" && !hasActiveMembership) {
-      throw new UnauthorizedError10("Only a site Property Management account can issue this visitor QR code.");
+      throw new UnauthorizedError11("Only a site Property Management account can issue this visitor QR code.");
     }
     const configuredGateIds = site?.metadata?.hidQrCodePass?.qrGatePermissions?.[resolvedIssuer === "resident" ? "resident" : "propertyManagement"] || [];
     const gateReaderIds = configuredGateIds.filter((readerId) => typeof readerId === "string" && /^[a-f0-9]{24}$/i.test(readerId)).map(String);
@@ -52447,7 +52498,7 @@ function useVisitorTransactionService() {
 import Joi68 from "joi";
 import moment5 from "moment-timezone";
 import { ObjectId as ObjectId89 } from "mongodb";
-import { BadRequestError as BadRequestError123, NotFoundError as NotFoundError36, InternalServerError as InternalServerError44, UnauthorizedError as UnauthorizedError11, logger as logger94 } from "@7365admin1/node-server-utils";
+import { BadRequestError as BadRequestError123, NotFoundError as NotFoundError36, InternalServerError as InternalServerError44, UnauthorizedError as UnauthorizedError12, logger as logger94 } from "@7365admin1/node-server-utils";
 
 // src/models/visitor-invite.model.ts
 import Joi66 from "joi";
@@ -57231,7 +57282,7 @@ function useVisitorTransactionController() {
     }
     const inviterUserId = callerId(req);
     if (!inviterUserId) {
-      next(new UnauthorizedError11("Not authorized."));
+      next(new UnauthorizedError12("Not authorized."));
       return;
     }
     try {
@@ -57795,7 +57846,7 @@ function useGuestManagementController() {
 // src/controllers/person.controller.ts
 import Joi71 from "joi";
 import { BadRequestError as BadRequestError126, logger as logger97 } from "@7365admin1/node-server-utils";
-import { NotFoundError as NotFoundError37, UnauthorizedError as UnauthorizedError12 } from "@7365admin1/node-server-utils";
+import { NotFoundError as NotFoundError37, UnauthorizedError as UnauthorizedError13 } from "@7365admin1/node-server-utils";
 function usePersonController() {
   const {
     getAll: _getAll,
@@ -57829,7 +57880,7 @@ function usePersonController() {
     }
     const org = person.org?.toString() ?? "";
     if (!org || !actor.orgIds.includes(org)) {
-      throw new UnauthorizedError12("Not authorized.");
+      throw new UnauthorizedError13("Not authorized.");
     }
     return actor;
   }
@@ -57955,7 +58006,7 @@ function usePersonController() {
           });
         } else if (org) {
           if (!actor.orgIds.includes(org)) {
-            throw new UnauthorizedError12("Not authorized.");
+            throw new UnauthorizedError13("Not authorized.");
           }
         } else {
           orgs = actor.orgIds;
@@ -62275,7 +62326,7 @@ function useSiteFacilityService() {
 import {
   BadRequestError as BadRequestError148,
   NotFoundError as NotFoundError43,
-  UnauthorizedError as UnauthorizedError13,
+  UnauthorizedError as UnauthorizedError14,
   logger as logger116
 } from "@7365admin1/node-server-utils";
 import Joi83 from "joi";
@@ -62362,7 +62413,7 @@ function useSiteFacilityController() {
       } else {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin)
-          throw new UnauthorizedError13("Not authorized.");
+          throw new UnauthorizedError14("Not authorized.");
       }
       const data = await _getAll({
         search,
@@ -65397,7 +65448,7 @@ function useBulletinBoardService() {
 import {
   BadRequestError as BadRequestError157,
   NotFoundError as NotFoundError51,
-  UnauthorizedError as UnauthorizedError14,
+  UnauthorizedError as UnauthorizedError15,
   logger as logger125
 } from "@7365admin1/node-server-utils";
 import Joi91 from "joi";
@@ -65433,7 +65484,7 @@ function useBulletinBoardController() {
       } else {
         const { canReach } = await siteReachOf(req);
         if (!await canReach(scopeOf(value))) {
-          throw new UnauthorizedError14("Not authorized.");
+          throw new UnauthorizedError15("Not authorized.");
         }
       }
       const data = await _add(value);
@@ -65990,7 +66041,7 @@ import { BadRequestError as BadRequestError163, logger as logger131 } from "@736
 import {
   BadRequestError as BadRequestError162,
   logger as logger130,
-  UnauthorizedError as UnauthorizedError15,
+  UnauthorizedError as UnauthorizedError16,
   useAtlas as useAtlas88
 } from "@7365admin1/node-server-utils";
 
@@ -66374,7 +66425,7 @@ function useSiteBillingItemService() {
   function assertUnitAtSite(buildingUnit, site) {
     const siteId = site?.toString?.() ?? "";
     if (!siteId || (buildingUnit?.site?.toString() ?? "") !== siteId) {
-      throw new UnauthorizedError15("Not authorized.");
+      throw new UnauthorizedError16("Not authorized.");
     }
   }
   async function add(value) {
@@ -66545,7 +66596,7 @@ function useSiteBillingItemService() {
         message: error.message
       });
       await session.abortTransaction();
-      if (error instanceof BadRequestError162 || error instanceof UnauthorizedError15) {
+      if (error instanceof BadRequestError162 || error instanceof UnauthorizedError16) {
         throw error;
       }
       throw new BadRequestError162("Failed to update Site Billing Item.");
@@ -68514,7 +68565,7 @@ import Joi99 from "joi";
 
 // src/utils/resident-unit.util.ts
 import { ObjectId as ObjectId123 } from "mongodb";
-import { UnauthorizedError as UnauthorizedError16, useAtlas as useAtlas94 } from "@7365admin1/node-server-utils";
+import { UnauthorizedError as UnauthorizedError17, useAtlas as useAtlas94 } from "@7365admin1/node-server-utils";
 async function requireOwnUnit(req, site, unitId) {
   const actor = await resolveInviteActor(callerId(req));
   if (actor.isSuperAdmin)
@@ -68522,7 +68573,7 @@ async function requireOwnUnit(req, site, unitId) {
   const unit = unitId?.toString?.() ?? "";
   const siteId = site?.toString?.() ?? "";
   if (!ObjectId123.isValid(unit) || !ObjectId123.isValid(siteId) || !actor.id) {
-    throw new UnauthorizedError16("Not authorized.");
+    throw new UnauthorizedError17("Not authorized.");
   }
   const db2 = useAtlas94.getDb();
   if (!db2)
@@ -68534,7 +68585,7 @@ async function requireOwnUnit(req, site, unitId) {
     status: { $ne: "deleted" }
   });
   if (!own)
-    throw new UnauthorizedError16("Not authorized.");
+    throw new UnauthorizedError17("Not authorized.");
 }
 
 // src/controllers/site-unit-billing.controller.ts
@@ -77086,7 +77137,7 @@ function useOnlineFormRepo() {
 import {
   BadRequestError as BadRequestError203,
   NotFoundError as NotFoundError71,
-  UnauthorizedError as UnauthorizedError17,
+  UnauthorizedError as UnauthorizedError18,
   logger as logger169
 } from "@7365admin1/node-server-utils";
 import Joi122 from "joi";
@@ -77158,10 +77209,10 @@ function useOnlineFormController() {
       if (site) {
         await requireSiteReach(req, site);
       } else if (!actor.isSuperAdmin) {
-        throw new UnauthorizedError17("Not authorized.");
+        throw new UnauthorizedError18("Not authorized.");
       }
       if (org && !actor.isSuperAdmin && !actor.orgIds.includes(org)) {
-        throw new UnauthorizedError17("Not authorized.");
+        throw new UnauthorizedError18("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
@@ -77226,7 +77277,7 @@ function useOnlineFormController() {
       if (payload.org) {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin && !actor.orgIds.includes(payload.org)) {
-          throw new UnauthorizedError17("Not authorized.");
+          throw new UnauthorizedError18("Not authorized.");
         }
       }
       await _updateOnlineFormById(_id, payload);
@@ -84472,7 +84523,7 @@ import {
   BadRequestError as BadRequestError228,
   NotFoundError as NotFoundError78,
   InternalServerError as InternalServerError81,
-  UnauthorizedError as UnauthorizedError18,
+  UnauthorizedError as UnauthorizedError19,
   useAtlas as useAtlas131,
   hashPassword as hashPassword4
 } from "@7365admin1/node-server-utils";
@@ -84741,10 +84792,10 @@ function useVerificationServiceV2() {
       const org = await getOrgById(orgId);
       const actor = await resolveInviteActor(invitedBy);
       if (!actor.id) {
-        throw new UnauthorizedError18("Sign in to continue.");
+        throw new UnauthorizedError19("Sign in to continue.");
       }
       if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
-        throw new UnauthorizedError18(
+        throw new UnauthorizedError19(
           "You can only invite service providers to your own organisation's sites."
         );
       }
@@ -89147,7 +89198,7 @@ import Joi158 from "joi";
 import { ObjectId as ObjectId178 } from "mongodb";
 import {
   InternalServerError as InternalServerError93,
-  UnauthorizedError as UnauthorizedError19,
+  UnauthorizedError as UnauthorizedError20,
   useAtlas as useAtlas145
 } from "@7365admin1/node-server-utils";
 function db() {
@@ -89163,7 +89214,7 @@ function asObjectId(value) {
 function requireCaller(req) {
   const id = callerId(req);
   if (!id || !ObjectId178.isValid(id)) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return id;
 }
@@ -89171,7 +89222,7 @@ function requireSelfId(req, claimed) {
   const caller = requireCaller(req);
   const asked = claimed?.toString?.() ?? "";
   if (!asked || asked !== caller) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return caller;
 }
@@ -89179,11 +89230,11 @@ async function requireOwnChannel(req, channelId) {
   const caller = requireCaller(req);
   const _id = asObjectId(channelId);
   if (!_id)
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   const channel = await db().collection("channel-preloved").findOne({ _id }, { projection: { senderId: 1, receiverId: 1, postId: 1 } });
   const participants = [channel?.senderId, channel?.receiverId].map((id) => id?.toString?.() ?? "").filter(Boolean);
   if (!channel || !participants.includes(caller)) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return { caller, channel };
 }
@@ -89191,10 +89242,10 @@ async function requireOwnChatMessage(req, chatId) {
   const caller = requireCaller(req);
   const _id = asObjectId(chatId);
   if (!_id)
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   const message = await db().collection("chat-preloved").findOne({ _id }, { projection: { senderId: 1 } });
   if (!message || message.senderId?.toString?.() !== caller) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return caller;
 }
@@ -89620,7 +89671,7 @@ function useBidPrelovedService() {
 // src/controllers/bid-preloved.controller.ts
 import {
   BadRequestError as BadRequestError251,
-  UnauthorizedError as UnauthorizedError20,
+  UnauthorizedError as UnauthorizedError21,
   logger as logger212
 } from "@7365admin1/node-server-utils";
 import Joi161 from "joi";
@@ -89672,7 +89723,7 @@ function useBidPrelovedController() {
       const bid = await _getById(params.id);
       const seller = await sellerOfPost(bid?.postId);
       if (!seller || seller !== caller) {
-        throw new UnauthorizedError20("Not authorized.");
+        throw new UnauthorizedError21("Not authorized.");
       }
       const data = await _updateStatus(params.id, body.status);
       res.status(200).json(data);
@@ -89696,7 +89747,7 @@ function useBidPrelovedController() {
       const data = await _getById(params.id);
       const seller = await sellerOfPost(data?.postId);
       if (data?.buyerId?.toString?.() !== caller && seller !== caller) {
-        throw new UnauthorizedError20("Not authorized.");
+        throw new UnauthorizedError21("Not authorized.");
       }
       res.status(200).json(data);
     } catch (error2) {
@@ -90094,7 +90145,7 @@ function useFormEntryRepo() {
 import {
   BadRequestError as BadRequestError253,
   NotFoundError as NotFoundError89,
-  UnauthorizedError as UnauthorizedError21,
+  UnauthorizedError as UnauthorizedError22,
   logger as logger214
 } from "@7365admin1/node-server-utils";
 import Joi163 from "joi";
@@ -90204,7 +90255,7 @@ function useFormEntryController() {
       } else {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin)
-          throw new UnauthorizedError21("Not authorized.");
+          throw new UnauthorizedError22("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
@@ -90255,7 +90306,7 @@ function useFormEntryController() {
         await requireSiteReach(req, rest.site);
       delete rest.userId;
       if (isOwner && rest.status && rest.status !== "pending") {
-        throw new UnauthorizedError21("Not authorized.");
+        throw new UnauthorizedError22("Not authorized.");
       }
       await _updateFormEntryById(_id, rest);
       res.json({ message: "Successfully updated online form." });
@@ -90312,7 +90363,7 @@ function useFormEntryController() {
   async function residentFormSubmission(req, res, next) {
     const userId = callerId(req);
     if (!userId) {
-      next(new UnauthorizedError21("Not authorized."));
+      next(new UnauthorizedError22("Not authorized."));
       return;
     }
     const payload = { ...req.body, userId };
@@ -91543,7 +91594,7 @@ function useHidAmicoController() {
 import {
   BadRequestError as BadRequestError256,
   logger as logger216,
-  UnauthorizedError as UnauthorizedError22
+  UnauthorizedError as UnauthorizedError23
 } from "@7365admin1/node-server-utils";
 import Joi165 from "joi";
 function usePlatformTermsController() {
@@ -91559,7 +91610,7 @@ function usePlatformTermsController() {
   async function requireOwnRecord(req, user, { staffMayRead = false } = {}) {
     const id = callerId(req);
     if (!id) {
-      throw new UnauthorizedError22("Not authorized.");
+      throw new UnauthorizedError23("Not authorized.");
     }
     if (id === user) {
       return id;
@@ -91567,7 +91618,7 @@ function usePlatformTermsController() {
     if (staffMayRead) {
       return await requirePlatformStaff(req);
     }
-    throw new UnauthorizedError22("Not authorized.");
+    throw new UnauthorizedError23("Not authorized.");
   }
   async function getLatest(_req, res, next) {
     try {
@@ -91773,7 +91824,7 @@ function useConsoleAuditController() {
 // src/controllers/notification.controller.ts
 import {
   BadRequestError as BadRequestError258,
-  UnauthorizedError as UnauthorizedError23,
+  UnauthorizedError as UnauthorizedError24,
   logger as logger218
 } from "@7365admin1/node-server-utils";
 function useNotificationController() {
@@ -91791,10 +91842,10 @@ function useNotificationController() {
   function inboxOwner(req, claimed) {
     const caller = callerId5(req);
     if (!caller) {
-      throw new UnauthorizedError23("Not authorized.");
+      throw new UnauthorizedError24("Not authorized.");
     }
     if (claimed && claimed !== caller) {
-      throw new UnauthorizedError23("Not authorized.");
+      throw new UnauthorizedError24("Not authorized.");
     }
     return caller;
   }
@@ -91806,7 +91857,7 @@ function useNotificationController() {
     }
     try {
       if (!await isSuperAdmin(callerId5(req))) {
-        throw new UnauthorizedError23("Not authorized.");
+        throw new UnauthorizedError24("Not authorized.");
       }
       const inserted = await _addMany(value.to, {
         title: value.title,