@7365admin1/core 3.53.1 → 3.53.3

package/dist/index.mjs

@@ -10221,39 +10221,28 @@ import { ObjectId as ObjectId15 } from "mongodb";
 import { useAtlas as useAtlas8 } from "@7365admin1/node-server-utils";
 import { ObjectId as ObjectId14 } from "mongodb";
 var LIVE_ROLE = { status: { $ne: "deleted" } };
-async function isSuperAdmin(userId) {
+async function resolveStaffRole(userId) {
   const id = userId?.toString() ?? "";
   if (!id || !ObjectId14.isValid(id))
-    return false;
+    return null;
   const db2 = useAtlas8.getDb();
   if (!db2)
-    return false;
+    return null;
   const member = await db2.collection("members").findOne({
     user: new ObjectId14(id),
     type: "admin",
     status: { $ne: "deleted" }
   });
   if (!member?.role || !ObjectId14.isValid(member.role.toString()))
-    return false;
+    return null;
   const role = await db2.collection("roles").findOne({ _id: new ObjectId14(member.role.toString()), ...LIVE_ROLE });
-  return role?.type === "admin";
+  return role?.type === "admin" ? role : null;
+}
+async function isSuperAdmin(userId) {
+  return await resolveStaffRole(userId) !== null;
 }
 async function isPlatformOwner(userId) {
-  const id = userId?.toString() ?? "";
-  if (!id || !ObjectId14.isValid(id))
-    return false;
-  const db2 = useAtlas8.getDb();
-  if (!db2)
-    return false;
-  const member = await db2.collection("members").findOne({
-    user: new ObjectId14(id),
-    type: "admin",
-    status: { $ne: "deleted" }
-  });
-  if (!member?.role || !ObjectId14.isValid(member.role.toString()))
-    return false;
-  const role = await db2.collection("roles").findOne({ _id: new ObjectId14(member.role.toString()), ...LIVE_ROLE });
-  return role?.type === "admin" && role?.default === true;
+  return (await resolveStaffRole(userId))?.default === true;
 }
 
 // src/utils/org-suspension.util.ts
@@ -16237,6 +16226,8 @@ var MFile = class {
     this.size = value.size ?? 0;
     this.status = value.status ?? "draft";
     this.createdAt = value.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+    if (value.createdBy)
+      this.createdBy = value.createdBy.toString();
   }
 };
 
@@ -18070,32 +18061,127 @@ function usePersonRepo() {
 
 // src/utils/console-authz.util.ts
 import { UnauthorizedError as UnauthorizedError3 } from "@7365admin1/node-server-utils";
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name) => `${name}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name) => consoleSpellings(resource, name).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+
+// src/utils/console-authz.util.ts
 function callerId(req) {
   const user = req.user;
   return user?.user?.toString?.() || user?._id?.toString?.() || "";
 }
-async function requirePlatformStaff(req) {
+async function requirePlatformStaff(req, grant) {
   const id = callerId(req);
-  if (!id || !await isSuperAdmin(id)) {
+  const role = id ? await resolveStaffRole(id) : null;
+  if (!role) {
+    throw new UnauthorizedError3("Not authorized.");
+  }
+  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
     throw new UnauthorizedError3("Not authorized.");
   }
   return id;
 }
-async function requireSelfOrPlatformStaff(req, userId) {
+async function requireConsolePermission(req, resource, action) {
+  return await requirePlatformStaff(req, { resource, action });
+}
+async function requireSelfOrPlatformStaff(req, userId, grant) {
   const id = callerId(req);
   const target = userId?.toString() ?? "";
   if (id && target && target === id)
     return id;
-  return await requirePlatformStaff(req);
+  return await requirePlatformStaff(req, grant);
 }
 async function requireOrgAccess(req, orgId) {
   return await requireOrgReach(req, orgId);
 }
-async function requirePlatformOwner(req) {
+async function requirePlatformOwner(req, grant) {
   const id = callerId(req);
   if (!id || !await isPlatformOwner(id)) {
     throw new UnauthorizedError3("Not authorized.");
   }
+  if (grant)
+    await requirePlatformStaff(req, grant);
   return id;
 }
 async function requireOrgReach(req, orgId) {
@@ -18122,10 +18208,10 @@ async function requireInviteReach(req, org, app) {
   if (org)
     await requireOrgReach(req, org);
 }
-async function requireUserFieldWrite(req, userId, field) {
+async function requireUserFieldWrite(req, userId, field, grant) {
   if (field === "email")
-    return await requirePlatformStaff(req);
-  return await requireSelfOrPlatformStaff(req, userId);
+    return await requirePlatformStaff(req, grant);
+  return await requireSelfOrPlatformStaff(req, userId, grant);
 }
 
 // src/utils/user-response.util.ts
@@ -18165,7 +18251,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users", action: "see-user-details" });
       const user = await _getById(_id);
       res.json(user);
       return;
@@ -18250,7 +18336,7 @@ function useUserController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "users", "see-all-users");
       const data = await _getUsers({ search, page, status });
       res.json(data);
       return;
@@ -18345,7 +18431,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       const message = await _updateBirthday({ _id, ...payload });
       res.json({ message });
       return;
@@ -18387,7 +18473,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field);
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
       let message;
       if (payload.field === "plateNumber") {
         message = await updatePlateNumberByUserId(
@@ -18429,7 +18515,7 @@ function useUserController() {
     const newPassword = req.body.newPassword ?? "";
     const passwordConfirmation = req.body.passwordConfirmation ?? "";
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       await _updatePasswordById(
         _id,
         currentPassword,
@@ -18538,7 +18624,7 @@ function useRoleService() {
 async function requireRoleOrg(req, org) {
   const orgId = org?.toString() ?? "";
   if (!orgId) {
-    await requirePlatformStaff(req);
+    await requireConsolePermission(req, "roles-and-permissions");
     return;
   }
   await requireOrgAccess(req, orgId);
@@ -18580,7 +18666,7 @@ function useRoleController() {
     }
     try {
       if (payload.type === PLATFORM_STAFF_ROLE_TYPE) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "roles-and-permissions", "add-role");
       }
       if (payload.org) {
         await requireOrgReach(req, payload.org);
@@ -21988,13 +22074,14 @@ function useFileService() {
     bucket: SPACES_BUCKET,
     forcePathStyle: true
   });
-  async function createFile(value, folder = "default") {
+  async function createFile(value, folder = "default", createdBy) {
     const session = useAtlas29.getClient()?.startSession();
     session?.startTransaction();
     const file = {
       name: value.originalname,
       size: value.size ?? (value.buffer ? value.buffer.length : 0),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...createdBy ? { createdBy } : {}
     };
     try {
       const id = await _createFile(file, session);
@@ -26204,7 +26291,7 @@ async function entitledSites(req) {
 async function requireMemberOrg(req, org) {
   const orgId = org?.toString() ?? "";
   if (!orgId) {
-    await requirePlatformStaff(req);
+    await requireConsolePermission(req, "members");
     return;
   }
   await requireOrgAccess(req, orgId);
@@ -26251,7 +26338,7 @@ function useMemberController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, userId);
+      await requireSelfOrPlatformStaff(req, userId, { resource: "members", action: "view-members" });
       const data = await _getByUserId(userId);
       res.json(data);
       return;
@@ -26301,7 +26388,7 @@ function useMemberController() {
     const user = req.params.id;
     const type = req.params.type;
     try {
-      await requireSelfOrPlatformStaff(req, user);
+      await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
       const data = await _getByUserIdType(user, type);
       res.json(data);
       return;
@@ -26347,11 +26434,11 @@ function useMemberController() {
     }
     try {
       if (type === "admin") {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "members", "view-members");
       } else if (org) {
         await requireOrgAccess(req, org);
       } else if (user && user !== callerId(req)) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "users", "see-all-users");
       }
       const items = await _getAll({
         search,
@@ -26546,7 +26633,7 @@ function useMemberController() {
     const type = req.params.type;
     const org = req.query.org;
     try {
-      await requireSelfOrPlatformStaff(req, user);
+      await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
       const data = await _getByUserIdTypeOrg(
         user,
         type,
@@ -27078,8 +27165,55 @@ function useVerificationController() {
 }
 
 // src/controllers/file.controller.ts
-import { BadRequestError as BadRequestError50, logger as logger35 } from "@7365admin1/node-server-utils";
+import {
+  BadRequestError as BadRequestError50,
+  UnauthorizedError as UnauthorizedError7,
+  logger as logger35
+} from "@7365admin1/node-server-utils";
 import Joi27 from "joi";
+
+// src/utils/file-owner.util.ts
+function fileOwnerId(file) {
+  return file?.createdBy?.toString?.() ?? "";
+}
+function mayDeleteFile(params) {
+  if (!params.ownerId)
+    return true;
+  if (!params.callerId)
+    return false;
+  if (params.callerId === params.ownerId)
+    return true;
+  if (params.callerIsSuperAdmin)
+    return true;
+  const ownerOrgs = new Set((params.ownerOrgIds ?? []).map(String));
+  return (params.callerOrgIds ?? []).some((org) => ownerOrgs.has(String(org)));
+}
+
+// src/controllers/file.controller.ts
+async function requireFileDelete(req, file) {
+  const ownerId = fileOwnerId(file);
+  if (!ownerId)
+    return;
+  const caller = callerId(req);
+  if (!caller)
+    throw new UnauthorizedError7("Not authorized.");
+  if (caller === ownerId)
+    return;
+  const [me, owner] = await Promise.all([
+    resolveInviteActor(caller),
+    resolveInviteActor(ownerId)
+  ]);
+  if (mayDeleteFile({
+    ownerId,
+    callerId: caller,
+    callerIsSuperAdmin: me.isSuperAdmin,
+    callerOrgIds: me.orgIds,
+    ownerOrgIds: owner.orgIds
+  })) {
+    return;
+  }
+  throw new UnauthorizedError7("Not authorized.");
+}
 function useFileController() {
   const { createFile, deleteFile: _deleteFile } = useFileService();
   const { getFileById: _getFileById } = useFileRepo();
@@ -27089,7 +27223,7 @@ function useFileController() {
       return;
     }
     try {
-      const id = await createFile(req.file);
+      const id = await createFile(req.file, "default", callerId(req) || void 0);
       res.status(201).json({ message: "Successfully uploaded file", id });
       return;
     } catch (error) {
@@ -27108,6 +27242,7 @@ function useFileController() {
       return;
     }
     try {
+      await requireFileDelete(req, await _getFileById(_id));
       const message = await _deleteFile(_id);
       res.json({ message });
       return;
@@ -27150,7 +27285,7 @@ import {
   BadRequestError as BadRequestError54,
   logger as logger38,
   NotFoundError as NotFoundError17,
-  UnauthorizedError as UnauthorizedError7
+  UnauthorizedError as UnauthorizedError8
 } from "@7365admin1/node-server-utils";
 import Joi31 from "joi";
 
@@ -28354,7 +28489,7 @@ function useOrgController() {
       return;
     }
     try {
-      const createdBy = await requirePlatformStaff(req);
+      const createdBy = await requireConsolePermission(req, "organizations");
       await _add({ ...req.body, createdBy });
       res.status(201).json({ message: "Successfully created organization." });
       return;
@@ -28423,7 +28558,7 @@ function useOrgController() {
     try {
       const createdBy = callerId(req);
       if (!createdBy)
-        throw new UnauthorizedError7("Not authorized.");
+        throw new UnauthorizedError8("Not authorized.");
       const _id = await _add({ ...req.body, createdBy });
       const data = await _getById(_id);
       res.status(201).json({
@@ -28460,7 +28595,7 @@ function useOrgController() {
     const type = req.query.type ?? "";
     try {
       if (user !== callerId(req)) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "organizations", "see-all-organizations");
       }
       const data = await getOrgsByMembership({
         search,
@@ -28487,7 +28622,7 @@ function useOrgController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-organization-details");
       const data = await _getByName(name);
       res.json(data);
       return;
@@ -28525,7 +28660,7 @@ function useOrgController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-organization-details");
       const data = await _getByEmail(email);
       if (!data) {
         next(new NotFoundError17("Organization not found."));
@@ -28555,7 +28690,7 @@ function useOrgController() {
     try {
       const self = await _getUserById(callerId(req)).catch(() => null);
       if (!self?.email || self.email.toLowerCase() !== email.toLowerCase()) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "organizations", "see-all-organizations");
       }
       const data = await _getOrgsByEmail(email);
       res.json(data);
@@ -28615,7 +28750,7 @@ function useOrgController() {
     const orgId = req.params.id;
     const { status } = req.body;
     try {
-      const ownerId = await requirePlatformOwner(req);
+      const ownerId = await requirePlatformOwner(req, { resource: "organizations" });
       await _updateStatusById(orgId, status);
       const subscription = await _getSubscriptionByOrgId(orgId);
       if (subscription) {
@@ -28686,7 +28821,7 @@ function useOrgControllerV2() {
     const nature = value.nature ?? "";
     const status = value.status;
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-all-organizations");
       const data = await _getAll({
         search,
         page,
@@ -28723,7 +28858,7 @@ function useOrgControllerV2() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-all-organizations");
       const data = await _getOrganizationsWithSubscription({
         search: value.search ?? "",
         page: value.page ?? 1,
@@ -30924,7 +31059,7 @@ function useSubscriptionService() {
 import Joi36 from "joi";
 import {
   BadRequestError as BadRequestError70,
-  UnauthorizedError as UnauthorizedError8,
+  UnauthorizedError as UnauthorizedError9,
   logger as logger48
 } from "@7365admin1/node-server-utils";
 
@@ -31252,7 +31387,7 @@ function useSubscriptionController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const id = await _add(payload);
       res.status(201).json({ message: "Successfully added subscription.", id });
       return;
@@ -31299,7 +31434,7 @@ function useSubscriptionController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "see-all-subscriptions");
       const data = await _getSubscriptions({ search, page, status });
       res.json(data);
       return;
@@ -31345,7 +31480,7 @@ function useSubscriptionController() {
     try {
       const subscription = await _getSubscriptionById(subscriptionId);
       if (!subscription) {
-        throw new UnauthorizedError8("Not authorized.");
+        throw new UnauthorizedError9("Not authorized.");
       }
       await requireOrgAccess(req, subscription.org?.toString());
       const _res = await _updateSubscriptionSeats({
@@ -31433,7 +31568,7 @@ function useSubscriptionController() {
   }
   async function createConsoleSubscription(req, res, next) {
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const form = await readConsoleForm(req);
       const existing = await _getByOrgId(form.orgId);
       if (existing && existing.status !== "ended") {
@@ -31479,7 +31614,7 @@ function useSubscriptionController() {
   }
   async function updateConsoleSubscription(req, res, next) {
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const form = await readConsoleForm(req);
       const existing = await _getByOrgId(form.orgId);
       if (!existing?._id) {
@@ -31519,7 +31654,7 @@ function useSubscriptionController() {
   }
   async function getConsoleSubscription(req, res, next) {
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "see-subscription-details");
       const orgId = req.params.id;
       if (!/^[0-9a-fA-F]{24}$/.test(orgId ?? "")) {
         throw new BadRequestError70("That client could not be found.");
@@ -31588,7 +31723,7 @@ function useSubscriptionPlanController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const _id = await _add(req.body);
       const data = await _getById(_id);
       await recordConsoleAction({
@@ -31684,7 +31819,7 @@ function useSubscriptionPlanController() {
     }
     const id = req.params.id;
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const before = await _getById(id);
       await _update(id, req.body);
       const data = await _getById(id);
@@ -31716,7 +31851,7 @@ function useSubscriptionPlanController() {
     const id = req.params.id;
     const { status } = req.body;
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       await _updateStatusById(id, status);
       const data = await _getById(id);
       await recordConsoleAction({
@@ -31861,7 +31996,7 @@ function usePromoCodeController() {
     payload.code = payload.code.trim().toUpperCase();
     payload.fixed_rate = parseInt(payload.fixed_rate ?? "0");
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "create-promo-code");
       const created = await _add(payload);
       await recordConsoleAction({
         action: "promo-code.created" /* PROMO_CODE_CREATED */,
@@ -31914,7 +32049,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "promo-codes", "see-promo-code-details");
       const data = await _getById(_id);
       res.json(data);
       return;
@@ -31943,7 +32078,7 @@ function usePromoCodeController() {
     const limit = parseInt(req.query.limit ?? "10");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "promo-codes");
       const data = await _getPromoCodes({
         search,
         page,
@@ -31968,7 +32103,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "edit-promo-code-details");
       const before = await _getById(req.params.id);
       await _updateById(req.params.id, req.body);
       await recordConsoleAction({
@@ -32004,7 +32139,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "change-promo-code-status");
       await _updateStatusById(req.params.id, status.value.status);
       await recordConsoleAction({
         action: "promo-code.status-changed" /* PROMO_CODE_STATUS_CHANGED */,
@@ -32033,7 +32168,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "delete-promo-code");
       await _softDeleteById(req.params.id, staffId);
       await recordConsoleAction({
         action: "promo-code.removed" /* PROMO_CODE_REMOVED */,
@@ -41677,7 +41812,7 @@ function useCustomerSiteService() {
 import Joi59 from "joi";
 import {
   BadRequestError as BadRequestError106,
-  UnauthorizedError as UnauthorizedError9,
+  UnauthorizedError as UnauthorizedError10,
   logger as logger78
 } from "@7365admin1/node-server-utils";
 async function requireEitherOrg(req, ...orgs) {
@@ -41686,7 +41821,7 @@ async function requireEitherOrg(req, ...orgs) {
   if (actor.isSuperAdmin)
     return;
   if (wanted.length === 0 || !wanted.some((org) => actor.orgIds.includes(org))) {
-    throw new UnauthorizedError9("Not authorized.");
+    throw new UnauthorizedError10("Not authorized.");
   }
 }
 function useCustomerSiteController() {
@@ -44899,7 +45034,7 @@ import {
   BadRequestError as BadRequestError120,
   InternalServerError as InternalServerError42,
   NotFoundError as NotFoundError34,
-  UnauthorizedError as UnauthorizedError10,
+  UnauthorizedError as UnauthorizedError11,
   logger as logger90
 } from "@7365admin1/node-server-utils";
 
@@ -48433,8 +48568,8 @@ function useHidAmicoService() {
         await siteAccess.authorizeSite({ siteId, userId: value.userId, permissions });
       }
     } catch (error) {
-      if (error instanceof UnauthorizedError10) {
-        throw new UnauthorizedError10("You do not have permission to manage HID access at this site.");
+      if (error instanceof UnauthorizedError11) {
+        throw new UnauthorizedError11("You do not have permission to manage HID access at this site.");
       }
       throw error;
     }
@@ -48458,7 +48593,7 @@ function useHidAmicoService() {
     try {
       await authorizeSiteForCaller(String(reader.site || ""), userId);
     } catch (error) {
-      if (error instanceof UnauthorizedError10)
+      if (error instanceof UnauthorizedError11)
         throw error;
       throw new NotFoundError34(HID_READER_NOT_FOUND);
     }
@@ -48510,10 +48645,10 @@ function useHidAmicoService() {
   async function assertUserReaderPermission(reader, userId, options = {}) {
     const permission = await getReaderPermissionForUser(reader, userId);
     if (!permission.granted) {
-      throw new UnauthorizedError10("You do not have HID access permission for this reader.");
+      throw new UnauthorizedError11("You do not have HID access permission for this reader.");
     }
     if (options.intercom && !permission.intercom) {
-      throw new UnauthorizedError10("You do not have HID intercom permission for this reader.");
+      throw new UnauthorizedError11("You do not have HID intercom permission for this reader.");
     }
     return permission;
   }
@@ -49851,10 +49986,10 @@ function useHidAmicoService() {
     const hasActiveMembership = memberships.some((membership) => membership.status !== "deleted" && membership.status !== "inactive");
     const resolvedIssuer = issuer || (hasResidentMembership ? "resident" : "property_management");
     if (resolvedIssuer === "resident" && !hasResidentMembership) {
-      throw new UnauthorizedError10("Only a Resident account can issue a Resident visitor QR code.");
+      throw new UnauthorizedError11("Only a Resident account can issue a Resident visitor QR code.");
     }
     if (resolvedIssuer === "property_management" && !hasActiveMembership) {
-      throw new UnauthorizedError10("Only a site Property Management account can issue this visitor QR code.");
+      throw new UnauthorizedError11("Only a site Property Management account can issue this visitor QR code.");
     }
     const configuredGateIds = site?.metadata?.hidQrCodePass?.qrGatePermissions?.[resolvedIssuer === "resident" ? "resident" : "propertyManagement"] || [];
     const gateReaderIds = configuredGateIds.filter((readerId) => typeof readerId === "string" && /^[a-f0-9]{24}$/i.test(readerId)).map(String);
@@ -52447,7 +52582,7 @@ function useVisitorTransactionService() {
 import Joi68 from "joi";
 import moment5 from "moment-timezone";
 import { ObjectId as ObjectId89 } from "mongodb";
-import { BadRequestError as BadRequestError123, NotFoundError as NotFoundError36, InternalServerError as InternalServerError44, UnauthorizedError as UnauthorizedError11, logger as logger94 } from "@7365admin1/node-server-utils";
+import { BadRequestError as BadRequestError123, NotFoundError as NotFoundError36, InternalServerError as InternalServerError44, UnauthorizedError as UnauthorizedError12, logger as logger94 } from "@7365admin1/node-server-utils";
 
 // src/models/visitor-invite.model.ts
 import Joi66 from "joi";
@@ -57231,7 +57366,7 @@ function useVisitorTransactionController() {
     }
     const inviterUserId = callerId(req);
     if (!inviterUserId) {
-      next(new UnauthorizedError11("Not authorized."));
+      next(new UnauthorizedError12("Not authorized."));
       return;
     }
     try {
@@ -57795,7 +57930,7 @@ function useGuestManagementController() {
 // src/controllers/person.controller.ts
 import Joi71 from "joi";
 import { BadRequestError as BadRequestError126, logger as logger97 } from "@7365admin1/node-server-utils";
-import { NotFoundError as NotFoundError37, UnauthorizedError as UnauthorizedError12 } from "@7365admin1/node-server-utils";
+import { NotFoundError as NotFoundError37, UnauthorizedError as UnauthorizedError13 } from "@7365admin1/node-server-utils";
 function usePersonController() {
   const {
     getAll: _getAll,
@@ -57829,7 +57964,7 @@ function usePersonController() {
     }
     const org = person.org?.toString() ?? "";
     if (!org || !actor.orgIds.includes(org)) {
-      throw new UnauthorizedError12("Not authorized.");
+      throw new UnauthorizedError13("Not authorized.");
     }
     return actor;
   }
@@ -57955,7 +58090,7 @@ function usePersonController() {
           });
         } else if (org) {
           if (!actor.orgIds.includes(org)) {
-            throw new UnauthorizedError12("Not authorized.");
+            throw new UnauthorizedError13("Not authorized.");
           }
         } else {
           orgs = actor.orgIds;
@@ -62275,7 +62410,7 @@ function useSiteFacilityService() {
 import {
   BadRequestError as BadRequestError148,
   NotFoundError as NotFoundError43,
-  UnauthorizedError as UnauthorizedError13,
+  UnauthorizedError as UnauthorizedError14,
   logger as logger116
 } from "@7365admin1/node-server-utils";
 import Joi83 from "joi";
@@ -62362,7 +62497,7 @@ function useSiteFacilityController() {
       } else {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin)
-          throw new UnauthorizedError13("Not authorized.");
+          throw new UnauthorizedError14("Not authorized.");
       }
       const data = await _getAll({
         search,
@@ -65397,7 +65532,7 @@ function useBulletinBoardService() {
 import {
   BadRequestError as BadRequestError157,
   NotFoundError as NotFoundError51,
-  UnauthorizedError as UnauthorizedError14,
+  UnauthorizedError as UnauthorizedError15,
   logger as logger125
 } from "@7365admin1/node-server-utils";
 import Joi91 from "joi";
@@ -65433,7 +65568,7 @@ function useBulletinBoardController() {
       } else {
         const { canReach } = await siteReachOf(req);
         if (!await canReach(scopeOf(value))) {
-          throw new UnauthorizedError14("Not authorized.");
+          throw new UnauthorizedError15("Not authorized.");
         }
       }
       const data = await _add(value);
@@ -65990,7 +66125,7 @@ import { BadRequestError as BadRequestError163, logger as logger131 } from "@736
 import {
   BadRequestError as BadRequestError162,
   logger as logger130,
-  UnauthorizedError as UnauthorizedError15,
+  UnauthorizedError as UnauthorizedError16,
   useAtlas as useAtlas88
 } from "@7365admin1/node-server-utils";
 
@@ -66374,7 +66509,7 @@ function useSiteBillingItemService() {
   function assertUnitAtSite(buildingUnit, site) {
     const siteId = site?.toString?.() ?? "";
     if (!siteId || (buildingUnit?.site?.toString() ?? "") !== siteId) {
-      throw new UnauthorizedError15("Not authorized.");
+      throw new UnauthorizedError16("Not authorized.");
     }
   }
   async function add(value) {
@@ -66545,7 +66680,7 @@ function useSiteBillingItemService() {
         message: error.message
       });
       await session.abortTransaction();
-      if (error instanceof BadRequestError162 || error instanceof UnauthorizedError15) {
+      if (error instanceof BadRequestError162 || error instanceof UnauthorizedError16) {
         throw error;
       }
       throw new BadRequestError162("Failed to update Site Billing Item.");
@@ -68514,7 +68649,7 @@ import Joi99 from "joi";
 
 // src/utils/resident-unit.util.ts
 import { ObjectId as ObjectId123 } from "mongodb";
-import { UnauthorizedError as UnauthorizedError16, useAtlas as useAtlas94 } from "@7365admin1/node-server-utils";
+import { UnauthorizedError as UnauthorizedError17, useAtlas as useAtlas94 } from "@7365admin1/node-server-utils";
 async function requireOwnUnit(req, site, unitId) {
   const actor = await resolveInviteActor(callerId(req));
   if (actor.isSuperAdmin)
@@ -68522,7 +68657,7 @@ async function requireOwnUnit(req, site, unitId) {
   const unit = unitId?.toString?.() ?? "";
   const siteId = site?.toString?.() ?? "";
   if (!ObjectId123.isValid(unit) || !ObjectId123.isValid(siteId) || !actor.id) {
-    throw new UnauthorizedError16("Not authorized.");
+    throw new UnauthorizedError17("Not authorized.");
   }
   const db2 = useAtlas94.getDb();
   if (!db2)
@@ -68534,7 +68669,7 @@ async function requireOwnUnit(req, site, unitId) {
     status: { $ne: "deleted" }
   });
   if (!own)
-    throw new UnauthorizedError16("Not authorized.");
+    throw new UnauthorizedError17("Not authorized.");
 }
 
 // src/controllers/site-unit-billing.controller.ts
@@ -77086,7 +77221,7 @@ function useOnlineFormRepo() {
 import {
   BadRequestError as BadRequestError203,
   NotFoundError as NotFoundError71,
-  UnauthorizedError as UnauthorizedError17,
+  UnauthorizedError as UnauthorizedError18,
   logger as logger169
 } from "@7365admin1/node-server-utils";
 import Joi122 from "joi";
@@ -77158,10 +77293,10 @@ function useOnlineFormController() {
       if (site) {
         await requireSiteReach(req, site);
       } else if (!actor.isSuperAdmin) {
-        throw new UnauthorizedError17("Not authorized.");
+        throw new UnauthorizedError18("Not authorized.");
       }
       if (org && !actor.isSuperAdmin && !actor.orgIds.includes(org)) {
-        throw new UnauthorizedError17("Not authorized.");
+        throw new UnauthorizedError18("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
@@ -77226,7 +77361,7 @@ function useOnlineFormController() {
       if (payload.org) {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin && !actor.orgIds.includes(payload.org)) {
-          throw new UnauthorizedError17("Not authorized.");
+          throw new UnauthorizedError18("Not authorized.");
         }
       }
       await _updateOnlineFormById(_id, payload);
@@ -84472,7 +84607,7 @@ import {
   BadRequestError as BadRequestError228,
   NotFoundError as NotFoundError78,
   InternalServerError as InternalServerError81,
-  UnauthorizedError as UnauthorizedError18,
+  UnauthorizedError as UnauthorizedError19,
   useAtlas as useAtlas131,
   hashPassword as hashPassword4
 } from "@7365admin1/node-server-utils";
@@ -84741,10 +84876,10 @@ function useVerificationServiceV2() {
       const org = await getOrgById(orgId);
       const actor = await resolveInviteActor(invitedBy);
       if (!actor.id) {
-        throw new UnauthorizedError18("Sign in to continue.");
+        throw new UnauthorizedError19("Sign in to continue.");
       }
       if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
-        throw new UnauthorizedError18(
+        throw new UnauthorizedError19(
           "You can only invite service providers to your own organisation's sites."
         );
       }
@@ -86422,7 +86557,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, value);
+      await requireSelfOrPlatformStaff(req, value, { resource: "users", action: "see-user-details" });
       const user = await _getById(value);
       res.json(user);
       return;
@@ -86459,7 +86594,7 @@ function useUserControllerV2() {
     if (error)
       return rejectValidation(error, next);
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "users", "see-all-users");
       const users = await _getUsers({
         search: value.search ?? "",
         page: value.page,
@@ -86584,7 +86719,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       const message = await _updateBirthday({ _id, ...payload });
       res.json({ message });
       return;
@@ -86616,7 +86751,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field);
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
       const message = await _updateUserFieldById({ _id, ...payload });
       res.json({ message });
       return;
@@ -86647,7 +86782,7 @@ function useUserControllerV2() {
     const newPassword = req.body.newPassword ?? "";
     const passwordConfirmation = req.body.passwordConfirmation ?? "";
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       await _updatePasswordById(
         _id,
         currentPassword,
@@ -86831,7 +86966,7 @@ function useRoleControllerV2() {
     }
     try {
       if (value.type === PLATFORM_STAFF_ROLE_TYPE) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "roles-and-permissions", "add-role");
       }
       if (value.org) {
         await requireOrgReach(req, value.org);
@@ -89147,7 +89282,7 @@ import Joi158 from "joi";
 import { ObjectId as ObjectId178 } from "mongodb";
 import {
   InternalServerError as InternalServerError93,
-  UnauthorizedError as UnauthorizedError19,
+  UnauthorizedError as UnauthorizedError20,
   useAtlas as useAtlas145
 } from "@7365admin1/node-server-utils";
 function db() {
@@ -89163,7 +89298,7 @@ function asObjectId(value) {
 function requireCaller(req) {
   const id = callerId(req);
   if (!id || !ObjectId178.isValid(id)) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return id;
 }
@@ -89171,7 +89306,7 @@ function requireSelfId(req, claimed) {
   const caller = requireCaller(req);
   const asked = claimed?.toString?.() ?? "";
   if (!asked || asked !== caller) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return caller;
 }
@@ -89179,11 +89314,11 @@ async function requireOwnChannel(req, channelId) {
   const caller = requireCaller(req);
   const _id = asObjectId(channelId);
   if (!_id)
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   const channel = await db().collection("channel-preloved").findOne({ _id }, { projection: { senderId: 1, receiverId: 1, postId: 1 } });
   const participants = [channel?.senderId, channel?.receiverId].map((id) => id?.toString?.() ?? "").filter(Boolean);
   if (!channel || !participants.includes(caller)) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return { caller, channel };
 }
@@ -89191,10 +89326,10 @@ async function requireOwnChatMessage(req, chatId) {
   const caller = requireCaller(req);
   const _id = asObjectId(chatId);
   if (!_id)
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   const message = await db().collection("chat-preloved").findOne({ _id }, { projection: { senderId: 1 } });
   if (!message || message.senderId?.toString?.() !== caller) {
-    throw new UnauthorizedError19("Not authorized.");
+    throw new UnauthorizedError20("Not authorized.");
   }
   return caller;
 }
@@ -89620,7 +89755,7 @@ function useBidPrelovedService() {
 // src/controllers/bid-preloved.controller.ts
 import {
   BadRequestError as BadRequestError251,
-  UnauthorizedError as UnauthorizedError20,
+  UnauthorizedError as UnauthorizedError21,
   logger as logger212
 } from "@7365admin1/node-server-utils";
 import Joi161 from "joi";
@@ -89672,7 +89807,7 @@ function useBidPrelovedController() {
       const bid = await _getById(params.id);
       const seller = await sellerOfPost(bid?.postId);
       if (!seller || seller !== caller) {
-        throw new UnauthorizedError20("Not authorized.");
+        throw new UnauthorizedError21("Not authorized.");
       }
       const data = await _updateStatus(params.id, body.status);
       res.status(200).json(data);
@@ -89696,7 +89831,7 @@ function useBidPrelovedController() {
       const data = await _getById(params.id);
       const seller = await sellerOfPost(data?.postId);
       if (data?.buyerId?.toString?.() !== caller && seller !== caller) {
-        throw new UnauthorizedError20("Not authorized.");
+        throw new UnauthorizedError21("Not authorized.");
       }
       res.status(200).json(data);
     } catch (error2) {
@@ -90094,7 +90229,7 @@ function useFormEntryRepo() {
 import {
   BadRequestError as BadRequestError253,
   NotFoundError as NotFoundError89,
-  UnauthorizedError as UnauthorizedError21,
+  UnauthorizedError as UnauthorizedError22,
   logger as logger214
 } from "@7365admin1/node-server-utils";
 import Joi163 from "joi";
@@ -90204,7 +90339,7 @@ function useFormEntryController() {
       } else {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin)
-          throw new UnauthorizedError21("Not authorized.");
+          throw new UnauthorizedError22("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
@@ -90255,7 +90390,7 @@ function useFormEntryController() {
         await requireSiteReach(req, rest.site);
       delete rest.userId;
       if (isOwner && rest.status && rest.status !== "pending") {
-        throw new UnauthorizedError21("Not authorized.");
+        throw new UnauthorizedError22("Not authorized.");
       }
       await _updateFormEntryById(_id, rest);
       res.json({ message: "Successfully updated online form." });
@@ -90312,7 +90447,7 @@ function useFormEntryController() {
   async function residentFormSubmission(req, res, next) {
     const userId = callerId(req);
     if (!userId) {
-      next(new UnauthorizedError21("Not authorized."));
+      next(new UnauthorizedError22("Not authorized."));
       return;
     }
     const payload = { ...req.body, userId };
@@ -91543,7 +91678,7 @@ function useHidAmicoController() {
 import {
   BadRequestError as BadRequestError256,
   logger as logger216,
-  UnauthorizedError as UnauthorizedError22
+  UnauthorizedError as UnauthorizedError23
 } from "@7365admin1/node-server-utils";
 import Joi165 from "joi";
 function usePlatformTermsController() {
@@ -91559,15 +91694,15 @@ function usePlatformTermsController() {
   async function requireOwnRecord(req, user, { staffMayRead = false } = {}) {
     const id = callerId(req);
     if (!id) {
-      throw new UnauthorizedError22("Not authorized.");
+      throw new UnauthorizedError23("Not authorized.");
     }
     if (id === user) {
       return id;
     }
     if (staffMayRead) {
-      return await requirePlatformStaff(req);
+      return await requireConsolePermission(req, "platform-terms", "see-platform-terms");
     }
-    throw new UnauthorizedError22("Not authorized.");
+    throw new UnauthorizedError23("Not authorized.");
   }
   async function getLatest(_req, res, next) {
     try {
@@ -91657,7 +91792,7 @@ function usePlatformTermsController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "platform-terms", "see-platform-terms");
       res.json(
         await _listAcceptance({
           version: value.version || null,
@@ -91689,7 +91824,7 @@ function usePlatformTermsController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "platform-terms", "edit-platform-terms");
       const created = await _add({
         terms: value.terms,
         policies: value.policies,
@@ -91747,7 +91882,7 @@ function useConsoleAuditController() {
     }
     const to = value.to && value.to.length === 10 ? `${value.to}T23:59:59.999Z` : value.to;
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "activity-history", "see-activity-history");
       res.json(
         await _list({
           org: value.org || "",
@@ -91773,7 +91908,7 @@ function useConsoleAuditController() {
 // src/controllers/notification.controller.ts
 import {
   BadRequestError as BadRequestError258,
-  UnauthorizedError as UnauthorizedError23,
+  UnauthorizedError as UnauthorizedError24,
   logger as logger218
 } from "@7365admin1/node-server-utils";
 function useNotificationController() {
@@ -91791,10 +91926,10 @@ function useNotificationController() {
   function inboxOwner(req, claimed) {
     const caller = callerId5(req);
     if (!caller) {
-      throw new UnauthorizedError23("Not authorized.");
+      throw new UnauthorizedError24("Not authorized.");
     }
     if (claimed && claimed !== caller) {
-      throw new UnauthorizedError23("Not authorized.");
+      throw new UnauthorizedError24("Not authorized.");
     }
     return caller;
   }
@@ -91806,7 +91941,7 @@ function useNotificationController() {
     }
     try {
       if (!await isSuperAdmin(callerId5(req))) {
-        throw new UnauthorizedError23("Not authorized.");
+        throw new UnauthorizedError24("Not authorized.");
       }
       const inserted = await _addMany(value.to, {
         title: value.title,
@@ -92413,6 +92548,7 @@ export {
   resolveHidPhysicalCardValue,
   resolveInviteActor,
   resolveSiteTimezone,
+  resolveStaffRole,
   robotSchema,
   rtspUrl,
   schema,