@7365admin1/core 3.53.3 → 3.53.5

package/dist/index.js

@@ -5926,7 +5926,9 @@ __export(src_exports, {
   CLIENT_ACTIONS: () => CLIENT_ACTIONS,
   CLOCK_DRIFT_WARN_SECONDS: () => CLOCK_DRIFT_WARN_SECONDS,
   CONSOLE_AUDIT_LABELS: () => CONSOLE_AUDIT_LABELS,
+  CONSOLE_PERMISSIONS: () => CONSOLE_PERMISSIONS,
   CONTRACTOR_TYPE_LABELS: () => CONTRACTOR_TYPE_LABELS,
+  CROSS_CLIENT_GRANT: () => CROSS_CLIENT_GRANT,
   CURRENT_TIME_ENDPOINT: () => CURRENT_TIME_ENDPOINT,
   CameraType: () => CameraType,
   ConsoleAuditAction: () => ConsoleAuditAction,
@@ -6138,6 +6140,9 @@ __export(src_exports, {
   chatSchema: () => chatSchema,
   clampPtzSpeed: () => clampPtzSpeed,
   clockDriftSeconds: () => clockDriftSeconds,
+  consoleRoleAllows: () => consoleRoleAllows,
+  consoleRoleAllowsAll: () => consoleRoleAllowsAll,
+  consoleSpellings: () => consoleSpellings,
   console_audit_namespace_collection: () => console_audit_namespace_collection,
   createManpowerRemarksDaily: () => createManpowerRemarksDaily,
   customerSchema: () => customerSchema,
@@ -6237,6 +6242,8 @@ __export(src_exports, {
   relayForRecorder: () => relayForRecorder,
   remarksSchema: () => remarksSchema,
   renderPagePdf: () => renderPagePdf,
+  requireConsolePermission: () => requireConsolePermission,
+  requirePlatformStaff: () => requirePlatformStaff,
   resetCameraTransports: () => resetCameraTransports,
   residentAppModuleKeys: () => residentAppModuleKeys,
   residentFormEntry: () => residentFormEntry,
@@ -6408,6 +6415,7 @@ __export(src_exports, {
   site_people_namespace_collection: () => site_people_namespace_collection,
   snapshotEndpoint: () => snapshotEndpoint,
   snapshotRefusalReason: () => snapshotRefusalReason,
+  staffMayBypass: () => staffMayBypass,
   stringifyHidJson: () => stringifyHidJson,
   stripFacialImageMetadata: () => stripFacialImageMetadata,
   subscriptionPlanSchema: () => subscriptionPlanSchema,
@@ -11191,10 +11199,10 @@ function useAuthService() {
 
 // src/controllers/auth.controller.ts
 var import_joi16 = __toESM(require("joi"));
-var import_node_server_utils39 = require("@7365admin1/node-server-utils");
+var import_node_server_utils40 = require("@7365admin1/node-server-utils");
 
 // src/services/verification.service.ts
-var import_node_server_utils34 = require("@7365admin1/node-server-utils");
+var import_node_server_utils35 = require("@7365admin1/node-server-utils");
 
 // src/repositories/verification.repo.ts
 var import_node_server_utils19 = require("@7365admin1/node-server-utils");
@@ -14077,9 +14085,13 @@ async function resolveInviteActor(userId) {
   const members = await db2.collection("members").find({ user: new import_mongodb25.ObjectId(id), status: { $ne: "deleted" } }).toArray();
   const adminMember = members.find((m) => m.type === "admin");
   let isSuperAdmin2 = false;
+  let staffPermissions;
   if (adminMember?.role && import_mongodb25.ObjectId.isValid(adminMember.role.toString())) {
     const role = await db2.collection("roles").findOne({ _id: new import_mongodb25.ObjectId(adminMember.role.toString()), ...LIVE_ROLE });
     isSuperAdmin2 = role?.type === "admin";
+    if (isSuperAdmin2) {
+      staffPermissions = Array.isArray(role?.permissions) ? role?.permissions : [];
+    }
   }
   const orgIds = Array.from(
     new Set(
@@ -14102,6 +14114,7 @@ async function resolveInviteActor(userId) {
     id,
     name: user?.name ?? adminMember?.name ?? "",
     isSuperAdmin: isSuperAdmin2,
+    staffPermissions,
     orgIds,
     propertyManagementOrgIds,
     memberships: members.map((m) => ({
@@ -14202,7 +14215,7 @@ async function holdsRole(userId, roleId) {
 }
 
 // src/services/service-provider-invite.service.ts
-var import_node_server_utils33 = require("@7365admin1/node-server-utils");
+var import_node_server_utils34 = require("@7365admin1/node-server-utils");
 var import_mongodb30 = require("mongodb");
 
 // src/services/notification.service.ts
@@ -15421,10 +15434,173 @@ var NotificationService = class {
   }
 };
 
+// src/utils/console-authz.util.ts
+var import_node_server_utils33 = require("@7365admin1/node-server-utils");
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name) => `${name}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name) => consoleSpellings(resource, name).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+var CROSS_CLIENT_GRANT = {
+  resource: "organizations"
+};
+function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
+  if (!actor.isSuperAdmin)
+    return false;
+  return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
+}
+
+// src/utils/console-authz.util.ts
+function callerId(req) {
+  const user = req.user;
+  return user?.user?.toString?.() || user?._id?.toString?.() || "";
+}
+async function requirePlatformStaff(req, grant) {
+  const id = callerId(req);
+  const role = id ? await resolveStaffRole(id) : null;
+  if (!role) {
+    throw new import_node_server_utils33.UnauthorizedError("Not authorized.");
+  }
+  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
+    throw new import_node_server_utils33.UnauthorizedError("Not authorized.");
+  }
+  return id;
+}
+async function requireConsolePermission(req, resource, action) {
+  return await requirePlatformStaff(req, { resource, action });
+}
+async function requireSelfOrPlatformStaff(req, userId, grant) {
+  const id = callerId(req);
+  const target = userId?.toString() ?? "";
+  if (id && target && target === id)
+    return id;
+  return await requirePlatformStaff(req, grant);
+}
+async function requireOrgAccess(req, orgId) {
+  return await requireOrgReach(req, orgId);
+}
+async function requirePlatformOwner(req, grant) {
+  const id = callerId(req);
+  if (!id || !await isPlatformOwner(id)) {
+    throw new import_node_server_utils33.UnauthorizedError("Not authorized.");
+  }
+  if (grant)
+    await requirePlatformStaff(req, grant);
+  return id;
+}
+async function requireOrgReach(req, orgId) {
+  const id = callerId(req);
+  if (!id)
+    throw new import_node_server_utils33.UnauthorizedError("Not authorized.");
+  const org = orgId?.toString() ?? "";
+  const actor = await resolveInviteActor(id);
+  if (staffMayBypass(actor))
+    return id;
+  if (org && actor.orgIds.includes(org))
+    return id;
+  if (org && await hasOrgInvitation(id, org))
+    return id;
+  if (org && await hasOrgOwnership(id, org))
+    return id;
+  throw new import_node_server_utils33.UnauthorizedError("Not authorized.");
+}
+async function requireInviteReach(req, org, app) {
+  const apps = Array.isArray(app) ? app : [app];
+  if (apps.some((a) => a === PLATFORM_STAFF_MEMBER_TYPE)) {
+    await requirePlatformStaff(req);
+  }
+  if (org)
+    await requireOrgReach(req, org);
+}
+async function requireUserFieldWrite(req, userId, field, grant) {
+  if (field === "email")
+    return await requirePlatformStaff(req, grant);
+  return await requireSelfOrPlatformStaff(req, userId, grant);
+}
+
 // src/services/service-provider-invite.service.ts
 var INVITE_VALID_HOURS = 72;
 function useServiceProviderInviteService() {
-  const mailer = new import_node_server_utils33.useMailer({
+  const mailer = new import_node_server_utils34.useMailer({
     host: MAILER_TRANSPORT_HOST,
     port: MAILER_TRANSPORT_PORT,
     secure: MAILER_TRANSPORT_SECURE,
@@ -15478,16 +15654,16 @@ function useServiceProviderInviteService() {
         });
       }
     } catch (error) {
-      import_node_server_utils33.logger.log({
+      import_node_server_utils34.logger.log({
         level: "error",
         message: `Invitation in-app notification failed: ${error?.message}`
       });
     }
-    const filePath = (0, import_node_server_utils33.getDirectory)(
+    const filePath = (0, import_node_server_utils34.getDirectory)(
       __dirname,
       `./public/handlebars/${invite.type}`
     );
-    const emailContent = (0, import_node_server_utils33.compileHandlebar)({
+    const emailContent = (0, import_node_server_utils34.compileHandlebar)({
       context: {
         email,
         orgName,
@@ -15507,22 +15683,22 @@ function useServiceProviderInviteService() {
   async function load(id) {
     const invite = await _getById(id);
     if (!invite)
-      throw new import_node_server_utils33.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils34.NotFoundError("Invitation not found.");
     return invite;
   }
   function assertOwnerOrSuperAdmin(actor, invite) {
-    if (actor.isSuperAdmin)
+    if (staffMayBypass(actor))
       return;
     const org = inviteOrgId(invite);
     if (org && actor.orgIds.includes(org))
       return;
-    throw new import_node_server_utils33.UnauthorizedError(
+    throw new import_node_server_utils34.UnauthorizedError(
       "This invitation belongs to another organisation."
     );
   }
   function assertSuperAdmin(actor) {
-    if (!actor.isSuperAdmin) {
-      throw new import_node_server_utils33.UnauthorizedError(
+    if (!staffMayBypass(actor)) {
+      throw new import_node_server_utils34.UnauthorizedError(
         "Only a Seven365 administrator can approve or reject invitations."
       );
     }
@@ -15530,12 +15706,12 @@ function useServiceProviderInviteService() {
   function assertAllowed(action, invite) {
     const refusal = refuseServiceProviderInviteAction(action, invite.status);
     if (refusal)
-      throw new import_node_server_utils33.BadRequestError(refusal);
+      throw new import_node_server_utils34.BadRequestError(refusal);
   }
   async function actorFor(userId) {
     const actor = await resolveInviteActor(userId);
     if (!actor.id)
-      throw new import_node_server_utils33.UnauthorizedError("Sign in to continue.");
+      throw new import_node_server_utils34.UnauthorizedError("Sign in to continue.");
     return actor;
   }
   async function listApprovals({
@@ -15571,8 +15747,8 @@ function useServiceProviderInviteService() {
     const actor = await actorFor(userId);
     let scope = actor.orgIds;
     if (orgId) {
-      if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
-        throw new import_node_server_utils33.UnauthorizedError(
+      if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
+        throw new import_node_server_utils34.UnauthorizedError(
           "You are not a member of that organisation."
         );
       }
@@ -15582,7 +15758,7 @@ function useServiceProviderInviteService() {
       statuses: statuses ?? [],
       // A super admin asking for everything passes no scope; everyone else is
       // pinned to their own organisations even if they ask for more.
-      orgIds: actor.isSuperAdmin && !orgId ? void 0 : scope,
+      orgIds: staffMayBypass(actor) && !orgId ? void 0 : scope,
       search,
       page,
       limit
@@ -15641,7 +15817,7 @@ function useServiceProviderInviteService() {
     assertSuperAdmin(actor);
     const trimmed = String(reason ?? "").trim();
     if (!trimmed) {
-      throw new import_node_server_utils33.BadRequestError(
+      throw new import_node_server_utils34.BadRequestError(
         "Give a reason for not approving this invitation. The property manager will see it."
       );
     }
@@ -15695,7 +15871,7 @@ function useServiceProviderInviteService() {
       set: { expireAt }
     });
     if (!updated) {
-      throw new import_node_server_utils33.BadRequestError(
+      throw new import_node_server_utils34.BadRequestError(
         refuseServiceProviderInviteAction("resend", invite.status) ?? "This invitation cannot be sent again."
       );
     }
@@ -15731,7 +15907,7 @@ function useServiceProviderInviteService() {
     );
     const invitedUserId = user?._id?.toString();
     if (!invitedUserId || invitedUserId !== userId) {
-      throw new import_node_server_utils33.UnauthorizedError("This invitation was sent to someone else.");
+      throw new import_node_server_utils34.UnauthorizedError("This invitation was sent to someone else.");
     }
   }
   async function decline({ id, userId }) {
@@ -15761,7 +15937,7 @@ function useServiceProviderInviteService() {
     const invite = await load(id);
     await assertInvitedParty(actor.id, invite);
     if (invite.status === "awaiting-approval" /* AWAITING_APPROVAL */) {
-      throw new import_node_server_utils33.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils34.NotFoundError("Invitation not found.");
     }
     const { orgName, siteName } = await inviteContext(invite);
     return {
@@ -15799,7 +15975,7 @@ function useVerificationService() {
     from: MAILER_FROM_EMAIL,
     password: MAILER_PASSWORD
   };
-  const mailer = new import_node_server_utils34.useMailer(MailerConfig);
+  const mailer = new import_node_server_utils35.useMailer(MailerConfig);
   const {
     add,
     getById: _getById,
@@ -15837,11 +16013,11 @@ function useVerificationService() {
       value.type = type;
       const res = await add(value);
       const dir = __dirname;
-      const filePath = (0, import_node_server_utils34.getDirectory)(dir, `./public/handlebars/${type}`);
+      const filePath = (0, import_node_server_utils35.getDirectory)(dir, `./public/handlebars/${type}`);
       const isMember = type === "member-invite";
       const subject = isMember ? "Member Invite" : "User Invite";
       const link = `${APP_MAIN}/verify/${isMember ? "membership" : "invitation"}/${res}`;
-      const emailContent = (0, import_node_server_utils34.compileHandlebar)({
+      const emailContent = (0, import_node_server_utils35.compileHandlebar)({
         context: {
           email: userName,
           validity: VERIFICATION_USER_INVITE_DURATION,
@@ -15855,7 +16031,7 @@ function useVerificationService() {
         html: emailContent,
         sender: "iService365"
       }).catch((error) => {
-        import_node_server_utils34.logger.log({
+        import_node_server_utils35.logger.log({
           level: "error",
           message: `Error sending user ${type} email: ${error}`
         });
@@ -15899,7 +16075,7 @@ function useVerificationService() {
       const createdId = await add(value);
       verificationIds.push(createdId.toString());
       const link = `${APP_MAIN}/verify/invitation/${createdId}`;
-      const emailContent = (0, import_node_server_utils34.compileHandlebar)({
+      const emailContent = (0, import_node_server_utils35.compileHandlebar)({
         context: {
           email,
           validity: VERIFICATION_USER_INVITE_DURATION,
@@ -15912,7 +16088,7 @@ function useVerificationService() {
           hasPestControl: app === "pest_control_services",
           hasPoolMaintenance: app === "pool_maintenance_services"
         },
-        filePath: (0, import_node_server_utils34.getDirectory)(__dirname, "./public/handlebars/user-invite")
+        filePath: (0, import_node_server_utils35.getDirectory)(__dirname, "./public/handlebars/user-invite")
       });
       await mailer.sendMail({
         to: email,
@@ -15941,7 +16117,7 @@ function useVerificationService() {
     });
     if (existing) {
       if (existing.status === "complete") {
-        throw new import_node_server_utils34.BadRequestError(
+        throw new import_node_server_utils35.BadRequestError(
           `User already completed member invite for app: ${metadata.app}`
         );
       }
@@ -15956,13 +16132,13 @@ function useVerificationService() {
     };
     const res = await add(value);
     const link = `${APP_MAIN}/verify/membership/${res}`;
-    const emailContent = (0, import_node_server_utils34.compileHandlebar)({
+    const emailContent = (0, import_node_server_utils35.compileHandlebar)({
       context: {
         email,
         validity: VERIFICATION_USER_INVITE_DURATION,
         link
       },
-      filePath: (0, import_node_server_utils34.getDirectory)(__dirname, "./public/handlebars/member-invite")
+      filePath: (0, import_node_server_utils35.getDirectory)(__dirname, "./public/handlebars/member-invite")
     });
     await mailer.sendMail({
       to: email,
@@ -16008,8 +16184,8 @@ function useVerificationService() {
     });
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
-      import_node_server_utils34.logger.log({ level: "error", message: messages });
-      throw new import_node_server_utils34.BadRequestError(`Invalid input: ${error.message}`);
+      import_node_server_utils35.logger.log({ level: "error", message: messages });
+      throw new import_node_server_utils35.BadRequestError(`Invalid input: ${error.message}`);
     }
     let subject = "Service Provider Invite" /* _SERVICE_PROVIDER_INVITE */;
     let type = "service-provider-invite" /* SERVICE_PROVIDER_INVITE */;
@@ -16032,10 +16208,10 @@ function useVerificationService() {
       const org = await getOrgById(orgId);
       const actor = await resolveInviteActor(invitedBy);
       if (!actor.id) {
-        throw new import_node_server_utils34.UnauthorizedError("Sign in to continue.");
+        throw new import_node_server_utils35.UnauthorizedError("Sign in to continue.");
       }
-      if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
-        throw new import_node_server_utils34.UnauthorizedError(
+      if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
+        throw new import_node_server_utils35.UnauthorizedError(
           "You can only invite service providers to your own organisation's sites."
         );
       }
@@ -16054,7 +16230,7 @@ function useVerificationService() {
         inviterIsPropertyManagement: actor.propertyManagementOrgIds.includes(orgId)
       });
       if (!decision.ok) {
-        throw new import_node_server_utils34.BadRequestError(decision.reason);
+        throw new import_node_server_utils35.BadRequestError(decision.reason);
       }
       value.type = decision.type;
       subject = decision.subject;
@@ -16115,8 +16291,8 @@ function useVerificationService() {
     });
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
-      import_node_server_utils34.logger.log({ level: "error", message: messages });
-      throw new import_node_server_utils34.BadRequestError(`Invalid input: ${error.message}`);
+      import_node_server_utils35.logger.log({ level: "error", message: messages });
+      throw new import_node_server_utils35.BadRequestError(`Invalid input: ${error.message}`);
     }
     const subject = "Service Provider Invite" /* _SERVICE_PROVIDER_INVITE */;
     const type = "service-provider-invite" /* SERVICE_PROVIDER_INVITE */;
@@ -16136,12 +16312,12 @@ function useVerificationService() {
     };
     try {
       const id = await _add(value);
-      const filePath = (0, import_node_server_utils34.getDirectory)(
+      const filePath = (0, import_node_server_utils35.getDirectory)(
         __dirname,
         `./public/handlebars/${value.type}`
       );
       const link = `${APP_MAIN}/verify/${value.type}/${id}`;
-      const emailContent = (0, import_node_server_utils34.compileHandlebar)({
+      const emailContent = (0, import_node_server_utils35.compileHandlebar)({
         context: {
           email,
           app,
@@ -16174,12 +16350,12 @@ function useVerificationService() {
     try {
       const user = await getUserByEmail(email);
       if (!user) {
-        throw new import_node_server_utils34.NotFoundError("Email not found");
+        throw new import_node_server_utils35.NotFoundError("Email not found");
       }
       const res = await add(value);
       const dir = __dirname;
-      const filePath = (0, import_node_server_utils34.getDirectory)(dir, "./public/handlebars/forget-password");
-      const emailContent = (0, import_node_server_utils34.compileHandlebar)({
+      const filePath = (0, import_node_server_utils35.getDirectory)(dir, "./public/handlebars/forget-password");
+      const emailContent = (0, import_node_server_utils35.compileHandlebar)({
         context: {
           userName: user?.name,
           validity: VERIFICATION_FORGET_PASSWORD_DURATION,
@@ -16193,21 +16369,21 @@ function useVerificationService() {
         sender: "iService365",
         html: emailContent
       }).catch((error) => {
-        import_node_server_utils34.logger.log({
+        import_node_server_utils35.logger.log({
           level: "error",
           message: `Error sending forget password email: ${error}`
         });
       });
       return "Successfully created a link to reset password. Please check your email.";
     } catch (error) {
-      throw new import_node_server_utils34.InternalServerError("Failed to create forget password link.");
+      throw new import_node_server_utils35.InternalServerError("Failed to create forget password link.");
     }
   }
   async function getById(id) {
     try {
       const _id = await _getById(id);
       if (!_id) {
-        throw new import_node_server_utils34.NotFoundError("Verification not found.");
+        throw new import_node_server_utils35.NotFoundError("Verification not found.");
       }
       return _id;
     } catch (error) {
@@ -16216,48 +16392,48 @@ function useVerificationService() {
   }
   function errorByType(type, status) {
     if ((type === "user-invite" || type === "member-invite" || type === "service-provider-invite" || type === "service-provider-create-org") && status === "expired") {
-      throw new import_node_server_utils34.BadRequestError(
+      throw new import_node_server_utils35.BadRequestError(
         "Invitation has already expired, please contact admin to resend the invitation."
       );
     }
     if (type === "user-sign-up" && status === "expired") {
-      throw new import_node_server_utils34.BadRequestError(
+      throw new import_node_server_utils35.BadRequestError(
         "Sign up verification has expired, please sign up again to get a new verification link."
       );
     }
     if ((type === "user-invite" || type === "member-invite" || type === "service-provider-invite" || type === "service-provider-create-org") && status === "complete") {
-      throw new import_node_server_utils34.BadRequestError(
+      throw new import_node_server_utils35.BadRequestError(
         "User already registered, please login to continue."
       );
     }
     if (type === "forget-password" && status === "complete") {
-      throw new import_node_server_utils34.BadRequestError(
+      throw new import_node_server_utils35.BadRequestError(
         "Forget password verification has already been used, please request a new one."
       );
     }
     if (type === "forget-password" && status === "expired") {
-      throw new import_node_server_utils34.BadRequestError(
+      throw new import_node_server_utils35.BadRequestError(
         "Forget password verification has expired, please request a new one."
       );
     }
-    throw new import_node_server_utils34.BadRequestError("Invalid verification.");
+    throw new import_node_server_utils35.BadRequestError("Invalid verification.");
   }
   async function verify(id) {
-    const session = import_node_server_utils34.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils35.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
       const _id = await _getById(id);
       if (!_id) {
-        throw new import_node_server_utils34.NotFoundError("Verification not found.");
+        throw new import_node_server_utils35.NotFoundError("Verification not found.");
       }
       if (_id.status === "expired") {
         errorByType(_id.type, "expired");
       }
       if (_id.status === "cancelled") {
-        throw new import_node_server_utils34.BadRequestError("Verification already cancelled.");
+        throw new import_node_server_utils35.BadRequestError("Verification already cancelled.");
       }
       if (_id.status === "complete") {
-        throw new import_node_server_utils34.BadRequestError("Verification already completed.");
+        throw new import_node_server_utils35.BadRequestError("Verification already completed.");
       }
       const expiration = new Date(_id.expireAt).getTime();
       const now = (/* @__PURE__ */ new Date()).getTime();
@@ -16268,7 +16444,7 @@ function useVerificationService() {
       return _id;
     } catch (error) {
       await session?.abortTransaction();
-      import_node_server_utils34.logger.log({
+      import_node_server_utils35.logger.log({
         level: "info",
         message: `Error verifying user invitation: ${error}`
       });
@@ -16281,7 +16457,7 @@ function useVerificationService() {
     try {
       await updateStatusById(id, "cancelled");
     } catch (error) {
-      throw new import_node_server_utils34.InternalServerError(
+      throw new import_node_server_utils35.InternalServerError(
         `Error cancelling user invitation: ${error}`
       );
     }
@@ -16301,7 +16477,7 @@ function useVerificationService() {
     try {
       const user = await getUserByEmail(email);
       if (user) {
-        throw new import_node_server_utils34.BadRequestError(
+        throw new import_node_server_utils35.BadRequestError(
           `Email ${email} is already registered, please login to continue.`
         );
       }
@@ -16315,8 +16491,8 @@ function useVerificationService() {
       };
       const res = await add(value);
       const dir = __dirname;
-      const filePath = (0, import_node_server_utils34.getDirectory)(dir, "./public/handlebars/sign-up");
-      const emailContent = (0, import_node_server_utils34.compileHandlebar)({
+      const filePath = (0, import_node_server_utils35.getDirectory)(dir, "./public/handlebars/sign-up");
+      const emailContent = (0, import_node_server_utils35.compileHandlebar)({
         context: {
           email,
           validity: "5 minutes",
@@ -16330,7 +16506,7 @@ function useVerificationService() {
         html: emailContent,
         sender: "iService365"
       }).catch((error) => {
-        import_node_server_utils34.logger.log({
+        import_node_server_utils35.logger.log({
           level: "error",
           message: `Error sending user invite email: ${error}`
         });
@@ -16351,7 +16527,7 @@ function useVerificationService() {
       }
       return "Successfully checked for expired invitations.";
     } catch (error) {
-      import_node_server_utils34.logger.log({
+      import_node_server_utils35.logger.log({
         level: "info",
         message: `Error checking expired user invitation: ${error}`
       });
@@ -16375,13 +16551,13 @@ function useVerificationService() {
 }
 
 // src/services/user.service.ts
-var import_node_server_utils38 = require("@7365admin1/node-server-utils");
+var import_node_server_utils39 = require("@7365admin1/node-server-utils");
 
 // src/repositories/role.repo.ts
-var import_node_server_utils36 = require("@7365admin1/node-server-utils");
+var import_node_server_utils37 = require("@7365admin1/node-server-utils");
 
 // src/models/role.model.ts
-var import_node_server_utils35 = require("@7365admin1/node-server-utils");
+var import_node_server_utils36 = require("@7365admin1/node-server-utils");
 var import_mongodb32 = require("mongodb");
 var PLATFORM_STAFF_ROLE_TYPE = "admin";
 var MRole = class {
@@ -16390,28 +16566,28 @@ var MRole = class {
       try {
         value._id = new import_mongodb32.ObjectId(value._id);
       } catch (error) {
-        throw new import_node_server_utils35.BadRequestError("Invalid role ID format.");
+        throw new import_node_server_utils36.BadRequestError("Invalid role ID format.");
       }
     }
     if (typeof value.org === "string" && value.org.length === 24) {
       try {
         value.org = new import_mongodb32.ObjectId(value.org);
       } catch (error) {
-        throw new import_node_server_utils35.BadRequestError("Invalid org ID format.");
+        throw new import_node_server_utils36.BadRequestError("Invalid org ID format.");
       }
     }
     if (typeof value.site === "string" && value.site.length === 24) {
       try {
         value.site = new import_mongodb32.ObjectId(value.site);
       } catch (error) {
-        throw new import_node_server_utils35.BadRequestError("Invalid site ID format.");
+        throw new import_node_server_utils36.BadRequestError("Invalid site ID format.");
       }
     }
     if (value.createdBy) {
       try {
         value.createdBy = new import_mongodb32.ObjectId(value.createdBy);
       } catch (error) {
-        throw new import_node_server_utils35.BadRequestError("Invalid created by ID format.");
+        throw new import_node_server_utils36.BadRequestError("Invalid created by ID format.");
       }
     }
     this._id = value._id ?? new import_mongodb32.ObjectId();
@@ -16434,9 +16610,9 @@ var MRole = class {
 // src/repositories/role.repo.ts
 var import_mongodb33 = require("mongodb");
 function useRoleRepo() {
-  const db2 = import_node_server_utils36.useAtlas.getDb();
+  const db2 = import_node_server_utils37.useAtlas.getDb();
   if (!db2) {
-    throw new import_node_server_utils36.InternalServerError("Unable to connect to server.");
+    throw new import_node_server_utils37.InternalServerError("Unable to connect to server.");
   }
   const namespace_collection = "roles";
   const collection = db2.collection(namespace_collection);
@@ -16448,14 +16624,14 @@ function useRoleRepo() {
         { key: { status: 1 } }
       ]);
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to create index on role.");
+      throw new import_node_server_utils37.InternalServerError("Failed to create index on role.");
     }
   }
   async function createTextIndex() {
     try {
       await collection.createIndex({ name: "text" });
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to create text index on role.");
+      throw new import_node_server_utils37.InternalServerError("Failed to create text index on role.");
     }
   }
   async function createUniqueIndex() {
@@ -16465,62 +16641,62 @@ function useRoleRepo() {
         { unique: true }
       );
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to create unique index on role.");
+      throw new import_node_server_utils37.InternalServerError("Failed to create unique index on role.");
     }
   }
-  const { delNamespace, setCache, getCache } = (0, import_node_server_utils36.useCache)(namespace_collection);
-  const { delNamespace: _delDashboardNameSpace } = (0, import_node_server_utils36.useCache)("dashboard");
+  const { delNamespace, setCache, getCache } = (0, import_node_server_utils37.useCache)(namespace_collection);
+  const { delNamespace: _delDashboardNameSpace } = (0, import_node_server_utils37.useCache)("dashboard");
   async function addRole(value, session) {
     value = new MRole(value);
     try {
       const res = await collection.insertOne(value, { session });
       delNamespace().then(() => {
-        import_node_server_utils36.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+        import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(
+        import_node_server_utils37.logger.error(
           `Failed to clear cache for namespace: ${namespace_collection}`,
           err
         );
       });
       return res.insertedId;
     } catch (error) {
-      import_node_server_utils36.logger.log({ level: "error", message: `${error}` });
+      import_node_server_utils37.logger.log({ level: "error", message: `${error}` });
       const isDuplicated = error.message.includes("duplicate");
       if (isDuplicated) {
-        throw new import_node_server_utils36.BadRequestError("Role already exists.");
+        throw new import_node_server_utils37.BadRequestError("Role already exists.");
       }
-      throw new import_node_server_utils36.InternalServerError("Failed to create role.");
+      throw new import_node_server_utils37.InternalServerError("Failed to create role.");
     }
   }
   async function getRoleByUserId(value) {
     try {
       value = new import_mongodb33.ObjectId(value);
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid user ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid user ID format.");
     }
     try {
-      const cacheKey = (0, import_node_server_utils36.makeCacheKey)(namespace_collection, { user: value });
+      const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, { user: value });
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils36.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache hit for key: ${cacheKey}`);
         return cachedData;
       }
       const data = await collection.findOne({ user: value });
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils36.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils37.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to retrieve role by user ID.");
+      throw new import_node_server_utils37.InternalServerError("Failed to retrieve role by user ID.");
     }
   }
   async function getOwnerRolesByTypeOrg(type, org) {
     try {
       org = new import_mongodb33.ObjectId(org);
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid organization ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid organization ID format.");
     }
     const cacheOptions = {
       org: org.toString(),
@@ -16528,69 +16704,69 @@ function useRoleRepo() {
       type,
       status: "active"
     };
-    const cacheKey = (0, import_node_server_utils36.makeCacheKey)(namespace_collection, cacheOptions);
+    const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, cacheOptions);
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
-      import_node_server_utils36.logger.info(`Cache hit for key: ${cacheKey}`);
+      import_node_server_utils37.logger.info(`Cache hit for key: ${cacheKey}`);
       return cachedData;
     }
     try {
       const data = await collection.find({ org, permissions: "*", type, status: "active" }).toArray();
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils36.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils37.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to retrieve role by user ID.");
+      throw new import_node_server_utils37.InternalServerError("Failed to retrieve role by user ID.");
     }
   }
   async function getRoleById(_id) {
     try {
       _id = new import_mongodb33.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid role ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid role ID format.");
     }
     try {
-      const cacheKey = (0, import_node_server_utils36.makeCacheKey)(namespace_collection, { _id });
+      const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, { _id });
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils36.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache hit for key: ${cacheKey}`);
         return cachedData;
       }
       const data = await collection.findOne({ _id });
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils36.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils37.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to retrieve role by ID.");
+      throw new import_node_server_utils37.InternalServerError("Failed to retrieve role by ID.");
     }
   }
   async function getRoleByName(name, type) {
     if (!name) {
-      throw new import_node_server_utils36.BadRequestError("Role name is required.");
+      throw new import_node_server_utils37.BadRequestError("Role name is required.");
     }
     const query2 = type ? { name, type } : { name };
     try {
-      const cacheKey = (0, import_node_server_utils36.makeCacheKey)(namespace_collection, query2);
+      const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, query2);
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils36.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache hit for key: ${cacheKey}`);
         return cachedData;
       }
       const data = await collection.findOne(query2);
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils36.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils37.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to retrieve role by name.");
+      throw new import_node_server_utils37.InternalServerError("Failed to retrieve role by name.");
     }
   }
   async function getRoles({
@@ -16607,14 +16783,14 @@ function useRoleRepo() {
       try {
         org = new import_mongodb33.ObjectId(org);
       } catch (error) {
-        throw new import_node_server_utils36.BadRequestError("Invalid organization ID format.");
+        throw new import_node_server_utils37.BadRequestError("Invalid organization ID format.");
       }
     }
     if (site && typeof site === "string" && site.length === 24) {
       try {
         site = new import_mongodb33.ObjectId(site);
       } catch (error) {
-        throw new import_node_server_utils36.BadRequestError("Invalid site ID format.");
+        throw new import_node_server_utils37.BadRequestError("Invalid site ID format.");
       }
     }
     const query2 = { status: "active", org };
@@ -16633,10 +16809,10 @@ function useRoleRepo() {
       query2.type = type;
       cacheOptions.type = type;
     }
-    const cacheKey = (0, import_node_server_utils36.makeCacheKey)(namespace_collection, cacheOptions);
+    const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, cacheOptions);
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
-      import_node_server_utils36.logger.info(`Cache hit for key: ${cacheKey}`);
+      import_node_server_utils37.logger.info(`Cache hit for key: ${cacheKey}`);
       return cachedData;
     }
     try {
@@ -16647,15 +16823,15 @@ function useRoleRepo() {
         { $limit: limit }
       ]).toArray();
       const length = await collection.countDocuments(query2);
-      const data = (0, import_node_server_utils36.paginate)(items, page, limit, length);
+      const data = (0, import_node_server_utils37.paginate)(items, page, limit, length);
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils36.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils37.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils37.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      import_node_server_utils36.logger.log({ level: "error", message: `${error}` });
+      import_node_server_utils37.logger.log({ level: "error", message: `${error}` });
       throw error;
     }
   }
@@ -16665,12 +16841,12 @@ function useRoleRepo() {
         org = new import_mongodb33.ObjectId(org);
       }
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid organization ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid organization ID format.");
     }
     try {
       return await collection.find({ status: "active", type, org }).sort({ name: 1 }).toArray();
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to retrieve replacement roles.");
+      throw new import_node_server_utils37.InternalServerError("Failed to retrieve replacement roles.");
     }
   }
   async function assertNotSeededOwnerRole(_id) {
@@ -16679,19 +16855,19 @@ function useRoleRepo() {
       { projection: { type: 1, default: 1 } }
     );
     if (role?.type === PLATFORM_STAFF_ROLE_TYPE && role?.default === true) {
-      throw new import_node_server_utils36.BadRequestError(
+      throw new import_node_server_utils37.BadRequestError(
         "The Seven365 platform owner role cannot be edited or deleted."
       );
     }
   }
   async function updateRole(_id, value, session) {
     if (!_id) {
-      throw new import_node_server_utils36.BadRequestError("Role ID is required.");
+      throw new import_node_server_utils37.BadRequestError("Role ID is required.");
     }
     try {
       _id = new import_mongodb33.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid role ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid role ID format.");
     }
     await assertNotSeededOwnerRole(_id);
     if (!value.name) {
@@ -16704,9 +16880,9 @@ function useRoleRepo() {
       try {
         await collection.updateOne({ _id }, { $set: value }, { session });
         delNamespace().then(() => {
-          import_node_server_utils36.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+          import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
         }).catch((err) => {
-          import_node_server_utils36.logger.error(
+          import_node_server_utils37.logger.error(
             `Failed to clear cache for namespace: ${namespace_collection}`,
             err
           );
@@ -16715,29 +16891,29 @@ function useRoleRepo() {
       } catch (error) {
         const isDuplicated = error.message.includes("duplicate");
         if (isDuplicated) {
-          throw new import_node_server_utils36.BadRequestError("Role name already exists.");
+          throw new import_node_server_utils37.BadRequestError("Role name already exists.");
         }
-        throw new import_node_server_utils36.InternalServerError("Failed to update role.");
+        throw new import_node_server_utils37.InternalServerError("Failed to update role.");
       }
     } else {
-      throw new import_node_server_utils36.BadRequestError("No fields to update.");
+      throw new import_node_server_utils37.BadRequestError("No fields to update.");
     }
   }
   async function updatePermissionsById(_id, permissions, session) {
     if (!_id) {
-      throw new import_node_server_utils36.BadRequestError("Role ID is required.");
+      throw new import_node_server_utils37.BadRequestError("Role ID is required.");
     }
     try {
       _id = new import_mongodb33.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid role ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid role ID format.");
     }
     await assertNotSeededOwnerRole(_id);
     if (!permissions) {
-      throw new import_node_server_utils36.BadRequestError("Permissions are required.");
+      throw new import_node_server_utils37.BadRequestError("Permissions are required.");
     }
     if (permissions.length === 0) {
-      throw new import_node_server_utils36.BadRequestError("Permissions cannot be empty.");
+      throw new import_node_server_utils37.BadRequestError("Permissions cannot be empty.");
     }
     try {
       await collection.updateOne(
@@ -16746,23 +16922,23 @@ function useRoleRepo() {
         { session }
       );
       delNamespace().then(() => {
-        import_node_server_utils36.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+        import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(
+        import_node_server_utils37.logger.error(
           `Failed to clear cache for namespace: ${namespace_collection}`,
           err
         );
       });
       return "Successfully updated role permissions.";
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to update role permissions.");
+      throw new import_node_server_utils37.InternalServerError("Failed to update role permissions.");
     }
   }
   async function deleteRole(_id, session) {
     try {
       _id = new import_mongodb33.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils36.BadRequestError("Invalid role ID format.");
+      throw new import_node_server_utils37.BadRequestError("Invalid role ID format.");
     }
     await assertNotSeededOwnerRole(_id);
     try {
@@ -16777,24 +16953,24 @@ function useRoleRepo() {
         { session }
       );
       if (res.modifiedCount === 0) {
-        throw new import_node_server_utils36.InternalServerError("Unable to update role status.");
+        throw new import_node_server_utils37.InternalServerError("Unable to update role status.");
       }
       delNamespace().then(() => {
-        import_node_server_utils36.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+        import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(
+        import_node_server_utils37.logger.error(
           `Failed to clear cache for namespace: ${namespace_collection}`,
           err
         );
       });
       _delDashboardNameSpace().then(() => {
-        import_node_server_utils36.logger.info(`Cache cleared for namespace: dashboard`);
+        import_node_server_utils37.logger.info(`Cache cleared for namespace: dashboard`);
       }).catch((err) => {
-        import_node_server_utils36.logger.error(`Failed to clear cache for namespace: dashboard`, err);
+        import_node_server_utils37.logger.error(`Failed to clear cache for namespace: dashboard`, err);
       });
       return "Successfully deleted role permission.";
     } catch (error) {
-      throw new import_node_server_utils36.InternalServerError("Failed to delete role.");
+      throw new import_node_server_utils37.InternalServerError("Failed to delete role.");
     }
   }
   return {
@@ -16815,7 +16991,7 @@ function useRoleRepo() {
 }
 
 // src/repositories/file.repo.ts
-var import_node_server_utils37 = require("@7365admin1/node-server-utils");
+var import_node_server_utils38 = require("@7365admin1/node-server-utils");
 
 // src/models/file.model.ts
 var MFile = class {
@@ -16834,13 +17010,13 @@ var MFile = class {
 // src/repositories/file.repo.ts
 var import_mongodb34 = require("mongodb");
 function useFileRepo() {
-  const db2 = import_node_server_utils37.useAtlas.getDb();
+  const db2 = import_node_server_utils38.useAtlas.getDb();
   if (!db2) {
-    throw new import_node_server_utils37.InternalServerError("Unable to connect to server.");
+    throw new import_node_server_utils38.InternalServerError("Unable to connect to server.");
   }
   const namespace_collection = "files";
   const collection = db2.collection(namespace_collection);
-  const { delNamespace, getCache, setCache } = (0, import_node_server_utils37.useCache)(namespace_collection);
+  const { delNamespace, getCache, setCache } = (0, import_node_server_utils38.useCache)(namespace_collection);
   async function createIndex() {
     try {
       await collection.createIndexes([
@@ -16848,7 +17024,7 @@ function useFileRepo() {
         { key: { status: 1 } }
       ]);
     } catch (error) {
-      throw new import_node_server_utils37.InternalServerError("Failed to create index on feedback.");
+      throw new import_node_server_utils38.InternalServerError("Failed to create index on feedback.");
     }
   }
   async function createFile(value, session) {
@@ -16856,65 +17032,65 @@ function useFileRepo() {
       value = new MFile(value);
       const res = await collection.insertOne(value, { session });
       delNamespace().then(() => {
-        import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+        import_node_server_utils38.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
       }).catch((err) => {
-        import_node_server_utils37.logger.error(
+        import_node_server_utils38.logger.error(
           `Failed to clear cache for namespace: ${namespace_collection}`,
           err
         );
       });
       return res.insertedId.toString();
     } catch (error) {
-      throw new import_node_server_utils37.InternalServerError("Failed to create file.");
+      throw new import_node_server_utils38.InternalServerError("Failed to create file.");
     }
   }
   async function deleteFileById(_id, session) {
     try {
       _id = new import_mongodb34.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils37.BadRequestError("Invalid file ID format.");
+      throw new import_node_server_utils38.BadRequestError("Invalid file ID format.");
     }
     try {
       await collection.deleteOne({ _id }, { session });
       delNamespace().then(() => {
-        import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+        import_node_server_utils38.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
       }).catch((err) => {
-        import_node_server_utils37.logger.error(
+        import_node_server_utils38.logger.error(
           `Failed to clear cache for namespace: ${namespace_collection}`,
           err
         );
       });
       return "File deleted successfully.";
     } catch (error) {
-      throw new import_node_server_utils37.InternalServerError("Failed to delete file.");
+      throw new import_node_server_utils38.InternalServerError("Failed to delete file.");
     }
   }
   async function getAllDraftedFiles() {
-    const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, {
+    const cacheKey = (0, import_node_server_utils38.makeCacheKey)(namespace_collection, {
       status: ["draft", null]
     });
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
-      import_node_server_utils37.logger.info(`Cache hit for key: ${cacheKey}`);
+      import_node_server_utils38.logger.info(`Cache hit for key: ${cacheKey}`);
       return cachedData;
     }
     try {
       const data = await collection.find({ $and: [{ status: "draft" }, { status: null }] }).toArray();
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils37.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils38.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils37.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils38.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils37.InternalServerError("Failed to get drafted files.");
+      throw new import_node_server_utils38.InternalServerError("Failed to get drafted files.");
     }
   }
   async function updateStatusById(_id, value, session) {
     try {
       _id = new import_mongodb34.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils37.BadRequestError("Invalid file ID format.");
+      throw new import_node_server_utils38.BadRequestError("Invalid file ID format.");
     }
     try {
       const res = await collection.updateOne(
@@ -16923,29 +17099,29 @@ function useFileRepo() {
         { session }
       );
       delNamespace().then(() => {
-        import_node_server_utils37.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
+        import_node_server_utils38.logger.info(`Cache cleared for namespace: ${namespace_collection}`);
       }).catch((err) => {
-        import_node_server_utils37.logger.error(
+        import_node_server_utils38.logger.error(
           `Failed to clear cache for namespace: ${namespace_collection}`,
           err
         );
       });
       return res;
     } catch (error) {
-      throw new import_node_server_utils37.InternalServerError("Failed to update file.");
+      throw new import_node_server_utils38.InternalServerError("Failed to update file.");
     }
   }
   async function getFileById(_id) {
     try {
       _id = new import_mongodb34.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils37.BadRequestError("Invalid ID.");
+      throw new import_node_server_utils38.BadRequestError("Invalid ID.");
     }
-    const cacheKey = (0, import_node_server_utils37.makeCacheKey)(namespace_collection, { _id: String(_id) });
+    const cacheKey = (0, import_node_server_utils38.makeCacheKey)(namespace_collection, { _id: String(_id) });
     try {
       const cached = await getCache(cacheKey);
       if (cached) {
-        import_node_server_utils37.logger.log({
+        import_node_server_utils38.logger.log({
           level: "info",
           message: `Cache hit for getById file: ${cacheKey}`
         });
@@ -16955,22 +17131,22 @@ function useFileRepo() {
         _id
       });
       setCache(cacheKey, result, 300).then(() => {
-        import_node_server_utils37.logger.log({
+        import_node_server_utils38.logger.log({
           level: "info",
           message: `Cache set for file by id: ${cacheKey}`
         });
       }).catch((err) => {
-        import_node_server_utils37.logger.log({
+        import_node_server_utils38.logger.log({
           level: "error",
           message: `Failed to set cache for file by id: ${err.message}`
         });
       });
       return result;
     } catch (error) {
-      if (error instanceof import_node_server_utils37.AppError) {
+      if (error instanceof import_node_server_utils38.AppError) {
         throw error;
       } else {
-        throw new import_node_server_utils37.InternalServerError("Failed to get file by id.");
+        throw new import_node_server_utils38.InternalServerError("Failed to get file by id.");
       }
     }
   }
@@ -17011,7 +17187,7 @@ function useUserService() {
         role = result._id?.toString();
       }
     } catch (error) {
-      import_node_server_utils38.logger.error(error.message);
+      import_node_server_utils39.logger.error(error.message);
     }
     if (!role) {
       try {
@@ -17023,15 +17199,15 @@ function useUserService() {
         });
         role = result.toString();
       } catch (error) {
-        import_node_server_utils38.logger.error(error.message);
+        import_node_server_utils39.logger.error(error.message);
       }
       if (!role) {
-        import_node_server_utils38.logger.error("Failed to create default role.");
+        import_node_server_utils39.logger.error("Failed to create default role.");
       }
     }
     let user = "";
     if (!DEFAULT_USER_EMAIL) {
-      import_node_server_utils38.logger.error("Default user email is not set.");
+      import_node_server_utils39.logger.error("Default user email is not set.");
     }
     try {
       const result = await getUserByEmail(DEFAULT_USER_EMAIL);
@@ -17039,11 +17215,11 @@ function useUserService() {
         user = result._id?.toString();
       }
     } catch (error) {
-      import_node_server_utils38.logger.error(error.message);
+      import_node_server_utils39.logger.error(error.message);
     }
     if (!user) {
       try {
-        const password = await (0, import_node_server_utils38.hashPassword)(DEFAULT_USER_PASSWORD);
+        const password = await (0, import_node_server_utils39.hashPassword)(DEFAULT_USER_PASSWORD);
         const userId = await addUser({
           email: DEFAULT_USER_EMAIL,
           password,
@@ -17051,10 +17227,10 @@ function useUserService() {
         });
         user = userId.toString();
       } catch (error) {
-        import_node_server_utils38.logger.error(error.message);
+        import_node_server_utils39.logger.error(error.message);
       }
       if (!user) {
-        import_node_server_utils38.logger.error("Failed to create default user.");
+        import_node_server_utils39.logger.error("Failed to create default user.");
       }
     }
     try {
@@ -17065,7 +17241,7 @@ function useUserService() {
         type: "admin"
       });
     } catch (error) {
-      import_node_server_utils38.logger.error(error.message);
+      import_node_server_utils39.logger.error(error.message);
     }
   }
   async function createUserBySignUp({
@@ -17073,28 +17249,28 @@ function useUserService() {
     name = "",
     password = ""
   } = {}) {
-    const session = import_node_server_utils38.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils39.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
       const signUp = await getVerificationById(id);
       if (!signUp) {
-        throw new import_node_server_utils38.BadRequestError("Invalid sign up link.");
+        throw new import_node_server_utils39.BadRequestError("Invalid sign up link.");
       }
       if (signUp.status === "complete") {
-        throw new import_node_server_utils38.BadRequestError(
+        throw new import_node_server_utils39.BadRequestError(
           "You have already an account created using this link."
         );
       }
       const expired = new Date(signUp.expireAt) < /* @__PURE__ */ new Date();
       if (signUp.status === "expired" || expired) {
-        throw new import_node_server_utils38.BadRequestError("Sign up link expired.");
+        throw new import_node_server_utils39.BadRequestError("Sign up link expired.");
       }
       const email = signUp.email;
       const _user = await getUserByEmail(signUp.email);
       if (_user) {
-        throw new import_node_server_utils38.BadRequestError(`User already exists: ${email}.`);
+        throw new import_node_server_utils39.BadRequestError(`User already exists: ${email}.`);
       }
-      const hashedPassword = await (0, import_node_server_utils38.hashPassword)(password);
+      const hashedPassword = await (0, import_node_server_utils39.hashPassword)(password);
       let org = null;
       if (signUp.metadata?.org) {
         org = await getOrgById(signUp.metadata.org);
@@ -17143,30 +17319,30 @@ function useUserService() {
       throw error;
     }
     if (newPassword !== passwordConfirmation) {
-      throw new import_node_server_utils38.BadRequestError("Passwords do not match.");
+      throw new import_node_server_utils39.BadRequestError("Passwords do not match.");
     }
     let hashedPassword;
-    const session = import_node_server_utils38.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils39.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
-      hashedPassword = await (0, import_node_server_utils38.hashPassword)(newPassword);
+      hashedPassword = await (0, import_node_server_utils39.hashPassword)(newPassword);
     } catch (error) {
-      throw new import_node_server_utils38.InternalServerError(`Error hashing password: ${error}`);
+      throw new import_node_server_utils39.InternalServerError(`Error hashing password: ${error}`);
     }
     try {
       const otpDoc = await getVerificationById(id);
       if (!otpDoc) {
-        throw new import_node_server_utils38.NotFoundError("You are using an invalid reset link.");
+        throw new import_node_server_utils39.NotFoundError("You are using an invalid reset link.");
       }
       if (otpDoc.status === "complete") {
-        throw new import_node_server_utils38.BadRequestError("This link has already been invalidated.");
+        throw new import_node_server_utils39.BadRequestError("This link has already been invalidated.");
       }
       const user = await getUserByEmail(otpDoc.email);
       if (!user) {
-        throw new import_node_server_utils38.NotFoundError("User not found.");
+        throw new import_node_server_utils39.NotFoundError("User not found.");
       }
       if (!user._id) {
-        throw new import_node_server_utils38.InternalServerError("Invalid user ID.");
+        throw new import_node_server_utils39.InternalServerError("Invalid user ID.");
       }
       await updateStatusById(id, "complete", session);
       await _resetPassword(
@@ -17186,7 +17362,7 @@ function useUserService() {
       session?.endSession();
     }
   }
-  const s3 = new import_node_server_utils38.useS3({
+  const s3 = new import_node_server_utils39.useS3({
     accessKeyId: SPACES_ACCESS_KEY,
     secretAccessKey: SPACES_SECRET_KEY,
     endpoint: SPACES_ENDPOINT,
@@ -17199,7 +17375,7 @@ function useUserService() {
     user,
     previousProfile
   }) {
-    const session = import_node_server_utils38.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils39.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     const _file = {
       name: file.originalname,
@@ -17232,18 +17408,18 @@ function useUserService() {
   async function updatePasswordById(id, currentPassword, newPassword, passwordConfirmation) {
     let hashedPassword;
     const user = await getUserById(id);
-    const isPasswordValid = await (0, import_node_server_utils38.comparePassword)(
+    const isPasswordValid = await (0, import_node_server_utils39.comparePassword)(
       currentPassword,
       user.password
     );
     if (!isPasswordValid)
-      throw new import_node_server_utils38.BadRequestError("Invalid current password.");
+      throw new import_node_server_utils39.BadRequestError("Invalid current password.");
     if (newPassword !== passwordConfirmation)
-      throw new import_node_server_utils38.BadRequestError("Passwords do not match.");
+      throw new import_node_server_utils39.BadRequestError("Passwords do not match.");
     try {
-      hashedPassword = await (0, import_node_server_utils38.hashPassword)(newPassword);
+      hashedPassword = await (0, import_node_server_utils39.hashPassword)(newPassword);
       if (!hashedPassword)
-        throw new import_node_server_utils38.InternalServerError("Error hashing password.");
+        throw new import_node_server_utils39.InternalServerError("Error hashing password.");
       return await updatePassword({ _id: id, password: hashedPassword });
     } catch (error) {
       throw error;
@@ -17281,8 +17457,8 @@ function useAuthController() {
       });
       if (error) {
         const messages = error.details.map((d) => d.message);
-        import_node_server_utils39.logger.log({ level: "error", message: messages.join(", ") });
-        next(new import_node_server_utils39.BadRequestError(messages.join(", ")));
+        import_node_server_utils40.logger.log({ level: "error", message: messages.join(", ") });
+        next(new import_node_server_utils40.BadRequestError(messages.join(", ")));
         return;
       }
       const session = await _login(value);
@@ -17294,7 +17470,7 @@ function useAuthController() {
       res.cookie("sid", session.sid, cookieOptions).cookie("user", session.user, cookieOptions).json(session);
       return;
     } catch (error) {
-      import_node_server_utils39.logger.log({ level: "error", message: error.message });
+      import_node_server_utils40.logger.log({ level: "error", message: error.message });
       next(error);
       return;
     }
@@ -17305,8 +17481,8 @@ function useAuthController() {
     });
     const { error, value } = validation.validate(req.body);
     if (error) {
-      import_node_server_utils39.logger.log({ level: "error", message: error.message });
-      next(new import_node_server_utils39.BadRequestError(error.message));
+      import_node_server_utils40.logger.log({ level: "error", message: error.message });
+      next(new import_node_server_utils40.BadRequestError(error.message));
       return;
     }
     try {
@@ -17314,7 +17490,7 @@ function useAuthController() {
       res.json(session);
       return;
     } catch (error2) {
-      import_node_server_utils39.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils40.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -17322,7 +17498,7 @@ function useAuthController() {
   async function logout(req, res, next) {
     const sid = getSessionIdFromRequest(req);
     if (!sid) {
-      next(new import_node_server_utils39.BadRequestError("Session ID is required"));
+      next(new import_node_server_utils40.BadRequestError("Session ID is required"));
       return;
     }
     const refreshToken2 = typeof req.body?.refreshToken === "string" ? req.body.refreshToken : void 0;
@@ -17331,7 +17507,7 @@ function useAuthController() {
       res.json({ message: "Logged out successfully" });
       return;
     } catch (error) {
-      import_node_server_utils39.logger.log({ level: "error", message: error.message });
+      import_node_server_utils40.logger.log({ level: "error", message: error.message });
       next(error);
       return;
     }
@@ -17346,8 +17522,8 @@ function useAuthController() {
     });
     if (error) {
       const messages = error.details.map((d) => d.message);
-      import_node_server_utils39.logger.log({ level: "error", message: messages.join(", ") });
-      next(new import_node_server_utils39.BadRequestError(messages.join(", ")));
+      import_node_server_utils40.logger.log({ level: "error", message: messages.join(", ") });
+      next(new import_node_server_utils40.BadRequestError(messages.join(", ")));
       return;
     }
     const email = value.email;
@@ -17362,7 +17538,7 @@ function useAuthController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils39.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils40.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -17376,8 +17552,8 @@ function useAuthController() {
     const payload = { ...req.body };
     const { error } = validation.validate(payload);
     if (error) {
-      import_node_server_utils39.logger.log({ level: "error", message: error.message });
-      next(new import_node_server_utils39.BadRequestError(error.message));
+      import_node_server_utils40.logger.log({ level: "error", message: error.message });
+      next(new import_node_server_utils40.BadRequestError(error.message));
       return;
     }
     const otp = req.body.otp;
@@ -17392,7 +17568,7 @@ function useAuthController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils39.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils40.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -17407,8 +17583,8 @@ function useAuthController() {
     const { error } = validation.validate(payload);
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
-      import_node_server_utils39.logger.log({ level: "error", message: messages });
-      next(new import_node_server_utils39.BadRequestError(messages));
+      import_node_server_utils40.logger.log({ level: "error", message: messages });
+      next(new import_node_server_utils40.BadRequestError(messages));
       return;
     }
     const password = req.body.password;
@@ -17417,7 +17593,7 @@ function useAuthController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils39.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils40.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -17437,10 +17613,10 @@ var import_joi18 = __toESM(require("joi"));
 var import_node_server_utils43 = require("@7365admin1/node-server-utils");
 
 // src/repositories/person.repo.ts
-var import_node_server_utils41 = require("@7365admin1/node-server-utils");
+var import_node_server_utils42 = require("@7365admin1/node-server-utils");
 
 // src/models/person.model.ts
-var import_node_server_utils40 = require("@7365admin1/node-server-utils");
+var import_node_server_utils41 = require("@7365admin1/node-server-utils");
 var import_joi17 = __toESM(require("joi"));
 var import_mongodb35 = require("mongodb");
 var PersonTypes = /* @__PURE__ */ ((PersonTypes3) => {
@@ -17568,7 +17744,7 @@ var schemaUpdatePerson = import_joi17.default.object({
 function MPerson(value) {
   const { error } = schemaPerson.validate(value);
   if (error) {
-    throw new import_node_server_utils40.BadRequestError(error.details[0].message);
+    throw new import_node_server_utils41.BadRequestError(error.details[0].message);
   }
   if (value._id && typeof value._id === "string") {
     try {
@@ -17597,7 +17773,7 @@ function MPerson(value) {
         try {
           file.id = new import_mongodb35.ObjectId(file.id);
         } catch {
-          throw new import_node_server_utils40.BadRequestError("Invalid file id format");
+          throw new import_node_server_utils41.BadRequestError("Invalid file id format");
         }
       }
       return file;
@@ -17614,28 +17790,28 @@ function MPerson(value) {
     try {
       value.acceptedTerms = new import_mongodb35.ObjectId(value.acceptedTerms);
     } catch {
-      throw new import_node_server_utils40.BadRequestError("Invalid accepted terms ID.");
+      throw new import_node_server_utils41.BadRequestError("Invalid accepted terms ID.");
     }
   }
   if (value.block && typeof value.block === "string") {
     try {
       value.block = new import_mongodb35.ObjectId(value.block);
     } catch {
-      throw new import_node_server_utils40.BadRequestError("Invalid block ID.");
+      throw new import_node_server_utils41.BadRequestError("Invalid block ID.");
     }
   }
   if (value.level && typeof value.level === "string") {
     try {
       value.level = new import_mongodb35.ObjectId(value.level);
     } catch {
-      throw new import_node_server_utils40.BadRequestError("Invalid level ID.");
+      throw new import_node_server_utils41.BadRequestError("Invalid level ID.");
     }
   }
   if (value.unit && typeof value.unit === "string") {
     try {
       value.unit = new import_mongodb35.ObjectId(value.unit);
     } catch {
-      throw new import_node_server_utils40.BadRequestError("Invalid unit ID.");
+      throw new import_node_server_utils41.BadRequestError("Invalid unit ID.");
     }
   }
   return {
@@ -17717,13 +17893,13 @@ var makeContainsRegex = (input) => {
 // src/repositories/person.repo.ts
 var site_people_namespace_collection = "site.people";
 function usePersonRepo() {
-  const db2 = import_node_server_utils41.useAtlas.getDb();
+  const db2 = import_node_server_utils42.useAtlas.getDb();
   if (!db2) {
-    throw new import_node_server_utils41.InternalServerError("Unable to connect to server.");
+    throw new import_node_server_utils42.InternalServerError("Unable to connect to server.");
   }
   const collection = db2.collection(site_people_namespace_collection);
   const vehiclesCollection = db2.collection("vehicles");
-  const { delNamespace, getCache, setCache } = (0, import_node_server_utils41.useCache)(
+  const { delNamespace, getCache, setCache } = (0, import_node_server_utils42.useCache)(
     site_people_namespace_collection
   );
   async function withoutDeletedPlates(people) {
@@ -17772,7 +17948,7 @@ function usePersonRepo() {
         { key: { unit: 1, status: 1 } }
       ]);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to create index on site people.");
+      throw new import_node_server_utils42.InternalServerError("Failed to create index on site people.");
     }
   }
   async function createTextIndex() {
@@ -17785,7 +17961,7 @@ function usePersonRepo() {
         contact: "text"
       });
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError(
+      throw new import_node_server_utils42.InternalServerError(
         "Failed to create text index on site people."
       );
     }
@@ -17795,11 +17971,11 @@ function usePersonRepo() {
       value = MPerson(value);
       const res = await collection.insertOne(value, { session });
       delNamespace().then(() => {
-        import_node_server_utils41.logger.info(
+        import_node_server_utils42.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils41.logger.error(
+        import_node_server_utils42.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -17808,7 +17984,7 @@ function usePersonRepo() {
     } catch (error) {
       const isDuplicated = error.message.includes("duplicate");
       if (isDuplicated) {
-        throw new import_node_server_utils41.BadRequestError("Person already exists.");
+        throw new import_node_server_utils42.BadRequestError("Person already exists.");
       }
       throw error;
     }
@@ -17936,7 +18112,7 @@ function usePersonRepo() {
         collection.aggregate([{ $match: query2 }, { $count: "total" }], { session }).toArray()
       ]);
       const totalCount = countResult[0]?.total || 0;
-      const data = (0, import_node_server_utils41.paginate)(
+      const data = (0, import_node_server_utils42.paginate)(
         await withoutDeletedPlates(items),
         page,
         limit,
@@ -17951,7 +18127,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb37.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils41.BadRequestError("Invalid person transaction ID format.");
+      throw new import_node_server_utils42.BadRequestError("Invalid person transaction ID format.");
     }
     value.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     if (value.updatedBy) {
@@ -17967,11 +18143,11 @@ function usePersonRepo() {
         { session }
       );
       delNamespace().then(() => {
-        import_node_server_utils41.logger.info(
+        import_node_server_utils42.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils41.logger.error(
+        import_node_server_utils42.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -17985,7 +18161,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb37.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils41.BadRequestError("Invalid customer ID format.");
+      throw new import_node_server_utils42.BadRequestError("Invalid customer ID format.");
     }
     try {
       const updateValue = {
@@ -17995,14 +18171,14 @@ function usePersonRepo() {
       };
       const res = await collection.updateOne({ _id }, { $set: updateValue });
       if (res.modifiedCount === 0) {
-        throw new import_node_server_utils41.InternalServerError("Unable to delete visitor transaction.");
+        throw new import_node_server_utils42.InternalServerError("Unable to delete visitor transaction.");
       }
       delNamespace().then(() => {
-        import_node_server_utils41.logger.info(
+        import_node_server_utils42.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils41.logger.error(
+        import_node_server_utils42.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -18016,15 +18192,15 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb37.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils41.BadRequestError("Invalid person ID.");
+      throw new import_node_server_utils42.BadRequestError("Invalid person ID.");
     }
-    const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+    const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
       _id: String(_id)
     });
     try {
       const cached = await getCache(cacheKey);
       if (cached) {
-        import_node_server_utils41.logger.log({
+        import_node_server_utils42.logger.log({
           level: "info",
           message: `Cache hit for getById person: ${cacheKey}`
         });
@@ -18034,34 +18210,34 @@ function usePersonRepo() {
         _id
       });
       setCache(cacheKey, result, 300).then(() => {
-        import_node_server_utils41.logger.log({
+        import_node_server_utils42.logger.log({
           level: "info",
           message: `Cache set for person by id: ${cacheKey}`
         });
       }).catch((err) => {
-        import_node_server_utils41.logger.log({
+        import_node_server_utils42.logger.log({
           level: "error",
           message: `Failed to set cache for person by id: ${err.message}`
         });
       });
       return result;
     } catch (error) {
-      if (error instanceof import_node_server_utils41.AppError) {
+      if (error instanceof import_node_server_utils42.AppError) {
         throw error;
       } else {
-        throw new import_node_server_utils41.InternalServerError("Failed to get person by id.");
+        throw new import_node_server_utils42.InternalServerError("Failed to get person by id.");
       }
     }
   }
   async function getPersonByPlateNumber(plateNumber) {
-    const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+    const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
       plateNumber,
       key: "get-person-plate-number"
     });
     try {
       const cacheData = await getCache(cacheKey);
       if (cacheData) {
-        import_node_server_utils41.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlatesOne(cacheData);
       }
       const data = await collection.findOne(
@@ -18069,13 +18245,13 @@ function usePersonRepo() {
         { sort: { _id: -1 } }
       );
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils41.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils41.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils42.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlatesOne(data);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError(
+      throw new import_node_server_utils42.InternalServerError(
         "Failed to fetch individual by plate number."
       );
     }
@@ -18087,11 +18263,11 @@ function usePersonRepo() {
         status: "approved"
       };
       if (excludePersonId) {
-        query2._id = { $ne: (0, import_node_server_utils41.toObjectId)(excludePersonId) };
+        query2._id = { $ne: (0, import_node_server_utils42.toObjectId)(excludePersonId) };
       }
       return await collection.findOne(query2);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError(
+      throw new import_node_server_utils42.InternalServerError(
         "Failed to fetch approved person by plate number."
       );
     }
@@ -18099,47 +18275,47 @@ function usePersonRepo() {
   async function getByNRIC(value) {
     try {
       if (!value || value.trim() === "") {
-        import_node_server_utils41.logger.warn("getByNRIC called with an empty or invalid NRIC value.");
+        import_node_server_utils42.logger.warn("getByNRIC called with an empty or invalid NRIC value.");
         return null;
       }
-      const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+      const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
         nric: value
       });
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils41.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlatesOne(cachedData);
       }
       const data = await collection.findOne({ nric: value });
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils41.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils41.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils42.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlatesOne(data);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to retrieve person by NRIC.");
+      throw new import_node_server_utils42.InternalServerError("Failed to retrieve person by NRIC.");
     }
   }
   async function getPersonByPhoneNumber(value) {
     try {
-      const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+      const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
         contact: value
       });
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils41.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlatesOne(cachedData);
       }
       const data = await collection.findOne({ contact: value });
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils41.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils41.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils42.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlatesOne(data);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError(
+      throw new import_node_server_utils42.InternalServerError(
         "Failed to retrieve person by Phone Number."
       );
     }
@@ -18151,7 +18327,7 @@ function usePersonRepo() {
   }, session) {
     try {
       if (!unit || !import_mongodb37.ObjectId.isValid(unit)) {
-        throw new import_node_server_utils41.BadRequestError("Invalid unit ID.");
+        throw new import_node_server_utils42.BadRequestError("Invalid unit ID.");
       }
       const query2 = {
         unit: new import_mongodb37.ObjectId(unit),
@@ -18196,14 +18372,14 @@ function usePersonRepo() {
       ]).toArray();
       return await withoutDeletedPlates(data);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError(
+      throw new import_node_server_utils42.InternalServerError(
         "Failed to fetch people type residents by unit."
       );
     }
   }
   async function getCompany(search, orgs) {
     try {
-      const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+      const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
         company: search
       });
       const baseQuery = {
@@ -18273,18 +18449,18 @@ function usePersonRepo() {
       ]).toArray();
       return data;
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to fetch visitor by company.");
+      throw new import_node_server_utils42.InternalServerError("Failed to fetch visitor by company.");
     }
   }
   async function getPeopleByPlateNumber(plateNumber) {
-    const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+    const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
       plateNumber,
       key: "get-people-plate-number"
     });
     try {
       const cacheData = await getCache(cacheKey);
       if (cacheData) {
-        import_node_server_utils41.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlates(cacheData);
       }
       const data = await collection.find(
@@ -18292,13 +18468,13 @@ function usePersonRepo() {
         { sort: { _id: -1 } }
       ).toArray();
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils41.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils41.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils42.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlates(data);
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to fetch people by plate number.");
+      throw new import_node_server_utils42.InternalServerError("Failed to fetch people by plate number.");
     }
   }
   async function getPeopleByNRIC({
@@ -18323,13 +18499,13 @@ function usePersonRepo() {
       sort: JSON.stringify(sort)
     };
     try {
-      const cacheKey = (0, import_node_server_utils41.makeCacheKey)(
+      const cacheKey = (0, import_node_server_utils42.makeCacheKey)(
         site_people_namespace_collection,
         cacheOptions
       );
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils41.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache hit for key: ${cacheKey}`);
         const cachedPage = cachedData;
         return {
           ...cachedPage,
@@ -18338,26 +18514,26 @@ function usePersonRepo() {
       }
       const items = await collection.find(query2).sort(sort).skip(page * limit).limit(limit).toArray();
       const length = await collection.countDocuments(query2);
-      const data = (0, import_node_server_utils41.paginate)(
+      const data = (0, import_node_server_utils42.paginate)(
         await withoutDeletedPlates(items),
         page,
         limit,
         length
       );
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils41.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils42.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils41.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils42.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to retrieve person by NRIC.");
+      throw new import_node_server_utils42.InternalServerError("Failed to retrieve person by NRIC.");
     }
   }
   async function pushVehicleById(id, plate, session) {
     const { plateNumber, recNo } = plate;
     const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const _id = (0, import_node_server_utils41.toObjectId)(id);
+    const _id = (0, import_node_server_utils42.toObjectId)(id);
     try {
       const updateExisting = await collection.updateOne(
         {
@@ -18390,15 +18566,15 @@ function usePersonRepo() {
         );
       }
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to push vehicle plates by nric.");
+      throw new import_node_server_utils42.InternalServerError("Failed to push vehicle plates by nric.");
     }
   }
   async function pullVehicleByRecNo(recNo, scope, session) {
     const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const owner = scope?.peopleId ? (0, import_node_server_utils41.toObjectId)(scope.peopleId) : null;
-    const site = scope?.site ? (0, import_node_server_utils41.toObjectId)(scope.site) : null;
+    const owner = scope?.peopleId ? (0, import_node_server_utils42.toObjectId)(scope.peopleId) : null;
+    const site = scope?.site ? (0, import_node_server_utils42.toObjectId)(scope.site) : null;
     if (!owner && !site) {
-      throw new import_node_server_utils41.BadRequestError(
+      throw new import_node_server_utils42.BadRequestError(
         "Cannot remove a vehicle plate without a person or a site."
       );
     }
@@ -18439,24 +18615,24 @@ function usePersonRepo() {
         { session }
       );
     } catch (error) {
-      import_node_server_utils41.logger.log({
+      import_node_server_utils42.logger.log({
         level: "error",
         message: `pullVehicleByRecNo failed on ${matchKey} for ${owner ? "person" : "site"} ${String(owner ?? site)}: ${error?.message ?? error}`
       });
-      throw new import_node_server_utils41.InternalServerError(
+      throw new import_node_server_utils42.InternalServerError(
         "Could not take the plate off the resident's record."
       );
     }
   }
   async function getByUserId(userId) {
-    const user = (0, import_node_server_utils41.toObjectId)(userId);
-    const cacheKey = (0, import_node_server_utils41.makeCacheKey)(site_people_namespace_collection, {
+    const user = (0, import_node_server_utils42.toObjectId)(userId);
+    const cacheKey = (0, import_node_server_utils42.makeCacheKey)(site_people_namespace_collection, {
       user: userId
     });
     try {
       const cached = await getCache(cacheKey);
       if (cached) {
-        import_node_server_utils41.logger.log({
+        import_node_server_utils42.logger.log({
           level: "info",
           message: `Cache hit for getByUserId person: ${cacheKey}`
         });
@@ -18466,22 +18642,22 @@ function usePersonRepo() {
         user
       });
       setCache(cacheKey, result, 15 * 60).then(() => {
-        import_node_server_utils41.logger.log({
+        import_node_server_utils42.logger.log({
           level: "info",
           message: `Cache set for person by user: ${cacheKey}`
         });
       }).catch((err) => {
-        import_node_server_utils41.logger.log({
+        import_node_server_utils42.logger.log({
           level: "error",
           message: `Failed to set cache for person by user: ${err.message}`
         });
       });
       return result;
     } catch (error) {
-      if (error instanceof import_node_server_utils41.AppError) {
+      if (error instanceof import_node_server_utils42.AppError) {
         throw error;
       } else {
-        throw new import_node_server_utils41.InternalServerError("Failed to get person by user.");
+        throw new import_node_server_utils42.InternalServerError("Failed to get person by user.");
       }
     }
   }
@@ -18490,7 +18666,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb37.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils41.BadRequestError("Invalid ID format.");
+      throw new import_node_server_utils42.BadRequestError("Invalid ID format.");
     }
     try {
       const res = await collection.updateOne(
@@ -18499,14 +18675,14 @@ function usePersonRepo() {
         { session }
       );
       if (res.modifiedCount === 0) {
-        throw new import_node_server_utils41.InternalServerError(`Unable to ${value.status}   person.`);
+        throw new import_node_server_utils42.InternalServerError(`Unable to ${value.status}   person.`);
       }
       delNamespace().then(() => {
-        import_node_server_utils41.logger.info(
+        import_node_server_utils42.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils41.logger.error(
+        import_node_server_utils42.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -18522,7 +18698,7 @@ function usePersonRepo() {
       const data = await collection.find(query2, { session }).limit(10).toArray();
       return data;
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to find persons" + error);
+      throw new import_node_server_utils42.InternalServerError("Failed to find persons" + error);
     }
   }
   async function addFromVisitor(value, session) {
@@ -18557,7 +18733,7 @@ function usePersonRepo() {
       _id = new import_mongodb37.ObjectId(personId);
       acceptedTerms = new import_mongodb37.ObjectId(termsId);
     } catch {
-      throw new import_node_server_utils41.BadRequestError("Invalid ID format.");
+      throw new import_node_server_utils42.BadRequestError("Invalid ID format.");
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     try {
@@ -18566,7 +18742,7 @@ function usePersonRepo() {
         { $set: { acceptedTerms, acceptedTermsAt: now, updatedAt: now } }
       );
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to record terms acceptance.");
+      throw new import_node_server_utils42.InternalServerError("Failed to record terms acceptance.");
     }
   }
   async function getAcceptedTerms(personId) {
@@ -18574,7 +18750,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb37.ObjectId(personId);
     } catch {
-      throw new import_node_server_utils41.BadRequestError("Invalid person ID format.");
+      throw new import_node_server_utils42.BadRequestError("Invalid person ID format.");
     }
     try {
       return await collection.findOne(
@@ -18582,11 +18758,11 @@ function usePersonRepo() {
         { projection: { acceptedTerms: 1, acceptedTermsAt: 1, _id: 0 } }
       );
     } catch (error) {
-      throw new import_node_server_utils41.InternalServerError("Failed to read terms acceptance.");
+      throw new import_node_server_utils42.InternalServerError("Failed to read terms acceptance.");
     }
   }
   async function updatePlateNumberByUserId(userId, plateNumber, session) {
-    const user = (0, import_node_server_utils41.toObjectId)(userId);
+    const user = (0, import_node_server_utils42.toObjectId)(userId);
     try {
       const result = await collection.updateOne(
         { user },
@@ -18600,25 +18776,25 @@ function usePersonRepo() {
         { session }
       );
       if (result.matchedCount === 0) {
-        throw new import_node_server_utils41.BadRequestError("Person not found for this user.");
+        throw new import_node_server_utils42.BadRequestError("Person not found for this user.");
       }
       try {
         await delNamespace();
-        import_node_server_utils41.logger.info(
+        import_node_server_utils42.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       } catch (err) {
-        import_node_server_utils41.logger.error(
+        import_node_server_utils42.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
       }
       return "Successfully updated plate number.";
     } catch (error) {
-      if (error instanceof import_node_server_utils41.BadRequestError) {
+      if (error instanceof import_node_server_utils42.BadRequestError) {
         throw error;
       }
-      throw new import_node_server_utils41.InternalServerError("Failed to update plate number.");
+      throw new import_node_server_utils42.InternalServerError("Failed to update plate number.");
     }
   }
   return {
@@ -18649,161 +18825,6 @@ function usePersonRepo() {
   };
 }
 
-// src/utils/console-authz.util.ts
-var import_node_server_utils42 = require("@7365admin1/node-server-utils");
-
-// src/utils/console-permission.util.ts
-var CONSOLE_PERMISSIONS = Object.freeze({
-  organizations: Object.freeze([
-    "see-all-organizations",
-    "see-organization-details"
-  ]),
-  "promo-codes": Object.freeze([
-    "create-promo-code",
-    "see-promo-code-details",
-    "edit-promo-code-details",
-    "change-promo-code-status",
-    "delete-promo-code"
-  ]),
-  users: Object.freeze(["see-all-users", "see-user-details"]),
-  invitations: Object.freeze([
-    "create-invitation",
-    "view-invitations",
-    "cancel-invitation"
-  ]),
-  subscriptions: Object.freeze([
-    "see-all-subscriptions",
-    "see-subscription-details",
-    "manage-subscription"
-  ]),
-  "sp-approvals": Object.freeze([
-    "see-all-sp-approvals",
-    "approve-sp",
-    "reject-sp",
-    "delete-sp-approval"
-  ]),
-  "marketplace-vendors": Object.freeze([
-    "see-all-marketplace-vendors",
-    "see-marketplace-vendor-details"
-  ]),
-  "platform-terms": Object.freeze([
-    "see-platform-terms",
-    "edit-platform-terms"
-  ]),
-  "activity-history": Object.freeze(["see-activity-history"]),
-  members: Object.freeze([
-    "view-members",
-    "assign-member-role",
-    "suspend-member",
-    "activate-member",
-    "delete-member"
-  ]),
-  "roles-and-permissions": Object.freeze([
-    "add-role",
-    "see-all-roles",
-    "see-role-details",
-    "update-role",
-    "delete-role"
-  ])
-});
-var RESOURCE_SPELLINGS = Object.freeze({
-  "roles-and-permissions": Object.freeze([
-    "roles-and-permissions",
-    "roles"
-  ]),
-  roles: Object.freeze(["roles", "roles-and-permissions"])
-});
-function consoleSpellings(resource, action) {
-  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
-  return resources.map((name) => `${name}:${action}`);
-}
-function consoleRoleAllowsAll(held) {
-  if (!Array.isArray(held) || held.length === 0)
-    return true;
-  return held.includes("*");
-}
-function consoleRoleAllows(held, resource, action) {
-  if (consoleRoleAllowsAll(held))
-    return true;
-  const actions = CONSOLE_PERMISSIONS[resource];
-  if (!actions?.length)
-    return false;
-  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
-  return wanted.some(
-    (name) => consoleSpellings(resource, name).some(
-      (spelling) => held.includes(spelling)
-    )
-  );
-}
-
-// src/utils/console-authz.util.ts
-function callerId(req) {
-  const user = req.user;
-  return user?.user?.toString?.() || user?._id?.toString?.() || "";
-}
-async function requirePlatformStaff(req, grant) {
-  const id = callerId(req);
-  const role = id ? await resolveStaffRole(id) : null;
-  if (!role) {
-    throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
-  }
-  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
-    throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
-  }
-  return id;
-}
-async function requireConsolePermission(req, resource, action) {
-  return await requirePlatformStaff(req, { resource, action });
-}
-async function requireSelfOrPlatformStaff(req, userId, grant) {
-  const id = callerId(req);
-  const target = userId?.toString() ?? "";
-  if (id && target && target === id)
-    return id;
-  return await requirePlatformStaff(req, grant);
-}
-async function requireOrgAccess(req, orgId) {
-  return await requireOrgReach(req, orgId);
-}
-async function requirePlatformOwner(req, grant) {
-  const id = callerId(req);
-  if (!id || !await isPlatformOwner(id)) {
-    throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
-  }
-  if (grant)
-    await requirePlatformStaff(req, grant);
-  return id;
-}
-async function requireOrgReach(req, orgId) {
-  const id = callerId(req);
-  if (!id)
-    throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
-  const org = orgId?.toString() ?? "";
-  const actor = await resolveInviteActor(id);
-  if (actor.isSuperAdmin)
-    return id;
-  if (org && actor.orgIds.includes(org))
-    return id;
-  if (org && await hasOrgInvitation(id, org))
-    return id;
-  if (org && await hasOrgOwnership(id, org))
-    return id;
-  throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
-}
-async function requireInviteReach(req, org, app) {
-  const apps = Array.isArray(app) ? app : [app];
-  if (apps.some((a) => a === PLATFORM_STAFF_MEMBER_TYPE)) {
-    await requirePlatformStaff(req);
-  }
-  if (org)
-    await requireOrgReach(req, org);
-}
-async function requireUserFieldWrite(req, userId, field, grant) {
-  if (field === "email")
-    return await requirePlatformStaff(req, grant);
-  return await requireSelfOrPlatformStaff(req, userId, grant);
-}
-
 // src/utils/user-response.util.ts
 function publicIdentity(user) {
   if (!user || typeof user !== "object")
@@ -26731,7 +26752,7 @@ async function requireSiteReach(req, site, permission) {
   if (!siteId)
     throw new import_node_server_utils56.UnauthorizedError("Not authorized.");
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   if (permission) {
     await useCameraViewService().authorizeSite({
@@ -26746,8 +26767,9 @@ async function requireSiteReach(req, site, permission) {
 async function siteReachOf(req) {
   const actor = await resolveInviteActor(callerId(req));
   const reachable = /* @__PURE__ */ new Map();
+  const bypass = staffMayBypass(actor);
   function canReach(record) {
-    if (actor.isSuperAdmin)
+    if (bypass)
       return Promise.resolve(true);
     if (!record)
       return Promise.resolve(false);
@@ -26768,7 +26790,7 @@ async function siteReachOf(req) {
     return reachable.get(site);
   }
   async function only(records) {
-    if (actor.isSuperAdmin)
+    if (bypass)
       return records;
     const verdicts = await Promise.all(records.map((r) => canReach(r)));
     return records.filter((_, i) => verdicts[i]);
@@ -26782,7 +26804,7 @@ async function requireSiteReachIfSignedIn(req, site) {
 }
 async function entitledSites(req) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return null;
   if (actor.memberships.length === 0)
     return [];
@@ -37351,13 +37373,13 @@ var import_node_server_utils101 = require("@7365admin1/node-server-utils");
 var import_joi50 = __toESM(require("joi"));
 async function requireSiteWrite(req, siteId) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   await useCameraViewService().entitleSite({ siteId, userId: actor.id });
 }
 async function requireSiteRead(req, siteId, site) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   const owner = (site?.orgId ?? site?.org)?.toString?.() ?? "";
   if (owner && actor.orgIds.includes(owner))
@@ -42182,7 +42204,7 @@ var import_node_server_utils118 = require("@7365admin1/node-server-utils");
 async function requireEitherOrg(req, ...orgs) {
   const wanted = orgs.map((org) => org?.toString?.() ?? "").filter((org) => Boolean(org));
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   if (wanted.length === 0 || !wanted.some((org) => actor.orgIds.includes(org))) {
     throw new import_node_server_utils118.UnauthorizedError("Not authorized.");
@@ -42278,7 +42300,7 @@ function useCustomerSiteController() {
     try {
       await requireOrgAccess(req, org);
       const actor = await resolveInviteActor(callerId(req));
-      const siteScope = actor.isSuperAdmin ? null : orgSiteScope({ memberships: actor.memberships, org });
+      const siteScope = staffMayBypass(actor) ? null : orgSiteScope({ memberships: actor.memberships, org });
       const data = await _getAll({
         search,
         page,
@@ -42312,7 +42334,7 @@ function useCustomerSiteController() {
     }
     try {
       const actor = await resolveInviteActor(callerId(req));
-      if (!actor.isSuperAdmin) {
+      if (!staffMayBypass(actor)) {
         await useCameraViewService().entitleSite({
           siteId: site,
           userId: actor.id
@@ -58248,7 +58270,7 @@ function usePersonController() {
   } = usePersonService();
   async function entitlePerson(req, _id) {
     const actor = await resolveInviteActor(callerId(req));
-    if (actor.isSuperAdmin)
+    if (staffMayBypass(actor))
       return actor;
     const person = await _getById(_id);
     if (!person)
@@ -64809,7 +64831,7 @@ function useDocumentManagementController() {
       return;
     }
     const actor = await resolveInviteActor(callerId(req));
-    if (actor.isSuperAdmin)
+    if (staffMayBypass(actor))
       return;
     const org = doc?.org?.toString() ?? "";
     if (!org || !actor.orgIds.includes(org)) {
@@ -68773,7 +68795,7 @@ var import_mongodb123 = require("mongodb");
 var import_node_server_utils193 = require("@7365admin1/node-server-utils");
 async function requireOwnUnit(req, site, unitId) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   const unit = unitId?.toString?.() ?? "";
   const siteId = site?.toString?.() ?? "";
@@ -77288,10 +77310,10 @@ function useOnlineFormController() {
       const { actor } = await siteReachOf(req);
       if (site) {
         await requireSiteReach(req, site);
-      } else if (!actor.isSuperAdmin) {
+      } else if (!staffMayBypass(actor)) {
         throw new import_node_server_utils230.UnauthorizedError("Not authorized.");
       }
-      if (org && !actor.isSuperAdmin && !actor.orgIds.includes(org)) {
+      if (org && !staffMayBypass(actor) && !actor.orgIds.includes(org)) {
         throw new import_node_server_utils230.UnauthorizedError("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
@@ -77356,7 +77378,7 @@ function useOnlineFormController() {
       }
       if (payload.org) {
         const { actor } = await siteReachOf(req);
-        if (!actor.isSuperAdmin && !actor.orgIds.includes(payload.org)) {
+        if (!staffMayBypass(actor) && !actor.orgIds.includes(payload.org)) {
           throw new import_node_server_utils230.UnauthorizedError("Not authorized.");
         }
       }
@@ -84778,7 +84800,7 @@ function useVerificationServiceV2() {
       if (!actor.id) {
         throw new import_node_server_utils262.UnauthorizedError("Sign in to continue.");
       }
-      if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
+      if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
         throw new import_node_server_utils262.UnauthorizedError(
           "You can only invite service providers to your own organisation's sites."
         );
@@ -85280,6 +85302,11 @@ function useServiceProviderInviteController() {
   }
   async function approvals(req, res, next) {
     try {
+      await requireConsolePermission(
+        req,
+        "sp-approvals",
+        "see-all-sp-approvals"
+      );
       const schema2 = import_joi143.default.object({
         status: import_joi143.default.string().valid(
           "awaiting-approval",
@@ -85306,6 +85333,11 @@ function useServiceProviderInviteController() {
   }
   async function pendingApprovalCount(req, res, next) {
     try {
+      await requireConsolePermission(
+        req,
+        "sp-approvals",
+        "see-all-sp-approvals"
+      );
       res.json(await approvalCount({ userId: callerId5(req) }));
     } catch (error) {
       next(error);
@@ -85313,6 +85345,7 @@ function useServiceProviderInviteController() {
   }
   async function approve(req, res, next) {
     try {
+      await requireConsolePermission(req, "sp-approvals", "approve-sp");
       res.json(await _approve({ id: inviteId(req), userId: callerId5(req) }));
     } catch (error) {
       import_node_server_utils264.logger.log({ level: "error", message: `${error.message}` });
@@ -85321,6 +85354,7 @@ function useServiceProviderInviteController() {
   }
   async function reject(req, res, next) {
     try {
+      await requireConsolePermission(req, "sp-approvals", "reject-sp");
       const { error, value } = import_joi143.default.object({
         reason: import_joi143.default.string().trim().min(1).max(1e3).required()
       }).validate(req.body ?? {});
@@ -92035,7 +92069,9 @@ function useNotificationPreferenceController() {
   CLIENT_ACTIONS,
   CLOCK_DRIFT_WARN_SECONDS,
   CONSOLE_AUDIT_LABELS,
+  CONSOLE_PERMISSIONS,
   CONTRACTOR_TYPE_LABELS,
+  CROSS_CLIENT_GRANT,
   CURRENT_TIME_ENDPOINT,
   CameraType,
   ConsoleAuditAction,
@@ -92247,6 +92283,9 @@ function useNotificationPreferenceController() {
   chatSchema,
   clampPtzSpeed,
   clockDriftSeconds,
+  consoleRoleAllows,
+  consoleRoleAllowsAll,
+  consoleSpellings,
   console_audit_namespace_collection,
   createManpowerRemarksDaily,
   customerSchema,
@@ -92346,6 +92385,8 @@ function useNotificationPreferenceController() {
   relayForRecorder,
   remarksSchema,
   renderPagePdf,
+  requireConsolePermission,
+  requirePlatformStaff,
   resetCameraTransports,
   residentAppModuleKeys,
   residentFormEntry,
@@ -92517,6 +92558,7 @@ function useNotificationPreferenceController() {
   site_people_namespace_collection,
   snapshotEndpoint,
   snapshotRefusalReason,
+  staffMayBypass,
   stringifyHidJson,
   stripFacialImageMetadata,
   subscriptionPlanSchema,