@7365admin1/core 3.53.3 → 3.53.5

package/dist/index.mjs

@@ -10496,7 +10496,7 @@ import {
   BadRequestError as BadRequestError29,
   NotFoundError as NotFoundError11,
   InternalServerError as InternalServerError15,
-  UnauthorizedError as UnauthorizedError2,
+  UnauthorizedError as UnauthorizedError3,
   useAtlas as useAtlas20
 } from "@7365admin1/node-server-utils";
 
@@ -13430,9 +13430,13 @@ async function resolveInviteActor(userId) {
   const members = await db2.collection("members").find({ user: new ObjectId25(id), status: { $ne: "deleted" } }).toArray();
   const adminMember = members.find((m) => m.type === "admin");
   let isSuperAdmin2 = false;
+  let staffPermissions;
   if (adminMember?.role && ObjectId25.isValid(adminMember.role.toString())) {
     const role = await db2.collection("roles").findOne({ _id: new ObjectId25(adminMember.role.toString()), ...LIVE_ROLE });
     isSuperAdmin2 = role?.type === "admin";
+    if (isSuperAdmin2) {
+      staffPermissions = Array.isArray(role?.permissions) ? role?.permissions : [];
+    }
   }
   const orgIds = Array.from(
     new Set(
@@ -13455,6 +13459,7 @@ async function resolveInviteActor(userId) {
     id,
     name: user?.name ?? adminMember?.name ?? "",
     isSuperAdmin: isSuperAdmin2,
+    staffPermissions,
     orgIds,
     propertyManagementOrgIds,
     memberships: members.map((m) => ({
@@ -13557,7 +13562,7 @@ async function holdsRole(userId, roleId) {
 // src/services/service-provider-invite.service.ts
 import {
   BadRequestError as BadRequestError28,
-  UnauthorizedError,
+  UnauthorizedError as UnauthorizedError2,
   NotFoundError as NotFoundError10,
   compileHandlebar,
   getDirectory,
@@ -14796,6 +14801,169 @@ var NotificationService = class {
   }
 };
 
+// src/utils/console-authz.util.ts
+import { UnauthorizedError } from "@7365admin1/node-server-utils";
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name) => `${name}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name) => consoleSpellings(resource, name).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+var CROSS_CLIENT_GRANT = {
+  resource: "organizations"
+};
+function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
+  if (!actor.isSuperAdmin)
+    return false;
+  return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
+}
+
+// src/utils/console-authz.util.ts
+function callerId(req) {
+  const user = req.user;
+  return user?.user?.toString?.() || user?._id?.toString?.() || "";
+}
+async function requirePlatformStaff(req, grant) {
+  const id = callerId(req);
+  const role = id ? await resolveStaffRole(id) : null;
+  if (!role) {
+    throw new UnauthorizedError("Not authorized.");
+  }
+  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
+    throw new UnauthorizedError("Not authorized.");
+  }
+  return id;
+}
+async function requireConsolePermission(req, resource, action) {
+  return await requirePlatformStaff(req, { resource, action });
+}
+async function requireSelfOrPlatformStaff(req, userId, grant) {
+  const id = callerId(req);
+  const target = userId?.toString() ?? "";
+  if (id && target && target === id)
+    return id;
+  return await requirePlatformStaff(req, grant);
+}
+async function requireOrgAccess(req, orgId) {
+  return await requireOrgReach(req, orgId);
+}
+async function requirePlatformOwner(req, grant) {
+  const id = callerId(req);
+  if (!id || !await isPlatformOwner(id)) {
+    throw new UnauthorizedError("Not authorized.");
+  }
+  if (grant)
+    await requirePlatformStaff(req, grant);
+  return id;
+}
+async function requireOrgReach(req, orgId) {
+  const id = callerId(req);
+  if (!id)
+    throw new UnauthorizedError("Not authorized.");
+  const org = orgId?.toString() ?? "";
+  const actor = await resolveInviteActor(id);
+  if (staffMayBypass(actor))
+    return id;
+  if (org && actor.orgIds.includes(org))
+    return id;
+  if (org && await hasOrgInvitation(id, org))
+    return id;
+  if (org && await hasOrgOwnership(id, org))
+    return id;
+  throw new UnauthorizedError("Not authorized.");
+}
+async function requireInviteReach(req, org, app) {
+  const apps = Array.isArray(app) ? app : [app];
+  if (apps.some((a) => a === PLATFORM_STAFF_MEMBER_TYPE)) {
+    await requirePlatformStaff(req);
+  }
+  if (org)
+    await requireOrgReach(req, org);
+}
+async function requireUserFieldWrite(req, userId, field, grant) {
+  if (field === "email")
+    return await requirePlatformStaff(req, grant);
+  return await requireSelfOrPlatformStaff(req, userId, grant);
+}
+
 // src/services/service-provider-invite.service.ts
 var INVITE_VALID_HOURS = 72;
 function useServiceProviderInviteService() {
@@ -14886,18 +15054,18 @@ function useServiceProviderInviteService() {
     return invite;
   }
   function assertOwnerOrSuperAdmin(actor, invite) {
-    if (actor.isSuperAdmin)
+    if (staffMayBypass(actor))
       return;
     const org = inviteOrgId(invite);
     if (org && actor.orgIds.includes(org))
       return;
-    throw new UnauthorizedError(
+    throw new UnauthorizedError2(
       "This invitation belongs to another organisation."
     );
   }
   function assertSuperAdmin(actor) {
-    if (!actor.isSuperAdmin) {
-      throw new UnauthorizedError(
+    if (!staffMayBypass(actor)) {
+      throw new UnauthorizedError2(
         "Only a Seven365 administrator can approve or reject invitations."
       );
     }
@@ -14910,7 +15078,7 @@ function useServiceProviderInviteService() {
   async function actorFor(userId) {
     const actor = await resolveInviteActor(userId);
     if (!actor.id)
-      throw new UnauthorizedError("Sign in to continue.");
+      throw new UnauthorizedError2("Sign in to continue.");
     return actor;
   }
   async function listApprovals({
@@ -14946,8 +15114,8 @@ function useServiceProviderInviteService() {
     const actor = await actorFor(userId);
     let scope = actor.orgIds;
     if (orgId) {
-      if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
-        throw new UnauthorizedError(
+      if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
+        throw new UnauthorizedError2(
           "You are not a member of that organisation."
         );
       }
@@ -14957,7 +15125,7 @@ function useServiceProviderInviteService() {
       statuses: statuses ?? [],
       // A super admin asking for everything passes no scope; everyone else is
       // pinned to their own organisations even if they ask for more.
-      orgIds: actor.isSuperAdmin && !orgId ? void 0 : scope,
+      orgIds: staffMayBypass(actor) && !orgId ? void 0 : scope,
       search,
       page,
       limit
@@ -15106,7 +15274,7 @@ function useServiceProviderInviteService() {
     );
     const invitedUserId = user?._id?.toString();
     if (!invitedUserId || invitedUserId !== userId) {
-      throw new UnauthorizedError("This invitation was sent to someone else.");
+      throw new UnauthorizedError2("This invitation was sent to someone else.");
     }
   }
   async function decline({ id, userId }) {
@@ -15407,10 +15575,10 @@ function useVerificationService() {
       const org = await getOrgById(orgId);
       const actor = await resolveInviteActor(invitedBy);
       if (!actor.id) {
-        throw new UnauthorizedError2("Sign in to continue.");
+        throw new UnauthorizedError3("Sign in to continue.");
       }
-      if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
-        throw new UnauthorizedError2(
+      if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
+        throw new UnauthorizedError3(
           "You can only invite service providers to your own organisation's sites."
         );
       }
@@ -18059,161 +18227,6 @@ function usePersonRepo() {
   };
 }
 
-// src/utils/console-authz.util.ts
-import { UnauthorizedError as UnauthorizedError3 } from "@7365admin1/node-server-utils";
-
-// src/utils/console-permission.util.ts
-var CONSOLE_PERMISSIONS = Object.freeze({
-  organizations: Object.freeze([
-    "see-all-organizations",
-    "see-organization-details"
-  ]),
-  "promo-codes": Object.freeze([
-    "create-promo-code",
-    "see-promo-code-details",
-    "edit-promo-code-details",
-    "change-promo-code-status",
-    "delete-promo-code"
-  ]),
-  users: Object.freeze(["see-all-users", "see-user-details"]),
-  invitations: Object.freeze([
-    "create-invitation",
-    "view-invitations",
-    "cancel-invitation"
-  ]),
-  subscriptions: Object.freeze([
-    "see-all-subscriptions",
-    "see-subscription-details",
-    "manage-subscription"
-  ]),
-  "sp-approvals": Object.freeze([
-    "see-all-sp-approvals",
-    "approve-sp",
-    "reject-sp",
-    "delete-sp-approval"
-  ]),
-  "marketplace-vendors": Object.freeze([
-    "see-all-marketplace-vendors",
-    "see-marketplace-vendor-details"
-  ]),
-  "platform-terms": Object.freeze([
-    "see-platform-terms",
-    "edit-platform-terms"
-  ]),
-  "activity-history": Object.freeze(["see-activity-history"]),
-  members: Object.freeze([
-    "view-members",
-    "assign-member-role",
-    "suspend-member",
-    "activate-member",
-    "delete-member"
-  ]),
-  "roles-and-permissions": Object.freeze([
-    "add-role",
-    "see-all-roles",
-    "see-role-details",
-    "update-role",
-    "delete-role"
-  ])
-});
-var RESOURCE_SPELLINGS = Object.freeze({
-  "roles-and-permissions": Object.freeze([
-    "roles-and-permissions",
-    "roles"
-  ]),
-  roles: Object.freeze(["roles", "roles-and-permissions"])
-});
-function consoleSpellings(resource, action) {
-  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
-  return resources.map((name) => `${name}:${action}`);
-}
-function consoleRoleAllowsAll(held) {
-  if (!Array.isArray(held) || held.length === 0)
-    return true;
-  return held.includes("*");
-}
-function consoleRoleAllows(held, resource, action) {
-  if (consoleRoleAllowsAll(held))
-    return true;
-  const actions = CONSOLE_PERMISSIONS[resource];
-  if (!actions?.length)
-    return false;
-  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
-  return wanted.some(
-    (name) => consoleSpellings(resource, name).some(
-      (spelling) => held.includes(spelling)
-    )
-  );
-}
-
-// src/utils/console-authz.util.ts
-function callerId(req) {
-  const user = req.user;
-  return user?.user?.toString?.() || user?._id?.toString?.() || "";
-}
-async function requirePlatformStaff(req, grant) {
-  const id = callerId(req);
-  const role = id ? await resolveStaffRole(id) : null;
-  if (!role) {
-    throw new UnauthorizedError3("Not authorized.");
-  }
-  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
-    throw new UnauthorizedError3("Not authorized.");
-  }
-  return id;
-}
-async function requireConsolePermission(req, resource, action) {
-  return await requirePlatformStaff(req, { resource, action });
-}
-async function requireSelfOrPlatformStaff(req, userId, grant) {
-  const id = callerId(req);
-  const target = userId?.toString() ?? "";
-  if (id && target && target === id)
-    return id;
-  return await requirePlatformStaff(req, grant);
-}
-async function requireOrgAccess(req, orgId) {
-  return await requireOrgReach(req, orgId);
-}
-async function requirePlatformOwner(req, grant) {
-  const id = callerId(req);
-  if (!id || !await isPlatformOwner(id)) {
-    throw new UnauthorizedError3("Not authorized.");
-  }
-  if (grant)
-    await requirePlatformStaff(req, grant);
-  return id;
-}
-async function requireOrgReach(req, orgId) {
-  const id = callerId(req);
-  if (!id)
-    throw new UnauthorizedError3("Not authorized.");
-  const org = orgId?.toString() ?? "";
-  const actor = await resolveInviteActor(id);
-  if (actor.isSuperAdmin)
-    return id;
-  if (org && actor.orgIds.includes(org))
-    return id;
-  if (org && await hasOrgInvitation(id, org))
-    return id;
-  if (org && await hasOrgOwnership(id, org))
-    return id;
-  throw new UnauthorizedError3("Not authorized.");
-}
-async function requireInviteReach(req, org, app) {
-  const apps = Array.isArray(app) ? app : [app];
-  if (apps.some((a) => a === PLATFORM_STAFF_MEMBER_TYPE)) {
-    await requirePlatformStaff(req);
-  }
-  if (org)
-    await requireOrgReach(req, org);
-}
-async function requireUserFieldWrite(req, userId, field, grant) {
-  if (field === "email")
-    return await requirePlatformStaff(req, grant);
-  return await requireSelfOrPlatformStaff(req, userId, grant);
-}
-
 // src/utils/user-response.util.ts
 function publicIdentity(user) {
   if (!user || typeof user !== "object")
@@ -26186,7 +26199,7 @@ async function requireSiteReach(req, site, permission) {
   if (!siteId)
     throw new UnauthorizedError6("Not authorized.");
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   if (permission) {
     await useCameraViewService().authorizeSite({
@@ -26201,8 +26214,9 @@ async function requireSiteReach(req, site, permission) {
 async function siteReachOf(req) {
   const actor = await resolveInviteActor(callerId(req));
   const reachable = /* @__PURE__ */ new Map();
+  const bypass = staffMayBypass(actor);
   function canReach(record) {
-    if (actor.isSuperAdmin)
+    if (bypass)
       return Promise.resolve(true);
     if (!record)
       return Promise.resolve(false);
@@ -26223,7 +26237,7 @@ async function siteReachOf(req) {
     return reachable.get(site);
   }
   async function only(records) {
-    if (actor.isSuperAdmin)
+    if (bypass)
       return records;
     const verdicts = await Promise.all(records.map((r) => canReach(r)));
     return records.filter((_, i) => verdicts[i]);
@@ -26237,7 +26251,7 @@ async function requireSiteReachIfSignedIn(req, site) {
 }
 async function entitledSites(req) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return null;
   if (actor.memberships.length === 0)
     return [];
@@ -36942,13 +36956,13 @@ import { BadRequestError as BadRequestError91, logger as logger65 } from "@7365a
 import Joi50 from "joi";
 async function requireSiteWrite(req, siteId) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   await useCameraViewService().entitleSite({ siteId, userId: actor.id });
 }
 async function requireSiteRead(req, siteId, site) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   const owner = (site?.orgId ?? site?.org)?.toString?.() ?? "";
   if (owner && actor.orgIds.includes(owner))
@@ -41818,7 +41832,7 @@ import {
 async function requireEitherOrg(req, ...orgs) {
   const wanted = orgs.map((org) => org?.toString?.() ?? "").filter((org) => Boolean(org));
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   if (wanted.length === 0 || !wanted.some((org) => actor.orgIds.includes(org))) {
     throw new UnauthorizedError10("Not authorized.");
@@ -41914,7 +41928,7 @@ function useCustomerSiteController() {
     try {
       await requireOrgAccess(req, org);
       const actor = await resolveInviteActor(callerId(req));
-      const siteScope = actor.isSuperAdmin ? null : orgSiteScope({ memberships: actor.memberships, org });
+      const siteScope = staffMayBypass(actor) ? null : orgSiteScope({ memberships: actor.memberships, org });
       const data = await _getAll({
         search,
         page,
@@ -41948,7 +41962,7 @@ function useCustomerSiteController() {
     }
     try {
       const actor = await resolveInviteActor(callerId(req));
-      if (!actor.isSuperAdmin) {
+      if (!staffMayBypass(actor)) {
         await useCameraViewService().entitleSite({
           siteId: site,
           userId: actor.id
@@ -57952,7 +57966,7 @@ function usePersonController() {
   } = usePersonService();
   async function entitlePerson(req, _id) {
     const actor = await resolveInviteActor(callerId(req));
-    if (actor.isSuperAdmin)
+    if (staffMayBypass(actor))
       return actor;
     const person = await _getById(_id);
     if (!person)
@@ -64621,7 +64635,7 @@ function useDocumentManagementController() {
       return;
     }
     const actor = await resolveInviteActor(callerId(req));
-    if (actor.isSuperAdmin)
+    if (staffMayBypass(actor))
       return;
     const org = doc?.org?.toString() ?? "";
     if (!org || !actor.orgIds.includes(org)) {
@@ -68652,7 +68666,7 @@ import { ObjectId as ObjectId123 } from "mongodb";
 import { UnauthorizedError as UnauthorizedError17, useAtlas as useAtlas94 } from "@7365admin1/node-server-utils";
 async function requireOwnUnit(req, site, unitId) {
   const actor = await resolveInviteActor(callerId(req));
-  if (actor.isSuperAdmin)
+  if (staffMayBypass(actor))
     return;
   const unit = unitId?.toString?.() ?? "";
   const siteId = site?.toString?.() ?? "";
@@ -77292,10 +77306,10 @@ function useOnlineFormController() {
       const { actor } = await siteReachOf(req);
       if (site) {
         await requireSiteReach(req, site);
-      } else if (!actor.isSuperAdmin) {
+      } else if (!staffMayBypass(actor)) {
         throw new UnauthorizedError18("Not authorized.");
       }
-      if (org && !actor.isSuperAdmin && !actor.orgIds.includes(org)) {
+      if (org && !staffMayBypass(actor) && !actor.orgIds.includes(org)) {
         throw new UnauthorizedError18("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
@@ -77360,7 +77374,7 @@ function useOnlineFormController() {
       }
       if (payload.org) {
         const { actor } = await siteReachOf(req);
-        if (!actor.isSuperAdmin && !actor.orgIds.includes(payload.org)) {
+        if (!staffMayBypass(actor) && !actor.orgIds.includes(payload.org)) {
           throw new UnauthorizedError18("Not authorized.");
         }
       }
@@ -84878,7 +84892,7 @@ function useVerificationServiceV2() {
       if (!actor.id) {
         throw new UnauthorizedError19("Sign in to continue.");
       }
-      if (!actor.isSuperAdmin && !actor.orgIds.includes(orgId)) {
+      if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
         throw new UnauthorizedError19(
           "You can only invite service providers to your own organisation's sites."
         );
@@ -85380,6 +85394,11 @@ function useServiceProviderInviteController() {
   }
   async function approvals(req, res, next) {
     try {
+      await requireConsolePermission(
+        req,
+        "sp-approvals",
+        "see-all-sp-approvals"
+      );
       const schema2 = Joi143.object({
         status: Joi143.string().valid(
           "awaiting-approval",
@@ -85406,6 +85425,11 @@ function useServiceProviderInviteController() {
   }
   async function pendingApprovalCount(req, res, next) {
     try {
+      await requireConsolePermission(
+        req,
+        "sp-approvals",
+        "see-all-sp-approvals"
+      );
       res.json(await approvalCount({ userId: callerId5(req) }));
     } catch (error) {
       next(error);
@@ -85413,6 +85437,7 @@ function useServiceProviderInviteController() {
   }
   async function approve(req, res, next) {
     try {
+      await requireConsolePermission(req, "sp-approvals", "approve-sp");
       res.json(await _approve({ id: inviteId(req), userId: callerId5(req) }));
     } catch (error) {
       logger198.log({ level: "error", message: `${error.message}` });
@@ -85421,6 +85446,7 @@ function useServiceProviderInviteController() {
   }
   async function reject(req, res, next) {
     try {
+      await requireConsolePermission(req, "sp-approvals", "reject-sp");
       const { error, value } = Joi143.object({
         reason: Joi143.string().trim().min(1).max(1e3).required()
       }).validate(req.body ?? {});
@@ -92228,7 +92254,9 @@ export {
   CLIENT_ACTIONS,
   CLOCK_DRIFT_WARN_SECONDS,
   CONSOLE_AUDIT_LABELS,
+  CONSOLE_PERMISSIONS,
   CONTRACTOR_TYPE_LABELS,
+  CROSS_CLIENT_GRANT,
   CURRENT_TIME_ENDPOINT,
   CameraType,
   ConsoleAuditAction,
@@ -92440,6 +92468,9 @@ export {
   chatSchema,
   clampPtzSpeed,
   clockDriftSeconds,
+  consoleRoleAllows,
+  consoleRoleAllowsAll,
+  consoleSpellings,
   console_audit_namespace_collection,
   createManpowerRemarksDaily,
   customerSchema,
@@ -92539,6 +92570,8 @@ export {
   relayForRecorder,
   remarksSchema,
   renderPagePdf,
+  requireConsolePermission,
+  requirePlatformStaff,
   resetCameraTransports,
   residentAppModuleKeys,
   residentFormEntry,
@@ -92710,6 +92743,7 @@ export {
   site_people_namespace_collection,
   snapshotEndpoint,
   snapshotRefusalReason,
+  staffMayBypass,
   stringifyHidJson,
   stripFacialImageMetadata,
   subscriptionPlanSchema,