@7365admin1/core 3.55.0 → 3.56.0

package/dist/index.mjs

@@ -18696,6 +18696,53 @@ function useRoleService() {
   return { deleteRole, getDeletionPreview, deleteWithReassignments };
 }
 
+// src/utils/role-scope.util.ts
+import { UnauthorizedError as UnauthorizedError4 } from "@7365admin1/node-server-utils";
+function roleScope(role) {
+  if ((role?.type ?? "") === PLATFORM_STAFF_ROLE_TYPE)
+    return "platform";
+  return role?.org?.toString() ? "client" : "client-template";
+}
+var PLATFORM_ONLY_RESOURCES = [
+  "organizations",
+  "promo-codes",
+  "subscriptions",
+  "sp-approvals",
+  "marketplace-vendors",
+  "platform-terms",
+  "activity-history"
+];
+var PLATFORM_ONLY_PERMISSIONS = new Set(
+  PLATFORM_ONLY_RESOURCES.flatMap(
+    (resource) => (CONSOLE_PERMISSIONS[resource] ?? []).map(
+      (action) => `${resource}:${action}`
+    )
+  )
+);
+function platformPermissionsAdded(next, held) {
+  const already = new Set(held ?? []);
+  return (next ?? []).filter(
+    (permission) => PLATFORM_ONLY_PERMISSIONS.has(permission) && !already.has(permission)
+  );
+}
+function requireNoPlatformGrant(role, next) {
+  if (roleScope(role) === "platform")
+    return;
+  const added = platformPermissionsAdded(next, role?.permissions);
+  if (added.length === 0)
+    return;
+  throw new UnauthorizedError4(
+    "These are Seven365 console permissions and cannot be granted on a client role: " + added.join(", ")
+  );
+}
+function refuseSharedClientTemplate(role) {
+  if (roleScope(role) !== "client-template")
+    return;
+  throw new UnauthorizedError4(
+    "This role is shared by every client that was invited with it and cannot be changed here."
+  );
+}
+
 // src/controllers/role.controller.ts
 async function requireRoleOrg(req, org) {
   const orgId = org?.toString() ?? "";
@@ -18710,6 +18757,10 @@ async function requireRoleRead(req, roleId, org) {
     return;
   await requireRoleOrg(req, org);
 }
+async function requireRoleWrite(req, role) {
+  refuseSharedClientTemplate(role);
+  await requireRoleOrg(req, role?.org);
+}
 function useRoleController() {
   const {
     addRole: _createRole,
@@ -18747,6 +18798,10 @@ function useRoleController() {
       if (payload.org) {
         await requireOrgReach(req, payload.org);
       }
+      requireNoPlatformGrant(
+        { type: payload.type, org: payload.org, permissions: [] },
+        payload.permissions
+      );
       const role = await _createRole(payload);
       res.status(201).json({ message: "Successfully created role.", data: { role } });
       return;
@@ -18850,7 +18905,8 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new NotFoundError14("Role not found.");
-      await requireRoleOrg(req, existing.org);
+      await requireRoleWrite(req, existing);
+      requireNoPlatformGrant(existing, permissions);
       const role = await _updateRole(_id, { name, permissions });
       res.json({ message: "Successfully updated role.", data: { role } });
       return;
@@ -18878,7 +18934,8 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new NotFoundError14("Role not found.");
-      await requireRoleOrg(req, existing.org);
+      await requireRoleWrite(req, existing);
+      requireNoPlatformGrant(existing, permissions);
       await _updatePermissionsById(_id, permissions);
       res.json({ message: "Successfully updated role permissions." });
       return;
@@ -18901,7 +18958,7 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new NotFoundError14("Role not found.");
-      await requireRoleOrg(req, existing.org);
+      await requireRoleWrite(req, existing);
       const message = await _deleteRole(_id);
       res.json({ message });
       return;
@@ -18957,7 +19014,7 @@ function useRoleController() {
       const existing = await _getRoleById(req.params.id);
       if (!existing)
         throw new NotFoundError14("Role not found.");
-      await requireRoleOrg(req, existing.org);
+      await requireRoleWrite(req, existing);
       const message = await _deleteWithReassignments(
         req.params.id,
         req.body.reassignments
@@ -18990,12 +19047,12 @@ import { BadRequestError as BadRequestError49, logger as logger33 } from "@7365a
 // src/services/member.service.ts
 import {
   BadRequestError as BadRequestError41,
-  UnauthorizedError as UnauthorizedError4,
+  UnauthorizedError as UnauthorizedError5,
   useAtlas as useAtlas27
 } from "@7365admin1/node-server-utils";
 async function requireStaffCaller(callerId5, what) {
   if (!await isSuperAdmin(callerId5)) {
-    throw new UnauthorizedError4(
+    throw new UnauthorizedError5(
       `Only Seven365 staff can ${what}.`
     );
   }
@@ -19212,14 +19269,14 @@ function useMemberService() {
 }
 
 // src/utils/site-reach.util.ts
-import { useAtlas as useAtlas34, UnauthorizedError as UnauthorizedError6 } from "@7365admin1/node-server-utils";
+import { useAtlas as useAtlas34, UnauthorizedError as UnauthorizedError7 } from "@7365admin1/node-server-utils";
 import { ObjectId as ObjectId47 } from "mongodb";
 
 // src/services/camera-view.service.ts
 import {
   BadRequestError as BadRequestError48,
   NotFoundError as NotFoundError16,
-  UnauthorizedError as UnauthorizedError5,
+  UnauthorizedError as UnauthorizedError6,
   logger as logger32,
   useAtlas as useAtlas33,
   useCache as useCache19
@@ -25666,7 +25723,7 @@ function useCameraViewService() {
   }
   async function authorizeCamera(params) {
     if (!params.userId || !ObjectId46.isValid(params.userId)) {
-      throw new UnauthorizedError5("Not signed in.");
+      throw new UnauthorizedError6("Not signed in.");
     }
     if (!ObjectId46.isValid(params.cameraId)) {
       throw new BadRequestError48("Invalid camera id.");
@@ -25695,7 +25752,7 @@ function useCameraViewService() {
       memberships
     );
     if (!hasAnyPermission(permissions, params.permissions)) {
-      throw new UnauthorizedError5(
+      throw new UnauthorizedError6(
         "You do not have permission to use this camera."
       );
     }
@@ -25803,7 +25860,7 @@ function useCameraViewService() {
   }
   async function entitleSite(params) {
     if (!params.userId || !ObjectId46.isValid(params.userId)) {
-      throw new UnauthorizedError5("Not signed in.");
+      throw new UnauthorizedError6("Not signed in.");
     }
     if (!ObjectId46.isValid(params.siteId)) {
       throw new BadRequestError48("Invalid site id.");
@@ -25835,7 +25892,7 @@ function useCameraViewService() {
     );
     const required = params.permissions ?? CAMERA_VIEW_PERMISSIONS;
     if (!hasAnyPermission(permissions, required)) {
-      throw new UnauthorizedError5(
+      throw new UnauthorizedError6(
         params.message ?? (required === CAMERA_VIEW_PERMISSIONS ? "You do not have permission to view these cameras." : "You do not have permission to set up cameras on this site.")
       );
     }
@@ -26244,7 +26301,7 @@ function idText(value) {
 async function requireSiteReach(req, site, permission) {
   const siteId = site?.toString?.() ?? "";
   if (!siteId)
-    throw new UnauthorizedError6("Not authorized.");
+    throw new UnauthorizedError7("Not authorized.");
   const actor = await resolveInviteActor(callerId(req));
   if (staffMayBypass(actor))
     return;
@@ -27230,7 +27287,7 @@ function useVerificationController() {
 // src/controllers/file.controller.ts
 import {
   BadRequestError as BadRequestError51,
-  UnauthorizedError as UnauthorizedError7,
+  UnauthorizedError as UnauthorizedError8,
   logger as logger35
 } from "@7365admin1/node-server-utils";
 import Joi27 from "joi";
@@ -27259,7 +27316,7 @@ async function requireFileDelete(req, file) {
     return;
   const caller = callerId(req);
   if (!caller)
-    throw new UnauthorizedError7("Not authorized.");
+    throw new UnauthorizedError8("Not authorized.");
   if (caller === ownerId)
     return;
   const [me, owner] = await Promise.all([
@@ -27275,7 +27332,7 @@ async function requireFileDelete(req, file) {
   })) {
     return;
   }
-  throw new UnauthorizedError7("Not authorized.");
+  throw new UnauthorizedError8("Not authorized.");
 }
 function useFileController() {
   const { createFile, deleteFile: _deleteFile } = useFileService();
@@ -27348,7 +27405,7 @@ import {
   BadRequestError as BadRequestError55,
   logger as logger38,
   NotFoundError as NotFoundError17,
-  UnauthorizedError as UnauthorizedError8
+  UnauthorizedError as UnauthorizedError9
 } from "@7365admin1/node-server-utils";
 import Joi31 from "joi";
 
@@ -28621,7 +28678,7 @@ function useOrgController() {
     try {
       const createdBy = callerId(req);
       if (!createdBy)
-        throw new UnauthorizedError8("Not authorized.");
+        throw new UnauthorizedError9("Not authorized.");
       const _id = await _add({ ...req.body, createdBy });
       const data = await _getById(_id);
       res.status(201).json({
@@ -31122,7 +31179,7 @@ function useSubscriptionService() {
 import Joi36 from "joi";
 import {
   BadRequestError as BadRequestError71,
-  UnauthorizedError as UnauthorizedError9,
+  UnauthorizedError as UnauthorizedError10,
   logger as logger48
 } from "@7365admin1/node-server-utils";
 
@@ -31543,7 +31600,7 @@ function useSubscriptionController() {
     try {
       const subscription = await _getSubscriptionById(subscriptionId);
       if (!subscription) {
-        throw new UnauthorizedError9("Not authorized.");
+        throw new UnauthorizedError10("Not authorized.");
       }
       await requireOrgAccess(req, subscription.org?.toString());
       const _res = await _updateSubscriptionSeats({
@@ -41875,7 +41932,7 @@ function useCustomerSiteService() {
 import Joi59 from "joi";
 import {
   BadRequestError as BadRequestError107,
-  UnauthorizedError as UnauthorizedError10,
+  UnauthorizedError as UnauthorizedError11,
   logger as logger78
 } from "@7365admin1/node-server-utils";
 async function requireEitherOrg(req, ...orgs) {
@@ -41884,7 +41941,7 @@ async function requireEitherOrg(req, ...orgs) {
   if (staffMayBypass(actor))
     return;
   if (wanted.length === 0 || !wanted.some((org) => actor.orgIds.includes(org))) {
-    throw new UnauthorizedError10("Not authorized.");
+    throw new UnauthorizedError11("Not authorized.");
   }
 }
 function useCustomerSiteController() {
@@ -45096,7 +45153,7 @@ import {
   BadRequestError as BadRequestError121,
   InternalServerError as InternalServerError42,
   NotFoundError as NotFoundError34,
-  UnauthorizedError as UnauthorizedError11,
+  UnauthorizedError as UnauthorizedError12,
   logger as logger90
 } from "@7365admin1/node-server-utils";
 
@@ -48630,8 +48687,8 @@ function useHidAmicoService() {
         await siteAccess.authorizeSite({ siteId, userId: value.userId, permissions });
       }
     } catch (error) {
-      if (error instanceof UnauthorizedError11) {
-        throw new UnauthorizedError11("You do not have permission to manage HID access at this site.");
+      if (error instanceof UnauthorizedError12) {
+        throw new UnauthorizedError12("You do not have permission to manage HID access at this site.");
       }
       throw error;
     }
@@ -48655,7 +48712,7 @@ function useHidAmicoService() {
     try {
       await authorizeSiteForCaller(String(reader.site || ""), userId);
     } catch (error) {
-      if (error instanceof UnauthorizedError11)
+      if (error instanceof UnauthorizedError12)
         throw error;
       throw new NotFoundError34(HID_READER_NOT_FOUND);
     }
@@ -48707,10 +48764,10 @@ function useHidAmicoService() {
   async function assertUserReaderPermission(reader, userId, options = {}) {
     const permission = await getReaderPermissionForUser(reader, userId);
     if (!permission.granted) {
-      throw new UnauthorizedError11("You do not have HID access permission for this reader.");
+      throw new UnauthorizedError12("You do not have HID access permission for this reader.");
     }
     if (options.intercom && !permission.intercom) {
-      throw new UnauthorizedError11("You do not have HID intercom permission for this reader.");
+      throw new UnauthorizedError12("You do not have HID intercom permission for this reader.");
     }
     return permission;
   }
@@ -50048,10 +50105,10 @@ function useHidAmicoService() {
     const hasActiveMembership = memberships.some((membership) => membership.status !== "deleted" && membership.status !== "inactive");
     const resolvedIssuer = issuer || (hasResidentMembership ? "resident" : "property_management");
     if (resolvedIssuer === "resident" && !hasResidentMembership) {
-      throw new UnauthorizedError11("Only a Resident account can issue a Resident visitor QR code.");
+      throw new UnauthorizedError12("Only a Resident account can issue a Resident visitor QR code.");
     }
     if (resolvedIssuer === "property_management" && !hasActiveMembership) {
-      throw new UnauthorizedError11("Only a site Property Management account can issue this visitor QR code.");
+      throw new UnauthorizedError12("Only a site Property Management account can issue this visitor QR code.");
     }
     const configuredGateIds = site?.metadata?.hidQrCodePass?.qrGatePermissions?.[resolvedIssuer === "resident" ? "resident" : "propertyManagement"] || [];
     const gateReaderIds = configuredGateIds.filter((readerId) => typeof readerId === "string" && /^[a-f0-9]{24}$/i.test(readerId)).map(String);
@@ -52644,7 +52701,7 @@ function useVisitorTransactionService() {
 import Joi68 from "joi";
 import moment5 from "moment-timezone";
 import { ObjectId as ObjectId90 } from "mongodb";
-import { BadRequestError as BadRequestError124, NotFoundError as NotFoundError36, InternalServerError as InternalServerError44, UnauthorizedError as UnauthorizedError12, logger as logger94 } from "@7365admin1/node-server-utils";
+import { BadRequestError as BadRequestError124, NotFoundError as NotFoundError36, InternalServerError as InternalServerError44, UnauthorizedError as UnauthorizedError13, logger as logger94 } from "@7365admin1/node-server-utils";
 
 // src/models/visitor-invite.model.ts
 import Joi66 from "joi";
@@ -57428,7 +57485,7 @@ function useVisitorTransactionController() {
     }
     const inviterUserId = callerId(req);
     if (!inviterUserId) {
-      next(new UnauthorizedError12("Not authorized."));
+      next(new UnauthorizedError13("Not authorized."));
       return;
     }
     try {
@@ -57992,7 +58049,7 @@ function useGuestManagementController() {
 // src/controllers/person.controller.ts
 import Joi71 from "joi";
 import { BadRequestError as BadRequestError127, logger as logger97 } from "@7365admin1/node-server-utils";
-import { NotFoundError as NotFoundError37, UnauthorizedError as UnauthorizedError13 } from "@7365admin1/node-server-utils";
+import { NotFoundError as NotFoundError37, UnauthorizedError as UnauthorizedError14 } from "@7365admin1/node-server-utils";
 function usePersonController() {
   const {
     getAll: _getAll,
@@ -58026,7 +58083,7 @@ function usePersonController() {
     }
     const org = person.org?.toString() ?? "";
     if (!org || !actor.orgIds.includes(org)) {
-      throw new UnauthorizedError13("Not authorized.");
+      throw new UnauthorizedError14("Not authorized.");
     }
     return actor;
   }
@@ -58152,7 +58209,7 @@ function usePersonController() {
           });
         } else if (org) {
           if (!actor.orgIds.includes(org)) {
-            throw new UnauthorizedError13("Not authorized.");
+            throw new UnauthorizedError14("Not authorized.");
           }
         } else {
           orgs = actor.orgIds;
@@ -62472,7 +62529,7 @@ function useSiteFacilityService() {
 import {
   BadRequestError as BadRequestError149,
   NotFoundError as NotFoundError43,
-  UnauthorizedError as UnauthorizedError14,
+  UnauthorizedError as UnauthorizedError15,
   logger as logger116
 } from "@7365admin1/node-server-utils";
 import Joi83 from "joi";
@@ -62559,7 +62616,7 @@ function useSiteFacilityController() {
       } else {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin)
-          throw new UnauthorizedError14("Not authorized.");
+          throw new UnauthorizedError15("Not authorized.");
       }
       const data = await _getAll({
         search,
@@ -65594,7 +65651,7 @@ function useBulletinBoardService() {
 import {
   BadRequestError as BadRequestError158,
   NotFoundError as NotFoundError51,
-  UnauthorizedError as UnauthorizedError15,
+  UnauthorizedError as UnauthorizedError16,
   logger as logger125
 } from "@7365admin1/node-server-utils";
 import Joi91 from "joi";
@@ -65630,7 +65687,7 @@ function useBulletinBoardController() {
       } else {
         const { canReach } = await siteReachOf(req);
         if (!await canReach(scopeOf(value))) {
-          throw new UnauthorizedError15("Not authorized.");
+          throw new UnauthorizedError16("Not authorized.");
         }
       }
       const data = await _add(value);
@@ -66187,7 +66244,7 @@ import { BadRequestError as BadRequestError164, logger as logger131 } from "@736
 import {
   BadRequestError as BadRequestError163,
   logger as logger130,
-  UnauthorizedError as UnauthorizedError16,
+  UnauthorizedError as UnauthorizedError17,
   useAtlas as useAtlas89
 } from "@7365admin1/node-server-utils";
 
@@ -66571,7 +66628,7 @@ function useSiteBillingItemService() {
   function assertUnitAtSite(buildingUnit, site) {
     const siteId = site?.toString?.() ?? "";
     if (!siteId || (buildingUnit?.site?.toString() ?? "") !== siteId) {
-      throw new UnauthorizedError16("Not authorized.");
+      throw new UnauthorizedError17("Not authorized.");
     }
   }
   async function add(value) {
@@ -66742,7 +66799,7 @@ function useSiteBillingItemService() {
         message: error.message
       });
       await session.abortTransaction();
-      if (error instanceof BadRequestError163 || error instanceof UnauthorizedError16) {
+      if (error instanceof BadRequestError163 || error instanceof UnauthorizedError17) {
         throw error;
       }
       throw new BadRequestError163("Failed to update Site Billing Item.");
@@ -68711,7 +68768,7 @@ import Joi99 from "joi";
 
 // src/utils/resident-unit.util.ts
 import { ObjectId as ObjectId124 } from "mongodb";
-import { UnauthorizedError as UnauthorizedError17, useAtlas as useAtlas95 } from "@7365admin1/node-server-utils";
+import { UnauthorizedError as UnauthorizedError18, useAtlas as useAtlas95 } from "@7365admin1/node-server-utils";
 async function requireOwnUnit(req, site, unitId) {
   const actor = await resolveInviteActor(callerId(req));
   if (staffMayBypass(actor))
@@ -68719,7 +68776,7 @@ async function requireOwnUnit(req, site, unitId) {
   const unit = unitId?.toString?.() ?? "";
   const siteId = site?.toString?.() ?? "";
   if (!ObjectId124.isValid(unit) || !ObjectId124.isValid(siteId) || !actor.id) {
-    throw new UnauthorizedError17("Not authorized.");
+    throw new UnauthorizedError18("Not authorized.");
   }
   const db2 = useAtlas95.getDb();
   if (!db2)
@@ -68731,7 +68788,7 @@ async function requireOwnUnit(req, site, unitId) {
     status: { $ne: "deleted" }
   });
   if (!own)
-    throw new UnauthorizedError17("Not authorized.");
+    throw new UnauthorizedError18("Not authorized.");
 }
 
 // src/controllers/site-unit-billing.controller.ts
@@ -77283,7 +77340,7 @@ function useOnlineFormRepo() {
 import {
   BadRequestError as BadRequestError204,
   NotFoundError as NotFoundError71,
-  UnauthorizedError as UnauthorizedError18,
+  UnauthorizedError as UnauthorizedError19,
   logger as logger169
 } from "@7365admin1/node-server-utils";
 import Joi122 from "joi";
@@ -77355,10 +77412,10 @@ function useOnlineFormController() {
       if (site) {
         await requireSiteReach(req, site);
       } else if (!staffMayBypass(actor)) {
-        throw new UnauthorizedError18("Not authorized.");
+        throw new UnauthorizedError19("Not authorized.");
       }
       if (org && !staffMayBypass(actor) && !actor.orgIds.includes(org)) {
-        throw new UnauthorizedError18("Not authorized.");
+        throw new UnauthorizedError19("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
@@ -77423,7 +77480,7 @@ function useOnlineFormController() {
       if (payload.org) {
         const { actor } = await siteReachOf(req);
         if (!staffMayBypass(actor) && !actor.orgIds.includes(payload.org)) {
-          throw new UnauthorizedError18("Not authorized.");
+          throw new UnauthorizedError19("Not authorized.");
         }
       }
       await _updateOnlineFormById(_id, payload);
@@ -84669,7 +84726,7 @@ import {
   BadRequestError as BadRequestError229,
   NotFoundError as NotFoundError78,
   InternalServerError as InternalServerError81,
-  UnauthorizedError as UnauthorizedError19,
+  UnauthorizedError as UnauthorizedError20,
   useAtlas as useAtlas132,
   hashPassword as hashPassword4
 } from "@7365admin1/node-server-utils";
@@ -84938,10 +84995,10 @@ function useVerificationServiceV2() {
       const org = await getOrgById(orgId);
       const actor = await resolveInviteActor(invitedBy);
       if (!actor.id) {
-        throw new UnauthorizedError19("Sign in to continue.");
+        throw new UnauthorizedError20("Sign in to continue.");
       }
       if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
-        throw new UnauthorizedError19(
+        throw new UnauthorizedError20(
           "You can only invite service providers to your own organisation's sites."
         );
       }
@@ -89358,7 +89415,7 @@ import Joi158 from "joi";
 import { ObjectId as ObjectId179 } from "mongodb";
 import {
   InternalServerError as InternalServerError93,
-  UnauthorizedError as UnauthorizedError20,
+  UnauthorizedError as UnauthorizedError21,
   useAtlas as useAtlas146
 } from "@7365admin1/node-server-utils";
 function db() {
@@ -89374,7 +89431,7 @@ function asObjectId(value) {
 function requireCaller(req) {
   const id = callerId(req);
   if (!id || !ObjectId179.isValid(id)) {
-    throw new UnauthorizedError20("Not authorized.");
+    throw new UnauthorizedError21("Not authorized.");
   }
   return id;
 }
@@ -89382,7 +89439,7 @@ function requireSelfId(req, claimed) {
   const caller = requireCaller(req);
   const asked = claimed?.toString?.() ?? "";
   if (!asked || asked !== caller) {
-    throw new UnauthorizedError20("Not authorized.");
+    throw new UnauthorizedError21("Not authorized.");
   }
   return caller;
 }
@@ -89390,11 +89447,11 @@ async function requireOwnChannel(req, channelId) {
   const caller = requireCaller(req);
   const _id = asObjectId(channelId);
   if (!_id)
-    throw new UnauthorizedError20("Not authorized.");
+    throw new UnauthorizedError21("Not authorized.");
   const channel = await db().collection("channel-preloved").findOne({ _id }, { projection: { senderId: 1, receiverId: 1, postId: 1 } });
   const participants = [channel?.senderId, channel?.receiverId].map((id) => id?.toString?.() ?? "").filter(Boolean);
   if (!channel || !participants.includes(caller)) {
-    throw new UnauthorizedError20("Not authorized.");
+    throw new UnauthorizedError21("Not authorized.");
   }
   return { caller, channel };
 }
@@ -89402,10 +89459,10 @@ async function requireOwnChatMessage(req, chatId) {
   const caller = requireCaller(req);
   const _id = asObjectId(chatId);
   if (!_id)
-    throw new UnauthorizedError20("Not authorized.");
+    throw new UnauthorizedError21("Not authorized.");
   const message = await db().collection("chat-preloved").findOne({ _id }, { projection: { senderId: 1 } });
   if (!message || message.senderId?.toString?.() !== caller) {
-    throw new UnauthorizedError20("Not authorized.");
+    throw new UnauthorizedError21("Not authorized.");
   }
   return caller;
 }
@@ -89831,7 +89888,7 @@ function useBidPrelovedService() {
 // src/controllers/bid-preloved.controller.ts
 import {
   BadRequestError as BadRequestError252,
-  UnauthorizedError as UnauthorizedError21,
+  UnauthorizedError as UnauthorizedError22,
   logger as logger212
 } from "@7365admin1/node-server-utils";
 import Joi161 from "joi";
@@ -89883,7 +89940,7 @@ function useBidPrelovedController() {
       const bid = await _getById(params.id);
       const seller = await sellerOfPost(bid?.postId);
       if (!seller || seller !== caller) {
-        throw new UnauthorizedError21("Not authorized.");
+        throw new UnauthorizedError22("Not authorized.");
       }
       const data = await _updateStatus(params.id, body.status);
       res.status(200).json(data);
@@ -89907,7 +89964,7 @@ function useBidPrelovedController() {
       const data = await _getById(params.id);
       const seller = await sellerOfPost(data?.postId);
       if (data?.buyerId?.toString?.() !== caller && seller !== caller) {
-        throw new UnauthorizedError21("Not authorized.");
+        throw new UnauthorizedError22("Not authorized.");
       }
       res.status(200).json(data);
     } catch (error2) {
@@ -90305,7 +90362,7 @@ function useFormEntryRepo() {
 import {
   BadRequestError as BadRequestError254,
   NotFoundError as NotFoundError89,
-  UnauthorizedError as UnauthorizedError22,
+  UnauthorizedError as UnauthorizedError23,
   logger as logger214
 } from "@7365admin1/node-server-utils";
 import Joi163 from "joi";
@@ -90415,7 +90472,7 @@ function useFormEntryController() {
       } else {
         const { actor } = await siteReachOf(req);
         if (!actor.isSuperAdmin)
-          throw new UnauthorizedError22("Not authorized.");
+          throw new UnauthorizedError23("Not authorized.");
       }
       const data = await _getAll({ search, page, limit, status, org, site });
       res.json(data);
@@ -90466,7 +90523,7 @@ function useFormEntryController() {
         await requireSiteReach(req, rest.site);
       delete rest.userId;
       if (isOwner && rest.status && rest.status !== "pending") {
-        throw new UnauthorizedError22("Not authorized.");
+        throw new UnauthorizedError23("Not authorized.");
       }
       await _updateFormEntryById(_id, rest);
       res.json({ message: "Successfully updated online form." });
@@ -90523,7 +90580,7 @@ function useFormEntryController() {
   async function residentFormSubmission(req, res, next) {
     const userId = callerId(req);
     if (!userId) {
-      next(new UnauthorizedError22("Not authorized."));
+      next(new UnauthorizedError23("Not authorized."));
       return;
     }
     const payload = { ...req.body, userId };
@@ -91754,7 +91811,7 @@ function useHidAmicoController() {
 import {
   BadRequestError as BadRequestError257,
   logger as logger216,
-  UnauthorizedError as UnauthorizedError23
+  UnauthorizedError as UnauthorizedError24
 } from "@7365admin1/node-server-utils";
 import Joi165 from "joi";
 function usePlatformTermsController() {
@@ -91770,7 +91827,7 @@ function usePlatformTermsController() {
   async function requireOwnRecord(req, user, { staffMayRead = false } = {}) {
     const id = callerId(req);
     if (!id) {
-      throw new UnauthorizedError23("Not authorized.");
+      throw new UnauthorizedError24("Not authorized.");
     }
     if (id === user) {
       return id;
@@ -91778,7 +91835,7 @@ function usePlatformTermsController() {
     if (staffMayRead) {
       return await requireConsolePermission(req, "platform-terms", "see-platform-terms");
     }
-    throw new UnauthorizedError23("Not authorized.");
+    throw new UnauthorizedError24("Not authorized.");
   }
   async function getLatest(_req, res, next) {
     try {
@@ -91984,7 +92041,7 @@ function useConsoleAuditController() {
 // src/controllers/notification.controller.ts
 import {
   BadRequestError as BadRequestError259,
-  UnauthorizedError as UnauthorizedError24,
+  UnauthorizedError as UnauthorizedError25,
   logger as logger218
 } from "@7365admin1/node-server-utils";
 function useNotificationController() {
@@ -92002,10 +92059,10 @@ function useNotificationController() {
   function inboxOwner(req, claimed) {
     const caller = callerId5(req);
     if (!caller) {
-      throw new UnauthorizedError24("Not authorized.");
+      throw new UnauthorizedError25("Not authorized.");
     }
     if (claimed && claimed !== caller) {
-      throw new UnauthorizedError24("Not authorized.");
+      throw new UnauthorizedError25("Not authorized.");
     }
     return caller;
   }
@@ -92017,7 +92074,7 @@ function useNotificationController() {
     }
     try {
       if (!await isSuperAdmin(callerId5(req))) {
-        throw new UnauthorizedError24("Not authorized.");
+        throw new UnauthorizedError25("Not authorized.");
       }
       const inserted = await _addMany(value.to, {
         title: value.title,