@7365admin1/core 3.64.3-staging.285 → 3.64.3-staging.287

package/.changeset/hid-profile-qr-backend.md

@@ -0,0 +1,31 @@
+---
+"@7365admin1/core": minor
+---
+
+Let a signed-in member hold their own HID QR code.
+
+`GET`, `POST` and `DELETE /readers/:readerId/profile-qr` read, issue and revoke
+the caller's own QR credential on one reader. The caller comes from the session,
+so there is no user id in the path to point at somebody else, and each handler
+calls `authorizeReader` for itself rather than trusting the router - the site is
+re-resolved from the stored reader record.
+
+The credential is the visitor mechanism: an alphanumeric value in the reader's
+`qrcodes` table, with the reader put into the QR-readable configuration first.
+Unlike a visitor pass it carries no validity window, matching the member's
+facial enrollment, which is standing until removed. Issuing replaces any earlier
+code for that member on that reader, and the replacement is written and verified
+before the old one is removed.
+
+It creates no access rule, deliberately. `setProfileFacial` beside it does not
+either: a member's door access comes from the HID permissions screen, and
+minting a rule here would mean anyone who can press Generate admits themselves.
+The read reports whether that screen admits them, resolved through
+`resolvePermissionUserBindings` - the same resolver that writes the rules onto
+the device - so the answer is the one the reader will actually be asked.
+
+Two settings are now readable that were already writable: the QR identification
+and legacy-mode flags `configureVisitorQrReader` sets on every issue, plus
+`access_rule_time_zones` alongside its two sibling link tables. Whether a reader
+was set up to accept a QR, and whether an access rule had a schedule, were
+invisible to every screen and every diagnosis.

package/.changeset/hid-reader-user-search.md

@@ -0,0 +1,22 @@
+---
+"@7365admin1/core": patch
+---
+
+Make the search on the HID reader user roster work.
+
+`listReaderUsers` asked the device to filter. Amico's `where` takes a value or a
+list of values per column and has no operator form, so the substring clause it
+sent for a text term, `{name: {LIKE: "%x%"}}`, was answered
+`400 Invalid value (string or array expected)`. Every search by name threw, and
+the screen showed "Unable to load HID users from reader" with an empty table.
+
+A numeric term took a different branch that matched the HID user id exactly.
+That did not fail, it answered wrongly: searching a registration number like
+`000004` resolved to `id = 4` and returned a different person.
+
+Rows are already pulled in one page and filtered here for `userType`, so the
+search now joins that filter as a case-insensitive substring over name, id and
+registration - the same three fields, and the same "contains" semantics, the
+identities search uses. Verified against a live reader: a name matches
+partially and case-insensitively, a registration number returns its own user,
+a full UID still works, and no match returns an empty page rather than an error.

package/.changeset/site-update-ignores-derived-resident-modules.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+Stop refusing Site Settings saves that send back `metadata.residentAppModulesEffective`.
+
+`GET /api/sites/:id` attaches the derived `residentAppModulesEffective` to
+`metadata` on every read, and the Site Settings screens save by sending the
+metadata they read straight back. `updateSiteSchema` does not allow that key, so
+`PATCH /api/sites/id/:id` refused the whole save with "is not allowed" — the
+resident-app configuration panel, the HID QR code pass and the HID face-reader
+toggle all failed.
+
+`updateById` now drops the derived key before validating. It is never stored and
+is recomputed on the next read, so nothing is lost; every stored key, including
+`residentAppModules`, is validated and saved exactly as before.

package/dist/index.d.ts

@@ -12642,6 +12642,48 @@ declare function useHidAmicoService(): {
         facialEnrolled: boolean;
         facialEnrolledAt: string;
     }>;
+    getProfileQr: (readerId: string, userId: string) => Promise<{
+        readerId: string;
+        userId: string;
+        memberId: string;
+        hidUserId: string;
+        registration: string;
+        readerName: string;
+        portalName: string;
+        qrEnabled: boolean;
+        issued: boolean;
+        qrValue: string;
+        issuedAt: string;
+        assigned: boolean | null;
+    }>;
+    issueProfileQr: (readerId: string, userId: string) => Promise<{
+        readerId: string;
+        userId: string;
+        memberId: string;
+        hidUserId: string;
+        registration: string;
+        readerName: string;
+        portalName: string;
+        qrEnabled: boolean;
+        issued: boolean;
+        qrValue: string;
+        issuedAt: string;
+        assigned: boolean | null;
+    }>;
+    deleteProfileQr: (readerId: string, userId: string) => Promise<{
+        readerId: string;
+        userId: string;
+        memberId: string;
+        hidUserId: string;
+        registration: string;
+        readerName: string;
+        portalName: string;
+        qrEnabled: boolean;
+        issued: boolean;
+        qrValue: string;
+        issuedAt: string;
+        assigned: boolean | null;
+    }>;
     setProfileFacial: (readerId: string, userId: string, image: Buffer, options?: {
         timestamp?: number;
         match?: boolean;
@@ -12891,6 +12933,9 @@ declare function useHidAmicoController(): {
     revokeVisitorQr: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getProfileFacial: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     setProfileFacial: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    getProfileQr: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    issueProfileQr: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    deleteProfileQr: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     setVisitorImage: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     deleteVisitorImage: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getIntercomStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -38517,6 +38517,13 @@ function residentAppModulesAboveCeiling(orgModules, requested) {
 function residentAppModulesAboveCeilingMessage(rejected) {
   return `This client has not been given ${rejected.join(", ")} in the resident app, so a site cannot switch it on. Ask Seven365 to add it to the organisation first.`;
 }
+function withoutDerivedSiteMetadata(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return metadata;
+  }
+  const { residentAppModulesEffective: _derived, ...stored } = metadata;
+  return stored;
+}
 function asModules(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -38704,8 +38711,9 @@ function useSiteController() {
   }
   async function updateById(req, res, next) {
     try {
+      const body = req.body?.metadata ? { ...req.body, metadata: withoutDerivedSiteMetadata(req.body.metadata) } : req.body;
       const { error, value } = updateSiteSchema.validate(
-        { _id: req.params.id, ...req.body },
+        { _id: req.params.id, ...body },
         { abortEarly: false }
       );
       if (error) {
@@ -48716,7 +48724,12 @@ var HID_READABLE_OBJECTS = /* @__PURE__ */ new Set([
   "time_spans",
   "group_access_rules",
   "portal_access_rules",
-  "user_access_rules"
+  "user_access_rules",
+  // The third leg of the authorization chain, alongside the two above. A rule
+  // with no time zone never grants, so leaving this unreadable made the most
+  // common misconfiguration the one nobody could see. Read-only: the mutable
+  // set is unchanged.
+  "access_rule_time_zones"
 ]);
 var HID_WRITABLE_CONFIGURATION = /* @__PURE__ */ new Map([
   ["identifier", /* @__PURE__ */ new Set([
@@ -48727,10 +48740,18 @@ var HID_WRITABLE_CONFIGURATION = /* @__PURE__ */ new Map([
   ["pjsip", new Set(PJSIP_CONFIGURATION_KEYS)]
 ]);
 var HID_READABLE_CONFIGURATION = /* @__PURE__ */ new Map([
-  ["general", /* @__PURE__ */ new Set(["online"])],
+  // `local_identification` and the two QR settings below are written by
+  // `configureVisitorQrReader` on every visitor-QR issue but could not be read
+  // back, so whether a reader is actually set up to accept a QR was invisible
+  // to every screen and every diagnosis. Reading a setting we already write is
+  // not a widening of what this endpoint can change - the writable map is
+  // untouched.
+  ["general", /* @__PURE__ */ new Set(["online", "local_identification"])],
+  ["face_id", /* @__PURE__ */ new Set(["qrcode_legacy_mode_enabled"])],
   ["identifier", /* @__PURE__ */ new Set([
     "card_identification_enabled",
     "pin_identification_enabled",
+    "qrcode_identification_enabled",
     "multi_factor_authentication"
   ])],
   // A configured password must never be returned to a browser client.
@@ -51116,20 +51137,21 @@ function useHidAmicoService() {
     const client = new HidAmicoClient(reader);
     try {
       await client.login();
-      const normalizedSearch = search.trim();
-      const numericSearch = /^\d{1,15}$/.test(normalizedSearch) ? Number(normalizedSearch) : null;
-      const userWhere = {};
-      if (numericSearch !== null && Number.isSafeInteger(numericSearch)) {
-        userWhere.id = numericSearch;
-      } else if (normalizedSearch) {
-        userWhere.name = { LIKE: `%${normalizedSearch}%` };
-      }
+      const normalizedSearch = search.trim().toLowerCase();
+      const matchesSearch = (row) => {
+        if (!normalizedSearch)
+          return true;
+        return [row.name, row.id, row.registration].some((value) => String(value ?? "").toLowerCase().includes(normalizedSearch));
+      };
       let rows = [];
       let reportedTotal = null;
       let hasMore = false;
       const response = await client.loadObjects({
         object: "users",
-        where: { users: userWhere },
+        where: { users: {} },
+        // One page of the device's table, then everything below is decided
+        // here. A reader holding more than this many users would need paging
+        // added; the estate's readers hold single figures.
         limit: 500,
         offset: 0,
         order: ["id", "ascending"]
@@ -51137,7 +51159,8 @@ function useHidAmicoService() {
       const deviceRows = getHidObjectRows(response, "users");
       const filteredRows = deviceRows.filter((row) => {
         const isVisitor = Number(row.user_type_id) === 1;
-        return userType === "visitor" ? isVisitor : userType === "user" ? !isVisitor : true;
+        const typeMatches = userType === "visitor" ? isVisitor : userType === "user" ? !isVisitor : true;
+        return typeMatches && matchesSearch(row);
       });
       reportedTotal = filteredRows.length;
       rows = filteredRows.slice(offset, offset + limit);
@@ -51821,6 +51844,198 @@ function useHidAmicoService() {
     }
     return null;
   }
+  function createProfileQrCredential(readerId, userId, qrValue) {
+    return {
+      credentialId: createStableHidId(`profile-qr:${readerId}:${userId}`),
+      object: "qrcodes",
+      value: qrValue || `USR${import_crypto3.default.randomBytes(12).toString("hex").toUpperCase()}`
+    };
+  }
+  async function isProfileAssignedToReader(reader, userId) {
+    try {
+      const documents = await repo.listSitePermissionDocuments(String(reader.site));
+      const assignments = documents.flatMap((document2) => Array.isArray(document2.assignments) ? document2.assignments : []);
+      if (!assignments.length)
+        return false;
+      const bindings = await repo.resolvePermissionUserBindings(String(reader.site), assignments);
+      return bindings.some((binding) => String(binding.userId) === String(userId));
+    } catch {
+      return null;
+    }
+  }
+  async function getProfileQr(readerId, userId) {
+    const reader = await getActiveReader(readerId);
+    const context = await getProfileEnrollmentContext(readerId, reader, userId);
+    const metadata = context.profileIdentity && isUnknownRecord2(context.profileIdentity.metadata) ? context.profileIdentity.metadata : {};
+    return {
+      readerId,
+      userId,
+      memberId: String(context.member._id),
+      hidUserId: String(context.hidUserId),
+      registration: context.registration,
+      readerName: String(reader.name || ""),
+      portalName: String(reader.portalName || ""),
+      qrEnabled: readerSupportsCredential(reader, "qr"),
+      issued: typeof metadata.profileQrValue === "string" && metadata.profileQrValue.length > 0,
+      qrValue: typeof metadata.profileQrValue === "string" ? metadata.profileQrValue : "",
+      issuedAt: typeof metadata.profileQrIssuedAt === "string" ? metadata.profileQrIssuedAt : "",
+      assigned: await isProfileAssignedToReader(reader, userId)
+    };
+  }
+  async function issueProfileQr(readerId, userId) {
+    const reader = await getActiveReader(readerId);
+    assertReaderCapability(reader, "qr");
+    assertReaderPortal(reader, "issuing a QR code");
+    const context = await getProfileEnrollmentContext(readerId, reader, userId);
+    if (!context.profileName) {
+      throw new import_node_server_utils137.BadRequestError("A profile name is required to issue a HID QR code.");
+    }
+    const issuedAt = /* @__PURE__ */ new Date();
+    const credential = createProfileQrCredential(readerId, userId);
+    const client = new HidAmicoClient(reader);
+    try {
+      await client.login();
+      await configureVisitorQrReader(client);
+      const existingUserResponse = await client.loadObjects({
+        object: "users",
+        where: { users: { id: context.hidUserId } },
+        limit: 1,
+        offset: 0
+      });
+      const hidUser = { name: context.profileName, registration: context.registration };
+      if (getHidObjectRows(existingUserResponse, "users").length) {
+        await client.modifyObjects({
+          object: "users",
+          where: { users: { id: context.hidUserId } },
+          values: hidUser
+        });
+      } else {
+        await client.createObjects({
+          object: "users",
+          values: [{ id: context.hidUserId, ...hidUser }]
+        });
+      }
+      const existingQrs = getHidObjectRows(
+        await client.loadObjects({
+          object: credential.object,
+          where: { [credential.object]: { user_id: context.hidUserId } },
+          limit: 100,
+          offset: 0
+        }),
+        credential.object
+      );
+      const credentialValues = { value: credential.value, user_id: context.hidUserId };
+      if (existingQrs.some((row) => String(row.id) === String(credential.credentialId))) {
+        await client.modifyObjects({
+          object: credential.object,
+          where: { [credential.object]: { id: credential.credentialId } },
+          values: credentialValues
+        });
+      } else {
+        await client.createObjects({
+          object: credential.object,
+          values: [{ id: credential.credentialId, ...credentialValues }]
+        });
+      }
+      const savedCredential = getHidObjectRows(
+        await client.loadObjects({
+          object: credential.object,
+          where: { [credential.object]: { id: credential.credentialId } },
+          limit: 1,
+          offset: 0
+        }),
+        credential.object
+      )[0];
+      if (!savedCredential || String(savedCredential.user_id) !== String(context.hidUserId) || String(savedCredential.value) !== String(credential.value)) {
+        throw new import_node_server_utils137.BadRequestError("The HID reader did not retain the generated QR code.");
+      }
+      for (const staleQr of existingQrs) {
+        const staleId = Number(staleQr.id);
+        if (Number.isSafeInteger(staleId) && staleId > 0 && staleId !== credential.credentialId) {
+          await client.destroyObjects({
+            object: credential.object,
+            where: { [credential.object]: { id: staleId } }
+          });
+        }
+      }
+      const existingIdentity = context.profileIdentity;
+      const existingMetadata = existingIdentity && isUnknownRecord2(existingIdentity.metadata) ? existingIdentity.metadata : {};
+      const identityPayload = {
+        hidUserId: String(context.hidUserId),
+        registration: context.registration,
+        user: userId,
+        member: context.member._id,
+        type: context.identityType,
+        status: "active",
+        metadata: {
+          ...existingMetadata,
+          name: context.profileName,
+          profileQr: true,
+          profileQrValue: credential.value,
+          profileQrCredentialId: credential.credentialId,
+          profileQrIssuedAt: issuedAt.toISOString()
+        }
+      };
+      if (existingIdentity?._id) {
+        await repo.updateIdentity(existingIdentity._id, identityPayload);
+      } else {
+        await repo.addIdentity({
+          ...identityPayload,
+          reader: readerId,
+          site: reader.site
+        });
+      }
+      await repo.updateById(readerId, { lastSeenAt: /* @__PURE__ */ new Date() });
+      await repo.addEvent({
+        reader: readerId,
+        site: reader.site,
+        type: "profile_qr_issued",
+        payload: {
+          user: userId,
+          member: String(context.member._id),
+          hidUserId: context.hidUserId,
+          credentialId: credential.credentialId
+        }
+      });
+      return getProfileQr(readerId, userId);
+    } catch (error) {
+      await repo.addEvent({
+        reader: readerId,
+        site: reader.site,
+        type: "profile_qr_issue_failed",
+        payload: { user: userId, message: getErrorMessage2(error) }
+      });
+      throw error;
+    } finally {
+      await client.logout();
+    }
+  }
+  async function deleteProfileQr(readerId, userId) {
+    const reader = await getActiveReader(readerId);
+    const context = await getProfileEnrollmentContext(readerId, reader, userId);
+    const client = new HidAmicoClient(reader);
+    try {
+      await client.login();
+      await client.destroyObjects({
+        object: "qrcodes",
+        where: { qrcodes: { user_id: context.hidUserId } }
+      });
+      if (context.profileIdentity?._id) {
+        const existingMetadata = isUnknownRecord2(context.profileIdentity.metadata) ? context.profileIdentity.metadata : {};
+        const { profileQr, profileQrValue, profileQrCredentialId, profileQrIssuedAt, ...rest } = existingMetadata;
+        await repo.updateIdentity(context.profileIdentity._id, { metadata: rest });
+      }
+      await repo.addEvent({
+        reader: readerId,
+        site: reader.site,
+        type: "profile_qr_revoked",
+        payload: { user: userId, hidUserId: context.hidUserId }
+      });
+      return getProfileQr(readerId, userId);
+    } finally {
+      await client.logout();
+    }
+  }
   async function getProfileFacial(readerId, userId) {
     const reader = await getActiveReader(readerId);
     const context = await getProfileEnrollmentContext(readerId, reader, userId);
@@ -53366,6 +53581,9 @@ function useHidAmicoService() {
     queueVisitorQrJob,
     processVisitorQrGatewayJobs,
     getProfileFacial,
+    getProfileQr,
+    issueProfileQr,
+    deleteProfileQr,
     setProfileFacial,
     setVisitorImage,
     deleteVisitorImage,
@@ -93472,6 +93690,45 @@ function useHidAmicoController() {
       next(error);
     }
   }
+  async function getProfileQr(req, res, next) {
+    const { error, value } = schemaHidAmicoReaderIdParams.validate(req.params);
+    if (error) {
+      next(new import_node_server_utils301.BadRequestError(error.message));
+      return;
+    }
+    try {
+      await authorizeReader(req, value.readerId);
+      res.json({ data: await service.getProfileQr(value.readerId, getAuthenticatedUserId(req)) });
+    } catch (error2) {
+      next(error2);
+    }
+  }
+  async function issueProfileQr(req, res, next) {
+    const { error, value } = schemaHidAmicoReaderIdParams.validate(req.params);
+    if (error) {
+      next(new import_node_server_utils301.BadRequestError(error.message));
+      return;
+    }
+    try {
+      await authorizeReader(req, value.readerId);
+      res.json({ data: await service.issueProfileQr(value.readerId, getAuthenticatedUserId(req)) });
+    } catch (error2) {
+      next(error2);
+    }
+  }
+  async function deleteProfileQr(req, res, next) {
+    const { error, value } = schemaHidAmicoReaderIdParams.validate(req.params);
+    if (error) {
+      next(new import_node_server_utils301.BadRequestError(error.message));
+      return;
+    }
+    try {
+      await authorizeReader(req, value.readerId);
+      res.json({ data: await service.deleteProfileQr(value.readerId, getAuthenticatedUserId(req)) });
+    } catch (error2) {
+      next(error2);
+    }
+  }
   async function setProfileFacial(req, res, next) {
     const params = schemaHidAmicoReaderIdParams.validate(req.params);
     const query2 = schemaHidAmicoUserImageUploadQuery.validate(req.query);
@@ -93698,6 +93955,9 @@ function useHidAmicoController() {
     revokeVisitorQr,
     getProfileFacial,
     setProfileFacial,
+    getProfileQr,
+    issueProfileQr,
+    deleteProfileQr,
     setVisitorImage,
     deleteVisitorImage,
     getIntercomStatus,