@7365admin1/core 3.64.5-staging.302 → 3.64.5-staging.304

package/.changeset/manpower-authenticated-namespace.md

@@ -0,0 +1,27 @@
+---
+"@7365admin1/core": minor
+---
+
+Manpower live status: an authenticated namespace beside the open one
+
+`/manpower` streams every client site's live staffing level — how many guards are
+actually on shift against how many were promised — to anyone who connects, with no
+credential of any kind.
+
+This adds `/manpower-live`, carrying exactly the same `manpower-status-update`
+events, which admits a socket only when the handshake presents a session id that
+resolves to a live session. Every refusal is an identical `Unauthorized`, and a
+session store that is down refuses rather than letting everyone in.
+
+`/manpower` itself is deliberately unchanged: the Capacitor guard app installed on
+phones today and the Nuxt security screen both connect to it with no credential and
+would be cut off the moment it were tightened. Every update is emitted to both, so
+the two feeds can never disagree, and both namespaces share one connection handler,
+so a client on the authenticated feed still starts the poll and still gets an
+immediate snapshot.
+
+A live session is the whole check, deliberately. Scoping the feed to the caller's
+own sites is not possible today: manpower lives in HRM Labs' vendor id space, none
+of those site ids match ours, and no field links the two — a site check would empty
+the screen for the one customer using it. That mapping is a schema change and
+belongs to the leads.

package/.changeset/notify-access-filter-on.md

@@ -0,0 +1,24 @@
+---
+"@7365admin1/core": minor
+---
+
+Notifications: stop sending alerts for modules a client was never given
+
+`NOTIFY_ACCESS_FILTER` now defaults to `on` instead of `log`, so the module-based
+drop is real: a recipient no longer gets a notification when every membership they
+hold at the site denies every module the notification's category is about.
+
+Only the module drop acts. The role-based check is still computed and logged and
+never drops anybody, because most apps do not enforce their role gates yet and a
+role-based drop would hide alerts for screens people can still open.
+
+Unchanged: residents, anyone with no membership at the site, Seven365 staff, sends
+with no site, and categories the catalogue does not govern are all exempt; any
+error sends to everyone; and `MODULE_LIST_GATE=off` still disables it entirely.
+`NOTIFY_ACCESS_FILTER=log` or `off` overrides this default with no deploy.
+
+This is inert until a client's module list is enforced — measured read-only on
+staging at the time of the flip, no organisation (0 of 199) and no site (0 of 256)
+had a stored list and there were no acknowledged-save markers, so nothing is
+dropped for anybody until a Super Admin saves a module list with the acknowledged
+preview.

package/dist/index.d.ts

@@ -14397,13 +14397,29 @@ declare function isPlatformOwner(userId?: string | ObjectId | null): Promise<boo
  * with no site (marketplace, broadcasts); a category not in the catalogue or
  * with no permission resources (resident-only and marketplace ones).
  *
- * `NOTIFY_ACCESS_FILTER`: `log` (code default) counts, logs and SENDS TO
- * EVERYONE; `on` drops; `off` reads nothing. `MODULE_LIST_GATE=off` is the
- * same as `off`. Any error sends to everyone.
+ * `NOTIFY_ACCESS_FILTER`: `on` (code default) DROPS; `log` counts, logs and
+ * sends to everyone; `off` reads nothing. `MODULE_LIST_GATE=off` is the same as
+ * `off`. Any error sends to everyone.
+ *
+ * The default was `log` from the day this shipped until the owner turned it on
+ * (2026-09-13), having accepted that some staff will notice alerts they used to
+ * get stopping. Only the MODULE drop became real; the role check above stays
+ * logged only, because most apps still do not enforce their role gates.
+ *
+ * Turning it on changed nothing on its own: the filter returns early unless the
+ * site or its organisation has an ENFORCED module list, and on the day of the
+ * flip no organisation and no site had one (measured read-only on staging: 0 of
+ * 199 organisations, 0 of 256 sites, 0 acknowledged-save markers). It takes
+ * effect for a client the first time a Super Admin saves that client's module
+ * list with the acknowledged preview.
+ *
+ * The env var still wins over this default, so a lead can put it back to `log`
+ * or `off` without waiting for a deploy.
  *
  * Both senders call this: core's `notification.service.ts send()` here, and
  * API-core's own `send()` (a separate class; memory
- * `two-notification-senders-not-one`), which must call it the same way.
+ * `two-notification-senders-not-one`), which imports this very function — so
+ * this default governs both, and neither can drift from the other.
  */
 type TNotifyAccessMode = "log" | "on" | "off";
 declare const NOTIFY_ACCESS_FILTER_DEFAULT: TNotifyAccessMode;

package/dist/index.js

@@ -536,13 +536,13 @@ var require_logger = __commonJS({
     "use strict";
     exports.__esModule = true;
     var _utils = require_utils();
-    var logger226 = {
+    var logger227 = {
       methodMap: ["debug", "info", "warn", "error"],
       level: "info",
       // Maps a given level value to the `methodMap` indexes above.
       lookupLevel: function lookupLevel(level) {
         if (typeof level === "string") {
-          var levelMap = _utils.indexOf(logger226.methodMap, level.toLowerCase());
+          var levelMap = _utils.indexOf(logger227.methodMap, level.toLowerCase());
           if (levelMap >= 0) {
             level = levelMap;
           } else {
@@ -553,9 +553,9 @@ var require_logger = __commonJS({
       },
       // Can be overridden in the host environment
       log: function log(level) {
-        level = logger226.lookupLevel(level);
-        if (typeof console !== "undefined" && logger226.lookupLevel(logger226.level) <= level) {
-          var method = logger226.methodMap[level];
+        level = logger227.lookupLevel(level);
+        if (typeof console !== "undefined" && logger227.lookupLevel(logger227.level) <= level) {
+          var method = logger227.methodMap[level];
           if (!console[method]) {
             method = "log";
           }
@@ -566,7 +566,7 @@ var require_logger = __commonJS({
         }
       }
     };
-    exports["default"] = logger226;
+    exports["default"] = logger227;
     module2.exports = exports["default"];
   }
 });
@@ -16560,7 +16560,7 @@ async function siteModulePreview(site, org, proposed, data = moduleGateData()) {
 }
 
 // src/utils/notification-access.util.ts
-var NOTIFY_ACCESS_FILTER_DEFAULT = "log";
+var NOTIFY_ACCESS_FILTER_DEFAULT = "on";
 function notifyAccessMode(env2 = process.env) {
   return gateMode(env2.NOTIFY_ACCESS_FILTER, ["log", "on", "off"], NOTIFY_ACCESS_FILTER_DEFAULT);
 }
@@ -87847,6 +87847,52 @@ var isWithinHour = (alertTime, timeNow) => {
 var import_node_server_utils264 = require("@7365admin1/node-server-utils");
 var import_mongodb162 = require("mongodb");
 var import_moment_timezone11 = __toESM(require("moment-timezone"));
+
+// src/utils/socket-session.util.ts
+var MANPOWER_LIVE_NAMESPACE = "/manpower-live";
+function sidFromHandshake(handshake) {
+  const cookie = String(handshake?.headers?.cookie ?? "");
+  const fromCookie = /(?:^|;\s*)sid=([^;]*)/.exec(cookie);
+  if (fromCookie) {
+    const value = decodeURIComponent(fromCookie[1]).trim();
+    if (value)
+      return value;
+  }
+  for (const key of ["sid", "token"]) {
+    const value = handshake?.auth?.[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  const header = handshake?.headers?.authorization;
+  if (typeof header === "string" && header.trim()) {
+    const value = header.trim();
+    return value.toLowerCase().startsWith("bearer ") ? value.slice("bearer ".length).trim() : value;
+  }
+  return "";
+}
+function userIdOfSession(session) {
+  if (!session || typeof session !== "object")
+    return "";
+  const record = session;
+  return String(record.user ?? record._id ?? "").trim();
+}
+async function authoriseSocketSession(handshake, readSession) {
+  const sid = sidFromHandshake(handshake);
+  if (!sid)
+    throw new Error("Unauthorized");
+  let session;
+  try {
+    session = await readSession(sid);
+  } catch {
+    throw new Error("Unauthorized");
+  }
+  const userId = userIdOfSession(session);
+  if (!userId)
+    throw new Error("Unauthorized");
+  return userId;
+}
+
+// src/events/manpower.event.ts
 async function manpowerEvents(io) {
   let intervalId = null;
   let activeConnections = 0;
@@ -87907,8 +87953,7 @@ async function manpowerEvents(io) {
           newStatus = "Over";
         else if (actual < expected)
           newStatus = "Under";
-        const namespace2 = `/manpower`;
-        io.of(namespace2).emit("manpower-status-update", {
+        const update = {
           siteId: doc.siteId,
           siteName: doc.siteName,
           shift: shift.key,
@@ -87916,7 +87961,9 @@ async function manpowerEvents(io) {
           actual,
           expected,
           selectedDateSGT
-        });
+        };
+        io.of("/manpower").emit("manpower-status-update", update);
+        io.of(MANPOWER_LIVE_NAMESPACE).emit("manpower-status-update", update);
       }
     }
   };
@@ -87936,7 +87983,7 @@ async function manpowerEvents(io) {
       console.log(" Interval stopped.");
     }
   };
-  io.of("/manpower").on("connection", (socket) => {
+  const onConnection = (socket) => {
     activeConnections += 1;
     const date = socket.handshake.query.date;
     if (activeConnections === 1) {
@@ -87951,7 +87998,26 @@ async function manpowerEvents(io) {
         stopInterval();
       }
     });
+  };
+  io.of("/manpower").on("connection", onConnection);
+  const live = io.of(MANPOWER_LIVE_NAMESPACE);
+  live.use(async (socket, next) => {
+    try {
+      const { getCache } = (0, import_node_server_utils264.useCache)("sessions");
+      socket.data.userId = await authoriseSocketSession(
+        socket.handshake,
+        (sid) => getCache(`sid:${sid}`)
+      );
+      next();
+    } catch (error) {
+      import_node_server_utils264.logger.log({
+        level: "debug",
+        message: `[manpower] refused a socket: ${error?.message}`
+      });
+      next(new Error("Unauthorized"));
+    }
   });
+  live.on("connection", onConnection);
 }
 
 // src/services/reddot-payment.service.ts