@7365admin1/core 3.64.5-staging.303 → 3.64.5-staging.304

package/.changeset/manpower-authenticated-namespace.md

@@ -0,0 +1,27 @@
+---
+"@7365admin1/core": minor
+---
+
+Manpower live status: an authenticated namespace beside the open one
+
+`/manpower` streams every client site's live staffing level — how many guards are
+actually on shift against how many were promised — to anyone who connects, with no
+credential of any kind.
+
+This adds `/manpower-live`, carrying exactly the same `manpower-status-update`
+events, which admits a socket only when the handshake presents a session id that
+resolves to a live session. Every refusal is an identical `Unauthorized`, and a
+session store that is down refuses rather than letting everyone in.
+
+`/manpower` itself is deliberately unchanged: the Capacitor guard app installed on
+phones today and the Nuxt security screen both connect to it with no credential and
+would be cut off the moment it were tightened. Every update is emitted to both, so
+the two feeds can never disagree, and both namespaces share one connection handler,
+so a client on the authenticated feed still starts the poll and still gets an
+immediate snapshot.
+
+A live session is the whole check, deliberately. Scoping the feed to the caller's
+own sites is not possible today: manpower lives in HRM Labs' vendor id space, none
+of those site ids match ours, and no field links the two — a site check would empty
+the screen for the one customer using it. That mapping is a schema change and
+belongs to the leads.

package/dist/index.js

@@ -536,13 +536,13 @@ var require_logger = __commonJS({
     "use strict";
     exports.__esModule = true;
     var _utils = require_utils();
-    var logger226 = {
+    var logger227 = {
       methodMap: ["debug", "info", "warn", "error"],
       level: "info",
       // Maps a given level value to the `methodMap` indexes above.
       lookupLevel: function lookupLevel(level) {
         if (typeof level === "string") {
-          var levelMap = _utils.indexOf(logger226.methodMap, level.toLowerCase());
+          var levelMap = _utils.indexOf(logger227.methodMap, level.toLowerCase());
           if (levelMap >= 0) {
             level = levelMap;
           } else {
@@ -553,9 +553,9 @@ var require_logger = __commonJS({
       },
       // Can be overridden in the host environment
       log: function log(level) {
-        level = logger226.lookupLevel(level);
-        if (typeof console !== "undefined" && logger226.lookupLevel(logger226.level) <= level) {
-          var method = logger226.methodMap[level];
+        level = logger227.lookupLevel(level);
+        if (typeof console !== "undefined" && logger227.lookupLevel(logger227.level) <= level) {
+          var method = logger227.methodMap[level];
           if (!console[method]) {
             method = "log";
           }
@@ -566,7 +566,7 @@ var require_logger = __commonJS({
         }
       }
     };
-    exports["default"] = logger226;
+    exports["default"] = logger227;
     module2.exports = exports["default"];
   }
 });
@@ -87847,6 +87847,52 @@ var isWithinHour = (alertTime, timeNow) => {
 var import_node_server_utils264 = require("@7365admin1/node-server-utils");
 var import_mongodb162 = require("mongodb");
 var import_moment_timezone11 = __toESM(require("moment-timezone"));
+
+// src/utils/socket-session.util.ts
+var MANPOWER_LIVE_NAMESPACE = "/manpower-live";
+function sidFromHandshake(handshake) {
+  const cookie = String(handshake?.headers?.cookie ?? "");
+  const fromCookie = /(?:^|;\s*)sid=([^;]*)/.exec(cookie);
+  if (fromCookie) {
+    const value = decodeURIComponent(fromCookie[1]).trim();
+    if (value)
+      return value;
+  }
+  for (const key of ["sid", "token"]) {
+    const value = handshake?.auth?.[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  const header = handshake?.headers?.authorization;
+  if (typeof header === "string" && header.trim()) {
+    const value = header.trim();
+    return value.toLowerCase().startsWith("bearer ") ? value.slice("bearer ".length).trim() : value;
+  }
+  return "";
+}
+function userIdOfSession(session) {
+  if (!session || typeof session !== "object")
+    return "";
+  const record = session;
+  return String(record.user ?? record._id ?? "").trim();
+}
+async function authoriseSocketSession(handshake, readSession) {
+  const sid = sidFromHandshake(handshake);
+  if (!sid)
+    throw new Error("Unauthorized");
+  let session;
+  try {
+    session = await readSession(sid);
+  } catch {
+    throw new Error("Unauthorized");
+  }
+  const userId = userIdOfSession(session);
+  if (!userId)
+    throw new Error("Unauthorized");
+  return userId;
+}
+
+// src/events/manpower.event.ts
 async function manpowerEvents(io) {
   let intervalId = null;
   let activeConnections = 0;
@@ -87907,8 +87953,7 @@ async function manpowerEvents(io) {
           newStatus = "Over";
         else if (actual < expected)
           newStatus = "Under";
-        const namespace2 = `/manpower`;
-        io.of(namespace2).emit("manpower-status-update", {
+        const update = {
           siteId: doc.siteId,
           siteName: doc.siteName,
           shift: shift.key,
@@ -87916,7 +87961,9 @@ async function manpowerEvents(io) {
           actual,
           expected,
           selectedDateSGT
-        });
+        };
+        io.of("/manpower").emit("manpower-status-update", update);
+        io.of(MANPOWER_LIVE_NAMESPACE).emit("manpower-status-update", update);
       }
     }
   };
@@ -87936,7 +87983,7 @@ async function manpowerEvents(io) {
       console.log(" Interval stopped.");
     }
   };
-  io.of("/manpower").on("connection", (socket) => {
+  const onConnection = (socket) => {
     activeConnections += 1;
     const date = socket.handshake.query.date;
     if (activeConnections === 1) {
@@ -87951,7 +87998,26 @@ async function manpowerEvents(io) {
         stopInterval();
       }
     });
+  };
+  io.of("/manpower").on("connection", onConnection);
+  const live = io.of(MANPOWER_LIVE_NAMESPACE);
+  live.use(async (socket, next) => {
+    try {
+      const { getCache } = (0, import_node_server_utils264.useCache)("sessions");
+      socket.data.userId = await authoriseSocketSession(
+        socket.handshake,
+        (sid) => getCache(`sid:${sid}`)
+      );
+      next();
+    } catch (error) {
+      import_node_server_utils264.logger.log({
+        level: "debug",
+        message: `[manpower] refused a socket: ${error?.message}`
+      });
+      next(new Error("Unauthorized"));
+    }
   });
+  live.on("connection", onConnection);
 }
 
 // src/services/reddot-payment.service.ts