@7365admin1/core 3.64.5-staging.303 → 3.64.5-staging.305

package/.changeset/manpower-authenticated-namespace.md

@@ -0,0 +1,27 @@
+---
+"@7365admin1/core": minor
+---
+
+Manpower live status: an authenticated namespace beside the open one
+
+`/manpower` streams every client site's live staffing level — how many guards are
+actually on shift against how many were promised — to anyone who connects, with no
+credential of any kind.
+
+This adds `/manpower-live`, carrying exactly the same `manpower-status-update`
+events, which admits a socket only when the handshake presents a session id that
+resolves to a live session. Every refusal is an identical `Unauthorized`, and a
+session store that is down refuses rather than letting everyone in.
+
+`/manpower` itself is deliberately unchanged: the Capacitor guard app installed on
+phones today and the Nuxt security screen both connect to it with no credential and
+would be cut off the moment it were tightened. Every update is emitted to both, so
+the two feeds can never disagree, and both namespaces share one connection handler,
+so a client on the authenticated feed still starts the poll and still gets an
+immediate snapshot.
+
+A live session is the whole check, deliberately. Scoping the feed to the caller's
+own sites is not possible today: manpower lives in HRM Labs' vendor id space, none
+of those site ids match ours, and no field links the two — a site check would empty
+the screen for the one customer using it. That mapping is a schema change and
+belongs to the leads.

package/.changeset/module-gate-kill-switch-and-read.md

@@ -0,0 +1,26 @@
+---
+"@7365admin1/core": patch
+---
+
+Module gate: the kill switch now stops the 409, and the check stops reading when there is nothing to decide
+
+Two follow-ups from the module-gate server review, both behaviour-neutral for
+anybody who is not using the kill switch.
+
+**`MODULE_LIST_GATE=off` now means off.** Every other part of the gate checked the
+master switch; `mustAcknowledge` did not. So with the gate switched off, a save that
+narrowed a client's module list was still refused with a 409 "acknowledge the impact
+first" — the one lever a lead would reach for in an emergency, not working for the
+one path that blocks a save from going through. Both the organisation and the site
+save paths go through that function, so both are fixed. With the switch at its
+default the 409 behaves exactly as before, and that is asserted.
+
+**`moduleDeniedForCaller` no longer reads memberships when no list is enforced.** It
+runs on every governed request and read the caller's memberships before finding out
+whether there was anything to decide — and `members.user` has no index to use. It now
+returns early unless the site or its organisation has an enforced list, which is what
+the notification filter already did. No verdict changes: a client that really has an
+enforced list is still measured exactly as before, and that is asserted too.
+
+Also corrects the 3.65.0 changelog, which claimed `MODULE_LIST_GATE` switched all of
+the gate off at once. It did not, for the reason above.

package/dist/index.js

@@ -536,13 +536,13 @@ var require_logger = __commonJS({
     "use strict";
     exports.__esModule = true;
     var _utils = require_utils();
-    var logger226 = {
+    var logger227 = {
       methodMap: ["debug", "info", "warn", "error"],
       level: "info",
       // Maps a given level value to the `methodMap` indexes above.
       lookupLevel: function lookupLevel(level) {
         if (typeof level === "string") {
-          var levelMap = _utils.indexOf(logger226.methodMap, level.toLowerCase());
+          var levelMap = _utils.indexOf(logger227.methodMap, level.toLowerCase());
           if (levelMap >= 0) {
             level = levelMap;
           } else {
@@ -553,9 +553,9 @@ var require_logger = __commonJS({
       },
       // Can be overridden in the host environment
       log: function log(level) {
-        level = logger226.lookupLevel(level);
-        if (typeof console !== "undefined" && logger226.lookupLevel(logger226.level) <= level) {
-          var method = logger226.methodMap[level];
+        level = logger227.lookupLevel(level);
+        if (typeof console !== "undefined" && logger227.lookupLevel(logger227.level) <= level) {
+          var method = logger227.methodMap[level];
           if (!console[method]) {
             method = "log";
           }
@@ -566,7 +566,7 @@ var require_logger = __commonJS({
         }
       }
     };
-    exports["default"] = logger226;
+    exports["default"] = logger227;
     module2.exports = exports["default"];
   }
 });
@@ -15855,6 +15855,8 @@ function deniedForMembership({
   return { denied, since: [orgTier.since, siteTier.since].sort().pop() ?? "" };
 }
 function mustAcknowledge(preview, acknowledged) {
+  if (!moduleListGateOn())
+    return false;
   if (acknowledged === true || !preview.newlyDenied.length)
     return false;
   return !preview.impact || preview.impact.memberCount > 0;
@@ -87847,6 +87849,52 @@ var isWithinHour = (alertTime, timeNow) => {
 var import_node_server_utils264 = require("@7365admin1/node-server-utils");
 var import_mongodb162 = require("mongodb");
 var import_moment_timezone11 = __toESM(require("moment-timezone"));
+
+// src/utils/socket-session.util.ts
+var MANPOWER_LIVE_NAMESPACE = "/manpower-live";
+function sidFromHandshake(handshake) {
+  const cookie = String(handshake?.headers?.cookie ?? "");
+  const fromCookie = /(?:^|;\s*)sid=([^;]*)/.exec(cookie);
+  if (fromCookie) {
+    const value = decodeURIComponent(fromCookie[1]).trim();
+    if (value)
+      return value;
+  }
+  for (const key of ["sid", "token"]) {
+    const value = handshake?.auth?.[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  const header = handshake?.headers?.authorization;
+  if (typeof header === "string" && header.trim()) {
+    const value = header.trim();
+    return value.toLowerCase().startsWith("bearer ") ? value.slice("bearer ".length).trim() : value;
+  }
+  return "";
+}
+function userIdOfSession(session) {
+  if (!session || typeof session !== "object")
+    return "";
+  const record = session;
+  return String(record.user ?? record._id ?? "").trim();
+}
+async function authoriseSocketSession(handshake, readSession) {
+  const sid = sidFromHandshake(handshake);
+  if (!sid)
+    throw new Error("Unauthorized");
+  let session;
+  try {
+    session = await readSession(sid);
+  } catch {
+    throw new Error("Unauthorized");
+  }
+  const userId = userIdOfSession(session);
+  if (!userId)
+    throw new Error("Unauthorized");
+  return userId;
+}
+
+// src/events/manpower.event.ts
 async function manpowerEvents(io) {
   let intervalId = null;
   let activeConnections = 0;
@@ -87907,8 +87955,7 @@ async function manpowerEvents(io) {
           newStatus = "Over";
         else if (actual < expected)
           newStatus = "Under";
-        const namespace2 = `/manpower`;
-        io.of(namespace2).emit("manpower-status-update", {
+        const update = {
           siteId: doc.siteId,
           siteName: doc.siteName,
           shift: shift.key,
@@ -87916,7 +87963,9 @@ async function manpowerEvents(io) {
           actual,
           expected,
           selectedDateSGT
-        });
+        };
+        io.of("/manpower").emit("manpower-status-update", update);
+        io.of(MANPOWER_LIVE_NAMESPACE).emit("manpower-status-update", update);
       }
     }
   };
@@ -87936,7 +87985,7 @@ async function manpowerEvents(io) {
       console.log(" Interval stopped.");
     }
   };
-  io.of("/manpower").on("connection", (socket) => {
+  const onConnection = (socket) => {
     activeConnections += 1;
     const date = socket.handshake.query.date;
     if (activeConnections === 1) {
@@ -87951,7 +88000,26 @@ async function manpowerEvents(io) {
         stopInterval();
       }
     });
+  };
+  io.of("/manpower").on("connection", onConnection);
+  const live = io.of(MANPOWER_LIVE_NAMESPACE);
+  live.use(async (socket, next) => {
+    try {
+      const { getCache } = (0, import_node_server_utils264.useCache)("sessions");
+      socket.data.userId = await authoriseSocketSession(
+        socket.handshake,
+        (sid) => getCache(`sid:${sid}`)
+      );
+      next();
+    } catch (error) {
+      import_node_server_utils264.logger.log({
+        level: "debug",
+        message: `[manpower] refused a socket: ${error?.message}`
+      });
+      next(new Error("Unauthorized"));
+    }
   });
+  live.on("connection", onConnection);
 }
 
 // src/services/reddot-payment.service.ts
@@ -96817,6 +96885,8 @@ async function moduleDeniedForCaller({
     if (!user || !siteId)
       return ALLOW;
     const siteDoc = typeof site === "string" ? await data.site(siteId).catch(() => null) : site ?? null;
+    if (!await siteHasEnforcedList(siteDoc, data))
+      return ALLOW;
     const gate = await gateAtSite(await data.membershipsOf([user]), siteDoc, siteId, data);
     if (gate.exempt)
       return ALLOW;