@7365admin1/core 3.64.5-staging.305 → 3.64.5-staging.306

package/.changeset/people-create-reach-gate.md

@@ -0,0 +1,31 @@
+---
+"@7365admin1/core": patch
+---
+
+POST /api/people: count cross-client person creation (gate ships switched off)
+
+The signed-in branch of `POST /api/people` checked only that somebody was signed
+in. The site and organisation came straight from the request body, and where that
+body carries an e-mail, a password and a resident/tenant type, the service goes on
+to create a **user account** and an **active membership** as well as the person row.
+
+`site.people` is the collection every site-reach decision on the platform reads its
+verdict from, so a row written there is not an ordinary record — it manufactures
+reach into another client's estate.
+
+This adds the site-reach check the camera, HID and people-list paths already use,
+behind `PEOPLE_CREATE_REACH_MODE`, and **ships it in `log` mode**: it records what
+it would refuse and refuses nothing. `enforce` refuses; `off` does not look. Any
+unexpected error allows the request — this must never be why a real registration
+fails.
+
+It ships off because of RP-5. A person row carries no `createdBy`, so who created
+the existing rows cannot be established retrospectively and the true refusal count
+is only knowable from live traffic. Measured read-only on staging: 372
+`site.people` rows, of which exactly **1** is self-signup shaped (`platform:
+"mobile"`, `status: "pending"`) and 371 were written by a signed-in caller, across
+3 of 256 sites.
+
+Pre-login self-signup is untouched in every mode: a request with no session takes
+the other branch of `add` before this runs, and that route is already constrained
+by its own allow-list schema with `status` and `platform` pinned server-side.

package/dist/index.js

@@ -62478,6 +62478,21 @@ var import_joi72 = __toESM(require("joi"));
 var import_node_server_utils148 = require("@7365admin1/node-server-utils");
 var import_node_server_utils149 = require("@7365admin1/node-server-utils");
 
+// src/utils/people-create-gate.util.ts
+var PEOPLE_CREATE_REACH_MODE_DEFAULT = "log";
+function peopleCreateReachMode(env2 = process.env) {
+  return gateMode(
+    env2.PEOPLE_CREATE_REACH_MODE,
+    ["log", "enforce", "off"],
+    PEOPLE_CREATE_REACH_MODE_DEFAULT
+  );
+}
+function peopleCreateVerdict(params) {
+  if (params.mode === "off" || params.reachable)
+    return { refuse: false, record: false };
+  return { refuse: params.mode === "enforce", record: true };
+}
+
 // src/utils/self-signup-files.util.ts
 function dropUnsentFiles(body) {
   if (!Array.isArray(body?.files))
@@ -62587,6 +62602,41 @@ function usePersonController() {
       next(new import_node_server_utils148.BadRequestError(messages));
       return;
     }
+    try {
+      const mode = peopleCreateReachMode();
+      if (mode !== "off") {
+        const actor = await resolveInviteActor(callerId(req));
+        let reachable = true;
+        if (!staffMayBypass(actor)) {
+          const site = payload?.site ? String(payload.site) : "";
+          const org = payload?.org ? String(payload.org) : "";
+          if (site) {
+            reachable = await useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
+              () => true,
+              () => false
+            );
+          } else if (org) {
+            reachable = actor.orgIds.includes(org);
+          }
+        }
+        const verdict = peopleCreateVerdict({ mode, reachable });
+        if (verdict.record) {
+          import_node_server_utils148.logger.log({
+            level: "info",
+            message: `[people-create] ${verdict.refuse ? "refused" : "would-refuse"} caller=${actor.id} site=${payload?.site ?? ""} org=${payload?.org ?? ""} mode=${mode}`
+          });
+        }
+        if (verdict.refuse) {
+          next(new import_node_server_utils149.UnauthorizedError("Not authorized."));
+          return;
+        }
+      }
+    } catch (gateError) {
+      import_node_server_utils148.logger.log({
+        level: "warn",
+        message: `[people-create] reach check failed open: ${gateError?.message}`
+      });
+    }
     try {
       const data = await _add(payload);
       res.status(201).json({ message: data });