@7365admin1/core 3.66.0 → 3.68.0

package/CHANGELOG.md

@@ -1,5 +1,83 @@
 # @iservice365/core
 
+## 3.68.0
+
+### Minor Changes
+
+- d7e9298: Manpower live status: an authenticated namespace beside the open one
+
+  `/manpower` streams every client site's live staffing level — how many guards are
+  actually on shift against how many were promised — to anyone who connects, with no
+  credential of any kind.
+
+  This adds `/manpower-live`, carrying exactly the same `manpower-status-update`
+  events, which admits a socket only when the handshake presents a session id that
+  resolves to a live session. Every refusal is an identical `Unauthorized`, and a
+  session store that is down refuses rather than letting everyone in.
+
+  `/manpower` itself is deliberately unchanged: the Capacitor guard app installed on
+  phones today and the Nuxt security screen both connect to it with no credential and
+  would be cut off the moment it were tightened. Every update is emitted to both, so
+  the two feeds can never disagree, and both namespaces share one connection handler,
+  so a client on the authenticated feed still starts the poll and still gets an
+  immediate snapshot.
+
+  A live session is the whole check, deliberately. Scoping the feed to the caller's
+  own sites is not possible today: manpower lives in HRM Labs' vendor id space, none
+  of those site ids match ours, and no field links the two — a site check would empty
+  the screen for the one customer using it. That mapping is a schema change and
+  belongs to the leads.
+
+### Patch Changes
+
+- 87c8679: Module gate: the kill switch now stops the 409, and the check stops reading when there is nothing to decide
+
+  Two follow-ups from the module-gate server review, both behaviour-neutral for
+  anybody who is not using the kill switch.
+
+  **`MODULE_LIST_GATE=off` now means off.** Every other part of the gate checked the
+  master switch; `mustAcknowledge` did not. So with the gate switched off, a save that
+  narrowed a client's module list was still refused with a 409 "acknowledge the impact
+  first" — the one lever a lead would reach for in an emergency, not working for the
+  one path that blocks a save from going through. Both the organisation and the site
+  save paths go through that function, so both are fixed. With the switch at its
+  default the 409 behaves exactly as before, and that is asserted.
+
+  **`moduleDeniedForCaller` no longer reads memberships when no list is enforced.** It
+  runs on every governed request and read the caller's memberships before finding out
+  whether there was anything to decide — and `members.user` has no index to use. It now
+  returns early unless the site or its organisation has an enforced list, which is what
+  the notification filter already did. No verdict changes: a client that really has an
+  enforced list is still measured exactly as before, and that is asserted too.
+
+  Also corrects the 3.65.0 changelog, which claimed `MODULE_LIST_GATE` switched all of
+  the gate off at once. It did not, for the reason above.
+
+## 3.67.0
+
+### Minor Changes
+
+- 7b9ea2f: Notifications: stop sending alerts for modules a client was never given
+
+  `NOTIFY_ACCESS_FILTER` now defaults to `on` instead of `log`, so the module-based
+  drop is real: a recipient no longer gets a notification when every membership they
+  hold at the site denies every module the notification's category is about.
+
+  Only the module drop acts. The role-based check is still computed and logged and
+  never drops anybody, because most apps do not enforce their role gates yet and a
+  role-based drop would hide alerts for screens people can still open.
+
+  Unchanged: residents, anyone with no membership at the site, Seven365 staff, sends
+  with no site, and categories the catalogue does not govern are all exempt; any
+  error sends to everyone; and `MODULE_LIST_GATE=off` still disables it entirely.
+  `NOTIFY_ACCESS_FILTER=log` or `off` overrides this default with no deploy.
+
+  This is inert until a client's module list is enforced — measured read-only on
+  staging at the time of the flip, no organisation (0 of 199) and no site (0 of 256)
+  had a stored list and there were no acknowledged-save markers, so nothing is
+  dropped for anybody until a Super Admin saves a module list with the acknowledged
+  preview.
+
 ## 3.66.0
 
 ### Minor Changes
@@ -62,7 +140,9 @@
     the keys in `MODULE_GATE_ENFORCE_KEYS`. Work stamped (`at`) before the
     acknowledged save is accepted.
   - `MODULE_LIST_GATE` (code default `on`) switches all of the above off at
-    once.
+    once. CORRECTION (3.68.0): it did not. `mustAcknowledge` never read it, so
+    with the gate off a narrowing save was still refused with a 409. Fixed in
+    3.68.0; every other path did check it.
 
 ### Patch Changes
 

package/dist/index.d.ts

@@ -14185,13 +14185,29 @@ declare function isPlatformOwner(userId?: string | ObjectId | null): Promise<boo
  * with no site (marketplace, broadcasts); a category not in the catalogue or
  * with no permission resources (resident-only and marketplace ones).
  *
- * `NOTIFY_ACCESS_FILTER`: `log` (code default) counts, logs and SENDS TO
- * EVERYONE; `on` drops; `off` reads nothing. `MODULE_LIST_GATE=off` is the
- * same as `off`. Any error sends to everyone.
+ * `NOTIFY_ACCESS_FILTER`: `on` (code default) DROPS; `log` counts, logs and
+ * sends to everyone; `off` reads nothing. `MODULE_LIST_GATE=off` is the same as
+ * `off`. Any error sends to everyone.
+ *
+ * The default was `log` from the day this shipped until the owner turned it on
+ * (2026-09-13), having accepted that some staff will notice alerts they used to
+ * get stopping. Only the MODULE drop became real; the role check above stays
+ * logged only, because most apps still do not enforce their role gates.
+ *
+ * Turning it on changed nothing on its own: the filter returns early unless the
+ * site or its organisation has an ENFORCED module list, and on the day of the
+ * flip no organisation and no site had one (measured read-only on staging: 0 of
+ * 199 organisations, 0 of 256 sites, 0 acknowledged-save markers). It takes
+ * effect for a client the first time a Super Admin saves that client's module
+ * list with the acknowledged preview.
+ *
+ * The env var still wins over this default, so a lead can put it back to `log`
+ * or `off` without waiting for a deploy.
  *
  * Both senders call this: core's `notification.service.ts send()` here, and
  * API-core's own `send()` (a separate class; memory
- * `two-notification-senders-not-one`), which must call it the same way.
+ * `two-notification-senders-not-one`), which imports this very function — so
+ * this default governs both, and neither can drift from the other.
  */
 type TNotifyAccessMode = "log" | "on" | "off";
 declare const NOTIFY_ACCESS_FILTER_DEFAULT: TNotifyAccessMode;

package/dist/index.js

@@ -536,13 +536,13 @@ var require_logger = __commonJS({
     "use strict";
     exports.__esModule = true;
     var _utils = require_utils();
-    var logger226 = {
+    var logger227 = {
       methodMap: ["debug", "info", "warn", "error"],
       level: "info",
       // Maps a given level value to the `methodMap` indexes above.
       lookupLevel: function lookupLevel(level) {
         if (typeof level === "string") {
-          var levelMap = _utils.indexOf(logger226.methodMap, level.toLowerCase());
+          var levelMap = _utils.indexOf(logger227.methodMap, level.toLowerCase());
           if (levelMap >= 0) {
             level = levelMap;
           } else {
@@ -553,9 +553,9 @@ var require_logger = __commonJS({
       },
       // Can be overridden in the host environment
       log: function log(level) {
-        level = logger226.lookupLevel(level);
-        if (typeof console !== "undefined" && logger226.lookupLevel(logger226.level) <= level) {
-          var method = logger226.methodMap[level];
+        level = logger227.lookupLevel(level);
+        if (typeof console !== "undefined" && logger227.lookupLevel(logger227.level) <= level) {
+          var method = logger227.methodMap[level];
           if (!console[method]) {
             method = "log";
           }
@@ -566,7 +566,7 @@ var require_logger = __commonJS({
         }
       }
     };
-    exports["default"] = logger226;
+    exports["default"] = logger227;
     module2.exports = exports["default"];
   }
 });
@@ -15844,6 +15844,8 @@ function deniedForMembership({
   return { denied, since: [orgTier.since, siteTier.since].sort().pop() ?? "" };
 }
 function mustAcknowledge(preview, acknowledged) {
+  if (!moduleListGateOn())
+    return false;
   if (acknowledged === true || !preview.newlyDenied.length)
     return false;
   return !preview.impact || preview.impact.memberCount > 0;
@@ -16549,7 +16551,7 @@ async function siteModulePreview(site, org, proposed, data = moduleGateData()) {
 }
 
 // src/utils/notification-access.util.ts
-var NOTIFY_ACCESS_FILTER_DEFAULT = "log";
+var NOTIFY_ACCESS_FILTER_DEFAULT = "on";
 function notifyAccessMode(env2 = process.env) {
   return gateMode(env2.NOTIFY_ACCESS_FILTER, ["log", "on", "off"], NOTIFY_ACCESS_FILTER_DEFAULT);
 }
@@ -85931,6 +85933,52 @@ var isWithinHour = (alertTime, timeNow) => {
 var import_node_server_utils264 = require("@7365admin1/node-server-utils");
 var import_mongodb162 = require("mongodb");
 var import_moment_timezone11 = __toESM(require("moment-timezone"));
+
+// src/utils/socket-session.util.ts
+var MANPOWER_LIVE_NAMESPACE = "/manpower-live";
+function sidFromHandshake(handshake) {
+  const cookie = String(handshake?.headers?.cookie ?? "");
+  const fromCookie = /(?:^|;\s*)sid=([^;]*)/.exec(cookie);
+  if (fromCookie) {
+    const value = decodeURIComponent(fromCookie[1]).trim();
+    if (value)
+      return value;
+  }
+  for (const key of ["sid", "token"]) {
+    const value = handshake?.auth?.[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  const header = handshake?.headers?.authorization;
+  if (typeof header === "string" && header.trim()) {
+    const value = header.trim();
+    return value.toLowerCase().startsWith("bearer ") ? value.slice("bearer ".length).trim() : value;
+  }
+  return "";
+}
+function userIdOfSession(session) {
+  if (!session || typeof session !== "object")
+    return "";
+  const record = session;
+  return String(record.user ?? record._id ?? "").trim();
+}
+async function authoriseSocketSession(handshake, readSession) {
+  const sid = sidFromHandshake(handshake);
+  if (!sid)
+    throw new Error("Unauthorized");
+  let session;
+  try {
+    session = await readSession(sid);
+  } catch {
+    throw new Error("Unauthorized");
+  }
+  const userId = userIdOfSession(session);
+  if (!userId)
+    throw new Error("Unauthorized");
+  return userId;
+}
+
+// src/events/manpower.event.ts
 async function manpowerEvents(io) {
   let intervalId = null;
   let activeConnections = 0;
@@ -85991,8 +86039,7 @@ async function manpowerEvents(io) {
           newStatus = "Over";
         else if (actual < expected)
           newStatus = "Under";
-        const namespace2 = `/manpower`;
-        io.of(namespace2).emit("manpower-status-update", {
+        const update = {
           siteId: doc.siteId,
           siteName: doc.siteName,
           shift: shift.key,
@@ -86000,7 +86047,9 @@ async function manpowerEvents(io) {
           actual,
           expected,
           selectedDateSGT
-        });
+        };
+        io.of("/manpower").emit("manpower-status-update", update);
+        io.of(MANPOWER_LIVE_NAMESPACE).emit("manpower-status-update", update);
       }
     }
   };
@@ -86020,7 +86069,7 @@ async function manpowerEvents(io) {
       console.log(" Interval stopped.");
     }
   };
-  io.of("/manpower").on("connection", (socket) => {
+  const onConnection = (socket) => {
     activeConnections += 1;
     const date = socket.handshake.query.date;
     if (activeConnections === 1) {
@@ -86035,7 +86084,26 @@ async function manpowerEvents(io) {
         stopInterval();
       }
     });
+  };
+  io.of("/manpower").on("connection", onConnection);
+  const live = io.of(MANPOWER_LIVE_NAMESPACE);
+  live.use(async (socket, next) => {
+    try {
+      const { getCache } = (0, import_node_server_utils264.useCache)("sessions");
+      socket.data.userId = await authoriseSocketSession(
+        socket.handshake,
+        (sid) => getCache(`sid:${sid}`)
+      );
+      next();
+    } catch (error) {
+      import_node_server_utils264.logger.log({
+        level: "debug",
+        message: `[manpower] refused a socket: ${error?.message}`
+      });
+      next(new Error("Unauthorized"));
+    }
   });
+  live.on("connection", onConnection);
 }
 
 // src/services/reddot-payment.service.ts
@@ -94810,6 +94878,8 @@ async function moduleDeniedForCaller({
     if (!user || !siteId)
       return ALLOW;
     const siteDoc = typeof site === "string" ? await data.site(siteId).catch(() => null) : site ?? null;
+    if (!await siteHasEnforcedList(siteDoc, data))
+      return ALLOW;
     const gate = await gateAtSite(await data.membershipsOf([user]), siteDoc, siteId, data);
     if (gate.exempt)
       return ALLOW;