@7365admin1/core 3.68.0 → 3.68.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.68.0",
+  "version": "3.68.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/anpr-plate.test.mjs

@@ -0,0 +1,272 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  ALLOW_CAMERA_DIRECTIONS,
+  BLOCK_CAMERA_DIRECTIONS,
+  listsClearedByDirectionChange,
+  listsFilledByDirectionChange,
+  isAllowCameraDirection,
+  listsHeldBy,
+  listsToRevoke,
+  matchingPlateRecords,
+  parseDahuaFindRecords,
+  samePlate,
+  dahuaWallClock,
+  plateWindowMatches,
+  mustRevokeFrom,
+} from "./.build/utils/anpr-plate.util.mjs";
+
+/* --------------------------------------------------------------------------
+ * Which cameras a plate is written to.
+ * ----------------------------------------------------------------------- */
+
+test("an allowed plate goes to Entry, Both and Residents cameras only", () => {
+  assert.deepEqual([...ALLOW_CAMERA_DIRECTIONS].sort(), ["both", "entry", "residents"]);
+  assert.ok(!ALLOW_CAMERA_DIRECTIONS.includes("exit"));
+  assert.ok(!ALLOW_CAMERA_DIRECTIONS.includes("visitors"));
+});
+
+test("a blocked plate goes to every camera a car can come in through, not Exit", () => {
+  for (const direction of ALLOW_CAMERA_DIRECTIONS) {
+    assert.ok(
+      BLOCK_CAMERA_DIRECTIONS.includes(direction),
+      `${direction} lets an allowed plate in, so it must refuse a blocked one`,
+    );
+  }
+  assert.ok(BLOCK_CAMERA_DIRECTIONS.includes("visitors"));
+  assert.ok(!BLOCK_CAMERA_DIRECTIONS.includes("exit"));
+});
+
+/* --------------------------------------------------------------------------
+ * Reading a camera's find answer.
+ * ----------------------------------------------------------------------- */
+
+const TWO_COPIES =
+  "found=2\r\n" +
+  "records[0].RecNo=14\r\n" +
+  "records[0].PlateNumber=SGA1234X\r\n" +
+  "records[0].MasterOfCar=Old Name\r\n" +
+  "records[1].RecNo=91\r\n" +
+  "records[1].PlateNumber=SGA1234X\r\n";
+
+test("every record is read, not just the first", () => {
+  const { found, records } = parseDahuaFindRecords(TWO_COPIES);
+  assert.equal(found, 2);
+  assert.deepEqual(
+    records.map((record) => record.recNo),
+    ["14", "91"],
+  );
+});
+
+test("nothing found reads as no records", () => {
+  assert.deepEqual(parseDahuaFindRecords("found=0\r\n").records, []);
+  assert.deepEqual(parseDahuaFindRecords("").records, []);
+  assert.deepEqual(parseDahuaFindRecords(undefined).records, []);
+});
+
+test("only records that really are this plate are matched", () => {
+  const loose =
+    "found=2\n" +
+    "records[0].RecNo=5\nrecords[0].PlateNumber=SGA123\n" +
+    "records[1].RecNo=6\nrecords[1].PlateNumber=SGA1234\n";
+
+  // A firmware that matches loosely must not get a stranger removed.
+  assert.deepEqual(
+    matchingPlateRecords(loose, "SGA123").map((record) => record.recNo),
+    ["5"],
+  );
+});
+
+test("plates compare without case or spaces", () => {
+  assert.ok(samePlate("sga 1234x", "SGA1234X"));
+  assert.ok(!samePlate("SGA1234X", "SGA1234"));
+  assert.ok(!samePlate("", ""));
+});
+
+/* --------------------------------------------------------------------------
+ * Which lists a record holds, and which may be revoked.
+ * ----------------------------------------------------------------------- */
+
+test("a blocked whitelist vehicle holds both lists", () => {
+  assert.deepEqual(listsHeldBy({ type: "whitelist" }), { allow: true, block: false });
+  assert.deepEqual(listsHeldBy({ type: "blocklist" }), { allow: false, block: true });
+  assert.deepEqual(
+    listsHeldBy({ type: "blocklist", blockedFrom: "whitelist" }),
+    { allow: true, block: true },
+  );
+});
+
+test("a plate nobody else uses comes off both lists", () => {
+  assert.deepEqual(listsToRevoke([]), { allow: true, block: true });
+});
+
+test("deleting one record never lifts another record's block", () => {
+  // Staging has held the same plate as a whitelist AND a blocklist vehicle.
+  assert.deepEqual(listsToRevoke([{ type: "blocklist" }]), {
+    allow: true,
+    block: false,
+  });
+});
+
+test("deleting one record never shuts out another record's allowed plate", () => {
+  assert.deepEqual(listsToRevoke([{ type: "whitelist" }]), {
+    allow: false,
+    block: true,
+  });
+  assert.deepEqual(
+    listsToRevoke([{ type: "blocklist", blockedFrom: "whitelist" }]),
+    { allow: false, block: false },
+  );
+});
+
+/* --------------------------------------------------------------------------
+ * Changing a camera's type.
+ * ----------------------------------------------------------------------- */
+
+test("a camera changed to Exit has both lists cleared", () => {
+  for (const from of ["entry", "both", "residents", "visitors"]) {
+    assert.deepEqual(listsClearedByDirectionChange(from, "exit"), {
+      allow: true,
+      block: true,
+    });
+  }
+});
+
+test("an allowed camera changed to Visitors has only its allowed list cleared", () => {
+  for (const from of ["entry", "both", "residents"]) {
+    assert.deepEqual(listsClearedByDirectionChange(from, "visitors"), {
+      allow: true,
+      block: false,
+    });
+  }
+});
+
+test("any other change clears nothing", () => {
+  const none = { allow: false, block: false };
+  assert.deepEqual(listsClearedByDirectionChange("entry", "residents"), none);
+  assert.deepEqual(listsClearedByDirectionChange("both", "both"), none);
+  assert.deepEqual(listsClearedByDirectionChange("exit", "exit"), none);
+  assert.deepEqual(listsClearedByDirectionChange("visitors", "entry"), none);
+  assert.deepEqual(listsClearedByDirectionChange("exit", "visitors"), none);
+  // An edit that does not send a type changes nothing.
+  assert.deepEqual(listsClearedByDirectionChange("entry", undefined), none);
+  assert.deepEqual(listsClearedByDirectionChange("entry", ""), none);
+});
+
+test("a new Entry, Both or Residents camera receives every allowed and blocked plate", () => {
+  for (const to of ["entry", "both", "residents"]) {
+    assert.deepEqual(listsFilledByDirectionChange("", to), { allow: true, block: true });
+    assert.deepEqual(listsFilledByDirectionChange(undefined, to), { allow: true, block: true });
+  }
+});
+
+test("a new Visitors camera receives the blocked plates only; a new Exit camera nothing", () => {
+  assert.deepEqual(listsFilledByDirectionChange("", "visitors"), { allow: false, block: true });
+  assert.deepEqual(listsFilledByDirectionChange("", "exit"), { allow: false, block: false });
+});
+
+test("a camera changed to Entry, Both or Residents receives what it did not hold", () => {
+  // Visitors already holds the blocked plates.
+  assert.deepEqual(listsFilledByDirectionChange("visitors", "entry"), { allow: true, block: false });
+  // Exit holds nothing.
+  assert.deepEqual(listsFilledByDirectionChange("exit", "residents"), { allow: true, block: true });
+  assert.deepEqual(listsFilledByDirectionChange("exit", "visitors"), { allow: false, block: true });
+});
+
+test("changes between allowed types, or away from them, fill nothing", () => {
+  const none = { allow: false, block: false };
+  assert.deepEqual(listsFilledByDirectionChange("entry", "residents"), none);
+  assert.deepEqual(listsFilledByDirectionChange("both", "both"), none);
+  assert.deepEqual(listsFilledByDirectionChange("entry", "visitors"), none);
+  assert.deepEqual(listsFilledByDirectionChange("entry", "exit"), none);
+  assert.deepEqual(listsFilledByDirectionChange("entry", ""), none);
+});
+
+test("no type change both clears and fills", () => {
+  const all = ["", "entry", "both", "residents", "visitors", "exit"];
+  for (const from of all) {
+    for (const to of all) {
+      const cleared = listsClearedByDirectionChange(from, to);
+      const filled = listsFilledByDirectionChange(from, to);
+      assert.ok(
+        !((cleared.allow || cleared.block) && (filled.allow || filled.block)),
+        `${from} -> ${to}`,
+      );
+    }
+  }
+});
+
+test("direction spelling is forgiving", () => {
+  assert.ok(isAllowCameraDirection(" Residents "));
+  assert.ok(!isAllowCameraDirection("visitors"));
+});
+
+/* --------------------------------------------------------------------------
+ * The dates a season pass is allowed between, on the camera's own clock.
+ * ----------------------------------------------------------------------- */
+
+test("a UTC instant is written in the site's zone, not the server's", () => {
+  // 08/05/2026 01:13 PM in Singapore, as the screen sends it.
+  assert.equal(dahuaWallClock("2026-08-05T05:13:00.000Z", "Asia/Singapore"), "2026-08-05 13:13:00");
+  assert.equal(dahuaWallClock(new Date("2036-08-05T05:13:00.000Z"), "Asia/Singapore"), "2036-08-05 13:13:00");
+  assert.equal(dahuaWallClock("2026-08-05T13:13:00+08:00", "Asia/Singapore"), "2026-08-05 13:13:00");
+});
+
+test("the default zone is Singapore, and an unknown zone falls back to it", () => {
+  assert.equal(dahuaWallClock("2026-08-05T05:13:00Z"), "2026-08-05 13:13:00");
+  assert.equal(dahuaWallClock("2026-08-05T05:13:00Z", "Not/AZone"), "2026-08-05 13:13:00");
+  assert.equal(dahuaWallClock("2026-08-05T05:13:00Z", "Asia/Kuala_Lumpur"), "2026-08-05 13:13:00");
+  assert.equal(dahuaWallClock("2026-08-05T05:13:00Z", "UTC"), "2026-08-05 05:13:00");
+});
+
+test("a time already written for the camera is kept as it is", () => {
+  assert.equal(dahuaWallClock("2026-08-05 13:13:00", "UTC"), "2026-08-05 13:13:00");
+  assert.equal(dahuaWallClock("2026-08-05 13:13", "UTC"), "2026-08-05 13:13:00");
+});
+
+test("midnight is 00, never 24", () => {
+  assert.equal(dahuaWallClock("2026-08-04T16:00:00Z", "Asia/Singapore"), "2026-08-05 00:00:00");
+});
+
+test("nothing, or nonsense, is no time at all", () => {
+  assert.equal(dahuaWallClock(""), null);
+  assert.equal(dahuaWallClock(null), null);
+  assert.equal(dahuaWallClock("not a date"), null);
+});
+
+test("a camera record's window is read, and compared on the camera's clock", () => {
+  const text =
+    "found=1\r\nrecords[0].RecNo=7\r\nrecords[0].PlateNumber=TEST123\r\n" +
+    "records[0].BeginTime=2026-08-05 13:13:00\r\nrecords[0].CancelTime=2036-08-05 13:13:00\r\n" +
+    "records[0].MasterOfCar=Test Res 3\r\n";
+  const [record] = parseDahuaFindRecords(text).records;
+  assert.equal(record.beginTime, "2026-08-05 13:13:00");
+  assert.equal(record.cancelTime, "2036-08-05 13:13:00");
+  assert.equal(record.owner, "Test Res 3");
+
+  assert.ok(plateWindowMatches(record, { start: "2026-08-05 13:13:00", end: "2036-08-05 13:13:00" }));
+  // A plate left on for ten years does not match a season pass window.
+  assert.ok(!plateWindowMatches(record, { start: "2026-08-05 13:13:00", end: "2026-09-05 13:13:00" }));
+  // A camera that does not echo its times is never trusted.
+  assert.ok(!plateWindowMatches({ recNo: "7", plateNumber: "TEST123" }, { start: "2026-08-05 13:13:00", end: "2036-08-05 13:13:00" }));
+});
+
+test("an allowed plate is revoked from Entry, Both and Residents only", () => {
+  for (const d of ["entry", "both", "residents", " Entry "]) {
+    assert.ok(mustRevokeFrom(d, "allowed"), d);
+    assert.ok(mustRevokeFrom(d, "allowed", true), d);
+  }
+  for (const d of ["visitors", "exit", " Exit "]) {
+    assert.ok(!mustRevokeFrom(d, "allowed"), d);
+    assert.ok(!mustRevokeFrom(d, "allowed", true), d);
+  }
+});
+
+test("a blocked plate is revoked from every camera but Exit; Exit only when unblocking", () => {
+  for (const d of ["entry", "both", "residents", "visitors"]) {
+    assert.ok(mustRevokeFrom(d, "blocked"), d);
+  }
+  assert.ok(!mustRevokeFrom("exit", "blocked"), "deleting an ordinary vehicle");
+  assert.ok(mustRevokeFrom("exit", "blocked", true), "unblocking");
+});

package/test/dahua-protocol.util.test.mjs

@@ -5,13 +5,19 @@ import {
   DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT,
   DAHUA_LOCK_CHECK_DURATION_SEC,
   DAHUA_LOCK_LOGIN_TIMES,
+  DAHUA_COMMAND_ATTEMPTS,
+  DAHUA_COMMAND_DEADLINE_MS,
+  buildPlateClearEndpoint,
   buildPlateInsertEndpoint,
   buildPlateRemoveEndpoint,
   buildPlateUpdateEndpoint,
+  classifyDahuaAttempt,
   classifyDahuaFailure,
   classifyDahuaStatus,
   dahuaAuthBackoffMs,
+  dahuaCommandRetryDelayMs,
   maxAuthAttemptsPerLockWindow,
+  shouldRetryDahuaCommand,
 } from "./.build/utils/dahua-protocol.util.mjs";
 
 /* --------------------------------------------------------------------------
@@ -178,6 +184,24 @@ test("remove encodes its identifiers too", () => {
   );
 });
 
+test("clearing a plate list is one command, for that list only", () => {
+  assert.equal(
+    buildPlateClearEndpoint({ mode: "TrafficRedList" }),
+    "/cgi-bin/recordUpdater.cgi?action=clear&name=TrafficRedList",
+  );
+  assert.equal(
+    buildPlateClearEndpoint({ mode: "TrafficBlackList" }),
+    "/cgi-bin/recordUpdater.cgi?action=clear&name=TrafficBlackList",
+  );
+});
+
+test("nothing but the two plate lists can ever be cleared", () => {
+  // The same CGI empties ANY record set on the device - access cards included.
+  for (const mode of ["AccessControlCard", "", "TrafficRedList&name=AccessControlCard"]) {
+    assert.throws(() => buildPlateClearEndpoint({ mode }), /Refusing to clear/);
+  }
+});
+
 /* --------------------------------------------------------------------------
  * 4. Regression guard: `+OpenGate` is deliberately untouched.
  *
@@ -215,3 +239,116 @@ test("an absent optional field still renders as it did before", () => {
   assert.ok(url.includes("BeginTime=undefined"));
   assert.ok(url.includes("CancelTime=undefined"));
 });
+
+/* --------------------------------------------------------------------------
+ * 1b. Retrying one plate command (find, add, update, remove, clear).
+ * ------------------------------------------------------------------------ */
+
+/** Replays a command whose every try comes to `kind`; returns tries made. */
+function triesUntilGivingUp(kind, { loginProven = false, repeatable = true } = {}) {
+  let elapsedMs = 0;
+  let loginFailures = 0;
+  for (let attempt = 1; ; attempt++) {
+    if (kind === "login-refused") loginFailures++;
+    const nextDelayMs = dahuaCommandRetryDelayMs(attempt);
+    const retry = shouldRetryDahuaCommand({
+      kind,
+      attempt,
+      loginFailures,
+      loginProven,
+      repeatable,
+      elapsedMs,
+      nextDelayMs,
+    });
+    if (!retry) return attempt;
+    elapsedMs += nextDelayMs + 100; // the try itself
+  }
+}
+
+test("a refused login is tried ten times when these credentials just worked", () => {
+  assert.equal(DAHUA_COMMAND_ATTEMPTS, 10);
+  assert.equal(triesUntilGivingUp("login-refused", { loginProven: true }), 10);
+});
+
+test("a login that never worked stays below the device's lockout", () => {
+  const tries = triesUntilGivingUp("login-refused", { loginProven: false });
+  assert.equal(tries, DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT);
+  assert.ok(tries < DAHUA_LOCK_LOGIN_TIMES);
+});
+
+test("a 403 is never retried", () => {
+  assert.equal(triesUntilGivingUp("forbidden", { loginProven: true }), 1);
+});
+
+test("a camera that could not be reached or was busy gets ten tries", () => {
+  assert.equal(triesUntilGivingUp("not-sent"), 10);
+  assert.equal(triesUntilGivingUp("busy"), 10);
+});
+
+test("an insert that may have landed is not sent again blindly", () => {
+  assert.equal(triesUntilGivingUp("maybe-sent", { repeatable: false }), 1);
+  assert.equal(triesUntilGivingUp("maybe-sent", { repeatable: true }), 10);
+});
+
+test("all ten tries' pauses fit inside the deadline", () => {
+  let pauses = 0;
+  for (let attempt = 1; attempt < DAHUA_COMMAND_ATTEMPTS; attempt++) {
+    pauses += dahuaCommandRetryDelayMs(attempt);
+  }
+  assert.ok(pauses < DAHUA_COMMAND_DEADLINE_MS, `${pauses} ms of pauses`);
+  assert.deepEqual(
+    [1, 2, 3, 4, 5, 6, 9].map(dahuaCommandRetryDelayMs),
+    [1000, 2000, 3000, 4000, 5000, 5000, 5000],
+  );
+});
+
+test("a command that has run past its deadline is not retried", () => {
+  assert.equal(
+    shouldRetryDahuaCommand({
+      kind: "not-sent",
+      attempt: 2,
+      loginFailures: 0,
+      loginProven: true,
+      repeatable: true,
+      elapsedMs: DAHUA_COMMAND_DEADLINE_MS - 500,
+      nextDelayMs: 1000,
+    }),
+    false,
+  );
+});
+
+test("each try is read for what it came to", () => {
+  assert.equal(classifyDahuaAttempt({ statusCode: 200, text: "OK" }), "answered");
+  // A duplicate plate is an answer, not a failure to retry.
+  assert.equal(classifyDahuaAttempt({ statusCode: 400, text: "Error" }), "answered");
+  assert.equal(classifyDahuaAttempt({ statusCode: 401, text: "" }), "login-refused");
+  assert.equal(
+    classifyDahuaAttempt({ statusCode: 200, text: "Error\r\nInvalid Authority!" }),
+    "login-refused",
+  );
+  assert.equal(classifyDahuaAttempt({ statusCode: 403 }), "forbidden");
+  assert.equal(classifyDahuaAttempt({ statusCode: 503 }), "busy");
+  assert.equal(classifyDahuaAttempt({}), "maybe-sent");
+
+  const refused = Object.assign(new Error("connect ECONNREFUSED 10.0.0.9:80"), {
+    code: "ECONNREFUSED",
+  });
+  assert.equal(classifyDahuaAttempt({ error: refused }), "not-sent");
+  assert.equal(
+    classifyDahuaAttempt({ error: { name: "HttpClientConnectTimeoutError", message: "Connect timeout for 10000ms" } }),
+    "not-sent",
+  );
+  assert.equal(
+    classifyDahuaAttempt({ error: Object.assign(new Error("other side closed"), { code: "ECONNRESET" }) }),
+    "maybe-sent",
+  );
+  assert.equal(
+    classifyDahuaAttempt({ error: new Error("Request timeout for 10000 ms") }),
+    "maybe-sent",
+  );
+  // A port number that contains 401 is not a refused login.
+  assert.equal(
+    classifyDahuaAttempt({ error: new Error("connect EHOSTUNREACH 10.0.0.9:8401") }),
+    "not-sent",
+  );
+});

package/test/member-duplicate-error.test.mjs

@@ -0,0 +1,30 @@
+/*
+ * A duplicate membership must read as "already a member" (400), not a 500.
+ *
+ * The live unique index on `members` is `org_1_siteId_1_user_1_type_1`; the old
+ * check only recognised a message naming `org_1_user_1`, so every real duplicate
+ * fell through as a raw MongoServerError.
+ */
+import { strict as assert } from "node:assert";
+import test from "node:test";
+
+import { isDuplicateMemberError } from "./.build/models/member.model.mjs";
+
+test("the live unique index's duplicate is recognised", () => {
+  const err = Object.assign(
+    new Error(
+      'E11000 duplicate key error collection: iservice365.members index: org_1_siteId_1_user_1_type_1 dup key: { org: ObjectId("6a951ce603be44033d434f68") }',
+    ),
+    { code: 11000 },
+  );
+  assert.equal(isDuplicateMemberError(err), true);
+});
+
+test("a duplicate is recognised by code alone", () => {
+  assert.equal(isDuplicateMemberError({ code: 11000, message: "" }), true);
+});
+
+test("other errors are left alone", () => {
+  assert.equal(isDuplicateMemberError(new Error("connection reset")), false);
+  assert.equal(isDuplicateMemberError(undefined), false);
+});

package/test/people-create-gate.test.mjs

@@ -0,0 +1,71 @@
+/*
+ * POST /api/people creates a `site.people` row — and, where the body carries an
+ * e-mail, a password and a resident/tenant type, a USER ACCOUNT and an active
+ * membership too. The site and organisation come from the request body, and the
+ * signed-in branch checked only that somebody was signed in.
+ *
+ * `site.people` is the collection every site-reach decision reads its verdict
+ * from, so a row written there manufactures reach into another client's estate.
+ *
+ * This gate ships SWITCHED OFF (`log`): it records what it would refuse and
+ * refuses nothing, because a person row carries no `createdBy` and the real
+ * refusal count is only knowable from live traffic. These tests pin that
+ * default, so it cannot become enforcing by accident.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  PEOPLE_CREATE_REACH_MODE_DEFAULT,
+  peopleCreateReachMode,
+  peopleCreateVerdict,
+} from "./.build/utils/people-create-gate.util.mjs";
+
+test("the code default is LOG - it must not ship refusing anybody", () => {
+  assert.equal(PEOPLE_CREATE_REACH_MODE_DEFAULT, "log");
+  assert.equal(peopleCreateReachMode({}), "log");
+  // An unrecognised value falls back to the safe default rather than enforcing.
+  assert.equal(peopleCreateReachMode({ PEOPLE_CREATE_REACH_MODE: "nonsense" }), "log");
+  assert.equal(peopleCreateReachMode({ PEOPLE_CREATE_REACH_MODE: "ENFORCE" }), "enforce");
+  assert.equal(peopleCreateReachMode({ PEOPLE_CREATE_REACH_MODE: "off" }), "off");
+});
+
+test("a caller who reaches the estate is never refused, in any mode", () => {
+  for (const mode of ["log", "enforce", "off"]) {
+    assert.deepEqual(
+      peopleCreateVerdict({ mode, reachable: true }),
+      { refuse: false, record: false },
+      mode,
+    );
+  }
+});
+
+test("LOG records the cross-client creation and still allows it", () => {
+  // This is the whole shape of the ship: measured, not refused.
+  assert.deepEqual(peopleCreateVerdict({ mode: "log", reachable: false }), {
+    refuse: false,
+    record: true,
+  });
+});
+
+test("ENFORCE refuses a caller creating a person in an estate that is not theirs", () => {
+  assert.deepEqual(peopleCreateVerdict({ mode: "enforce", reachable: false }), {
+    refuse: true,
+    record: true,
+  });
+});
+
+test("OFF does not even look", () => {
+  assert.deepEqual(peopleCreateVerdict({ mode: "off", reachable: false }), {
+    refuse: false,
+    record: false,
+  });
+});
+
+test("the flag is the only thing between counting and refusing", () => {
+  // If this ever fails, the default has been changed and people who can create
+  // a person today may stop being able to - which is the RP-5 line.
+  const unreachable = { reachable: false };
+  assert.equal(peopleCreateVerdict({ mode: peopleCreateReachMode({}), ...unreachable }).refuse, false);
+  assert.equal(peopleCreateVerdict({ mode: "enforce", ...unreachable }).refuse, true);
+});