@7365admin1/core 3.72.1-staging.325 → 3.72.1-staging.326

package/dist/index.d.ts

@@ -13592,7 +13592,9 @@ declare function useHidAmicoService(): {
         hasMore: boolean;
         pageRange: string;
     }>;
-    createIdentity: (readerId: string, value: Partial<THidAmicoIdentity>) => Promise<{
+    createIdentity: (readerId: string, value: Partial<THidAmicoIdentity> & {
+        orgId?: string;
+    }) => Promise<{
         _id: bson.ObjectId;
         reader: bson.ObjectId;
         site: bson.ObjectId;

package/dist/index.js

@@ -44051,6 +44051,15 @@ var schemaHidAmicoIdentity = import_joi66.default.object({
 }).or("hidUserId", "registration", "cardNo");
 var schemaCreateHidAmicoIdentity = import_joi66.default.object({
   site: objectIdSchema2.optional(),
+  /*
+   * Which organisation's HID permission document this enrolment's access grant
+   * belongs in. Optional so existing callers keep working - the service falls
+   * back to the site's own organisation - but a managing agent should send its
+   * own org, because a site reached through `customer.sites` would otherwise
+   * get a second document and the permissions screen would show the person as
+   * unassigned while the door let them through.
+   */
+  orgId: objectIdSchema2.optional(),
   hidUserId: import_joi66.default.alternatives(import_joi66.default.string(), import_joi66.default.number()).optional().allow(null, ""),
   registration: import_joi66.default.string().trim().optional().allow(""),
   cardNo: import_joi66.default.string().optional().allow(null, ""),
@@ -45811,6 +45820,27 @@ function resolveHidPhysicalCardValue(input) {
   return normalizeHidCardValue(input.cardValue);
 }
 
+// src/utils/hid-assignment.util.ts
+function permissionSubjectOfIdentity(value) {
+  if (value.person) {
+    return { subjectId: String(value.person), category: "resident" };
+  }
+  if (value.member) {
+    return { subjectId: String(value.member), category: "property_management" };
+  }
+  if (value.serviceProvider) {
+    return { subjectId: String(value.serviceProvider), category: "service_provider" };
+  }
+  return null;
+}
+function assignmentNamesSubject(item, subject, scope) {
+  if (String(item.subjectId ?? "") !== subject.subjectId)
+    return false;
+  if (item.category !== subject.category)
+    return false;
+  return item.readerId ? String(item.readerId) === scope.readerId : item.locationKey === scope.locationKey;
+}
+
 // src/utils/hid-json.util.ts
 var import_node_crypto5 = __toESM(require("crypto"));
 var UINT64_MAX = 2n ** 64n - 1n;
@@ -48584,6 +48614,71 @@ function useHidAmicoService() {
       await client.logout();
     }
   }
+  async function resolvePermissionOrgId(reader, requested) {
+    if (requested)
+      return String(requested);
+    const site = await siteRepo.getSiteById(String(reader.site));
+    const orgId = String(site?.org ?? "");
+    if (!orgId) {
+      throw new import_node_server_utils141.BadRequestError("This site has no organisation, so HID access cannot be granted.");
+    }
+    return orgId;
+  }
+  async function addEnrolmentAssignment(reader, orgId, subject) {
+    const siteId = String(reader.site);
+    const readerId = String(reader._id);
+    const scope = await getPermissionScope(orgId, siteId, readerId);
+    const current = await repo.getSitePermissions(orgId, siteId);
+    const assignments = current.assignments ?? [];
+    if (assignments.some((item) => assignmentNamesSubject(item, subject, scope))) {
+      return null;
+    }
+    const [resolved] = await repo.resolvePermissionAssignments(siteId, [
+      { ...subject, intercom: false }
+    ]);
+    if (!resolved) {
+      throw new import_node_server_utils141.BadRequestError("This person cannot be granted access at this site.");
+    }
+    const next = [...assignments, {
+      ...resolved,
+      readerId: scope.readerId,
+      location: scope.location,
+      locationKey: scope.locationKey
+    }];
+    await repo.saveSitePermissions(orgId, siteId, next);
+    return async () => {
+      await repo.saveSitePermissions(orgId, siteId, assignments);
+    };
+  }
+  async function removeEnrolmentAssignment(reader, subject) {
+    const siteId = String(reader.site);
+    const readerId = String(reader._id);
+    const scope = {
+      readerId,
+      locationKey: normalizePermissionLocation(String(reader.location ?? ""))
+    };
+    const documents = await repo.listSitePermissionDocuments(siteId);
+    const undos = [];
+    for (const document2 of documents) {
+      const assignments = document2.assignments ?? [];
+      const next = assignments.filter((item) => !assignmentNamesSubject(item, subject, scope));
+      if (next.length === assignments.length)
+        continue;
+      const orgId = String(document2.orgId ?? "");
+      if (!orgId)
+        continue;
+      await repo.saveSitePermissions(orgId, siteId, next);
+      undos.push(async () => {
+        await repo.saveSitePermissions(orgId, siteId, assignments);
+      });
+    }
+    if (!undos.length)
+      return null;
+    return async () => {
+      for (const undo of undos)
+        await undo();
+    };
+  }
   async function resolveSubjectUser(site, value) {
     const subject = value.person ? { subjectId: String(value.person), category: "resident" } : value.member ? { subjectId: String(value.member), category: "property_management" } : value.serviceProvider ? { subjectId: String(value.serviceProvider), category: "service_provider" } : null;
     if (!subject) {
@@ -48615,6 +48710,7 @@ function useHidAmicoService() {
     );
   }
   async function createIdentity(readerId, value) {
+    const { orgId: requestedOrgId, ...identityValue } = value;
     const reader = await repo.getById(readerId);
     const linkedSubjects = [value.person, value.member, value.serviceProvider, value.visitor].filter(Boolean);
     if (linkedSubjects.length !== 1) {
@@ -48635,7 +48731,7 @@ function useHidAmicoService() {
     const subjectUser = await resolveSubjectUser(String(reader.site), value);
     await assertSubjectNotEnrolled(readerId, value, subjectUser);
     const identity = await repo.addIdentity({
-      ...value,
+      ...identityValue,
       // Stored, not derived on read. It is how this row is recognised as the
       // same human as one written by a different screen, and a `site.people`
       // row can be re-pointed at another account after the fact.
@@ -48643,9 +48739,17 @@ function useHidAmicoService() {
       reader: readerId,
       site: value.site || reader?.site?.toString()
     });
+    let undoAssignment = null;
     try {
+      const subject = permissionSubjectOfIdentity(identityValue);
+      if (subject) {
+        const orgId = await resolvePermissionOrgId(reader, requestedOrgId);
+        undoAssignment = await addEnrolmentAssignment(reader, orgId, subject);
+      }
       await reconcileStoredReaderPermissions(readerId);
     } catch (error) {
+      if (undoAssignment)
+        await undoAssignment();
       await repo.deleteIdentity(identity._id);
       throw error;
     }
@@ -48706,9 +48810,17 @@ function useHidAmicoService() {
   async function deleteIdentity(identityId) {
     const current = await repo.getIdentityById(identityId);
     const identity = await repo.deleteIdentity(identityId);
+    let undoAssignment = null;
     try {
+      const subject = permissionSubjectOfIdentity(current);
+      if (subject) {
+        const reader = await repo.getById(String(current.reader));
+        undoAssignment = await removeEnrolmentAssignment(reader, subject);
+      }
       await reconcileStoredReaderPermissions(String(current.reader));
     } catch (error) {
+      if (undoAssignment)
+        await undoAssignment();
       await repo.updateIdentity(identityId, { status: current.status || "active", deletedAt: "" });
       throw error;
     }