@7365admin1/core 3.72.1-staging.325 → 3.72.1-staging.327

package/.changeset/inventory-notification-category.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Add the `inventory` notification category (in-app and push), offered to roles holding any `inventory:*` permission, for API-core's inventory alerts: a request waiting for approval, a decided request, and low stock.

package/dist/index.d.ts

@@ -10567,12 +10567,12 @@ declare function useNewDashboardRepo(): {
             percentage: number | null;
         };
         supplyAlert: {
+            thresholdUnavailableReason?: string | undefined;
             items: {
                 name: any;
                 qty: any;
             }[];
-            basis: "lowest-quantity";
-            thresholdUnavailableReason: string;
+            basis: "lowest-quantity" | "below-alert-level";
         };
         taskCompleted: {
             completed: any;
@@ -13592,7 +13592,9 @@ declare function useHidAmicoService(): {
         hasMore: boolean;
         pageRange: string;
     }>;
-    createIdentity: (readerId: string, value: Partial<THidAmicoIdentity>) => Promise<{
+    createIdentity: (readerId: string, value: Partial<THidAmicoIdentity> & {
+        orgId?: string;
+    }) => Promise<{
         _id: bson.ObjectId;
         reader: bson.ObjectId;
         site: bson.ObjectId;

package/dist/index.js

@@ -9680,6 +9680,20 @@ var NOTIFICATION_CATEGORIES = [
     vendorDefault: true,
     rendered: true
   },
+  // Inventory (2026-09-17). Sent from `iservice365-API-core`'s inventory
+  // module: a stock request waiting for approval and stock falling to its alert
+  // level go to that store's staff; a decided request goes to the person who
+  // asked. The caller checks `rendered` before it sends, so the sender and this
+  // switch cannot land out of order.
+  {
+    key: "inventory",
+    label: "Inventory",
+    description: "When a stock request needs your approval or has been decided, or stock you look after runs low.",
+    channels: { inApp: true, push: true, email: false },
+    channelNote: { email: NO_EMAIL_RECIPIENT },
+    permissionResources: ["inventory"],
+    rendered: true
+  },
   {
     key: "serviceProviderInvite",
     label: "Service Provider Invitations",
@@ -44051,6 +44065,15 @@ var schemaHidAmicoIdentity = import_joi66.default.object({
 }).or("hidUserId", "registration", "cardNo");
 var schemaCreateHidAmicoIdentity = import_joi66.default.object({
   site: objectIdSchema2.optional(),
+  /*
+   * Which organisation's HID permission document this enrolment's access grant
+   * belongs in. Optional so existing callers keep working - the service falls
+   * back to the site's own organisation - but a managing agent should send its
+   * own org, because a site reached through `customer.sites` would otherwise
+   * get a second document and the permissions screen would show the person as
+   * unassigned while the door let them through.
+   */
+  orgId: objectIdSchema2.optional(),
   hidUserId: import_joi66.default.alternatives(import_joi66.default.string(), import_joi66.default.number()).optional().allow(null, ""),
   registration: import_joi66.default.string().trim().optional().allow(""),
   cardNo: import_joi66.default.string().optional().allow(null, ""),
@@ -45811,6 +45834,27 @@ function resolveHidPhysicalCardValue(input) {
   return normalizeHidCardValue(input.cardValue);
 }
 
+// src/utils/hid-assignment.util.ts
+function permissionSubjectOfIdentity(value) {
+  if (value.person) {
+    return { subjectId: String(value.person), category: "resident" };
+  }
+  if (value.member) {
+    return { subjectId: String(value.member), category: "property_management" };
+  }
+  if (value.serviceProvider) {
+    return { subjectId: String(value.serviceProvider), category: "service_provider" };
+  }
+  return null;
+}
+function assignmentNamesSubject(item, subject, scope) {
+  if (String(item.subjectId ?? "") !== subject.subjectId)
+    return false;
+  if (item.category !== subject.category)
+    return false;
+  return item.readerId ? String(item.readerId) === scope.readerId : item.locationKey === scope.locationKey;
+}
+
 // src/utils/hid-json.util.ts
 var import_node_crypto5 = __toESM(require("crypto"));
 var UINT64_MAX = 2n ** 64n - 1n;
@@ -48584,6 +48628,71 @@ function useHidAmicoService() {
       await client.logout();
     }
   }
+  async function resolvePermissionOrgId(reader, requested) {
+    if (requested)
+      return String(requested);
+    const site = await siteRepo.getSiteById(String(reader.site));
+    const orgId = String(site?.org ?? "");
+    if (!orgId) {
+      throw new import_node_server_utils141.BadRequestError("This site has no organisation, so HID access cannot be granted.");
+    }
+    return orgId;
+  }
+  async function addEnrolmentAssignment(reader, orgId, subject) {
+    const siteId = String(reader.site);
+    const readerId = String(reader._id);
+    const scope = await getPermissionScope(orgId, siteId, readerId);
+    const current = await repo.getSitePermissions(orgId, siteId);
+    const assignments = current.assignments ?? [];
+    if (assignments.some((item) => assignmentNamesSubject(item, subject, scope))) {
+      return null;
+    }
+    const [resolved] = await repo.resolvePermissionAssignments(siteId, [
+      { ...subject, intercom: false }
+    ]);
+    if (!resolved) {
+      throw new import_node_server_utils141.BadRequestError("This person cannot be granted access at this site.");
+    }
+    const next = [...assignments, {
+      ...resolved,
+      readerId: scope.readerId,
+      location: scope.location,
+      locationKey: scope.locationKey
+    }];
+    await repo.saveSitePermissions(orgId, siteId, next);
+    return async () => {
+      await repo.saveSitePermissions(orgId, siteId, assignments);
+    };
+  }
+  async function removeEnrolmentAssignment(reader, subject) {
+    const siteId = String(reader.site);
+    const readerId = String(reader._id);
+    const scope = {
+      readerId,
+      locationKey: normalizePermissionLocation(String(reader.location ?? ""))
+    };
+    const documents = await repo.listSitePermissionDocuments(siteId);
+    const undos = [];
+    for (const document2 of documents) {
+      const assignments = document2.assignments ?? [];
+      const next = assignments.filter((item) => !assignmentNamesSubject(item, subject, scope));
+      if (next.length === assignments.length)
+        continue;
+      const orgId = String(document2.orgId ?? "");
+      if (!orgId)
+        continue;
+      await repo.saveSitePermissions(orgId, siteId, next);
+      undos.push(async () => {
+        await repo.saveSitePermissions(orgId, siteId, assignments);
+      });
+    }
+    if (!undos.length)
+      return null;
+    return async () => {
+      for (const undo of undos)
+        await undo();
+    };
+  }
   async function resolveSubjectUser(site, value) {
     const subject = value.person ? { subjectId: String(value.person), category: "resident" } : value.member ? { subjectId: String(value.member), category: "property_management" } : value.serviceProvider ? { subjectId: String(value.serviceProvider), category: "service_provider" } : null;
     if (!subject) {
@@ -48615,6 +48724,7 @@ function useHidAmicoService() {
     );
   }
   async function createIdentity(readerId, value) {
+    const { orgId: requestedOrgId, ...identityValue } = value;
     const reader = await repo.getById(readerId);
     const linkedSubjects = [value.person, value.member, value.serviceProvider, value.visitor].filter(Boolean);
     if (linkedSubjects.length !== 1) {
@@ -48635,7 +48745,7 @@ function useHidAmicoService() {
     const subjectUser = await resolveSubjectUser(String(reader.site), value);
     await assertSubjectNotEnrolled(readerId, value, subjectUser);
     const identity = await repo.addIdentity({
-      ...value,
+      ...identityValue,
       // Stored, not derived on read. It is how this row is recognised as the
       // same human as one written by a different screen, and a `site.people`
       // row can be re-pointed at another account after the fact.
@@ -48643,9 +48753,17 @@ function useHidAmicoService() {
       reader: readerId,
       site: value.site || reader?.site?.toString()
     });
+    let undoAssignment = null;
     try {
+      const subject = permissionSubjectOfIdentity(identityValue);
+      if (subject) {
+        const orgId = await resolvePermissionOrgId(reader, requestedOrgId);
+        undoAssignment = await addEnrolmentAssignment(reader, orgId, subject);
+      }
       await reconcileStoredReaderPermissions(readerId);
     } catch (error) {
+      if (undoAssignment)
+        await undoAssignment();
       await repo.deleteIdentity(identity._id);
       throw error;
     }
@@ -48706,9 +48824,17 @@ function useHidAmicoService() {
   async function deleteIdentity(identityId) {
     const current = await repo.getIdentityById(identityId);
     const identity = await repo.deleteIdentity(identityId);
+    let undoAssignment = null;
     try {
+      const subject = permissionSubjectOfIdentity(current);
+      if (subject) {
+        const reader = await repo.getById(String(current.reader));
+        undoAssignment = await removeEnrolmentAssignment(reader, subject);
+      }
       await reconcileStoredReaderPermissions(String(current.reader));
     } catch (error) {
+      if (undoAssignment)
+        await undoAssignment();
       await repo.updateIdentity(identityId, { status: current.status || "active", deletedAt: "" });
       throw error;
     }
@@ -77712,6 +77838,7 @@ function highSeverityIncidentCount(severities) {
   ).length;
 }
 var SUPPLY_BASIS_LOWEST_QUANTITY = "lowest-quantity";
+var SUPPLY_BASIS_BELOW_ALERT_LEVEL = "below-alert-level";
 var SUPPLY_THRESHOLD_NOT_IN_MODEL = "Supplies do not record a stock threshold, so these are the lowest-quantity items rather than items below a level.";
 
 // src/repositories/new-dashboard.repo.ts
@@ -78570,6 +78697,32 @@ function useNewDashboardRepo() {
       { $unwind: { path: "$scheduleDoc", preserveNullAndEmptyArrays: false } }
     ];
   }
+  async function lowStockItems(site, serviceType) {
+    const stores = await db2.collection("inventory.stores").find({ sites: site, status: "active" }, { projection: { _id: 1 } }).toArray();
+    if (stores.length) {
+      const items2 = await db2.collection("inventory.items").aggregate([
+        {
+          $match: {
+            store: { $in: stores.map((store) => store._id) },
+            status: "active",
+            reorderLevel: { $gt: 0 },
+            $expr: { $lte: ["$onHand", "$reorderLevel"] }
+          }
+        },
+        { $sort: { onHand: 1 } },
+        { $limit: 5 },
+        { $project: { _id: 1, name: 1, qty: "$onHand" } }
+      ]).toArray();
+      return { items: items2, basis: SUPPLY_BASIS_BELOW_ALERT_LEVEL };
+    }
+    const items = await supplyCollection.aggregate([
+      { $match: { site, serviceType, status: "active" } },
+      { $sort: { qty: 1 } },
+      { $limit: 3 },
+      { $project: { _id: 1, name: 1, qty: 1 } }
+    ]).toArray();
+    return { items, basis: SUPPLY_BASIS_LOWEST_QUANTITY };
+  }
   async function getServiceDashboard({
     site,
     serviceType,
@@ -78627,12 +78780,7 @@ function useNewDashboardRepo() {
             }
           }
         ]).toArray(),
-        supplyCollection.aggregate([
-          { $match: { site, serviceType, status: "active" } },
-          { $sort: { qty: 1 } },
-          { $limit: 3 },
-          { $project: { _id: 1, name: 1, qty: 1 } }
-        ]).toArray(),
+        lowStockItems(site, serviceType),
         areaChecklistCollection.aggregate([
           ...areaChecklistScheduleLookup(site, serviceType, periodRange),
           {
@@ -78694,7 +78842,7 @@ function useNewDashboardRepo() {
           )
         },
         supplyAlert: {
-          items: supplyAlertReport.map((item) => ({
+          items: supplyAlertReport.items.map((item) => ({
             name: item.name,
             qty: item.qty
           })),
@@ -78702,8 +78850,8 @@ function useNewDashboardRepo() {
           // with no threshold, because `site.supplies` records no stock level to
           // compare against. Naming the ordering stops 900 gloves being drawn as
           // a warning. No threshold is invented here.
-          basis: SUPPLY_BASIS_LOWEST_QUANTITY,
-          thresholdUnavailableReason: SUPPLY_THRESHOLD_NOT_IN_MODEL
+          basis: supplyAlertReport.basis,
+          ...supplyAlertReport.basis === SUPPLY_BASIS_LOWEST_QUANTITY ? { thresholdUnavailableReason: SUPPLY_THRESHOLD_NOT_IN_MODEL } : {}
         },
         taskCompleted: {
           completed: tFacet.completed[0]?.count ?? 0,