@7365admin1/core 3.72.1-staging.326 → 3.72.1-staging.328

package/.changeset/inventory-notification-category.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Add the `inventory` notification category (in-app and push), offered to roles holding any `inventory:*` permission, for API-core's inventory alerts: a request waiting for approval, a decided request, and low stock.

package/dist/index.d.ts

@@ -10567,12 +10567,12 @@ declare function useNewDashboardRepo(): {
             percentage: number | null;
         };
         supplyAlert: {
+            thresholdUnavailableReason?: string | undefined;
             items: {
                 name: any;
                 qty: any;
             }[];
-            basis: "lowest-quantity";
-            thresholdUnavailableReason: string;
+            basis: "lowest-quantity" | "below-alert-level";
         };
         taskCompleted: {
             completed: any;
@@ -13237,6 +13237,8 @@ declare function useHidAmicoRepo(): {
     findIdentitiesByHidUserIds: (reader: string | ObjectId, hidUserIds: Array<string | number>) => Promise<mongodb.WithId<bson.Document>[]>;
     acquireEnrollmentLock: (reader: string | ObjectId, owner: string, ttlSeconds: number) => Promise<boolean>;
     releaseEnrollmentLock: (reader: string | ObjectId, owner?: string) => Promise<boolean>;
+    setEnrollmentSession: (reader: string | ObjectId, owner: string, session: string) => Promise<boolean>;
+    getEnrollmentSession: (reader: string | ObjectId) => Promise<string>;
     assertOrganizationSiteAccess: (site: string | ObjectId, org: string | ObjectId) => Promise<{
         siteId: ObjectId;
         orgId: ObjectId;

package/dist/index.js

@@ -9680,6 +9680,20 @@ var NOTIFICATION_CATEGORIES = [
     vendorDefault: true,
     rendered: true
   },
+  // Inventory (2026-09-17). Sent from `iservice365-API-core`'s inventory
+  // module: a stock request waiting for approval and stock falling to its alert
+  // level go to that store's staff; a decided request goes to the person who
+  // asked. The caller checks `rendered` before it sends, so the sender and this
+  // switch cannot land out of order.
+  {
+    key: "inventory",
+    label: "Inventory",
+    description: "When a stock request needs your approval or has been decided, or stock you look after runs low.",
+    channels: { inApp: true, push: true, email: false },
+    channelNote: { email: NO_EMAIL_RECIPIENT },
+    permissionResources: ["inventory"],
+    rendered: true
+  },
   {
     key: "serviceProviderInvite",
     label: "Service Provider Invitations",
@@ -45115,6 +45129,20 @@ function useHidAmicoRepo() {
       throw error;
     }
   }
+  async function setEnrollmentSession(reader, owner, session) {
+    const result = await enrollmentLocks().updateOne(
+      { _id: toId3(reader, "reader ID"), owner },
+      { $set: { session, sessionAt: /* @__PURE__ */ new Date() } }
+    );
+    return result.matchedCount > 0;
+  }
+  async function getEnrollmentSession(reader) {
+    const lock = await enrollmentLocks().findOne({
+      _id: toId3(reader, "reader ID"),
+      expiresAt: { $gt: /* @__PURE__ */ new Date() }
+    });
+    return String(lock?.session ?? "");
+  }
   async function releaseEnrollmentLock(reader, owner) {
     const result = await enrollmentLocks().deleteOne({
       _id: toId3(reader, "reader ID"),
@@ -45673,6 +45701,8 @@ function useHidAmicoRepo() {
     findIdentitiesByHidUserIds,
     acquireEnrollmentLock,
     releaseEnrollmentLock,
+    setEnrollmentSession,
+    getEnrollmentSession,
     assertOrganizationSiteAccess,
     getSitePermissions,
     listSitePermissionDocuments,
@@ -46921,6 +46951,8 @@ var HidAmicoClient = class {
   constructor(reader) {
     this.reader = reader;
     this.session = "";
+    /** True while `session` belongs to another request. See `adoptSession`. */
+    this.borrowedSession = false;
     const relayAuth = getRelayAuth();
     this.http = import_axios.default.create({
       baseURL: normalizeHidReaderBaseUrl(reader.baseUrl),
@@ -46980,6 +47012,7 @@ var HidAmicoClient = class {
       throw new import_node_server_utils141.BadRequestError("HID Amico login failed: missing session.");
     }
     this.session = res.data.session;
+    this.borrowedSession = false;
     return this.session;
   }
   async sessionIsValid() {
@@ -47132,10 +47165,34 @@ var HidAmicoClient = class {
       verified: true
     };
   }
+  /**
+   * Take over a session somebody else opened, without logging in.
+   *
+   * For the cancel path only. While an enrolment is listening the reader will
+   * not serve a second `hidlogin.fcgi` inside the client's 15 second timeout, so
+   * the cancel has to ride the enrolment's session or it never reaches the
+   * device at all.
+   *
+   * A borrowed session is NOT this client's to close - see `logout`.
+   */
+  adoptSession(session) {
+    this.session = String(session ?? "");
+    this.borrowedSession = Boolean(this.session);
+    return this.session;
+  }
+  /** Whether this client may end the session it is holding. */
+  get ownsSession() {
+    return Boolean(this.session) && !this.borrowedSession;
+  }
   async logout() {
     if (!this.session) {
       return;
     }
+    if (this.borrowedSession) {
+      this.session = "";
+      this.borrowedSession = false;
+      return;
+    }
     const logoutUrl = this.url("/logout.fcgi");
     try {
       this.session = "";
@@ -49852,7 +49909,8 @@ function useHidAmicoService() {
       throw new import_node_server_utils141.BadRequestError("Another physical HID card enrollment is already running on this reader.");
     }
     try {
-      await client.login();
+      const session = await client.login();
+      await repo.setEnrollmentSession(readerId, lockOwner, session);
       await assertHidUserExists(client, hidUserId);
       await ensurePhysicalCardIdentification(client);
       const beforeRows = await loadPhysicalCardRows(client, hidUserId);
@@ -49933,15 +49991,20 @@ function useHidAmicoService() {
   async function cancelUserCardEnrollment(readerId) {
     const reader = await getActiveReader(readerId);
     const client = new HidAmicoClient(reader);
+    const runningSession = await repo.getEnrollmentSession(readerId);
     try {
-      await client.login();
+      if (runningSession) {
+        client.adoptSession(runningSession);
+      } else {
+        await client.login();
+      }
       await client.cancelRemoteEnrollment();
       const enrollmentWasRunning = await repo.releaseEnrollmentLock(readerId);
       await repo.addEvent({
         reader: readerId,
         site: reader.site,
         type: "user_card_enrollment_cancelled",
-        payload: { enrollmentWasRunning }
+        payload: { enrollmentWasRunning, borrowedSession: Boolean(runningSession) }
       });
       return { readerId, cancelled: true };
     } finally {
@@ -77824,6 +77887,7 @@ function highSeverityIncidentCount(severities) {
   ).length;
 }
 var SUPPLY_BASIS_LOWEST_QUANTITY = "lowest-quantity";
+var SUPPLY_BASIS_BELOW_ALERT_LEVEL = "below-alert-level";
 var SUPPLY_THRESHOLD_NOT_IN_MODEL = "Supplies do not record a stock threshold, so these are the lowest-quantity items rather than items below a level.";
 
 // src/repositories/new-dashboard.repo.ts
@@ -78682,6 +78746,32 @@ function useNewDashboardRepo() {
       { $unwind: { path: "$scheduleDoc", preserveNullAndEmptyArrays: false } }
     ];
   }
+  async function lowStockItems(site, serviceType) {
+    const stores = await db2.collection("inventory.stores").find({ sites: site, status: "active" }, { projection: { _id: 1 } }).toArray();
+    if (stores.length) {
+      const items2 = await db2.collection("inventory.items").aggregate([
+        {
+          $match: {
+            store: { $in: stores.map((store) => store._id) },
+            status: "active",
+            reorderLevel: { $gt: 0 },
+            $expr: { $lte: ["$onHand", "$reorderLevel"] }
+          }
+        },
+        { $sort: { onHand: 1 } },
+        { $limit: 5 },
+        { $project: { _id: 1, name: 1, qty: "$onHand" } }
+      ]).toArray();
+      return { items: items2, basis: SUPPLY_BASIS_BELOW_ALERT_LEVEL };
+    }
+    const items = await supplyCollection.aggregate([
+      { $match: { site, serviceType, status: "active" } },
+      { $sort: { qty: 1 } },
+      { $limit: 3 },
+      { $project: { _id: 1, name: 1, qty: 1 } }
+    ]).toArray();
+    return { items, basis: SUPPLY_BASIS_LOWEST_QUANTITY };
+  }
   async function getServiceDashboard({
     site,
     serviceType,
@@ -78739,12 +78829,7 @@ function useNewDashboardRepo() {
             }
           }
         ]).toArray(),
-        supplyCollection.aggregate([
-          { $match: { site, serviceType, status: "active" } },
-          { $sort: { qty: 1 } },
-          { $limit: 3 },
-          { $project: { _id: 1, name: 1, qty: 1 } }
-        ]).toArray(),
+        lowStockItems(site, serviceType),
         areaChecklistCollection.aggregate([
           ...areaChecklistScheduleLookup(site, serviceType, periodRange),
           {
@@ -78806,7 +78891,7 @@ function useNewDashboardRepo() {
           )
         },
         supplyAlert: {
-          items: supplyAlertReport.map((item) => ({
+          items: supplyAlertReport.items.map((item) => ({
             name: item.name,
             qty: item.qty
           })),
@@ -78814,8 +78899,8 @@ function useNewDashboardRepo() {
           // with no threshold, because `site.supplies` records no stock level to
           // compare against. Naming the ordering stops 900 gloves being drawn as
           // a warning. No threshold is invented here.
-          basis: SUPPLY_BASIS_LOWEST_QUANTITY,
-          thresholdUnavailableReason: SUPPLY_THRESHOLD_NOT_IN_MODEL
+          basis: supplyAlertReport.basis,
+          ...supplyAlertReport.basis === SUPPLY_BASIS_LOWEST_QUANTITY ? { thresholdUnavailableReason: SUPPLY_THRESHOLD_NOT_IN_MODEL } : {}
         },
         taskCompleted: {
           completed: tFacet.completed[0]?.count ?? 0,