@7365admin1/core 3.79.1-staging.338 → 3.79.1-staging.340

package/.changeset/cleaning-robot-cloud-connector.md

@@ -0,0 +1,39 @@
+---
+"@7365admin1/core": minor
+---
+
+Cleaning robot: robot cloud connector, and stop projecting robot credentials
+
+Adds the signed client for the cleaning-robot cloud (`robot-cloud.util.ts`,
+`robot-cloud.service.ts`): request signing, the status vocabulary, the
+pixel/metre transform and the area colour conversions, plus the nine
+request/response endpoints. Credentials are passed in by the caller and are
+never read from the environment, logged, or placed in a request body.
+
+Also fixes a credential disclosure in the existing robot listing: `getRobots`
+projected `appKey` and `appToken` — the pair that signs every command sent to
+that estate's robots — into the response, so anyone holding `see-all-robots`
+received them. They are no longer returned.
+
+Fixes `POST /robots`, which had never worked: the service assigned an ObjectId
+where the model's schema wanted a string, so every create ended in
+`400 "createdBy" must be a string` and no robot could be registered at all.
+
+Adds the server-side enforcement of the five robot permissions, which have
+existed in the client catalogue but were never checked by the API. `"*"` allows
+everything; an empty list allows everything only on a `type: "admin"` role (the
+Seven365 staff role is seeded with `[]`, so enforcing it would refuse the
+platform owner); a non-empty list is enforced exactly.
+
+Adds `robotSn` to the robot record (optional, discovered from `get-robot-list`
+when absent) and `robot-fleet.service.ts`, which bridges a stored robot to the
+vendor cloud: live state, maps, map image URLs minted at use, and dispatch.
+
+Adds a table of which application may set up and monitor which robot type, so
+cleaning robots and security robots share one module while each app sees only
+its own.
+
+Adds an optional `type` ("cleaning" | "security") to the robot record with an
+optional filter, so both device classes share one module and one collection
+while each app lists only its own. Existing rows are untouched and an
+unfiltered query behaves exactly as before.

package/.changeset/hid-sip-account-list.md

@@ -0,0 +1,17 @@
+---
+"@7365admin1/core": minor
+---
+
+List a site's HID SIP accounts for the intercom contact picker.
+
+`hid-sip-accounts` could only be reached through `ensureSipAccount`, which
+creates and returns the CALLER's own extension together with its password.
+The intercom contact dialog needs the opposite view: every person on the site
+who holds an extension, so a contact names someone the reader can actually
+ring instead of a free-typed label.
+
+`listSipAccounts(orgId, siteId)` reads the site's non-disabled accounts, joins
+each to its `users` row for the display name and email, and returns name,
+extension, username and status per account. The SIP password is never in the
+response. The controller guards it with `authorizeSite` in the handler body,
+the same way `listEnrollmentReaders` does, so a router edit cannot expose it.