@7365admin1/layer-common 4.0.0 → 4.0.2

package/composables/useHidAmico.ts

@@ -80,11 +80,18 @@ type HidVisitorQrData = {
 type HidVisitorQrResponse = HidVisitorQrData | { data: HidVisitorQrData };
 
 type HidPermissionListResponse = {
-  items: THidPermissionCandidate[];
-  page: number;
-  pages: number;
-  pageRange: string;
-  limit: number;
+  items?: THidPermissionCandidate[];
+  page?: number;
+  pages?: number;
+  pageRange?: string;
+  limit?: number;
+  data?: {
+    items?: THidPermissionCandidate[];
+    page?: number;
+    pages?: number;
+    pageRange?: string;
+    limit?: number;
+  };
 };
 
 type HidFacialEnrollmentResult = {
@@ -94,6 +101,14 @@ type HidFacialEnrollmentResult = {
   errors?: Array<{ code?: number; message?: string }>;
 };
 
+export type HidFacialSyncResult = {
+  readerId: string;
+  facialDetected: number;
+  syncedCount: number;
+  unmappedCount: number;
+  message: string;
+};
+
 export type HidPhysicalCardType = "pacs" | "csn";
 
 export type HidPhysicalCard = {
@@ -184,6 +199,13 @@ export default function useHidAmico() {
     });
   }
 
+  function syncReaderFacialData(readerId: string) {
+    return useNuxtApp().$api<{ data: HidFacialSyncResult }>(
+      `${basePath}/readers/${readerId}/facial-sync`,
+      { method: "POST" },
+    );
+  }
+
   function configureReaderIntegration(readerId: string) {
     return useNuxtApp().$api<HidApiRecord>(`${basePath}/readers/${readerId}/configure`, {
       method: "POST",
@@ -247,6 +269,7 @@ export default function useHidAmico() {
     limit?: number;
     search?: string;
     status?: "mapped" | "unmapped" | "";
+    includeVisitors?: boolean;
   } = {}) {
     return useNuxtApp().$api<HidCollectionResponse>(`${basePath}/readers/${readerId}/users`, {
       method: "GET",
@@ -260,7 +283,7 @@ export default function useHidAmico() {
     search?: string;
     status?: "authorized" | "not_authorized" | "unknown" | "";
     method?: "facial" | "qr_code" | "id_password" | "pin" | "card" | "";
-    tab?: "resident" | "visitor" | "administrator";
+    tab?: "all" | "unmapped" | "mapped" | "resident" | "visitor" | "administrator";
   } = {}) {
     return useNuxtApp().$api<HidCollectionResponse>(`${basePath}/readers/${readerId}/access-logs`, {
       method: "GET",
@@ -492,6 +515,7 @@ export default function useHidAmico() {
     deleteReader,
     testReader,
     syncReader,
+    syncReaderFacialData,
     configureReaderIntegration,
     setReaderMonitor,
     setReaderOperatingMode,

package/composables/useHidNavigation.ts

@@ -23,12 +23,19 @@ export default function useHidNavigation() {
           },
         },
         {
-          title: "HID Users",
+          title: "HID Reader Users",
           route: {
             name: "org-site-access-mgmt-hid-users",
             params: { org, site },
           },
         },
+        {
+          title: "HID User Mapping",
+          route: {
+            name: "org-site-access-mgmt-hid-user-mapping",
+            params: { org, site },
+          },
+        },
         {
           title: "HID Cards",
           route: {

package/composables/useMember.ts

@@ -28,10 +28,6 @@ export default function useMember() {
   function getAllByUserId(user: string) {
     return useNuxtApp().$api<TMember>(`/api/members/users/${user}`);
   }
-  function getByMemberId(user: string) {
-    return useNuxtApp().$api<TMember>(`/api//user/${user}`);
-  }
-
   function getByUserIdType(user: string, type: string) {
     return useNuxtApp().$api<TMember>(`/api/members/user/${user}/app/${type}`);
   }
@@ -165,7 +161,6 @@ export default function useMember() {
     createUserByVerification,
     createMemberInvite,
     getByUserIdType,
-    getByMemberId,
     updateMemberStatus,
     updateMemberRole,
     createMemberDirect,

package/composables/usePromoCode.ts

@@ -28,9 +28,66 @@ export default function usePromoCode() {
     });
   }
 
+  /** One record, by its id. The console's detail screen opens on this. */
+  function getById(id: string) {
+    return useNuxtApp().$api<Record<string, any>>(
+      `/api/promo-codes/id/${id}`,
+      {
+        method: "GET",
+      }
+    );
+  }
+
+  /**
+   * Edit a code.
+   *
+   * `code` is NOT sent. It is immutable on the server - a subscription records
+   * the promo code it was bought with as text, so renaming one rewrites every
+   * invoice that already quotes it. The API accepts a `code` key and ignores
+   * it; leaving it out of the body means the screen can never look as though
+   * it changed something it did not.
+   */
+  function update(id: string, value: Partial<TPromoCode>) {
+    const { code, ...body } = value as Record<string, any>;
+
+    return useNuxtApp().$api<Record<string, any>>(`/api/promo-codes/${id}`, {
+      method: "PUT",
+      body,
+    });
+  }
+
+  /** Turn a code off, or back on. The only two states staff may set. */
+  function updateStatus(id: string, status: "active" | "disabled") {
+    return useNuxtApp().$api<Record<string, any>>(
+      `/api/promo-codes/${id}/status`,
+      {
+        method: "PATCH",
+        body: { status },
+      }
+    );
+  }
+
+  /**
+   * Remove a code from the console.
+   *
+   * A SOFT delete on the server: the record stays and is marked disabled and
+   * deleted, because subscriptions and invoices quote the code they were
+   * bought with. It leaves the list and stops being redeemable; it is not
+   * erased.
+   */
+  function remove(id: string) {
+    return useNuxtApp().$api<Record<string, any>>(`/api/promo-codes/${id}`, {
+      method: "DELETE",
+    });
+  }
+
   return {
     add,
     getPromoCodes,
     getByCode,
+    getById,
+    update,
+    updateStatus,
+    remove,
   };
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/pages/[org]/[site]/access-mgmt/hid-user-mapping/index.vue

@@ -0,0 +1,23 @@
+<template>
+  <v-container fluid>
+    <HidEnabledGate
+      :site="siteId"
+      :org="orgId"
+      message="Enable HID as a service for this site before mapping HID users."
+    >
+      <HidUserMapping :site="siteId" />
+    </HidEnabledGate>
+  </v-container>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: "default",
+  middleware: ["01-auth", "02-org"],
+  memberOnly: true,
+});
+
+const route = useRoute();
+const siteId = computed(() => String(route.params.site ?? ""));
+const orgId = computed(() => String(route.params.org ?? ""));
+</script>

package/pages/[org]/[site]/access-mgmt/hid-users/index.vue

@@ -5,7 +5,7 @@
       :org="orgId"
       message="Enable HID as a service for this site before managing HID users."
     >
-      <HidUserEnrollment :site="siteId" />
+      <HidReaderUserRoster :site="siteId" />
     </HidEnabledGate>
   </v-container>
 </template>

package/utils/client-subscription.test.ts

@@ -143,3 +143,98 @@ test("a billing cycle the screen does not know is shown, not swallowed", () => {
     "Yearly",
   );
 });
+
+/* ── SUSPEND / REACTIVATE, THE STATE THE LIST HAS TO SHOW AFTERWARDS ──────
+ *
+ * `PATCH /api/organizations/:id/status` (core `organization.controller.ts`
+ * `updateStatus`) writes BOTH `organizations.status` and the organisation's
+ * subscription status - the second one so the hourly sync job agrees rather
+ * than undoing the decision an hour later. So after the list is re-read, a
+ * suspended client arrives with both set, and this is what the row then says.
+ * Nothing in the screen holds a second copy of that state.
+ */
+
+/** Exactly what `updateStatus` leaves behind, applied to a list row. */
+function afterStatusChange(org: Record<string, any>, status: "active" | "suspended") {
+  return {
+    ...org,
+    status,
+    subscription: org.subscription?._id
+      ? { ...org.subscription, status }
+      : org.subscription,
+  };
+}
+
+test("suspending a client makes the row say Suspended", () => {
+  const before = orgWithSub({});
+  assert.equal(describeClientSubscription(before, NOW).state, "active");
+
+  const after = afterStatusChange(before, "suspended");
+  const v = describeClientSubscription(after, NOW);
+
+  assert.equal(v.state, "suspended");
+  assert.equal(v.label, "Suspended");
+  // Suspension is a decision somebody took, not a thing needing attention.
+  assert.equal(v.needsAttention, false);
+  // The dates are untouched - "data is kept" is visible, not just claimed.
+  assert.equal(v.billingCycle, describeClientSubscription(before, NOW).billingCycle);
+  assert.equal(v.start, describeClientSubscription(before, NOW).start);
+  assert.equal(v.end, describeClientSubscription(before, NOW).end);
+});
+
+test("reactivating puts the row back exactly where it was", () => {
+  const before = orgWithSub({});
+  const round = afterStatusChange(afterStatusChange(before, "suspended"), "active");
+
+  assert.deepEqual(
+    describeClientSubscription(round, NOW),
+    describeClientSubscription(before, NOW),
+  );
+});
+
+test("a complimentary client suspends and reactivates the same way", () => {
+  // All 11 production clients are complimentary, so this is the case that
+  // actually happens - and `billingMode` must survive the round trip.
+  const before = orgWithSub({ billingMode: "complimentary" });
+  assert.equal(describeClientSubscription(before, NOW).state, "complimentary");
+
+  assert.equal(
+    describeClientSubscription(afterStatusChange(before, "suspended"), NOW).state,
+    "suspended",
+  );
+  assert.equal(
+    describeClientSubscription(afterStatusChange(before, "active"), NOW).state,
+    "complimentary",
+  );
+});
+
+test("a client with NO subscription document still suspends", () => {
+  // `updateStatus` writes the organisation's status either way and only
+  // touches a subscription if one exists. This row has none, so the
+  // subscription column keeps saying so - the ORGANISATION's status is what
+  // moved it to the Suspended tab, and that is the honest reading of the
+  // record. The list is fetched per tab, so the row is on the tab that matches.
+  const before = { _id: "o-1", name: "A Client", status: "active", subscription: {} };
+  const after = afterStatusChange(before, "suspended");
+
+  assert.equal(after.status, "suspended");
+  assert.equal(describeClientSubscription(after, NOW).state, "none");
+  assert.equal(describeClientSubscription(after, NOW).label, "No subscription set up");
+});
+
+test("suspending does not clear an end date that had already passed", () => {
+  // Owner decision 8's flag and a suspension are different things, and the
+  // flag is derived at read time - suspending must not hide the fact that the
+  // subscription had run out, because reactivating brings it straight back.
+  const overdue = orgWithSub({ nextBillingDate: "2026-01-01T00:00:00.000Z" });
+  assert.equal(describeClientSubscription(overdue, NOW).needsAttention, true);
+
+  assert.equal(
+    describeClientSubscription(afterStatusChange(overdue, "suspended"), NOW).state,
+    "suspended",
+  );
+  assert.equal(
+    describeClientSubscription(afterStatusChange(overdue, "active"), NOW).needsAttention,
+    true,
+  );
+});

package/utils/console-tier.test.ts

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { consoleTier } from "./console-tier.ts";
+
+/** The seeded platform-staff role - `user.service.ts createDefaultUser()`. */
+const OWNER_ROLE = {
+  _id: "r-owner",
+  name: "Super Admin",
+  type: "admin",
+  default: true,
+  permissions: [],
+};
+
+/** A role made through the admin app. `default` is not in its Joi schema. */
+const STAFF_ROLE = {
+  _id: "r-staff",
+  name: "Operations",
+  type: "admin",
+  permissions: ["organization:read"],
+};
+
+const ADMIN_MEMBER = { _id: "m-1", user: "u-1", type: "admin", role: "r-owner" };
+
+test("the owner is an admin member on an admin role marked default", () => {
+  assert.equal(consoleTier(ADMIN_MEMBER, OWNER_ROLE), "owner");
+});
+
+test("ordinary Seven365 staff are admin, but their role is not the default one", () => {
+  assert.equal(consoleTier(ADMIN_MEMBER, STAFF_ROLE), "staff");
+  // The absence of the field, not just `false`, is the ordinary case: the admin
+  // app's create-role form cannot send it at all.
+  assert.equal(consoleTier(ADMIN_MEMBER, { ...STAFF_ROLE, default: false }), "staff");
+});
+
+test("BOTH halves are required - a role name proves nothing", () => {
+  // Staging carries an ordinary ORGANISATION role merely NAMED "Super Admin",
+  // and `web-app-org/pages/index.vue` gated the whole console on that name.
+  // That row must not reach owner, or staff, on the strength of its name.
+  const impostor = { _id: "r-x", name: "Super Admin", type: "organization", default: true };
+  assert.equal(consoleTier(ADMIN_MEMBER, impostor), "none");
+
+  // ...and an admin-typed role held through a non-admin membership is not
+  // staff either. `isSuperAdmin` requires `members.type === "admin"` too.
+  assert.equal(consoleTier({ ...ADMIN_MEMBER, type: "organization" }, OWNER_ROLE), "none");
+});
+
+test("`default` is only honoured when it is exactly true", () => {
+  // A truthy-but-not-true value is not what `createDefaultUser` writes, and the
+  // server compares with `===`. Drawing an owner control off `"true"` or `1`
+  // would show a button the server then refuses.
+  for (const value of ["true", 1, {}, "yes"]) {
+    assert.equal(
+      consoleTier(ADMIN_MEMBER, { ...STAFF_ROLE, default: value }),
+      "staff",
+      JSON.stringify(value),
+    );
+  }
+});
+
+test("anything unproven is `none` - this fails closed", () => {
+  const unproven: Array<[any, any]> = [
+    [null, OWNER_ROLE],
+    [undefined, OWNER_ROLE],
+    [{}, OWNER_ROLE],
+    [ADMIN_MEMBER, null], // the role request failed
+    [ADMIN_MEMBER, undefined],
+    [ADMIN_MEMBER, {}],
+    [null, null],
+    // An error body answered instead of a record. `member.controller.ts`
+    // answers `NotFoundError` as JSON, so this is a real wire shape.
+    [{ status: "error", message: "Member not found." }, OWNER_ROLE],
+  ];
+
+  for (const [member, role] of unproven) {
+    assert.equal(consoleTier(member, role), "none", JSON.stringify([member, role]));
+  }
+});
+
+test("a deleted staff membership is not staff", () => {
+  // `isSuperAdmin` excludes it server-side; the endpoint the browser reads does
+  // not, so it is excluded here to keep the two answers the same.
+  assert.equal(
+    consoleTier({ ...ADMIN_MEMBER, status: "deleted" }, OWNER_ROLE),
+    "none",
+  );
+});

package/utils/console-tier.ts

@@ -0,0 +1,67 @@
+/**
+ * WHICH SEVEN365 TIER THE SIGNED-IN PERSON IS, MIRRORED FROM THE SERVER'S RULE.
+ *
+ * Owner decision 9 splits Seven365 staff powers in two. Ordinary staff may view
+ * clients, set up subscriptions and manage promo codes. **Only the owner may
+ * suspend a client** - an action that stops that client's staff, residents and
+ * guards signing in.
+ *
+ * ## The server is the authority. This file only decides what to DRAW.
+ *
+ * `iservice365-core` `src/utils/super-admin.util.ts` answers the same question
+ * on the server, from the session id alone:
+ *
+ *   isSuperAdmin(userId)    -> a `members` row `{ type: "admin" }` whose role
+ *                              document is also `type: "admin"`
+ *   isPlatformOwner(userId) -> the same, AND that role has `default === true`
+ *
+ * `requirePlatformOwner` (`console-authz.util.ts`) runs `isPlatformOwner`
+ * inside `PATCH /api/organizations/:id/status` before it writes anything, and
+ * it reads the session - never the request body, never a header the browser
+ * chose. So a browser that lies to itself about its tier gets a button it can
+ * press and a 401 when it does. Hiding the control is a courtesy, not a lock.
+ *
+ * ## Why `role.default`, and why nothing here invents a new marker
+ *
+ * `default` is the only property of a platform-staff role that no API caller
+ * can set: `role.controller.ts` validates create/update with Joi object schemas
+ * that do not list it (Joi rejects unknown keys), `role.repo.ts` never writes
+ * it, and `MRole` defaults it to `false`. Exactly one server path sets it on an
+ * `admin`-typed role - `user.service.ts createDefaultUser()` at API boot. Every
+ * additional staff account is invited onto a role made through the admin app,
+ * which cannot carry it.
+ *
+ * ## Fail closed
+ *
+ * Anything this function cannot positively prove is `"none"`. A missing member
+ * row, a role that failed to load, a request that threw - all of them draw the
+ * ordinary-staff console with no suspend control, which is the recoverable
+ * mistake. The other direction is not.
+ *
+ * Both fields come back from endpoints the app already calls, unprojected:
+ * `GET /api/members/user/:id/app/admin` and `GET /api/roles/id/:id`. Nothing
+ * new had to be added to the API for this.
+ */
+
+export type TConsoleTier = "owner" | "staff" | "none";
+
+/**
+ * One divergence from the server, stated rather than hidden: `isSuperAdmin`
+ * matches `status: { $ne: "deleted" }` on the member row, and the endpoint the
+ * browser uses (`member.repo.ts getByUserIdType`) matches only `{ user, type }`.
+ * So a deleted staff membership can still be handed to this function. It is
+ * excluded here too, which keeps the drawn console and the server's answer the
+ * same for that case.
+ */
+export function consoleTier(
+  member: Record<string, any> | null | undefined,
+  role: Record<string, any> | null | undefined,
+): TConsoleTier {
+  if (member?.type !== "admin") return "none";
+  if (member?.status === "deleted") return "none";
+  if (role?.type !== "admin") return "none";
+
+  // `=== true` exactly as the server writes it. A role document that omits
+  // `default` (every role the admin app can create) is staff, not owner.
+  return role?.default === true ? "owner" : "staff";
+}

package/utils/data.test.ts

@@ -93,3 +93,87 @@ test("a non-array levels value is counted as zero, not as its own length", () =>
   assert.equal(levelCount({ levels: 7 as unknown as [] }), 0);
   assert.equal(levelCount({ levels: "12" as unknown as [] }), 0);
 });
+
+import { cameraErrorConverter } from "./data.ts";
+
+/** Shape of an ofetch failure: the status and body live under `response`. */
+const apiError = (status: number, message?: string) => ({
+  response: { status, _data: message === undefined ? {} : { message } },
+});
+
+test("a duplicate reads as a duplicate", () => {
+  assert.match(
+    cameraErrorConverter(apiError(400, "ANPR already exist."), "ip"),
+    /already exists on this site/
+  );
+  assert.match(
+    cameraErrorConverter(apiError(409), "ip"),
+    /already exists on this site/
+  );
+});
+
+test("a failure that is NOT a duplicate never says duplicate", () => {
+  const notDuplicate = [
+    cameraErrorConverter(apiError(401), "ip"),
+    cameraErrorConverter(apiError(403), "ip"),
+    cameraErrorConverter(apiError(404), "ip"),
+    cameraErrorConverter(apiError(429), "ip"),
+    cameraErrorConverter(apiError(500, "Failed to create ANPR."), "ip"),
+    cameraErrorConverter(new Error("Network request failed"), "ip"),
+  ];
+
+  for (const message of notDuplicate) {
+    assert.doesNotMatch(message, /already exist/i, message);
+  }
+});
+
+test("each cause gets its own message", () => {
+  assert.match(cameraErrorConverter(apiError(401), "ip"), /session has expired/);
+  assert.match(
+    cameraErrorConverter(apiError(403), "ip"),
+    /do not have permission/
+  );
+  assert.match(cameraErrorConverter(apiError(404), "ip"), /no longer exists/);
+  assert.match(cameraErrorConverter(apiError(429), "ip"), /Too many attempts/);
+  assert.match(
+    cameraErrorConverter(apiError(500, "Failed to create ANPR."), "ip"),
+    /could not save this CCTV camera/
+  );
+});
+
+test("no response at all reads as a connection problem, not a server refusal", () => {
+  assert.match(
+    cameraErrorConverter(new Error("Failed to fetch"), "ip"),
+    /Could not reach the server/
+  );
+});
+
+test("a rejected field is named the way the form names it", () => {
+  assert.equal(
+    cameraErrorConverter(apiError(400, '"host" is required'), "ip"),
+    "URL is required."
+  );
+  assert.equal(
+    cameraErrorConverter(apiError(400, '"name" is not allowed to be empty'), "ip"),
+    "Camera Name cannot be empty."
+  );
+  // A field with no friendly label still reads as a sentence.
+  assert.equal(
+    cameraErrorConverter(apiError(400, '"guardPost" must be a number'), "ip"),
+    "guardPost must be a number."
+  );
+});
+
+test("a plain 400 sentence from the API is passed through unchanged", () => {
+  assert.equal(
+    cameraErrorConverter(apiError(400, "Invalid _id format"), "ip"),
+    "Invalid _id format"
+  );
+});
+
+test("the camera type decides the wording", () => {
+  assert.match(cameraErrorConverter(apiError(404), "anpr"), /ANPR camera/);
+  assert.match(cameraErrorConverter(apiError(404), "ip"), /CCTV camera/);
+  // Unknown/absent type falls back to CCTV, which is what the panel defaults to.
+  assert.match(cameraErrorConverter(apiError(404)), /CCTV camera/);
+});

package/utils/data.ts

@@ -30,6 +30,98 @@ export const errorConverter = (data: any): string => {
   return error;
 };
 
+/**
+ * Field names the camera API validates, in the wording the camera form uses,
+ * so a rejection reads as the label the person is looking at.
+ */
+const CAMERA_FIELD_LABELS: Record<string, string> = {
+  host: "URL",
+  name: "Camera Name",
+  username: "User",
+  password: "Password",
+  direction: "Type",
+  category: "Category",
+  site: "Site",
+};
+
+/** Joi phrasing -> everyday phrasing. Anything unmapped is passed through. */
+const CAMERA_VALIDATION_PHRASES: Array<[RegExp, string]> = [
+  [/^is required$/, "is required."],
+  [/^is not allowed to be empty$/, "cannot be empty."],
+  [/^must be a string$/, "is not valid."],
+];
+
+/**
+ * Turns a save/delete failure on a site camera into a sentence the person
+ * setting up the camera can act on.
+ *
+ * The camera panel used to report every `type: "ip"` failure as "CCTV camera
+ * already exist", whatever actually went wrong - a signed-out session, a
+ * missing permission, a rejected field and a server outage all read as a
+ * duplicate. This maps the cases the API really returns instead.
+ */
+export const cameraErrorConverter = (error: any, type?: string): string => {
+  const camera = type === "anpr" ? "ANPR camera" : "CCTV camera";
+
+  const status =
+    error?.response?.status ?? error?.statusCode ?? error?.status ?? null;
+
+  const serverMessage = String(
+    error?.response?._data?.message ?? error?.data?.message ?? ""
+  ).trim();
+
+  // No response at all: the request never reached the API.
+  if (!status) {
+    return `Could not reach the server, so this ${camera} was not saved. Check your internet connection and try again.`;
+  }
+
+  if (status === 401) {
+    return `Your session has expired. Sign in again, then save this ${camera}.`;
+  }
+
+  if (status === 403) {
+    return `You do not have permission to change cameras on this site. Ask your iService365 administrator for access.`;
+  }
+
+  if (status === 404) {
+    return `This ${camera} no longer exists. Refresh the list and try again.`;
+  }
+
+  if (status === 429) {
+    return "Too many attempts in a short time. Wait a moment and try again.";
+  }
+
+  // The API reports a clash from the unique index as "ANPR already exist.",
+  // which is the same message for a CCTV record.
+  if (status === 409 || /already exist|duplicate/i.test(serverMessage)) {
+    return `A ${camera} with this URL already exists on this site. Check the list before adding it again.`;
+  }
+
+  if (status >= 500) {
+    return `The server could not save this ${camera}. Try again, and contact support if it keeps happening.`;
+  }
+
+  if (status === 400 && serverMessage) {
+    // Joi rejections arrive as `"host" is required`.
+    const field = serverMessage.match(/^"(\w+)"\s+(.+?)\.?$/);
+
+    if (field) {
+      const label = CAMERA_FIELD_LABELS[field[1]] ?? field[1];
+      const phrase =
+        CAMERA_VALIDATION_PHRASES.find(([pattern]) =>
+          pattern.test(field[2])
+        )?.[1] ?? `${field[2]}.`;
+
+      return `${label} ${phrase}`;
+    }
+
+    return serverMessage;
+  }
+
+  return errorConverter(error);
+};
+
+
 /**
  * A service-provider account can only be shown ITS OWN work orders, feedbacks
  * and key logs, so every one of those screens scopes its request by the