@7365admin1/layer-common 4.82.1-staging.472 → 4.82.1-staging.473

package/components/HidUserEnrollment.vue

@@ -2331,11 +2331,59 @@ function applyFacialResult(
   }
 }
 
+/**
+ * THE IDENTITY ROW BEHIND A ROSTER ROW.
+ *
+ * This list is read from the READER (`getReaderUsers`), and `listReaderUsers`
+ * builds each row out of the device's own `users` columns - it carries no
+ * identity `_id` at all, so `toHidUser` leaves `_id` undefined for every row on
+ * screen. A delete that only acted when `_id` was present therefore never
+ * touched the database: the device user was destroyed and the identity stayed
+ * `active`, with no error, because the guard was an `if` rather than a failure.
+ *
+ * That left the row orphaned, and an orphan is not inert. `findIdentityBySubject`
+ * excludes only `status: "deleted"`, so it still answers "this person is already
+ * enrolled on this reader" and REFUSES to enrol somebody the operator can no
+ * longer see. The reconcile reads it too: `findProfileIdentity` finds the active
+ * row and reuses its stored `hidUserId`, so the device user is rebuilt with the
+ * same UID the operator just deleted, from an access grant that was never
+ * removed because `deleteIdentity` never ran.
+ *
+ * Resolved the same way `saveUser` already resolves it, by the reader's own keys.
+ */
+async function findIdentityIdForUser(readerId: string, user: HidUser) {
+  if (user._id) return user._id;
+  if (!readerId) return "";
+  try {
+    const identity = await findExistingIdentityOnReader(readerId, {
+      hidUserId: String(user.hidUserId ?? ""),
+      registration: String(user.registration ?? ""),
+      cardNo: String(user.cardNo ?? ""),
+      metadata: {},
+    });
+    return identity?._id ?? "";
+  } catch (error: unknown) {
+    // A lookup failure must not stop the device delete the operator asked for.
+    // The row stays behind and the next delete can clear it.
+    console.error(
+      "Unable to resolve the stored identity for this HID user:",
+      error
+    );
+    return "";
+  }
+}
+
 async function deleteUser() {
   if (!selectedUser.value) return;
 
   deleting.value = true;
   try {
+    // Resolved BEFORE the device user is destroyed: this reads our own records,
+    // and doing it first means a failure here costs nothing.
+    const identityId = await findIdentityIdForUser(
+      selectedReaderId.value,
+      selectedUser.value
+    );
     await syncHidUserRole(
       selectedReaderId.value,
       toHidNumericId(selectedUser.value.hidUserId),
@@ -2346,8 +2394,10 @@ async function deleteUser() {
       toHidNumericId(selectedUser.value.hidUserId)
     );
     await deleteHidUserFromReader(selectedReaderId.value, selectedUser.value);
-    if (selectedUser.value._id) {
-      await deleteIdentity(selectedUser.value._id);
+    if (identityId) {
+      // Soft-deletes the row AND removes the access grant that let this person
+      // through, which is what stops the next reconcile rebuilding them.
+      await deleteIdentity(identityId);
     }
     deleteDialog.value = false;
     await loadUsers();

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.82.1-staging.472",
+  "version": "4.82.1-staging.473",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",