@7365admin1/layer-common 4.82.1-staging.476 → 4.83.0

package/components/HidProfileQrCode.vue

@@ -1,332 +0,0 @@
-<!--
-  MY HID QR CODE.
-
-  The signed-in member's own pass for one reader. Every other HID screen acts on
-  somebody else - a resident being enrolled, a visitor being issued a pass. This
-  one has no subject picker at all, because the server takes the caller from the
-  session and there is no user id to send.
-
-  Issuing a code does NOT grant access. A member's door permission comes from the
-  HID permissions screen, and minting an access rule here would let anyone who
-  can press Generate admit themselves. So the screen reports what the permissions
-  screen says (`assigned`) and warns when a code would be refused at the door,
-  rather than handing out something that silently fails.
--->
-<template>
-  <div class="hid-profile-qr">
-    <div class="hid-profile-qr__header">
-      <h2 class="hid-profile-qr__title">HID QR Code</h2>
-      <AppSelect
-        v-if="readerOptions.length"
-        v-model="selectedReaderId"
-        class="reader-select"
-        :items="readerOptions"
-        @update:model-value="loadProfile"
-      />
-    </div>
-
-    <v-card class="screen-modal hid-profile-qr__card">
-      <v-card-text class="screen-modal__body">
-        <div v-if="loading" class="hid-profile-qr__state">Loading...</div>
-
-        <div v-else-if="!readerOptions.length" class="hid-profile-qr__state">
-          No HID reader is set up for this site yet.
-        </div>
-
-        <template v-else>
-          <p class="hid-profile-qr__reader">
-            {{ profile?.readerName || "HID reader" }}
-            <span>{{ profile?.portalName || "Portal not configured" }}</span>
-          </p>
-
-          <!-- A code this reader cannot read is worse than no code, so the
-               capability is checked before anything is offered. -->
-          <v-alert
-            v-if="profile && !profile.qrEnabled"
-            type="warning"
-            variant="tonal"
-            density="compact"
-            class="mb-4"
-          >
-            This reader is not set up to read QR codes.
-          </v-alert>
-
-          <!-- The honest part: a code opens the door only for a member the
-               permissions screen already admits. `assigned` is null when the
-               lookup failed, which is not the same as "no". -->
-          <v-alert
-            v-else-if="profile && profile.assigned === false"
-            type="warning"
-            variant="tonal"
-            density="compact"
-            class="mb-4"
-          >
-            You are not assigned to this reader, so this code will be refused at
-            the door. Ask a property manager to add you on the HID permissions
-            screen.
-          </v-alert>
-
-          <div v-if="qrImage" class="hid-profile-qr__code">
-            <img :src="qrImage" alt="Your HID QR code" width="220" height="220" />
-            <p class="hid-profile-qr__issued">
-              Issued {{ formatIssuedAt(profile?.issuedAt) }}
-            </p>
-          </div>
-          <p v-else class="hid-profile-qr__state">
-            You have no QR code on this reader yet.
-          </p>
-
-          <div class="hid-profile-qr__actions">
-            <AppButton
-              :disabled="working || !profile?.qrEnabled"
-              @click="generate"
-            >
-              {{ profile?.issued ? "Regenerate" : "Generate QR Code" }}
-            </AppButton>
-            <AppButton
-              v-if="qrImage"
-              variant="ghost"
-              icon="mdi-download"
-              @click="downloadQr"
-            >
-              Download
-            </AppButton>
-            <AppButton
-              v-if="profile?.issued"
-              variant="ghost"
-              :disabled="working"
-              @click="remove"
-            >
-              Remove
-            </AppButton>
-          </div>
-
-          <p class="field-hint">
-            Regenerating replaces the previous code. The old one stops working
-            immediately.
-          </p>
-        </template>
-      </v-card-text>
-    </v-card>
-
-    <v-snackbar v-model="snackbar.show" :color="snackbar.color" timeout="4000">
-      {{ snackbar.message }}
-    </v-snackbar>
-  </div>
-</template>
-
-<script setup lang="ts">
-import QRCode from "qrcode";
-import type { HidProfileQr } from "../composables/useHidAmico";
-
-const props = defineProps<{ site: string }>();
-
-const { getReaders, getProfileQr, issueProfileQr, deleteProfileQr } = useHidAmico();
-
-type HidReaderOption = { _id: string; name?: string; portalName?: string };
-
-const readers = ref<HidReaderOption[]>([]);
-const { selectHidReader, resolveForSite } = useHidReaderSelection();
-const selectedReaderId = ref("");
-const profile = ref<HidProfileQr | null>(null);
-const qrImage = ref("");
-const loading = ref(false);
-const working = ref(false);
-const snackbar = reactive({ show: false, color: "success", message: "" });
-
-const readerOptions = computed(() => readers.value.map((reader) => ({
-  title: `${reader.name || reader._id} — ${reader.portalName || "Portal not configured"}`,
-  value: reader._id,
-})));
-
-function showToast(message: string, color: "success" | "error" = "success") {
-  snackbar.message = message;
-  snackbar.color = color;
-  snackbar.show = true;
-}
-
-function toRecord(value: unknown): Record<string, any> {
-  return value && typeof value === "object" ? (value as Record<string, any>) : {};
-}
-
-function errorMessage(error: unknown) {
-  const record = toRecord(error);
-  return String(toRecord(record.data).message || record.message || "Something went wrong.");
-}
-
-function formatIssuedAt(value?: string) {
-  if (!value) return "";
-  const date = new Date(value);
-  return Number.isNaN(date.getTime()) ? "" : date.toLocaleString();
-}
-
-/**
- * The image is drawn here, never fetched. The value is the credential itself,
- * so keeping it on this page and out of any URL is the point.
- */
-async function renderQr(value: string) {
-  if (!value) {
-    qrImage.value = "";
-    return;
-  }
-  try {
-    qrImage.value = await QRCode.toDataURL(value, { width: 440, margin: 1 });
-  } catch (error) {
-    console.error("Unable to render the HID QR code:", error);
-    qrImage.value = "";
-  }
-}
-
-/**
- * Saves the rendered code as a PNG.
- *
- * Straight off the data URL already in the page - no request, so the credential
- * never travels again to be downloaded. Same anchor-click approach `VisitorForm`
- * uses for a visitor pass, and the reader name is in the file name because a
- * member can hold one code per reader.
- */
-function downloadQr() {
-  if (!qrImage.value) return;
-  const slug = String(profile.value?.readerName || "reader")
-    .trim()
-    .replace(/[^a-z0-9]+/gi, "-")
-    .replace(/^-|-$/g, "")
-    .toLowerCase();
-  const link = document.createElement("a");
-  link.href = qrImage.value;
-  link.download = `hid-qr-${slug || "reader"}.png`;
-  link.click();
-}
-
-async function loadReaders() {
-  if (!props.site) return;
-  const response = toRecord(await getReaders({ site: props.site, page: 1, limit: 100 }));
-  const data = toRecord(response.data);
-  const items = response.items ?? data.items ?? data.readers ?? [];
-  readers.value = (Array.isArray(items) ? items : []).filter((reader) => reader?._id);
-  /* Shared with every other HID screen — see `useHidReaderSelection`. The
-     resolver refuses a remembered reader that is not this site's, so a site
-     switch or a deleted reader falls back to the first rather than querying
-     an id the site does not own. */
-  selectedReaderId.value = resolveForSite(props.site, readers.value);
-}
-
-async function loadProfile() {
-  if (!selectedReaderId.value) return;
-  loading.value = true;
-  try {
-    const response = await getProfileQr(selectedReaderId.value);
-    profile.value = response?.data ?? null;
-    await renderQr(profile.value?.qrValue || "");
-  } catch (error: unknown) {
-    profile.value = null;
-    qrImage.value = "";
-    showToast(errorMessage(error), "error");
-  } finally {
-    loading.value = false;
-  }
-}
-
-async function generate() {
-  if (!selectedReaderId.value) return;
-  working.value = true;
-  try {
-    const response = await issueProfileQr(selectedReaderId.value);
-    profile.value = response?.data ?? null;
-    await renderQr(profile.value?.qrValue || "");
-    showToast("QR code generated.");
-  } catch (error: unknown) {
-    showToast(errorMessage(error), "error");
-  } finally {
-    working.value = false;
-  }
-}
-
-async function remove() {
-  if (!selectedReaderId.value) return;
-  if (!window.confirm("Remove your QR code from this reader?")) return;
-  working.value = true;
-  try {
-    const response = await deleteProfileQr(selectedReaderId.value);
-    profile.value = response?.data ?? null;
-    await renderQr("");
-    showToast("QR code removed.");
-  } catch (error: unknown) {
-    showToast(errorMessage(error), "error");
-  } finally {
-    working.value = false;
-  }
-}
-
-watch(
-  () => props.site,
-  async () => {
-    await loadReaders();
-    await loadProfile();
-  },
-  { immediate: true },
-);
-
-/* Publish every change, including the seed above: a screen that had to fall
-   back to the first reader should leave the others agreeing with it. */
-watch(selectedReaderId, (value) => {
-  if (value) selectHidReader(props.site, value);
-});
-</script>
-
-<style scoped>
-.hid-profile-qr__header {
-  display: flex;
-  align-items: center;
-  gap: 12px;
-  flex-wrap: wrap;
-}
-
-.hid-profile-qr__title {
-  margin: 0;
-  font-size: 18px;
-  font-weight: 600;
-}
-
-.hid-profile-qr__card {
-  margin-top: 16px;
-  max-width: 460px;
-}
-
-.hid-profile-qr__reader {
-  margin: 0 0 14px;
-  font-size: 14px;
-  font-weight: 600;
-}
-
-.hid-profile-qr__reader span {
-  display: block;
-  color: var(--muted);
-  font-size: 12px;
-  font-weight: 500;
-}
-
-.hid-profile-qr__code {
-  display: grid;
-  place-items: center;
-  margin-bottom: 14px;
-}
-
-.hid-profile-qr__issued {
-  margin: 8px 0 0;
-  color: var(--muted);
-  font-size: 12px;
-}
-
-.hid-profile-qr__state {
-  color: var(--muted);
-  font-size: 13.5px;
-  padding: 8px 0 14px;
-}
-
-.hid-profile-qr__actions {
-  display: flex;
-  gap: 8px;
-  flex-wrap: wrap;
-}
-</style>

package/composables/useHidReaderSelection.ts

@@ -1,50 +0,0 @@
-import {
-  EMPTY_HID_READER_CHOICE,
-  resolveHidReaderId,
-  type HidReaderChoice,
-} from "../utils/hid-reader-selection";
-
-/**
- * ONE HID READER CHOICE, SHARED BY EVERY HID SCREEN.
- *
- * Declared at MODULE scope on purpose. Each screen held its own `ref("")`, and
- * because the HID screens are separate pages the ref was rebuilt on every
- * navigation — HID Reader Users, HID Cards, Access Logs and HID QR Code each
- * reset to the first reader no matter what had just been picked next door.
- *
- * A module-scoped ref is enough because moving between those pages is a ROUTE
- * change, not a page load: the menu's items carry a `route` and
- * `NavigationItem.vue` renders them through `:to`, so vue-router handles them
- * and this module is never re-evaluated.
- *
- * Deliberately NOT persisted. `localStorage` would carry the choice through a
- * hard refresh as well, which is a real but much smaller benefit than the
- * navigation case, and it is worth adding only once somebody has felt the
- * absence. See `utils/hid-reader-selection.ts` for the staleness rule that
- * would have to hold either way.
- *
- * Intercom keeps its own reader and is not wired to this. Its question is which
- * panel you are calling, not which door you are administering, and joining them
- * would mean switching reader on Access Logs changed who you would dial.
- */
-const choice = ref<HidReaderChoice>({ ...EMPTY_HID_READER_CHOICE });
-
-export default function useHidReaderSelection() {
-  /** Remember a choice. The site travels with it; an id alone means nothing. */
-  function selectHidReader(siteId: string, readerId: string) {
-    choice.value = { siteId: String(siteId ?? ""), readerId: String(readerId ?? "") };
-  }
-
-  /**
-   * The reader this screen should show, given the readers it just loaded.
-   *
-   * Call it after the reader list arrives, and write the answer back with
-   * `selectHidReader` so the screens agree on what "current" means even when
-   * one of them had to fall back to the first reader.
-   */
-  function resolveForSite(siteId: string, readers: readonly { _id?: unknown }[]) {
-    return resolveHidReaderId(siteId, readers, choice.value);
-  }
-
-  return { choice, selectHidReader, resolveForSite };
-}

package/composables/useSiteActions.ts

@@ -1,29 +0,0 @@
-import { NO_SITE_ACTIONS, siteActionsOf, type TSiteActions } from "../utils/site-actions";
-
-/**
- * May the signed-in person add / delete sites (and add organisations) in this
- * organisation? Re-asked whenever the organisation changes; hidden until core
- * answers. See `utils/site-actions.ts`.
- */
-export default function useSiteActions(org: MaybeRefOrGetter<string>) {
-  const actions = ref<TSiteActions>({ ...NO_SITE_ACTIONS });
-
-  watch(
-    () => toValue(org),
-    async (id) => {
-      actions.value = { ...NO_SITE_ACTIONS };
-      if (!id) return;
-      try {
-        const res = await useNuxtApp().$api<Record<string, any>>("/api/customer-sites", {
-          query: { org: id, status: "active", limit: 1, withActions: true },
-        });
-        if (toValue(org) === id) actions.value = siteActionsOf(res);
-      } catch {
-        // stays hidden - the server refuses the action anyway
-      }
-    },
-    { immediate: true },
-  );
-
-  return actions;
-}

package/composables/useSiteCategory.ts

@@ -1,45 +0,0 @@
-/**
- * THE CATEGORY OF THE SITE THE USER IS CURRENTLY IN.
- *
- * One shared answer, published once by the application's layout from the site
- * it already loaded for the switcher, and read by anything that has to behave
- * differently on a commercial or industrial site - the business Add Tenant
- * form, the tenant list. Publishing it rather than re-fetching it per
- * component means no two screens can disagree about which site this is.
- *
- * READ FROM THE CUSTOMER-SITE RECORD, NOT THE SITE RECORD. Both carry a
- * `category` and `customer-site.service` keeps them equal (it writes the site
- * on create and on update), but `siteSchema` DEFAULTS the site's own copy to
- * `commercial` - so a site created without an explicit category reads back as
- * commercial there even when it is a residential estate. The customer-site
- * copy has no default: it is either the category somebody chose or nothing.
- *
- * An empty category means "not published yet" or "never set", and every
- * caller must behave as it did before this existed - never assume commercial
- * from silence.
- */
-const BUSINESS_SITE_CATEGORIES: string[] = ["commercial", "industrial"];
-
-export default function useSiteCategory() {
-  const siteCategory = useState<string>("current-site-category", () => "");
-
-  function setSiteCategory(value?: string | null) {
-    siteCategory.value = typeof value === "string" ? value : "";
-  }
-
-  /**
-   * The categories whose units are LET TO A BUSINESS rather than lived in.
-   *
-   * These are the sites where a unit has an owner, an occupier and often a
-   * person in charge who is neither, so they are the sites that ask for a
-   * tenant's standing and print it back (see `OCCUPANCY_ROLE_OPTIONS`).
-   *
-   * The category never changes what the APPLICATION is called: the rail says
-   * Property Management on every site it serves.
-   */
-  const isBusinessSite = computed(() =>
-    BUSINESS_SITE_CATEGORIES.includes(siteCategory.value),
-  );
-
-  return { siteCategory, isBusinessSite, setSiteCategory };
-}

package/pages/[org]/[site]/access-mgmt/hid-qr-code/index.vue

@@ -1,23 +0,0 @@
-<template>
-  <v-container fluid>
-    <HidEnabledGate
-      :site="siteId"
-      :org="orgId"
-      message="Enable HID as a service for this site before generating a QR code."
-    >
-      <HidProfileQrCode :site="siteId" />
-    </HidEnabledGate>
-  </v-container>
-</template>
-
-<script setup lang="ts">
-definePageMeta({
-  layout: "default",
-  middleware: ["01-auth", "02-org"],
-  memberOnly: true,
-});
-
-const route = useRoute();
-const siteId = computed(() => String(route.params.site ?? ""));
-const orgId = computed(() => String(route.params.org ?? ""));
-</script>

package/server/plugins/no-powered-by.ts

@@ -1,7 +0,0 @@
-// Nuxt's renderer stamps `x-powered-by: Nuxt` on the HTML shell. It tells a
-// scanner the framework for free and helps nobody, so drop it.
-export default defineNitroPlugin((nitroApp) => {
-  nitroApp.hooks.hook("render:response", (response) => {
-    if (response?.headers) delete response.headers["x-powered-by"];
-  });
-});

package/utils/access-suspended.ts

@@ -1,18 +0,0 @@
-/**
- * Suspended = no access (owner 2026-10-01). When every membership of the
- * signed-in person is suspended the API answers any request with 401 +
- * `code: "ACCESS_SUSPENDED"` and the message "Your access has been suspended
- * by <org>. Contact your administrator." (core `suspendedSessionGuard`). The
- * session is already dead server-side; the app signs out and the sign-in page
- * (web-app-main) shows the message once, from this cookie.
- */
-export const ACCESS_SUSPENDED_CODE = "ACCESS_SUSPENDED";
-export const SIGNIN_NOTICE_COOKIE = "signin-notice";
-
-export function accessSuspendedMessage(data: unknown): string | null {
-  const body = data as { code?: unknown; message?: unknown } | null | undefined;
-  if (body?.code !== ACCESS_SUSPENDED_CODE) return null;
-  return typeof body.message === "string" && body.message
-    ? body.message
-    : "Your access has been suspended. Contact your administrator.";
-}

package/utils/attendance-proxy.ts

@@ -1,110 +0,0 @@
-/**
- * Site device mode (owner request 2026-10-01): one shared phone at a site checks
- * a person in or out with a photo, their name and their NRIC/FIN.
- *
- * Privacy (Singapore PDPA): the full NRIC is masked HERE, in the browser,
- * before anything is sent. Only the last 4 characters leave the device, plus
- * the prefix letter when the full number was typed, so the record can be shown
- * as "G****932P" (owner's display rule); last 4 only is shown as "****932P".
- */
-
-export const FULL_NRIC_RE = /^[STFGM]\d{7}[A-Z]$/;
-export const NRIC_LAST4_RE = /^\d{3}[A-Z]$/;
-const FULL_NRIC_ANYWHERE_RE = /[STFGM]\d{7}[A-Z]/i;
-
-export type TParsedNric =
-  | { ok: true; nricLast4: string; nricPrefix: string; masked: string; typedFull: boolean }
-  | { ok: false; error: string };
-
-/** Full NRIC/FIN or just its last 4, any case, spaces ignored. */
-export function parseNric(input: unknown): TParsedNric {
-  const value = String(input ?? "").replace(/\s+/g, "").toUpperCase();
-  if (!value) return { ok: false, error: "Type the NRIC/FIN, or just its last 4 characters (e.g. 932P)." };
-  if (FULL_NRIC_RE.test(value)) {
-    const nricLast4 = value.slice(-4);
-    const nricPrefix = value[0];
-    return { ok: true, nricLast4, nricPrefix, masked: `${nricPrefix}****${nricLast4}`, typedFull: true };
-  }
-  if (NRIC_LAST4_RE.test(value)) {
-    return { ok: true, nricLast4: value, nricPrefix: "", masked: `****${value}`, typedFull: false };
-  }
-  return {
-    ok: false,
-    error: "That doesn't look like an NRIC/FIN. Type the full number (e.g. S1234567D) or just the last 4 (e.g. 567D).",
-  };
-}
-
-/** Empty string when fine, otherwise the sentence to show. */
-export function nameError(input: unknown): string {
-  const value = String(input ?? "").trim();
-  if (!value) return "Type the person's name.";
-  if (FULL_NRIC_ANYWHERE_RE.test(value)) return "Please type the NRIC in the NRIC box, not in the name.";
-  if (value.length < 2) return "Type the person's full name.";
-  if (value.length > 80) return "The name is too long (80 characters at most).";
-  return "";
-}
-
-export function postError(input: unknown): string {
-  const value = String(input ?? "").trim();
-  if (FULL_NRIC_ANYWHERE_RE.test(value)) return "Please don't type an NRIC in Shift / post.";
-  if (value.length > 80) return "Shift / post is too long (80 characters at most).";
-  return "";
-}
-
-/** What is sent to the server. Never contains the full NRIC. */
-export function proxyPayload(input: { name: string; nric: string; post?: string }) {
-  const parsed = parseNric(input.nric);
-  if (!parsed.ok) throw new Error(parsed.error);
-  const name = String(input.name).trim().replace(/\s+/g, " ");
-  const post = String(input.post ?? "").trim();
-  return {
-    name,
-    nricLast4: parsed.nricLast4,
-    ...(parsed.nricPrefix ? { nricPrefix: parsed.nricPrefix } : {}),
-    ...(post ? { post } : {}),
-  };
-}
-
-/** CSV cell: quoted, and a leading = + - @ neutralised so a spreadsheet never runs it. */
-function csvCell(value: unknown): string {
-  let text = value === null || value === undefined ? "" : String(value);
-  if (/^[=+\-@\t\r]/.test(text)) text = `'${text}`;
-  return `"${text.replace(/"/g, '""')}"`;
-}
-
-export function toCsv(headers: string[], rows: unknown[][]): string {
-  return [headers, ...rows].map((row) => row.map(csvCell).join(",")).join("\r\n");
-}
-
-/** One export row for an attendance list item (web Attendance page). */
-export function attendanceCsvRow(
-  item: Record<string, any>,
-  photoLink: (id: string, which: "checkIn" | "checkOut") => string,
-  formatDate: (d: unknown) => string,
-): unknown[] {
-  return [
-    item.isProxy ? item.proxyName : item.userName,
-    item.isProxy ? item.nricMasked : "",
-    item.isProxy ? item.post ?? "" : "",
-    item.isProxy ? `Site device (${item.userName ?? ""})` : "Own account",
-    item.checkInTimestamp ? formatDate(item.checkInTimestamp) : "",
-    item.checkOutTimestamp ? formatDate(item.checkOutTimestamp) : "",
-    item.totalHours ?? "",
-    item.hasCheckInPhoto ? photoLink(String(item._id), "checkIn") : "",
-    item.hasCheckOutPhoto ? photoLink(String(item._id), "checkOut") : "",
-    item.suspicious ? item.suspiciousReason : "",
-  ];
-}
-
-export const ATTENDANCE_CSV_HEADERS = [
-  "Person",
-  "NRIC (last 4)",
-  "Shift / post",
-  "Taken on",
-  "Check in",
-  "Check out",
-  "Total hours",
-  "Check-in photo",
-  "Check-out photo",
-  "Check this",
-];