@7365admin1/layer-common 4.84.0 → 4.84.1-staging.482

package/constants/permissions.ts

@@ -206,6 +206,7 @@ export const PERMISSIONS = {
     "see-all-attendance",
     "see-attendance-details",
     "manage-attendance-settings",
+    "manage-site-device-mode",
   ],
   "my-attendance": ["see-own-attendance", "check-in-out"],
   toilet_locations: ["create-toilet-location"],

package/nuxt.config.ts

@@ -1,8 +1,23 @@
 // https://nuxt.com/docs/api/configuration/nuxt-config
 import vuetify, { transformAssetUrls } from "vite-plugin-vuetify";
+import { SECURITY_HEADERS } from "./utils/security-headers";
 export default defineNuxtConfig({
   ssr: false,
   devtools: { enabled: false },
+
+  // Security headers for every app that extends this layer: the HTML shell gets
+  // them from Nitro, the static files from the `_headers` file the Cloudflare
+  // preset writes from these same rules. See utils/security-headers.ts.
+  routeRules: {
+    "/**": { headers: SECURITY_HEADERS },
+    // Stored files read with the signed-in session (API-core
+    // GET /api/files/object/<key>) instead of the public CDN. Unused until an
+    // app's API_DO_STORAGE_ENDPOINT points at /api/storage/<folder>; that switch
+    // goes with SPACES_PRIVATE_PREFIXES - see the storage runbook.
+    ...(process.env.API_CORE
+      ? { "/api/storage/**": { proxy: `${process.env.API_CORE}/api/files/object/**` } }
+      : {}),
+  },
   build: {
     transpile: ["vuetify"],
   },
@@ -48,6 +63,9 @@ export default defineNuxtConfig({
       cookieConfig: {
         domain: (process.env.DOMAIN as string) ?? "localhost",
         secure: true,
+        // Explicit, not the browser default: the API also reads `sid` from the
+        // cookie, so a cross-site form post must never carry it (CSRF).
+        sameSite: "lax",
         maxAge: 30 * 24 * 60 * 60,
       },
       APP: (process.env.APP as string) ?? "App",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.84.0",
+  "version": "4.84.1-staging.482",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -22,6 +22,7 @@
     "pages",
     "plugins",
     "public",
+    "server",
     "services",
     "types",
     "utils",
@@ -57,8 +58,9 @@
     "@mdi/font": "^7.4.47",
     "@types/qrcode": "^1.5.6",
     "ckeditor5": "47.4.0",
+    "dompurify": "^3.3.1",
     "hls.js": "^1.6.13",
-    "html2pdf.js": "^0.10.2",
+    "html2pdf.js": "^0.14.0",
     "html5-qrcode": "^2.3.8",
     "moment-timezone": "^0.6.0",
     "nuxt-signature-pad": "^1.8.0",

package/pages/[org]/[site]/access-mgmt/administrator/index.vue

@@ -5,7 +5,7 @@
       :org="orgId"
       message="Enable HID as a service for this site before managing HID users."
     >
-      <HidUserEnrollment :site="siteId" />
+      <HidUserEnrollment :site="siteId" :org="orgId" />
     </HidEnabledGate>
   </v-container>
 </template>

package/pages/[org]/[site]/access-mgmt/hid-cards/index.vue

@@ -5,7 +5,7 @@
       :org="orgId"
       message="Enable HID as a service for this site before managing physical HID cards."
     >
-      <HidUserEnrollment :site="siteId" card-management />
+      <HidUserEnrollment :site="siteId" :org="orgId" card-management />
     </HidEnabledGate>
   </v-container>
 </template>

package/pages/[org]/[site]/access-mgmt/hid-qr-code/index.vue

@@ -0,0 +1,23 @@
+<template>
+  <v-container fluid>
+    <HidEnabledGate
+      :site="siteId"
+      :org="orgId"
+      message="Enable HID as a service for this site before generating a QR code."
+    >
+      <HidProfileQrCode :site="siteId" />
+    </HidEnabledGate>
+  </v-container>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: "default",
+  middleware: ["01-auth", "02-org"],
+  memberOnly: true,
+});
+
+const route = useRoute();
+const siteId = computed(() => String(route.params.site ?? ""));
+const orgId = computed(() => String(route.params.org ?? ""));
+</script>

package/pages/[org]/[site]/access-mgmt/hid-readers/index.vue

@@ -5,7 +5,7 @@
       :org="orgId"
       message="Enable HID as a service for this site before managing HID readers."
     >
-      <HidReaderManagement :site="siteId" />
+      <HidReaderManagement :site="siteId" :org="orgId" />
     </HidEnabledGate>
   </v-container>
 </template>

package/plugins/vuetify.ts

@@ -114,6 +114,12 @@ export default defineNuxtPlugin((app) => {
 
   const vuetify = createVuetify({
     defaults: {
+      // Phones (owner 2026-10-02, "most pages are not mobile responsive"): below
+      // 600px every data table shows each row as a stacked card (label: value)
+      // instead of a wide grid scrolled sideways. Tablets and desktop unchanged.
+      VDataTable: { mobileBreakpoint: "sm" },
+      VDataTableServer: { mobileBreakpoint: "sm" },
+      VDataTableVirtual: { mobileBreakpoint: "sm" },
       VTextField: {
         variant: "outlined",
         density: "comfortable",

package/server/plugins/no-powered-by.ts

@@ -0,0 +1,7 @@
+// Nuxt's renderer stamps `x-powered-by: Nuxt` on the HTML shell. It tells a
+// scanner the framework for free and helps nobody, so drop it.
+export default defineNitroPlugin((nitroApp) => {
+  nitroApp.hooks.hook("render:response", (response) => {
+    if (response?.headers) delete response.headers["x-powered-by"];
+  });
+});

package/types/attendance.d.ts

@@ -11,9 +11,11 @@ declare type TAttendance = {
 declare type TAttendanceCheckIn = {
   checkIn: {
     timestamp: string;
-    location: TAttendanceLocation;
+    location?: TAttendanceLocation;
     img?: string;
+    privatePhoto?: string;
   };
+  proxy?: TAttendanceProxy;
 };
 
 declare type TAttendanceCheckOut = {
@@ -35,4 +37,14 @@ declare type TAttendanceSettings = {
   location?: TAttendanceLocation;
   isGeofencingEnabled?: boolean;
   mile?: number;
+  /** Site device mode: one shared phone may check staff in/out (default OFF). */
+  siteDeviceMode?: boolean;
+};
+
+/** Who a Site device mode check-in is for. Never the full NRIC. */
+declare type TAttendanceProxy = {
+  name: string;
+  nricLast4: string;
+  nricPrefix?: string;
+  post?: string;
 };

package/types/document.d.ts

@@ -3,4 +3,18 @@ declare type TDocument = {
   name: string;
   attachment: string;
   type: string;
+  /**
+   * Set at upload or renewal, absent when the document never expires.
+   *
+   * An ISO instant on the way out of the API and a `YYYY-MM-DD` string on the
+   * way back in, which is what `InputDatePicker` binds to - hence the loose
+   * type rather than `string`.
+   */
+  expiryDate?: string | Date | null;
+  remarks?: string;
+  size?: number;
+  parentId?: string | null;
+  createdAt?: string | Date;
+  updatedAt?: string | Date;
+  status?: string;
 };

package/types/facility.d.ts

@@ -73,6 +73,10 @@ declare type TFacility = {
   hourInterval?: number;
   isBookingFeeEnabled: boolean;
   isGuestEnabled: boolean;
+  /** Residents may complete this facility's checklist themselves. */
+  isResidentChecklistEnabled?: boolean;
+  /** Security may complete it. Mutually exclusive with the above. */
+  isSecurityChecklistEnabled?: boolean;
   bookingAmount: number | null;
   peakBookingFeeAmount?: number | null;
   bookingFeeGuestAmount?: number | null;

package/types/member.d.ts

@@ -10,6 +10,10 @@ declare type TMember = {
   customerOrgId?: string;
   customerSiteId?: string;
   status?: string;
+  email?: string;
+  /** The building unit this member manages (a unit's Management tab). */
+  unit?: string | null;
+  unitName?: string;
   createdAt?: string;
   updatedAt?: string;
   deletedAt?: string;

package/types/people.d.ts

@@ -22,11 +22,38 @@ declare type TPeople = {
   email?: string;
   files?: { name: string, id: string }[];
   isOwner?: boolean;
+  /**
+   * Owner / occupant / person-in-charge, as the BUSINESS people form asks it.
+   * Absent on everyone else - `isOwner` is still the flag that decides unit
+   * ownership, and the server derives it from this when it is sent. See
+   * `OccupancyRoles` in core's `person.model.ts`.
+   */
+  occupancyRole?: TOccupancyRole;
+  // Link to this person's `users` row. Empty for the person types that carry
+  // no login, and empty for a resident whose account was never written.
+  user?: string;
+};
+
+declare type TOccupancyRole = "owner" | "occupant" | "person-in-charge";
+
+/** One standing and everything the product says about it. See `utils/occupancy-role.ts`. */
+declare type TOccupancyRoleOption = {
+  value: TOccupancyRole;
+  /** The label a stored role is printed with. */
+  title: string;
+  /** The row menu's wording. */
+  action: string;
+  /** The confirmation's heading and its sentence. */
+  prompt: string;
+  description: string;
 };
 
 declare type TPlateNumber = { plateNumber: string, recNo?: string, _id?: string, status: TVehicleStatus, type: TVehicleType, anprCameras?: TVehicleAnprCamera[] };
 
 
-declare type TPeoplePayload = Pick<TGuest, "name" | "block" | "level" | "unit" | "unitName" | "contact" | "plateNumber" | "nric" | "contact" | "remarks" | "org" | "site" | "start" | "end" | "type" | "isOwner"> & { status?: string }
+// `""` is the FORM's "nothing picked yet" - it is stripped from the payload
+// before it is sent, because absence is what the server reads as "never
+// asked". See `PeopleFormMgmt.vue`.
+declare type TPeoplePayload = Pick<TGuest, "name" | "block" | "level" | "unit" | "unitName" | "contact" | "plateNumber" | "nric" | "contact" | "remarks" | "org" | "site" | "start" | "end" | "type" | "isOwner"> & { status?: string; user?: string; occupancyRole?: TOccupancyRole | "" }
 
 declare type TPeopleType = "guest" | "resident" | "tenant"

package/types/service-provider.d.ts

@@ -7,6 +7,11 @@ declare type TServiceProvider = {
   serviceProviderOrgId: string;
   type: string;
   nature: string;
+  status?: string;
+  email?: string;
+  /** The building unit this provider serves (a unit's Management tab). */
+  unit?: string | null;
+  unitName?: string;
 };
 
 declare type TServiceProviderName = {

package/types/site.d.ts

@@ -5,7 +5,10 @@ declare type THidQrCodeFormat = "0" | "1" | "2";
 declare type THidPermissionCategory =
   | "resident"
   | "property_management"
-  | "service_provider";
+  /** A provider COMPANY - granting one admits every active member of that org. */
+  | "service_provider"
+  /** ONE PERSON from a provider company, by their membership at this site. */
+  | "service_provider_member";
 
 declare type THidPermissionAssignment = {
   subjectId: string;
@@ -27,7 +30,10 @@ declare type THidSitePermissions = {
   counts: {
     resident: number;
     propertyManagement: number;
+    /** Provider COMPANIES granted. */
     serviceProvider: number;
+    /** Named provider people granted. Counted apart from the companies. */
+    serviceProviderMember: number;
     intercom: number;
   };
 };

package/utils/attendance-proxy.ts

@@ -0,0 +1,110 @@
+/**
+ * Site device mode (owner request 2026-10-01): one shared phone at a site checks
+ * a person in or out with a photo, their name and their NRIC/FIN.
+ *
+ * Privacy (Singapore PDPA): the full NRIC is masked HERE, in the browser,
+ * before anything is sent. Only the last 4 characters leave the device, plus
+ * the prefix letter when the full number was typed, so the record can be shown
+ * as "G****932P" (owner's display rule); last 4 only is shown as "****932P".
+ */
+
+export const FULL_NRIC_RE = /^[STFGM]\d{7}[A-Z]$/;
+export const NRIC_LAST4_RE = /^\d{3}[A-Z]$/;
+const FULL_NRIC_ANYWHERE_RE = /[STFGM]\d{7}[A-Z]/i;
+
+export type TParsedNric =
+  | { ok: true; nricLast4: string; nricPrefix: string; masked: string; typedFull: boolean }
+  | { ok: false; error: string };
+
+/** Full NRIC/FIN or just its last 4, any case, spaces ignored. */
+export function parseNric(input: unknown): TParsedNric {
+  const value = String(input ?? "").replace(/\s+/g, "").toUpperCase();
+  if (!value) return { ok: false, error: "Type the NRIC/FIN, or just its last 4 characters (e.g. 932P)." };
+  if (FULL_NRIC_RE.test(value)) {
+    const nricLast4 = value.slice(-4);
+    const nricPrefix = value[0];
+    return { ok: true, nricLast4, nricPrefix, masked: `${nricPrefix}****${nricLast4}`, typedFull: true };
+  }
+  if (NRIC_LAST4_RE.test(value)) {
+    return { ok: true, nricLast4: value, nricPrefix: "", masked: `****${value}`, typedFull: false };
+  }
+  return {
+    ok: false,
+    error: "That doesn't look like an NRIC/FIN. Type the full number (e.g. S1234567D) or just the last 4 (e.g. 567D).",
+  };
+}
+
+/** Empty string when fine, otherwise the sentence to show. */
+export function nameError(input: unknown): string {
+  const value = String(input ?? "").trim();
+  if (!value) return "Type the person's name.";
+  if (FULL_NRIC_ANYWHERE_RE.test(value)) return "Please type the NRIC in the NRIC box, not in the name.";
+  if (value.length < 2) return "Type the person's full name.";
+  if (value.length > 80) return "The name is too long (80 characters at most).";
+  return "";
+}
+
+export function postError(input: unknown): string {
+  const value = String(input ?? "").trim();
+  if (FULL_NRIC_ANYWHERE_RE.test(value)) return "Please don't type an NRIC in Shift / post.";
+  if (value.length > 80) return "Shift / post is too long (80 characters at most).";
+  return "";
+}
+
+/** What is sent to the server. Never contains the full NRIC. */
+export function proxyPayload(input: { name: string; nric: string; post?: string }) {
+  const parsed = parseNric(input.nric);
+  if (!parsed.ok) throw new Error(parsed.error);
+  const name = String(input.name).trim().replace(/\s+/g, " ");
+  const post = String(input.post ?? "").trim();
+  return {
+    name,
+    nricLast4: parsed.nricLast4,
+    ...(parsed.nricPrefix ? { nricPrefix: parsed.nricPrefix } : {}),
+    ...(post ? { post } : {}),
+  };
+}
+
+/** CSV cell: quoted, and a leading = + - @ neutralised so a spreadsheet never runs it. */
+function csvCell(value: unknown): string {
+  let text = value === null || value === undefined ? "" : String(value);
+  if (/^[=+\-@\t\r]/.test(text)) text = `'${text}`;
+  return `"${text.replace(/"/g, '""')}"`;
+}
+
+export function toCsv(headers: string[], rows: unknown[][]): string {
+  return [headers, ...rows].map((row) => row.map(csvCell).join(",")).join("\r\n");
+}
+
+/** One export row for an attendance list item (web Attendance page). */
+export function attendanceCsvRow(
+  item: Record<string, any>,
+  photoLink: (id: string, which: "checkIn" | "checkOut") => string,
+  formatDate: (d: unknown) => string,
+): unknown[] {
+  return [
+    item.isProxy ? item.proxyName : item.userName,
+    item.isProxy ? item.nricMasked : "",
+    item.isProxy ? item.post ?? "" : "",
+    item.isProxy ? `Site device (${item.userName ?? ""})` : "Own account",
+    item.checkInTimestamp ? formatDate(item.checkInTimestamp) : "",
+    item.checkOutTimestamp ? formatDate(item.checkOutTimestamp) : "",
+    item.totalHours ?? "",
+    item.hasCheckInPhoto ? photoLink(String(item._id), "checkIn") : "",
+    item.hasCheckOutPhoto ? photoLink(String(item._id), "checkOut") : "",
+    item.suspicious ? item.suspiciousReason : "",
+  ];
+}
+
+export const ATTENDANCE_CSV_HEADERS = [
+  "Person",
+  "NRIC (last 4)",
+  "Shift / post",
+  "Taken on",
+  "Check in",
+  "Check out",
+  "Total hours",
+  "Check-in photo",
+  "Check-out photo",
+  "Check this",
+];