@justair/justair-library 7.6.0 → 7.7.0-alpha.3af709a

package/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are prioritized for the current default branch and actively supported releases of `JustAir-Solutions/justair-library`. Older or retired versions may not receive fixes.
+
+## Reporting a vulnerability
+
+Do not open a public GitHub issue for a suspected vulnerability.
+
+Send the initial report to `info@justair.co` with the subject `Security vulnerability: justair-library`. Include the affected repository or component, the potential impact, minimal reproduction steps, and a way to contact you.
+
+Do not include passwords, tokens, private keys, personal data, regulated data, or other sensitive payloads in the initial message. Ask for an approved secure transfer method when sensitive evidence is necessary.
+
+## Testing boundaries
+
+This policy does not grant authorization to access data that is not yours, disrupt service, perform denial-of-service testing, use social engineering, destroy data, or establish persistence. Stop testing and report the issue if sensitive data or credentials are encountered.
+
+## Coordinated disclosure
+
+Please allow JustAir reasonable time to investigate and remediate before public disclosure. Receipt of a report does not create a promise of a specific response or remediation timeline.

package/dist/constants/index.d.ts

@@ -4,4 +4,5 @@ export * from "./userNotifications.js";
 export * from "./deviceTypes.js";
 export * from "./timezones.js";
 export * from "./dataDownloads.js";
+export * from "./terms.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/terms.d.ts

@@ -0,0 +1,2 @@
+export const TERMS_VERSION_MAX_LENGTH: 32;
+//# sourceMappingURL=terms.d.ts.map

package/dist/constants/terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.d.ts","sourceRoot":"","sources":["../../src/constants/terms.js"],"names":[],"mappings":"AAaA,0CAA2C"}

package/dist/index.d.ts

@@ -103,6 +103,7 @@ import { PARAMETERS } from "./constants/pollutants.js";
 import { HEAVY_METALS } from "./constants/pollutants.js";
 import { ALERT_LEVEL_WEIGHTS } from "./constants/alertLevels.js";
 import { getAlertWeight } from "./constants/alertLevels.js";
+import { TERMS_VERSION_MAX_LENGTH } from "./constants/terms.js";
 import { DEVICE_TYPES } from "./constants/deviceTypes.js";
 import { DEVICE_TYPE_VALUES } from "./constants/deviceTypes.js";
 import { isAqiCapableDeviceType } from "./constants/deviceTypes.js";
@@ -121,5 +122,5 @@ import { validateQuietHours } from "./utils/quietHours.js";
 import { getZoneMinutes } from "./utils/quietHours.js";
 import { isInQuietWindow } from "./utils/quietHours.js";
 import { resolveQuietHours } from "./utils/quietHours.js";
-export { Database, adminSchema, Admin, configurationsSchema, Configurations, measurementsSchema, Measurements, monitorRequestsSchema, MonitorRequests, monitorsSchema, Monitors, organizationsSchema, Organizations, usersSchema, Users, COOKIE_CONSENT_CATEGORIES, COOKIE_CONSENT_VALUES, validateCookieConsent, eventsSchema, Events, lightMonitorSchema, LightMonitors, monitorSuppliersSchema, MonitorSuppliers, contextsSchema, Contexts, parametersSchema, Parameters, announcementSchema, Announcements, jobsSchema, Jobs, apiKeySchema, ApiKey, UsageMetrics, usageMetricsSchema, Audit, auditSchema, EventsAudit, eventsAuditSchema, MonitorAudit, monitorAuditSchema, parametersEnum, deploymentTypesEnum, AlertsAudit, Alerts, alertsSchema, alertsAuditSchema, Features, featuresSchema, dataCompletenessSchema, DataCompleteness, networkMetricsSchema, NetworkMetrics, rateOfChangeSchema, RateOfChange, changeStreamCheckpointsSchema, ChangeStreamCheckpoints, sitesSchema, Sites, sampleSitesSchema, SampleSites, sampleSiteAuditSchema, SampleSiteAudit, sampleParametersEnum, samplesSchema, Samples, samplesAuditSchema, SamplesAudit, sampleParameterReferenceConcentrations, passwordResetTokenSchema, PasswordResetToken, monitorEpisodesSchema, MonitorEpisode, userNotificationsSchema, UserNotification, AqiAlertNotification, DeviceOfflineNotification, WeeklyDigestNotification, AccountNotification, NOTIFICATION_KINDS, NOTIFICATION_CHANNELS, DELIVERY_STATUSES, DATA_DOWNLOAD_TYPES, dataDownloadSchema, DataDownloads, AqiDataDownload, SampleDataDownload, DATA_DOWNLOAD_MAX_RANGE_DAYS, DATA_DOWNLOAD_ERRORS, validateDataDownloadDateOrder, validateDataDownloadMaxDateRange, validateDataDownloadEmail, normalizeDataDownloadEmail, validateDataDownloadTimezone, normalizeDataDownloadTimezone, PARAMETERS, HEAVY_METALS, ALERT_LEVEL_WEIGHTS, getAlertWeight, DEVICE_TYPES, DEVICE_TYPE_VALUES, isAqiCapableDeviceType, AQI_CAPABLE_DEVICE_TYPES, projectSubscribedMonitors, resolveSubscribedMonitorIdsByUser, VISIBLE_SITE_MONITOR_FILTER, SUBSCRIBED_DEVICES_ERRORS, splitName, DEFAULT_QUIET_HOURS, DEFAULT_TIMEZONE, QUIET_HOURS_ERRORS, isValidTimeString, isValidIANATimezone, validateQuietHours, getZoneMinutes, isInQuietWindow, resolveQuietHours };
+export { Database, adminSchema, Admin, configurationsSchema, Configurations, measurementsSchema, Measurements, monitorRequestsSchema, MonitorRequests, monitorsSchema, Monitors, organizationsSchema, Organizations, usersSchema, Users, COOKIE_CONSENT_CATEGORIES, COOKIE_CONSENT_VALUES, validateCookieConsent, eventsSchema, Events, lightMonitorSchema, LightMonitors, monitorSuppliersSchema, MonitorSuppliers, contextsSchema, Contexts, parametersSchema, Parameters, announcementSchema, Announcements, jobsSchema, Jobs, apiKeySchema, ApiKey, UsageMetrics, usageMetricsSchema, Audit, auditSchema, EventsAudit, eventsAuditSchema, MonitorAudit, monitorAuditSchema, parametersEnum, deploymentTypesEnum, AlertsAudit, Alerts, alertsSchema, alertsAuditSchema, Features, featuresSchema, dataCompletenessSchema, DataCompleteness, networkMetricsSchema, NetworkMetrics, rateOfChangeSchema, RateOfChange, changeStreamCheckpointsSchema, ChangeStreamCheckpoints, sitesSchema, Sites, sampleSitesSchema, SampleSites, sampleSiteAuditSchema, SampleSiteAudit, sampleParametersEnum, samplesSchema, Samples, samplesAuditSchema, SamplesAudit, sampleParameterReferenceConcentrations, passwordResetTokenSchema, PasswordResetToken, monitorEpisodesSchema, MonitorEpisode, userNotificationsSchema, UserNotification, AqiAlertNotification, DeviceOfflineNotification, WeeklyDigestNotification, AccountNotification, NOTIFICATION_KINDS, NOTIFICATION_CHANNELS, DELIVERY_STATUSES, DATA_DOWNLOAD_TYPES, dataDownloadSchema, DataDownloads, AqiDataDownload, SampleDataDownload, DATA_DOWNLOAD_MAX_RANGE_DAYS, DATA_DOWNLOAD_ERRORS, validateDataDownloadDateOrder, validateDataDownloadMaxDateRange, validateDataDownloadEmail, normalizeDataDownloadEmail, validateDataDownloadTimezone, normalizeDataDownloadTimezone, PARAMETERS, HEAVY_METALS, ALERT_LEVEL_WEIGHTS, getAlertWeight, TERMS_VERSION_MAX_LENGTH, DEVICE_TYPES, DEVICE_TYPE_VALUES, isAqiCapableDeviceType, AQI_CAPABLE_DEVICE_TYPES, projectSubscribedMonitors, resolveSubscribedMonitorIdsByUser, VISIBLE_SITE_MONITOR_FILTER, SUBSCRIBED_DEVICES_ERRORS, splitName, DEFAULT_QUIET_HOURS, DEFAULT_TIMEZONE, QUIET_HOURS_ERRORS, isValidTimeString, isValidIANATimezone, validateQuietHours, getZoneMinutes, isInQuietWindow, resolveQuietHours };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.js"],"names":[],"mappings":"AAyKA;;;iBAEC;yBAtGwB,oBAAoB;qBADxB,gBAAgB;4BApEF,mBAAmB;sBAAnB,mBAAmB;qCAI/C,4BAA4B;+BAA5B,4BAA4B;mCAM5B,0BAA0B;6BAA1B,0BAA0B;sCAI1B,6BAA6B;gCAA7B,6BAA6B;+BAQ7B,sBAAsB;yBAAtB,sBAAsB;oCACsB,2BAA2B;8BAA3B,2BAA2B;4BAcvE,mBAAmB;sBAAnB,mBAAmB;0CAAnB,mBAAmB;sCAAnB,mBAAmB;sCAAnB,mBAAmB;6BAMnB,oBAAoB;uBAApB,oBAAoB;mCAnBuB,2BAA2B;8BAA3B,2BAA2B;uCAItE,8BAA8B;iCAA9B,8BAA8B;+BACI,sBAAsB;yBAAtB,sBAAsB;iCAClB,wBAAwB;2BAAxB,wBAAwB;mCAcnB,2BAA2B;8BAA3B,2BAA2B;2BAC5C,kBAAkB;qBAAlB,kBAAkB;6BACd,oBAAoB;uBAApB,oBAAoB;6BACR,0BAA0B;mCAA1B,0BAA0B;sBArCpE,0BAA0B;4BAA1B,0BAA0B;4BAiC1B,oBAAoB;kCAApB,oBAAoB;6BArBpB,sBAAsB;mCAAtB,sBAAsB;+BAAtB,sBAAsB;oCAAtB,sBAAsB;4BA+BtB,oBAAoB;uBAApB,oBAAoB;6BAApB,oBAAoB;kCAApB,oBAAoB;yBACc,sBAAsB;+BAAtB,sBAAsB;uCAIxD,8BAA8B;iCAA9B,8BAA8B;qCAI9B,4BAA4B;+BAA5B,4BAA4B;mCACc,0BAA0B;6BAA1B,0BAA0B;8CAIpE,qCAAqC;wCAArC,qCAAqC;4BAkDT,mBAAmB;sBAAnB,mBAAmB;kCAS/C,yBAAyB;4BAAzB,yBAAyB;sCAAzB,yBAAyB;gCAAzB,yBAAyB;qCAAzB,yBAAyB;8BASzB,qBAAqB;wBAArB,qBAAqB;mCAArB,qBAAqB;6BAArB,qBAAqB;uDAArB,qBAAqB;yCAIrB,gCAAgC;mCAAhC,gCAAgC;sCArDhC,6BAA6B;+BAA7B,6BAA6B;wCAW7B,+BAA+B;iCAA/B,+BAA+B;qCAA/B,+BAA+B;0CAA/B,+BAA+B;yCAA/B,+BAA+B;oCAA/B,+BAA+B;mCAA/B,+BAA+B;sCAA/B,+BAA+B;kCAA/B,+BAA+B;oCArBF,8BAA8B;mCAqE3D,2BAA2B;8BAA3B,2BAA2B;gCAA3B,2BAA2B;mCAA3B,2BAA2B;+DAsB3B,mCAAmC;qCAAnC,mCAAmC;mEAAnC,mCAAmC;yEAAnC,mCAAmC;mEAAnC,mCAAmC;qEAAnC,mCAAmC;yEAAnC,mCAAmC;2EAAnC,mCAAmC;2BAjGD,2BAA2B;6BAA3B,2BAA2B;oCAI7D,4BAA4B;+BAA5B,4BAA4B;6BAQ5B,4BAA4B;mCAA5B,4BAA4B;uCAA5B,4BAA4B;yCAA5B,4BAA4B;0CAgC5B,8BAA8B;kDAA9B,8BAA8B;4CAA9B,8BAA8B;0CAA9B,8BAA8B;0BAhBX,sBAAsB;oCASzC,uBAAuB;iCAhCG,0BAA0B;mCAgCpD,uBAAuB;kCAAvB,uBAAuB;oCACM,qBAAqB;mCADlD,uBAAuB;+BAAvB,uBAAuB;gCAAvB,uBAAuB;kCAAvB,uBAAuB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.js"],"names":[],"mappings":"AA0KA;;;iBAEC;yBAvGwB,oBAAoB;qBADxB,gBAAgB;4BApEF,mBAAmB;sBAAnB,mBAAmB;qCAI/C,4BAA4B;+BAA5B,4BAA4B;mCAM5B,0BAA0B;6BAA1B,0BAA0B;sCAI1B,6BAA6B;gCAA7B,6BAA6B;+BAQ7B,sBAAsB;yBAAtB,sBAAsB;oCACsB,2BAA2B;8BAA3B,2BAA2B;4BAcvE,mBAAmB;sBAAnB,mBAAmB;0CAAnB,mBAAmB;sCAAnB,mBAAmB;sCAAnB,mBAAmB;6BAMnB,oBAAoB;uBAApB,oBAAoB;mCAnBuB,2BAA2B;8BAA3B,2BAA2B;uCAItE,8BAA8B;iCAA9B,8BAA8B;+BACI,sBAAsB;yBAAtB,sBAAsB;iCAClB,wBAAwB;2BAAxB,wBAAwB;mCAcnB,2BAA2B;8BAA3B,2BAA2B;2BAC5C,kBAAkB;qBAAlB,kBAAkB;6BACd,oBAAoB;uBAApB,oBAAoB;6BACR,0BAA0B;mCAA1B,0BAA0B;sBArCpE,0BAA0B;4BAA1B,0BAA0B;4BAiC1B,oBAAoB;kCAApB,oBAAoB;6BArBpB,sBAAsB;mCAAtB,sBAAsB;+BAAtB,sBAAsB;oCAAtB,sBAAsB;4BA+BtB,oBAAoB;uBAApB,oBAAoB;6BAApB,oBAAoB;kCAApB,oBAAoB;yBACc,sBAAsB;+BAAtB,sBAAsB;uCAIxD,8BAA8B;iCAA9B,8BAA8B;qCAI9B,4BAA4B;+BAA5B,4BAA4B;mCACc,0BAA0B;6BAA1B,0BAA0B;8CAIpE,qCAAqC;wCAArC,qCAAqC;4BAmDT,mBAAmB;sBAAnB,mBAAmB;kCAS/C,yBAAyB;4BAAzB,yBAAyB;sCAAzB,yBAAyB;gCAAzB,yBAAyB;qCAAzB,yBAAyB;8BASzB,qBAAqB;wBAArB,qBAAqB;mCAArB,qBAAqB;6BAArB,qBAAqB;uDAArB,qBAAqB;yCAIrB,gCAAgC;mCAAhC,gCAAgC;sCArDhC,6BAA6B;+BAA7B,6BAA6B;wCAW7B,+BAA+B;iCAA/B,+BAA+B;qCAA/B,+BAA+B;0CAA/B,+BAA+B;yCAA/B,+BAA+B;oCAA/B,+BAA+B;mCAA/B,+BAA+B;sCAA/B,+BAA+B;kCAA/B,+BAA+B;oCAtBF,8BAA8B;mCAsE3D,2BAA2B;8BAA3B,2BAA2B;gCAA3B,2BAA2B;mCAA3B,2BAA2B;+DAsB3B,mCAAmC;qCAAnC,mCAAmC;mEAAnC,mCAAmC;yEAAnC,mCAAmC;mEAAnC,mCAAmC;qEAAnC,mCAAmC;yEAAnC,mCAAmC;2EAAnC,mCAAmC;2BAlGD,2BAA2B;6BAA3B,2BAA2B;oCAI7D,4BAA4B;+BAA5B,4BAA4B;yCAGM,sBAAsB;6BAMxD,4BAA4B;mCAA5B,4BAA4B;uCAA5B,4BAA4B;yCAA5B,4BAA4B;0CAgC5B,8BAA8B;kDAA9B,8BAA8B;4CAA9B,8BAA8B;0CAA9B,8BAA8B;0BAhBX,sBAAsB;oCASzC,uBAAuB;iCAjCG,0BAA0B;mCAiCpD,uBAAuB;kCAAvB,uBAAuB;oCACM,qBAAqB;mCADlD,uBAAuB;+BAAvB,uBAAuB;gCAAvB,uBAAuB;kCAAvB,uBAAuB"}

package/dist/models/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/models/users.js"],"names":[],"mappings":"AA6FA,8BA0GE;AAiCF,wBAAmD;AA/NnD,iDAA4D;AAC5D,6CAAmD;AAUnD,4DA0BC"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/models/users.js"],"names":[],"mappings":"AA8FA,8BAmIE;AAiCF,wBAAmD;AAxPnD,iDAA4D;AAC5D,6CAAmD;AAUnD,4DA0BC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justair/justair-library",
-  "version": "7.6.0",
+  "version": "7.7.0-alpha.3af709a",
   "description": "JustAir Internal Library",
   "main": "src/index.js",
   "type": "module",

package/src/constants/index.js

@@ -13,3 +13,4 @@ export * from "./userNotifications.js";
 export * from "./deviceTypes.js";
 export * from "./timezones.js";
 export * from "./dataDownloads.js";
+export * from "./terms.js";

package/src/constants/terms.js

@@ -0,0 +1,14 @@
+// Terms-of-service agreement vocabulary.
+//
+// Users.termsVersion stores the policy-document version a public user agreed
+// to at registration (e.g. "2026.1" — the published doc's tab name). The
+// VALUE is owned by the frontend signup flow; nothing in the
+// backend hardcodes a current version, so there is deliberately no
+// TERMS_CURRENT_VERSION constant here.
+//
+// The cap below is the one number shared by the two enforcement points in
+// different repos: the Users schema (`maxlength`) and JustAirUserService's
+// registration route validator. Import it from either barrel rather than
+// inlining the literal — if the two drift, the route accepts what the schema
+// rejects and a signup 500s instead of 400ing.
+export const TERMS_VERSION_MAX_LENGTH = 32;

package/src/constants/tests/constantsBarrel.test.js

@@ -8,6 +8,7 @@ import { PARAMETERS, HEAVY_METALS } from '../pollutants.js';
 import { ALERT_LEVEL_WEIGHTS, getAlertWeight } from '../alertLevels.js';
 import { DEFAULT_TIMEZONE } from '../timezones.js';
 import { DATA_DOWNLOAD_TYPES } from '../dataDownloads.js';
+import { TERMS_VERSION_MAX_LENGTH } from '../terms.js';
 
 test('barrel re-exports the pollutants constants unchanged (identity, not copies)', () => {
   expect(barrel.PARAMETERS).toBe(PARAMETERS);
@@ -56,6 +57,11 @@ test('barrel exports DATA_DOWNLOAD_TYPES (browser-safe, no Mongoose)', () => {
   expect(barrel.DATA_DOWNLOAD_TYPES).toBe(DATA_DOWNLOAD_TYPES);
 });
 
+test('barrel exports TERMS_VERSION_MAX_LENGTH (browser-safe, no Mongoose)', () => {
+  expect(barrel.TERMS_VERSION_MAX_LENGTH).toBe(TERMS_VERSION_MAX_LENGTH);
+  expect(TERMS_VERSION_MAX_LENGTH).toBe(32);
+});
+
 // models/dataDownloads.js destructures this list positionally to build the two
 // discriminators, so a reorder would silently swap the persisted dataType
 // values on every future download. Pin contents AND order.

package/src/index.js

@@ -75,6 +75,7 @@ import {
 } from "./constants/alertLevels.js";
 import { DEFAULT_TIMEZONE } from "./constants/timezones.js";
 import { DATA_DOWNLOAD_TYPES } from "./constants/dataDownloads.js";
+import { TERMS_VERSION_MAX_LENGTH } from "./constants/terms.js";
 import {
   DEVICE_TYPES,
   DEVICE_TYPE_VALUES,
@@ -280,6 +281,9 @@ export {
   // AQI alert-level hierarchy (single source of truth)
   ALERT_LEVEL_WEIGHTS,
   getAlertWeight,
+  // Terms agreement (JA-3396) — cap shared by the Users schema and
+  // JustAirUserService's registration route validator
+  TERMS_VERSION_MAX_LENGTH,
   // V2 device-type vocabulary (single source of truth) — JA-3110 / JA-3335
   DEVICE_TYPES,
   DEVICE_TYPE_VALUES,

package/src/models/users.js

@@ -6,6 +6,7 @@ import {
   QUIET_HOURS_ERRORS,
 } from "../utils/quietHours.js";
 import { DEVICE_TYPE_VALUES } from "../constants/deviceTypes.js";
+import { TERMS_VERSION_MAX_LENGTH } from "../constants/terms.js";
 
 const COOKIE_CONSENT_CATEGORIES = ["analytics_performance"];
 const COOKIE_CONSENT_VALUES = ["accept", "reject"];
@@ -193,6 +194,31 @@ const usersSchema = mongoose.Schema(
         message: "timezone must be a valid IANA timezone identifier",
       },
     },
+    // Terms agreement: the policy-document version the user agreed to at
+    // registration (e.g. "2026.1"). The client supplies the value (the signup
+    // FE owns it); the backend never hardcodes a
+    // current version. Written once at account creation — `immutable` means
+    // save() mutations are ignored and strict-mode query updates are
+    // stripped, silently by design; treat any need to change it as a product
+    // decision, not a bug. Absent = registered before terms tracking existed
+    // (or a legacy client that sent only { phone }); absence is legal
+    // forever. Deliberately NO acceptance boolean (an account cannot be
+    // created without pressing "I Agree", so it would be true on every
+    // record) and NO separate acceptance timestamp — createdAt IS the
+    // agreement date (grooming decision, 2026-09-03).
+    //
+    // Blank guard: immutability makes a stored value permanent, so a blank or
+    // padded string ("" / "  2026.1") would be an uncorrectable third state —
+    // looks present, records nothing. trim + minlength reject it here as the
+    // backstop; the registration route validator (JA-3397) is the primary
+    // 400 path, both sharing TERMS_VERSION_MAX_LENGTH.
+    termsVersion: {
+      type: String,
+      trim: true,
+      minlength: 1,
+      immutable: true,
+      maxlength: TERMS_VERSION_MAX_LENGTH,
+    },
   },
   {
     timestamps: true,