iobroker.zeiterfassung 0.1.2 → 0.1.3

package/README.md

@@ -305,6 +305,19 @@ local SQLite file, access is role-based, and every correction is written to an a
 
 ### **WORK IN PROGRESS**
 
+### 0.1.3 (2026-09-18)
+
+- (Alex) fix: the badge (RFID/NFC) tab builds the link from the address the administration is **currently** open
+  with — scheme, host and port come from the browser, so the link works on a plain HTTP instance and behind a reverse
+  proxy alike, and no server side guess can point at a scheme the instance does not serve
+- (Alex) fix: the badge (RFID/NFC) tab shows the state of every badge — active, expired or revoked — and when it was
+  last used. A revoked badge now offers “Remove permanently” instead of failing with “not found”: the old entry
+  disappears from the list, while the audit trail keeps the trace of it
+- (Alex) translations: a technical review pass over the 11 languages — the punch, break, absence, badge and overtime
+  text families were compared with each other. Five wrong `reports.overtime` labels were corrected (`pt`, `fr`, `it`,
+  `es`, `zh-cn` said “over time” instead of overtime), and the Polish punch labels now use the same root as the badge
+  texts. `docs/i18n.md` records the method and what a native speaker still has to settle
+
 ### 0.1.2 (2026-09-18)
 
 - (Alex) fix: a badge (RFID/NFC) link points to the address the administration itself is reached with — the scheme
@@ -353,18 +366,6 @@ local SQLite file, access is role-based, and every correction is written to an a
   per employee `monthWorkedMinutes`/`monthBalanceMinutes`/`yearBalanceMinutes` and `events.lastAt`/`lastType`/
   `lastUser`/`lastDirection`/`lastSource`
 
-### 0.0.18 (2026-09-18)
-
-- (Alex) fix: an uploaded background picture can be taken away again — every picture field has a “Remove picture”
-  button (the logo as well), and “Default” resets the colour and the background picture in one click
-- internal: the settings dialog shows the stored logo and background picture again (a read leaves the large pictures
-  out on purpose, so the preview and the remove button come from the branding route)
-- (Alex) internal: the release flow asks the owner before the version commit and the tag — the question “may I push,
-  or do you have remarks?” comes first and only a “go” leads to commit, tag and push; `CONTRIBUTING.md` documents
-  the step and `npm run push:approve` reminds of it
-- internal: the lint ignores the generated report of the browser tests (it carried a bundled viewer and made a local
-  `npm run lint` crash)
-
 Older entries are kept in [`CHANGELOG_OLD.md`](CHANGELOG_OLD.md).
 
 ## Provenance

package/build/lib/db/repositories/rfid.js

@@ -82,6 +82,7 @@ function createRfidRepository(db) {
   );
   const updateLastUsed = db.prepare("UPDATE rfid_tags SET last_used_at = ? WHERE id = ?");
   const deactivate = db.prepare("UPDATE rfid_tags SET is_active = 0 WHERE id = ?");
+  const deleteTag = db.prepare("DELETE FROM rfid_tags WHERE id = ?");
   const read = (id) => {
     const row = selectById.get(id);
     return row ? mapTagRow(row) : null;
@@ -174,6 +175,29 @@ function createRfidRepository(db) {
       });
       run();
       return true;
+    },
+    remove(input) {
+      var _a;
+      const tag = read(input.id);
+      if (!tag) {
+        return false;
+      }
+      const now = (_a = input.now) != null ? _a : Math.floor(Date.now() / 1e3);
+      const run = db.transaction(() => {
+        var _a2;
+        deleteTag.run(input.id);
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          actorId: input.actorId,
+          action: "rfid.delete",
+          entity: "rfid_tag",
+          entityId: input.id,
+          detail: { uid: tag.uid, userId: tag.userId, isActive: tag.isActive },
+          ip: (_a2 = input.actorIp) != null ? _a2 : null
+        });
+      });
+      run();
+      return true;
     }
   };
 }

package/build/lib/db/repositories/rfid.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/lib/db/repositories/rfid.ts"],
-  "sourcesContent": ["/**\n * RFID/NFC tags (`rfid_tags`).\n *\n * A tag is a **signed deep link**: `uid.userId.exp.signature`, where the signature is\n * `HMAC-SHA256(hmacSecret, \"uid.userId.exp\")`. That way a tag needs no login on the scanning phone, cannot be\n * guessed (a forged payload fails the signature) and can be revoked or given an expiry. The stored `token_hash`\n * is the signature itself; the extra `uid` row keeps the lookup cheap and lets a tag be revoked individually.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type { Db } from \"../database\";\nimport { ValidationError } from \"../../errors\";\nimport { writeAuditLog } from \"./audit\";\n\n/** A tag as it is stored (without the signature). */\nexport interface RfidTagRecord {\n\t/** Primary key */\n\tid: number;\n\t/** Identifier of the tag (`uid` of the NFC tag or a generated value) */\n\tuid: string;\n\t/** Owner of the tag, `null` after the user was deleted */\n\tuserId: number | null;\n\t/** Free-form label */\n\tlabel: string | null;\n\t/** False for revoked tags */\n\tisActive: boolean;\n\t/** Instant the tag stops working, `null` = never */\n\texpiresAt: number | null;\n\t/** Instant of the last scan, `null` if never used */\n\tlastUsedAt: number | null;\n\t/** Instant of creation, UTC epoch seconds */\n\tcreatedAt: number;\n}\n\n/** Tag storage operations. */\nexport interface RfidRepository {\n\t/** Creates a tag and audits it (the signature is never written to the audit trail) */\n\tcreate(input: {\n\t\tuid: string;\n\t\tuserId: number;\n\t\tsignature: string;\n\t\tlabel?: string | null;\n\t\t/** Instant the tag stops working, `null` = never */\n\t\texpiresAt?: number | null;\n\t\tactorId: number;\n\t\tactorIp?: string | null;\n\t\tnow?: number;\n\t}): RfidTagRecord;\n\t/** All tags, optionally including the revoked ones */\n\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[];\n\t/** Reads a tag by id */\n\tfindById(id: number): RfidTagRecord | null;\n\t/** Checks a scanned token and returns the tag when signature, activity, owner and expiry match */\n\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null;\n\t/** Records a successful scan */\n\ttouch(input: { id: number; now?: number }): void;\n\t/** Revokes a tag */\n\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean;\n}\n\n/**\n * Creates a random tag identifier.\n *\n * @returns base64url encoded identifier\n */\nexport function newTagUid(): string {\n\treturn randomBytes(16).toString(\"base64url\");\n}\n\n/**\n * Signs a tag payload.\n *\n * @param secret - instance secret (`hmacSecret`)\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload, UTC epoch seconds\n * @returns base64url encoded signature\n */\nexport function signTag(secret: string, uid: string, userId: number, expiresAt: number): string {\n\treturn createHmac(\"sha256\", secret).update(`${uid}.${userId}.${expiresAt}`).digest(\"base64url\");\n}\n\n/**\n * Builds the token a tag carries.\n *\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload\n * @param signature - signature of the payload\n * @returns the token\n */\nexport function buildTagToken(uid: string, userId: number, expiresAt: number, signature: string): string {\n\treturn `${uid}.${userId}.${expiresAt}.${signature}`;\n}\n\n/**\n * Splits a scanned token.\n *\n * @param token - token from the deep link or the QR code\n * @returns the parsed payload or `null` when the token is malformed\n */\nexport function parseTagToken(\n\ttoken: string,\n): { uid: string; userId: number; expiresAt: number; signature: string } | null {\n\tconst parts = token.trim().split(\".\");\n\tif (parts.length !== 4) {\n\t\treturn null;\n\t}\n\tconst [uid, rawUserId, rawExpires, signature] = parts;\n\tconst userId = Number(rawUserId);\n\tconst expiresAt = Number(rawExpires);\n\tif (!uid || !signature || !Number.isInteger(userId) || !Number.isInteger(expiresAt)) {\n\t\treturn null;\n\t}\n\treturn { uid, userId, expiresAt, signature };\n}\n\n/**\n * Compares two signatures without leaking the position of the first difference.\n *\n * @param expected - signature computed by the server\n * @param received - signature from the token\n * @returns true when both are identical\n */\nexport function sameSignature(expected: string, received: string): boolean {\n\tconst left = Buffer.from(expected);\n\tconst right = Buffer.from(received);\n\treturn left.length === right.length && timingSafeEqual(left, right);\n}\n\ninterface RfidRow {\n\tid: number;\n\tuid: string;\n\ttoken_hash: string;\n\tuser_id: number | null;\n\tlabel: string | null;\n\tis_active: number;\n\texpires_at: number | null;\n\tlast_used_at: number | null;\n\tcreated_at: number;\n}\n\nconst TAG_COLUMNS = `id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at`;\n\n/**\n * Maps a database row to a tag record (the signature stays inside the repository).\n *\n * @param row - raw database row\n * @returns tag record\n */\nfunction mapTagRow(row: RfidRow): RfidTagRecord {\n\treturn {\n\t\tid: row.id,\n\t\tuid: row.uid,\n\t\tuserId: row.user_id,\n\t\tlabel: row.label,\n\t\tisActive: row.is_active !== 0,\n\t\texpiresAt: row.expires_at,\n\t\tlastUsedAt: row.last_used_at,\n\t\tcreatedAt: row.created_at,\n\t};\n}\n\n/**\n * Creates the tag repository.\n *\n * @param db - open database handle\n * @returns repository instance\n */\nexport function createRfidRepository(db: Db): RfidRepository {\n\tconst insertTag = db.prepare(\n\t\t`INSERT INTO rfid_tags (uid, token_hash, user_id, label, is_active, expires_at, created_at)\n\t\t VALUES (?, ?, ?, ?, 1, ?, ?)`,\n\t);\n\tconst selectById = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE id = ?`);\n\tconst selectByUid = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE uid = ?`);\n\tconst selectAll = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags ORDER BY created_at DESC, id DESC`);\n\tconst selectActive = db.prepare(\n\t\t`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE is_active = 1 ORDER BY created_at DESC, id DESC`,\n\t);\n\tconst updateLastUsed = db.prepare(\"UPDATE rfid_tags SET last_used_at = ? WHERE id = ?\");\n\tconst deactivate = db.prepare(\"UPDATE rfid_tags SET is_active = 0 WHERE id = ?\");\n\n\t/**\n\t * Reads a tag.\n\t *\n\t * @param id - tag id\n\t * @returns tag or `null`\n\t */\n\tconst read = (id: number): RfidTagRecord | null => {\n\t\tconst row = selectById.get(id) as RfidRow | undefined;\n\t\treturn row ? mapTagRow(row) : null;\n\t};\n\n\treturn {\n\t\tcreate(input: {\n\t\t\tuid: string;\n\t\t\tuserId: number;\n\t\t\tsignature: string;\n\t\t\tlabel?: string | null;\n\t\t\texpiresAt?: number | null;\n\t\t\tactorId: number;\n\t\t\tactorIp?: string | null;\n\t\t\tnow?: number;\n\t\t}): RfidTagRecord {\n\t\t\tconst uid = input.uid.trim();\n\t\t\tif (!uid) {\n\t\t\t\tthrow new ValidationError(\"uid is required\");\n\t\t\t}\n\t\t\t// the caller passes the expiry it signed, so the stored value and the token cannot drift apart\n\t\t\tconst expiresAt = input.expiresAt ?? null;\n\t\t\tif (expiresAt !== null && (!Number.isInteger(expiresAt) || expiresAt <= 0)) {\n\t\t\t\tthrow new ValidationError(`expiresAt must be a positive instant (got ${input.expiresAt})`);\n\t\t\t}\n\t\t\tif (!input.signature) {\n\t\t\t\tthrow new ValidationError(\"signature is required\");\n\t\t\t}\n\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\n\t\t\tlet tagId = 0;\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tconst result = insertTag.run(uid, input.signature, input.userId, input.label ?? null, expiresAt, now);\n\t\t\t\ttagId = Number(result.lastInsertRowid);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.create\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: tagId,\n\t\t\t\t\t// the signature is a credential and never part of the audit trail\n\t\t\t\t\tdetail: { uid, userId: input.userId, label: input.label ?? null, expiresAt },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\n\t\t\tconst tag = read(tagId);\n\t\t\tif (!tag) {\n\t\t\t\tthrow new Error(`tag ${tagId} disappeared right after creation`);\n\t\t\t}\n\t\t\treturn tag;\n\t\t},\n\n\t\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[] {\n\t\t\tconst rows = (options?.includeInactive === true ? selectAll : selectActive).all() as RfidRow[];\n\t\t\treturn rows.map(mapTagRow);\n\t\t},\n\n\t\tfindById: read,\n\n\t\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null {\n\t\t\tconst row = selectByUid.get(input.uid.trim()) as RfidRow | undefined;\n\t\t\tif (!row) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst tag = mapTagRow(row);\n\t\t\tif (!tag.isActive) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// an expired tag (or payload) is worthless even when the signature is correct\n\t\t\tif (tag.expiresAt !== null && tag.expiresAt <= now) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (tag.userId !== input.userId) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// the stored signature has to match the signature of the scanned payload\n\t\t\treturn sameSignature(row.token_hash, input.signature) ? tag : null;\n\t\t},\n\n\t\ttouch(input: { id: number; now?: number }): void {\n\t\t\tupdateLastUsed.run(input.now ?? Math.floor(Date.now() / 1000), input.id);\n\t\t},\n\n\t\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag || !tag.isActive) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tdeactivate.run(input.id);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.revoke\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\tdetail: { uid: tag.uid, userId: tag.userId },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\t};\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,yBAAyD;AAEzD,oBAAgC;AAChC,mBAA8B;AAqDvB,SAAS,YAAoB;AACnC,aAAO,gCAAY,EAAE,EAAE,SAAS,WAAW;AAC5C;AAWO,SAAS,QAAQ,QAAgB,KAAa,QAAgB,WAA2B;AAC/F,aAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,EAAE,EAAE,OAAO,WAAW;AAC/F;AAWO,SAAS,cAAc,KAAa,QAAgB,WAAmB,WAA2B;AACxG,SAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,IAAI,SAAS;AAClD;AAQO,SAAS,cACf,OAC+E;AAC/E,QAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,GAAG;AACpC,MAAI,MAAM,WAAW,GAAG;AACvB,WAAO;AAAA,EACR;AACA,QAAM,CAAC,KAAK,WAAW,YAAY,SAAS,IAAI;AAChD,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,UAAU,MAAM,KAAK,CAAC,OAAO,UAAU,SAAS,GAAG;AACpF,WAAO;AAAA,EACR;AACA,SAAO,EAAE,KAAK,QAAQ,WAAW,UAAU;AAC5C;AASO,SAAS,cAAc,UAAkB,UAA2B;AAC1E,QAAM,OAAO,OAAO,KAAK,QAAQ;AACjC,QAAM,QAAQ,OAAO,KAAK,QAAQ;AAClC,SAAO,KAAK,WAAW,MAAM,cAAU,oCAAgB,MAAM,KAAK;AACnE;AAcA,MAAM,cAAc;AAQpB,SAAS,UAAU,KAA6B;AAC/C,SAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,KAAK,IAAI;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,UAAU,IAAI,cAAc;AAAA,IAC5B,WAAW,IAAI;AAAA,IACf,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,EAChB;AACD;AAQO,SAAS,qBAAqB,IAAwB;AAC5D,QAAM,YAAY,GAAG;AAAA,IACpB;AAAA;AAAA,EAED;AACA,QAAM,aAAa,GAAG,QAAQ,UAAU,WAAW,8BAA8B;AACjF,QAAM,cAAc,GAAG,QAAQ,UAAU,WAAW,+BAA+B;AACnF,QAAM,YAAY,GAAG,QAAQ,UAAU,WAAW,mDAAmD;AACrG,QAAM,eAAe,GAAG;AAAA,IACvB,UAAU,WAAW;AAAA,EACtB;AACA,QAAM,iBAAiB,GAAG,QAAQ,oDAAoD;AACtF,QAAM,aAAa,GAAG,QAAQ,iDAAiD;AAQ/E,QAAM,OAAO,CAAC,OAAqC;AAClD,UAAM,MAAM,WAAW,IAAI,EAAE;AAC7B,WAAO,MAAM,UAAU,GAAG,IAAI;AAAA,EAC/B;AAEA,SAAO;AAAA,IACN,OAAO,OASW;AA5MpB;AA6MG,YAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,8BAAgB,iBAAiB;AAAA,MAC5C;AAEA,YAAM,aAAY,WAAM,cAAN,YAAmB;AACrC,UAAI,cAAc,SAAS,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,IAAI;AAC3E,cAAM,IAAI,8BAAgB,6CAA6C,MAAM,SAAS,GAAG;AAAA,MAC1F;AACA,UAAI,CAAC,MAAM,WAAW;AACrB,cAAM,IAAI,8BAAgB,uBAAuB;AAAA,MAClD;AAEA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAErD,UAAI,QAAQ;AACZ,YAAM,MAAM,GAAG,YAAY,MAAY;AA7N1C,YAAAA,KAAAC,KAAA;AA8NI,cAAM,SAAS,UAAU,IAAI,KAAK,MAAM,WAAW,MAAM,SAAQD,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,WAAW,GAAG;AACpG,gBAAQ,OAAO,OAAO,eAAe;AACrC,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA;AAAA,UAEV,QAAQ,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAOC,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,UAAU;AAAA,UAC3E,KAAI,WAAM,YAAN,YAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AAEJ,YAAM,MAAM,KAAK,KAAK;AACtB,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,MAAM,OAAO,KAAK,mCAAmC;AAAA,MAChE;AACA,aAAO;AAAA,IACR;AAAA,IAEA,KAAK,SAA0D;AAC9D,YAAM,SAAQ,mCAAS,qBAAoB,OAAO,YAAY,cAAc,IAAI;AAChF,aAAO,KAAK,IAAI,SAAS;AAAA,IAC1B;AAAA,IAEA,UAAU;AAAA,IAEV,OAAO,OAA+F;AA3PxG;AA4PG,YAAM,MAAM,YAAY,IAAI,MAAM,IAAI,KAAK,CAAC;AAC5C,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,UAAU,GAAG;AACzB,UAAI,CAAC,IAAI,UAAU;AAClB,eAAO;AAAA,MACR;AAEA,UAAI,IAAI,cAAc,QAAQ,IAAI,aAAa,KAAK;AACnD,eAAO;AAAA,MACR;AACA,UAAI,IAAI,WAAW,MAAM,QAAQ;AAChC,eAAO;AAAA,MACR;AAEA,aAAO,cAAc,IAAI,YAAY,MAAM,SAAS,IAAI,MAAM;AAAA,IAC/D;AAAA,IAEA,MAAM,OAA2C;AAhRnD;AAiRG,qBAAe,KAAI,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,MAAM,EAAE;AAAA,IACxE;AAAA,IAEA,OAAO,OAAwF;AApRjG;AAqRG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,OAAO,CAAC,IAAI,UAAU;AAC1B,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AA1R1C,YAAAD;AA2RI,mBAAW,IAAI,MAAM,EAAE;AACvB,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAAA,UAC3C,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,EACD;AACD;",
+  "sourcesContent": ["/**\n * RFID/NFC tags (`rfid_tags`).\n *\n * A tag is a **signed deep link**: `uid.userId.exp.signature`, where the signature is\n * `HMAC-SHA256(hmacSecret, \"uid.userId.exp\")`. That way a tag needs no login on the scanning phone, cannot be\n * guessed (a forged payload fails the signature) and can be revoked or given an expiry. The stored `token_hash`\n * is the signature itself; the extra `uid` row keeps the lookup cheap and lets a tag be revoked individually.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type { Db } from \"../database\";\nimport { ValidationError } from \"../../errors\";\nimport { writeAuditLog } from \"./audit\";\n\n/** A tag as it is stored (without the signature). */\nexport interface RfidTagRecord {\n\t/** Primary key */\n\tid: number;\n\t/** Identifier of the tag (`uid` of the NFC tag or a generated value) */\n\tuid: string;\n\t/** Owner of the tag, `null` after the user was deleted */\n\tuserId: number | null;\n\t/** Free-form label */\n\tlabel: string | null;\n\t/** False for revoked tags */\n\tisActive: boolean;\n\t/** Instant the tag stops working, `null` = never */\n\texpiresAt: number | null;\n\t/** Instant of the last scan, `null` if never used */\n\tlastUsedAt: number | null;\n\t/** Instant of creation, UTC epoch seconds */\n\tcreatedAt: number;\n}\n\n/** Tag storage operations. */\nexport interface RfidRepository {\n\t/** Creates a tag and audits it (the signature is never written to the audit trail) */\n\tcreate(input: {\n\t\tuid: string;\n\t\tuserId: number;\n\t\tsignature: string;\n\t\tlabel?: string | null;\n\t\t/** Instant the tag stops working, `null` = never */\n\t\texpiresAt?: number | null;\n\t\tactorId: number;\n\t\tactorIp?: string | null;\n\t\tnow?: number;\n\t}): RfidTagRecord;\n\t/** All tags, optionally including the revoked ones */\n\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[];\n\t/** Reads a tag by id */\n\tfindById(id: number): RfidTagRecord | null;\n\t/** Checks a scanned token and returns the tag when signature, activity, owner and expiry match */\n\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null;\n\t/** Records a successful scan */\n\ttouch(input: { id: number; now?: number }): void;\n\t/** Revokes a tag */\n\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean;\n\t/** Deletes a tag for good \u2014 for a revoked badge that should disappear from the list */\n\tremove(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean;\n}\n\n/**\n * Creates a random tag identifier.\n *\n * @returns base64url encoded identifier\n */\nexport function newTagUid(): string {\n\treturn randomBytes(16).toString(\"base64url\");\n}\n\n/**\n * Signs a tag payload.\n *\n * @param secret - instance secret (`hmacSecret`)\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload, UTC epoch seconds\n * @returns base64url encoded signature\n */\nexport function signTag(secret: string, uid: string, userId: number, expiresAt: number): string {\n\treturn createHmac(\"sha256\", secret).update(`${uid}.${userId}.${expiresAt}`).digest(\"base64url\");\n}\n\n/**\n * Builds the token a tag carries.\n *\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload\n * @param signature - signature of the payload\n * @returns the token\n */\nexport function buildTagToken(uid: string, userId: number, expiresAt: number, signature: string): string {\n\treturn `${uid}.${userId}.${expiresAt}.${signature}`;\n}\n\n/**\n * Splits a scanned token.\n *\n * @param token - token from the deep link or the QR code\n * @returns the parsed payload or `null` when the token is malformed\n */\nexport function parseTagToken(\n\ttoken: string,\n): { uid: string; userId: number; expiresAt: number; signature: string } | null {\n\tconst parts = token.trim().split(\".\");\n\tif (parts.length !== 4) {\n\t\treturn null;\n\t}\n\tconst [uid, rawUserId, rawExpires, signature] = parts;\n\tconst userId = Number(rawUserId);\n\tconst expiresAt = Number(rawExpires);\n\tif (!uid || !signature || !Number.isInteger(userId) || !Number.isInteger(expiresAt)) {\n\t\treturn null;\n\t}\n\treturn { uid, userId, expiresAt, signature };\n}\n\n/**\n * Compares two signatures without leaking the position of the first difference.\n *\n * @param expected - signature computed by the server\n * @param received - signature from the token\n * @returns true when both are identical\n */\nexport function sameSignature(expected: string, received: string): boolean {\n\tconst left = Buffer.from(expected);\n\tconst right = Buffer.from(received);\n\treturn left.length === right.length && timingSafeEqual(left, right);\n}\n\ninterface RfidRow {\n\tid: number;\n\tuid: string;\n\ttoken_hash: string;\n\tuser_id: number | null;\n\tlabel: string | null;\n\tis_active: number;\n\texpires_at: number | null;\n\tlast_used_at: number | null;\n\tcreated_at: number;\n}\n\nconst TAG_COLUMNS = `id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at`;\n\n/**\n * Maps a database row to a tag record (the signature stays inside the repository).\n *\n * @param row - raw database row\n * @returns tag record\n */\nfunction mapTagRow(row: RfidRow): RfidTagRecord {\n\treturn {\n\t\tid: row.id,\n\t\tuid: row.uid,\n\t\tuserId: row.user_id,\n\t\tlabel: row.label,\n\t\tisActive: row.is_active !== 0,\n\t\texpiresAt: row.expires_at,\n\t\tlastUsedAt: row.last_used_at,\n\t\tcreatedAt: row.created_at,\n\t};\n}\n\n/**\n * Creates the tag repository.\n *\n * @param db - open database handle\n * @returns repository instance\n */\nexport function createRfidRepository(db: Db): RfidRepository {\n\tconst insertTag = db.prepare(\n\t\t`INSERT INTO rfid_tags (uid, token_hash, user_id, label, is_active, expires_at, created_at)\n\t\t VALUES (?, ?, ?, ?, 1, ?, ?)`,\n\t);\n\tconst selectById = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE id = ?`);\n\tconst selectByUid = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE uid = ?`);\n\tconst selectAll = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags ORDER BY created_at DESC, id DESC`);\n\tconst selectActive = db.prepare(\n\t\t`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE is_active = 1 ORDER BY created_at DESC, id DESC`,\n\t);\n\tconst updateLastUsed = db.prepare(\"UPDATE rfid_tags SET last_used_at = ? WHERE id = ?\");\n\tconst deactivate = db.prepare(\"UPDATE rfid_tags SET is_active = 0 WHERE id = ?\");\n\tconst deleteTag = db.prepare(\"DELETE FROM rfid_tags WHERE id = ?\");\n\n\t/**\n\t * Reads a tag.\n\t *\n\t * @param id - tag id\n\t * @returns tag or `null`\n\t */\n\tconst read = (id: number): RfidTagRecord | null => {\n\t\tconst row = selectById.get(id) as RfidRow | undefined;\n\t\treturn row ? mapTagRow(row) : null;\n\t};\n\n\treturn {\n\t\tcreate(input: {\n\t\t\tuid: string;\n\t\t\tuserId: number;\n\t\t\tsignature: string;\n\t\t\tlabel?: string | null;\n\t\t\texpiresAt?: number | null;\n\t\t\tactorId: number;\n\t\t\tactorIp?: string | null;\n\t\t\tnow?: number;\n\t\t}): RfidTagRecord {\n\t\t\tconst uid = input.uid.trim();\n\t\t\tif (!uid) {\n\t\t\t\tthrow new ValidationError(\"uid is required\");\n\t\t\t}\n\t\t\t// the caller passes the expiry it signed, so the stored value and the token cannot drift apart\n\t\t\tconst expiresAt = input.expiresAt ?? null;\n\t\t\tif (expiresAt !== null && (!Number.isInteger(expiresAt) || expiresAt <= 0)) {\n\t\t\t\tthrow new ValidationError(`expiresAt must be a positive instant (got ${input.expiresAt})`);\n\t\t\t}\n\t\t\tif (!input.signature) {\n\t\t\t\tthrow new ValidationError(\"signature is required\");\n\t\t\t}\n\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\n\t\t\tlet tagId = 0;\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tconst result = insertTag.run(uid, input.signature, input.userId, input.label ?? null, expiresAt, now);\n\t\t\t\ttagId = Number(result.lastInsertRowid);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.create\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: tagId,\n\t\t\t\t\t// the signature is a credential and never part of the audit trail\n\t\t\t\t\tdetail: { uid, userId: input.userId, label: input.label ?? null, expiresAt },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\n\t\t\tconst tag = read(tagId);\n\t\t\tif (!tag) {\n\t\t\t\tthrow new Error(`tag ${tagId} disappeared right after creation`);\n\t\t\t}\n\t\t\treturn tag;\n\t\t},\n\n\t\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[] {\n\t\t\tconst rows = (options?.includeInactive === true ? selectAll : selectActive).all() as RfidRow[];\n\t\t\treturn rows.map(mapTagRow);\n\t\t},\n\n\t\tfindById: read,\n\n\t\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null {\n\t\t\tconst row = selectByUid.get(input.uid.trim()) as RfidRow | undefined;\n\t\t\tif (!row) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst tag = mapTagRow(row);\n\t\t\tif (!tag.isActive) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// an expired tag (or payload) is worthless even when the signature is correct\n\t\t\tif (tag.expiresAt !== null && tag.expiresAt <= now) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (tag.userId !== input.userId) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// the stored signature has to match the signature of the scanned payload\n\t\t\treturn sameSignature(row.token_hash, input.signature) ? tag : null;\n\t\t},\n\n\t\ttouch(input: { id: number; now?: number }): void {\n\t\t\tupdateLastUsed.run(input.now ?? Math.floor(Date.now() / 1000), input.id);\n\t\t},\n\n\t\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag || !tag.isActive) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tdeactivate.run(input.id);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.revoke\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\tdetail: { uid: tag.uid, userId: tag.userId },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\n\t\tremove(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tdeleteTag.run(input.id);\n\t\t\t\t// the row is gone, the audit trail keeps the trace of it\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.delete\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\tdetail: { uid: tag.uid, userId: tag.userId, isActive: tag.isActive },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\t};\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,yBAAyD;AAEzD,oBAAgC;AAChC,mBAA8B;AAuDvB,SAAS,YAAoB;AACnC,aAAO,gCAAY,EAAE,EAAE,SAAS,WAAW;AAC5C;AAWO,SAAS,QAAQ,QAAgB,KAAa,QAAgB,WAA2B;AAC/F,aAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,EAAE,EAAE,OAAO,WAAW;AAC/F;AAWO,SAAS,cAAc,KAAa,QAAgB,WAAmB,WAA2B;AACxG,SAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,IAAI,SAAS;AAClD;AAQO,SAAS,cACf,OAC+E;AAC/E,QAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,GAAG;AACpC,MAAI,MAAM,WAAW,GAAG;AACvB,WAAO;AAAA,EACR;AACA,QAAM,CAAC,KAAK,WAAW,YAAY,SAAS,IAAI;AAChD,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,UAAU,MAAM,KAAK,CAAC,OAAO,UAAU,SAAS,GAAG;AACpF,WAAO;AAAA,EACR;AACA,SAAO,EAAE,KAAK,QAAQ,WAAW,UAAU;AAC5C;AASO,SAAS,cAAc,UAAkB,UAA2B;AAC1E,QAAM,OAAO,OAAO,KAAK,QAAQ;AACjC,QAAM,QAAQ,OAAO,KAAK,QAAQ;AAClC,SAAO,KAAK,WAAW,MAAM,cAAU,oCAAgB,MAAM,KAAK;AACnE;AAcA,MAAM,cAAc;AAQpB,SAAS,UAAU,KAA6B;AAC/C,SAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,KAAK,IAAI;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,UAAU,IAAI,cAAc;AAAA,IAC5B,WAAW,IAAI;AAAA,IACf,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,EAChB;AACD;AAQO,SAAS,qBAAqB,IAAwB;AAC5D,QAAM,YAAY,GAAG;AAAA,IACpB;AAAA;AAAA,EAED;AACA,QAAM,aAAa,GAAG,QAAQ,UAAU,WAAW,8BAA8B;AACjF,QAAM,cAAc,GAAG,QAAQ,UAAU,WAAW,+BAA+B;AACnF,QAAM,YAAY,GAAG,QAAQ,UAAU,WAAW,mDAAmD;AACrG,QAAM,eAAe,GAAG;AAAA,IACvB,UAAU,WAAW;AAAA,EACtB;AACA,QAAM,iBAAiB,GAAG,QAAQ,oDAAoD;AACtF,QAAM,aAAa,GAAG,QAAQ,iDAAiD;AAC/E,QAAM,YAAY,GAAG,QAAQ,oCAAoC;AAQjE,QAAM,OAAO,CAAC,OAAqC;AAClD,UAAM,MAAM,WAAW,IAAI,EAAE;AAC7B,WAAO,MAAM,UAAU,GAAG,IAAI;AAAA,EAC/B;AAEA,SAAO;AAAA,IACN,OAAO,OASW;AA/MpB;AAgNG,YAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,8BAAgB,iBAAiB;AAAA,MAC5C;AAEA,YAAM,aAAY,WAAM,cAAN,YAAmB;AACrC,UAAI,cAAc,SAAS,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,IAAI;AAC3E,cAAM,IAAI,8BAAgB,6CAA6C,MAAM,SAAS,GAAG;AAAA,MAC1F;AACA,UAAI,CAAC,MAAM,WAAW;AACrB,cAAM,IAAI,8BAAgB,uBAAuB;AAAA,MAClD;AAEA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAErD,UAAI,QAAQ;AACZ,YAAM,MAAM,GAAG,YAAY,MAAY;AAhO1C,YAAAA,KAAAC,KAAA;AAiOI,cAAM,SAAS,UAAU,IAAI,KAAK,MAAM,WAAW,MAAM,SAAQD,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,WAAW,GAAG;AACpG,gBAAQ,OAAO,OAAO,eAAe;AACrC,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA;AAAA,UAEV,QAAQ,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAOC,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,UAAU;AAAA,UAC3E,KAAI,WAAM,YAAN,YAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AAEJ,YAAM,MAAM,KAAK,KAAK;AACtB,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,MAAM,OAAO,KAAK,mCAAmC;AAAA,MAChE;AACA,aAAO;AAAA,IACR;AAAA,IAEA,KAAK,SAA0D;AAC9D,YAAM,SAAQ,mCAAS,qBAAoB,OAAO,YAAY,cAAc,IAAI;AAChF,aAAO,KAAK,IAAI,SAAS;AAAA,IAC1B;AAAA,IAEA,UAAU;AAAA,IAEV,OAAO,OAA+F;AA9PxG;AA+PG,YAAM,MAAM,YAAY,IAAI,MAAM,IAAI,KAAK,CAAC;AAC5C,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,UAAU,GAAG;AACzB,UAAI,CAAC,IAAI,UAAU;AAClB,eAAO;AAAA,MACR;AAEA,UAAI,IAAI,cAAc,QAAQ,IAAI,aAAa,KAAK;AACnD,eAAO;AAAA,MACR;AACA,UAAI,IAAI,WAAW,MAAM,QAAQ;AAChC,eAAO;AAAA,MACR;AAEA,aAAO,cAAc,IAAI,YAAY,MAAM,SAAS,IAAI,MAAM;AAAA,IAC/D;AAAA,IAEA,MAAM,OAA2C;AAnRnD;AAoRG,qBAAe,KAAI,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,MAAM,EAAE;AAAA,IACxE;AAAA,IAEA,OAAO,OAAwF;AAvRjG;AAwRG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,OAAO,CAAC,IAAI,UAAU;AAC1B,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AA7R1C,YAAAD;AA8RI,mBAAW,IAAI,MAAM,EAAE;AACvB,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAAA,UAC3C,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,IAEA,OAAO,OAAwF;AA7SjG;AA8SG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AAnT1C,YAAAA;AAoTI,kBAAU,IAAI,MAAM,EAAE;AAEtB,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,QAAQ,UAAU,IAAI,SAAS;AAAA,UACnE,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,EACD;AACD;",
   "names": ["_a", "_b"]
 }

package/build/lib/web/api.js

@@ -2187,6 +2187,22 @@ function createApi(deps) {
     }
     return (0, import_router.noContent)();
   });
+  route("DELETE", "/rfid/tags/:id/permanent", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const removed = rfid.remove({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    return (0, import_router.noContent)();
+  });
   route(
     "POST",
     "/rfid/scan",