iobroker.zeiterfassung 0.1.2 → 0.1.4

package/README.md

@@ -305,6 +305,30 @@ local SQLite file, access is role-based, and every correction is written to an a
 
 ### **WORK IN PROGRESS**
 
+### 0.1.4 (2026-09-18)
+
+- (Alex) **badges (RFID/NFC)**: a badge can be edited (employee, label, validity) and given a **new link** — for one
+  that was lost, expired or revoked and should work again. A new employee or a new validity re-signs the link, so the
+  answer carries it and the link handed out before stops working immediately (a label on its own leaves it alone)
+- (Alex) translations: a second technical pass, this time with a helper (`tools/check-i18n-review.mjs`) that looks for
+  what `check:i18n` cannot see — wrong script, copies between languages, texts much longer or shorter than English.
+  It found real gaps: `brandingHint` had lost its second sentence in nine languages, `brandColorHint` its “empty for
+  the default” in seven, and `admin.user.pinTitle` was a Russian sentence in the Ukrainian file. `docs/i18n.md` lists
+  what stays with a native speaker
+
+### 0.1.3 (2026-09-18)
+
+- (Alex) fix: the badge (RFID/NFC) tab builds the link from the address the administration is **currently** open
+  with — scheme, host and port come from the browser, so the link works on a plain HTTP instance and behind a reverse
+  proxy alike, and no server side guess can point at a scheme the instance does not serve
+- (Alex) fix: the badge (RFID/NFC) tab shows the state of every badge — active, expired or revoked — and when it was
+  last used. A revoked badge now offers “Remove permanently” instead of failing with “not found”: the old entry
+  disappears from the list, while the audit trail keeps the trace of it
+- (Alex) translations: a technical review pass over the 11 languages — the punch, break, absence, badge and overtime
+  text families were compared with each other. Five wrong `reports.overtime` labels were corrected (`pt`, `fr`, `it`,
+  `es`, `zh-cn` said “over time” instead of overtime), and the Polish punch labels now use the same root as the badge
+  texts. `docs/i18n.md` records the method and what a native speaker still has to settle
+
 ### 0.1.2 (2026-09-18)
 
 - (Alex) fix: a badge (RFID/NFC) link points to the address the administration itself is reached with — the scheme
@@ -336,35 +360,6 @@ local SQLite file, access is role-based, and every correction is written to an a
   states instead of waiting for the five minute timer. That is what made `users.<id>.present` and
   `company.presentCount` lag behind
 
-### 0.0.19 (2026-09-18)
-
-- internal: the browser tests wait longer for the slower runner of the pipeline and put the branding back when the
-  file is done, so it can run again and in any order; the end-to-end workflow uses the current majors of
-  `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` (the old ones still target Node 20, which
-  the runner deprecates)
-
-- (Alex) ioBroker comfort: **actions** (trigger rules) — a state of another adapter like a fingerprint reader, a
-  button or a door contact punches or sets the presence. The table lives in the administration
-  (`GET`/`PUT /api/trigger-rules`), a rule fires only when the value changes and honours a cooldown, and every
-  punch carries the note `trigger.<id>` in the audit trail
-- (Alex) **`sendTo` messages** — `punch`, `present`, `status`, `report` (PDF or Excel as base64) and `backup`, so a
-  script or a Blockly block drives the instance without HTTP
-- (Alex) more states for dashboards and notifications: `company.presentCount`/`present`/`openConflicts`/`lastPunch`,
-  per employee `monthWorkedMinutes`/`monthBalanceMinutes`/`yearBalanceMinutes` and `events.lastAt`/`lastType`/
-  `lastUser`/`lastDirection`/`lastSource`
-
-### 0.0.18 (2026-09-18)
-
-- (Alex) fix: an uploaded background picture can be taken away again — every picture field has a “Remove picture”
-  button (the logo as well), and “Default” resets the colour and the background picture in one click
-- internal: the settings dialog shows the stored logo and background picture again (a read leaves the large pictures
-  out on purpose, so the preview and the remove button come from the branding route)
-- (Alex) internal: the release flow asks the owner before the version commit and the tag — the question “may I push,
-  or do you have remarks?” comes first and only a “go” leads to commit, tag and push; `CONTRIBUTING.md` documents
-  the step and `npm run push:approve` reminds of it
-- internal: the lint ignores the generated report of the browser tests (it carried a bundled viewer and made a local
-  `npm run lint` crash)
-
 Older entries are kept in [`CHANGELOG_OLD.md`](CHANGELOG_OLD.md).
 
 ## Provenance

package/build/lib/db/repositories/rfid.js

@@ -82,6 +82,11 @@ function createRfidRepository(db) {
   );
   const updateLastUsed = db.prepare("UPDATE rfid_tags SET last_used_at = ? WHERE id = ?");
   const deactivate = db.prepare("UPDATE rfid_tags SET is_active = 0 WHERE id = ?");
+  const deleteTag = db.prepare("DELETE FROM rfid_tags WHERE id = ?");
+  const changeFields = db.prepare(
+    "UPDATE rfid_tags SET user_id = ?, label = ?, expires_at = ?, is_active = ? WHERE id = ?"
+  );
+  const changeSignature = db.prepare("UPDATE rfid_tags SET token_hash = ? WHERE id = ?");
   const read = (id) => {
     const row = selectById.get(id);
     return row ? mapTagRow(row) : null;
@@ -174,6 +179,76 @@ function createRfidRepository(db) {
       });
       run();
       return true;
+    },
+    remove(input) {
+      var _a;
+      const tag = read(input.id);
+      if (!tag) {
+        return false;
+      }
+      const now = (_a = input.now) != null ? _a : Math.floor(Date.now() / 1e3);
+      const run = db.transaction(() => {
+        var _a2;
+        deleteTag.run(input.id);
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          actorId: input.actorId,
+          action: "rfid.delete",
+          entity: "rfid_tag",
+          entityId: input.id,
+          detail: { uid: tag.uid, userId: tag.userId, isActive: tag.isActive },
+          ip: (_a2 = input.actorIp) != null ? _a2 : null
+        });
+      });
+      run();
+      return true;
+    },
+    update(input) {
+      var _a;
+      const tag = read(input.id);
+      if (!tag) {
+        return null;
+      }
+      const userId = input.userId === void 0 ? tag.userId : input.userId;
+      if (userId !== null && (!Number.isInteger(userId) || userId <= 0)) {
+        throw new import_errors.ValidationError(`userId must be a positive whole number (got ${input.userId})`);
+      }
+      const expiresAt = input.expiresAt === void 0 ? tag.expiresAt : input.expiresAt;
+      if (expiresAt !== null && (!Number.isInteger(expiresAt) || expiresAt <= 0)) {
+        throw new import_errors.ValidationError(`expiresAt must be a positive instant (got ${input.expiresAt})`);
+      }
+      if (input.signature !== void 0 && !input.signature) {
+        throw new import_errors.ValidationError("signature must not be empty");
+      }
+      const label = input.label === void 0 ? tag.label : input.label;
+      const isActive = input.activate === void 0 ? tag.isActive : input.activate;
+      const now = (_a = input.now) != null ? _a : Math.floor(Date.now() / 1e3);
+      const run = db.transaction(() => {
+        var _a2;
+        changeFields.run(userId, label, expiresAt, isActive ? 1 : 0, input.id);
+        if (input.signature !== void 0) {
+          changeSignature.run(input.signature, input.id);
+        }
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          actorId: input.actorId,
+          action: "rfid.update",
+          entity: "rfid_tag",
+          entityId: input.id,
+          // the signature itself stays out of the audit trail, whether it was replaced is what counts
+          detail: {
+            uid: tag.uid,
+            userId,
+            label,
+            expiresAt,
+            isActive,
+            reissued: input.signature !== void 0
+          },
+          ip: (_a2 = input.actorIp) != null ? _a2 : null
+        });
+      });
+      run();
+      return read(input.id);
     }
   };
 }

package/build/lib/db/repositories/rfid.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/lib/db/repositories/rfid.ts"],
-  "sourcesContent": ["/**\n * RFID/NFC tags (`rfid_tags`).\n *\n * A tag is a **signed deep link**: `uid.userId.exp.signature`, where the signature is\n * `HMAC-SHA256(hmacSecret, \"uid.userId.exp\")`. That way a tag needs no login on the scanning phone, cannot be\n * guessed (a forged payload fails the signature) and can be revoked or given an expiry. The stored `token_hash`\n * is the signature itself; the extra `uid` row keeps the lookup cheap and lets a tag be revoked individually.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type { Db } from \"../database\";\nimport { ValidationError } from \"../../errors\";\nimport { writeAuditLog } from \"./audit\";\n\n/** A tag as it is stored (without the signature). */\nexport interface RfidTagRecord {\n\t/** Primary key */\n\tid: number;\n\t/** Identifier of the tag (`uid` of the NFC tag or a generated value) */\n\tuid: string;\n\t/** Owner of the tag, `null` after the user was deleted */\n\tuserId: number | null;\n\t/** Free-form label */\n\tlabel: string | null;\n\t/** False for revoked tags */\n\tisActive: boolean;\n\t/** Instant the tag stops working, `null` = never */\n\texpiresAt: number | null;\n\t/** Instant of the last scan, `null` if never used */\n\tlastUsedAt: number | null;\n\t/** Instant of creation, UTC epoch seconds */\n\tcreatedAt: number;\n}\n\n/** Tag storage operations. */\nexport interface RfidRepository {\n\t/** Creates a tag and audits it (the signature is never written to the audit trail) */\n\tcreate(input: {\n\t\tuid: string;\n\t\tuserId: number;\n\t\tsignature: string;\n\t\tlabel?: string | null;\n\t\t/** Instant the tag stops working, `null` = never */\n\t\texpiresAt?: number | null;\n\t\tactorId: number;\n\t\tactorIp?: string | null;\n\t\tnow?: number;\n\t}): RfidTagRecord;\n\t/** All tags, optionally including the revoked ones */\n\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[];\n\t/** Reads a tag by id */\n\tfindById(id: number): RfidTagRecord | null;\n\t/** Checks a scanned token and returns the tag when signature, activity, owner and expiry match */\n\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null;\n\t/** Records a successful scan */\n\ttouch(input: { id: number; now?: number }): void;\n\t/** Revokes a tag */\n\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean;\n}\n\n/**\n * Creates a random tag identifier.\n *\n * @returns base64url encoded identifier\n */\nexport function newTagUid(): string {\n\treturn randomBytes(16).toString(\"base64url\");\n}\n\n/**\n * Signs a tag payload.\n *\n * @param secret - instance secret (`hmacSecret`)\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload, UTC epoch seconds\n * @returns base64url encoded signature\n */\nexport function signTag(secret: string, uid: string, userId: number, expiresAt: number): string {\n\treturn createHmac(\"sha256\", secret).update(`${uid}.${userId}.${expiresAt}`).digest(\"base64url\");\n}\n\n/**\n * Builds the token a tag carries.\n *\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload\n * @param signature - signature of the payload\n * @returns the token\n */\nexport function buildTagToken(uid: string, userId: number, expiresAt: number, signature: string): string {\n\treturn `${uid}.${userId}.${expiresAt}.${signature}`;\n}\n\n/**\n * Splits a scanned token.\n *\n * @param token - token from the deep link or the QR code\n * @returns the parsed payload or `null` when the token is malformed\n */\nexport function parseTagToken(\n\ttoken: string,\n): { uid: string; userId: number; expiresAt: number; signature: string } | null {\n\tconst parts = token.trim().split(\".\");\n\tif (parts.length !== 4) {\n\t\treturn null;\n\t}\n\tconst [uid, rawUserId, rawExpires, signature] = parts;\n\tconst userId = Number(rawUserId);\n\tconst expiresAt = Number(rawExpires);\n\tif (!uid || !signature || !Number.isInteger(userId) || !Number.isInteger(expiresAt)) {\n\t\treturn null;\n\t}\n\treturn { uid, userId, expiresAt, signature };\n}\n\n/**\n * Compares two signatures without leaking the position of the first difference.\n *\n * @param expected - signature computed by the server\n * @param received - signature from the token\n * @returns true when both are identical\n */\nexport function sameSignature(expected: string, received: string): boolean {\n\tconst left = Buffer.from(expected);\n\tconst right = Buffer.from(received);\n\treturn left.length === right.length && timingSafeEqual(left, right);\n}\n\ninterface RfidRow {\n\tid: number;\n\tuid: string;\n\ttoken_hash: string;\n\tuser_id: number | null;\n\tlabel: string | null;\n\tis_active: number;\n\texpires_at: number | null;\n\tlast_used_at: number | null;\n\tcreated_at: number;\n}\n\nconst TAG_COLUMNS = `id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at`;\n\n/**\n * Maps a database row to a tag record (the signature stays inside the repository).\n *\n * @param row - raw database row\n * @returns tag record\n */\nfunction mapTagRow(row: RfidRow): RfidTagRecord {\n\treturn {\n\t\tid: row.id,\n\t\tuid: row.uid,\n\t\tuserId: row.user_id,\n\t\tlabel: row.label,\n\t\tisActive: row.is_active !== 0,\n\t\texpiresAt: row.expires_at,\n\t\tlastUsedAt: row.last_used_at,\n\t\tcreatedAt: row.created_at,\n\t};\n}\n\n/**\n * Creates the tag repository.\n *\n * @param db - open database handle\n * @returns repository instance\n */\nexport function createRfidRepository(db: Db): RfidRepository {\n\tconst insertTag = db.prepare(\n\t\t`INSERT INTO rfid_tags (uid, token_hash, user_id, label, is_active, expires_at, created_at)\n\t\t VALUES (?, ?, ?, ?, 1, ?, ?)`,\n\t);\n\tconst selectById = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE id = ?`);\n\tconst selectByUid = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE uid = ?`);\n\tconst selectAll = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags ORDER BY created_at DESC, id DESC`);\n\tconst selectActive = db.prepare(\n\t\t`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE is_active = 1 ORDER BY created_at DESC, id DESC`,\n\t);\n\tconst updateLastUsed = db.prepare(\"UPDATE rfid_tags SET last_used_at = ? WHERE id = ?\");\n\tconst deactivate = db.prepare(\"UPDATE rfid_tags SET is_active = 0 WHERE id = ?\");\n\n\t/**\n\t * Reads a tag.\n\t *\n\t * @param id - tag id\n\t * @returns tag or `null`\n\t */\n\tconst read = (id: number): RfidTagRecord | null => {\n\t\tconst row = selectById.get(id) as RfidRow | undefined;\n\t\treturn row ? mapTagRow(row) : null;\n\t};\n\n\treturn {\n\t\tcreate(input: {\n\t\t\tuid: string;\n\t\t\tuserId: number;\n\t\t\tsignature: string;\n\t\t\tlabel?: string | null;\n\t\t\texpiresAt?: number | null;\n\t\t\tactorId: number;\n\t\t\tactorIp?: string | null;\n\t\t\tnow?: number;\n\t\t}): RfidTagRecord {\n\t\t\tconst uid = input.uid.trim();\n\t\t\tif (!uid) {\n\t\t\t\tthrow new ValidationError(\"uid is required\");\n\t\t\t}\n\t\t\t// the caller passes the expiry it signed, so the stored value and the token cannot drift apart\n\t\t\tconst expiresAt = input.expiresAt ?? null;\n\t\t\tif (expiresAt !== null && (!Number.isInteger(expiresAt) || expiresAt <= 0)) {\n\t\t\t\tthrow new ValidationError(`expiresAt must be a positive instant (got ${input.expiresAt})`);\n\t\t\t}\n\t\t\tif (!input.signature) {\n\t\t\t\tthrow new ValidationError(\"signature is required\");\n\t\t\t}\n\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\n\t\t\tlet tagId = 0;\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tconst result = insertTag.run(uid, input.signature, input.userId, input.label ?? null, expiresAt, now);\n\t\t\t\ttagId = Number(result.lastInsertRowid);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.create\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: tagId,\n\t\t\t\t\t// the signature is a credential and never part of the audit trail\n\t\t\t\t\tdetail: { uid, userId: input.userId, label: input.label ?? null, expiresAt },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\n\t\t\tconst tag = read(tagId);\n\t\t\tif (!tag) {\n\t\t\t\tthrow new Error(`tag ${tagId} disappeared right after creation`);\n\t\t\t}\n\t\t\treturn tag;\n\t\t},\n\n\t\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[] {\n\t\t\tconst rows = (options?.includeInactive === true ? selectAll : selectActive).all() as RfidRow[];\n\t\t\treturn rows.map(mapTagRow);\n\t\t},\n\n\t\tfindById: read,\n\n\t\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null {\n\t\t\tconst row = selectByUid.get(input.uid.trim()) as RfidRow | undefined;\n\t\t\tif (!row) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst tag = mapTagRow(row);\n\t\t\tif (!tag.isActive) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// an expired tag (or payload) is worthless even when the signature is correct\n\t\t\tif (tag.expiresAt !== null && tag.expiresAt <= now) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (tag.userId !== input.userId) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// the stored signature has to match the signature of the scanned payload\n\t\t\treturn sameSignature(row.token_hash, input.signature) ? tag : null;\n\t\t},\n\n\t\ttouch(input: { id: number; now?: number }): void {\n\t\t\tupdateLastUsed.run(input.now ?? Math.floor(Date.now() / 1000), input.id);\n\t\t},\n\n\t\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag || !tag.isActive) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tdeactivate.run(input.id);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.revoke\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\tdetail: { uid: tag.uid, userId: tag.userId },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\t};\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,yBAAyD;AAEzD,oBAAgC;AAChC,mBAA8B;AAqDvB,SAAS,YAAoB;AACnC,aAAO,gCAAY,EAAE,EAAE,SAAS,WAAW;AAC5C;AAWO,SAAS,QAAQ,QAAgB,KAAa,QAAgB,WAA2B;AAC/F,aAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,EAAE,EAAE,OAAO,WAAW;AAC/F;AAWO,SAAS,cAAc,KAAa,QAAgB,WAAmB,WAA2B;AACxG,SAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,IAAI,SAAS;AAClD;AAQO,SAAS,cACf,OAC+E;AAC/E,QAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,GAAG;AACpC,MAAI,MAAM,WAAW,GAAG;AACvB,WAAO;AAAA,EACR;AACA,QAAM,CAAC,KAAK,WAAW,YAAY,SAAS,IAAI;AAChD,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,UAAU,MAAM,KAAK,CAAC,OAAO,UAAU,SAAS,GAAG;AACpF,WAAO;AAAA,EACR;AACA,SAAO,EAAE,KAAK,QAAQ,WAAW,UAAU;AAC5C;AASO,SAAS,cAAc,UAAkB,UAA2B;AAC1E,QAAM,OAAO,OAAO,KAAK,QAAQ;AACjC,QAAM,QAAQ,OAAO,KAAK,QAAQ;AAClC,SAAO,KAAK,WAAW,MAAM,cAAU,oCAAgB,MAAM,KAAK;AACnE;AAcA,MAAM,cAAc;AAQpB,SAAS,UAAU,KAA6B;AAC/C,SAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,KAAK,IAAI;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,UAAU,IAAI,cAAc;AAAA,IAC5B,WAAW,IAAI;AAAA,IACf,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,EAChB;AACD;AAQO,SAAS,qBAAqB,IAAwB;AAC5D,QAAM,YAAY,GAAG;AAAA,IACpB;AAAA;AAAA,EAED;AACA,QAAM,aAAa,GAAG,QAAQ,UAAU,WAAW,8BAA8B;AACjF,QAAM,cAAc,GAAG,QAAQ,UAAU,WAAW,+BAA+B;AACnF,QAAM,YAAY,GAAG,QAAQ,UAAU,WAAW,mDAAmD;AACrG,QAAM,eAAe,GAAG;AAAA,IACvB,UAAU,WAAW;AAAA,EACtB;AACA,QAAM,iBAAiB,GAAG,QAAQ,oDAAoD;AACtF,QAAM,aAAa,GAAG,QAAQ,iDAAiD;AAQ/E,QAAM,OAAO,CAAC,OAAqC;AAClD,UAAM,MAAM,WAAW,IAAI,EAAE;AAC7B,WAAO,MAAM,UAAU,GAAG,IAAI;AAAA,EAC/B;AAEA,SAAO;AAAA,IACN,OAAO,OASW;AA5MpB;AA6MG,YAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,8BAAgB,iBAAiB;AAAA,MAC5C;AAEA,YAAM,aAAY,WAAM,cAAN,YAAmB;AACrC,UAAI,cAAc,SAAS,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,IAAI;AAC3E,cAAM,IAAI,8BAAgB,6CAA6C,MAAM,SAAS,GAAG;AAAA,MAC1F;AACA,UAAI,CAAC,MAAM,WAAW;AACrB,cAAM,IAAI,8BAAgB,uBAAuB;AAAA,MAClD;AAEA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAErD,UAAI,QAAQ;AACZ,YAAM,MAAM,GAAG,YAAY,MAAY;AA7N1C,YAAAA,KAAAC,KAAA;AA8NI,cAAM,SAAS,UAAU,IAAI,KAAK,MAAM,WAAW,MAAM,SAAQD,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,WAAW,GAAG;AACpG,gBAAQ,OAAO,OAAO,eAAe;AACrC,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA;AAAA,UAEV,QAAQ,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAOC,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,UAAU;AAAA,UAC3E,KAAI,WAAM,YAAN,YAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AAEJ,YAAM,MAAM,KAAK,KAAK;AACtB,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,MAAM,OAAO,KAAK,mCAAmC;AAAA,MAChE;AACA,aAAO;AAAA,IACR;AAAA,IAEA,KAAK,SAA0D;AAC9D,YAAM,SAAQ,mCAAS,qBAAoB,OAAO,YAAY,cAAc,IAAI;AAChF,aAAO,KAAK,IAAI,SAAS;AAAA,IAC1B;AAAA,IAEA,UAAU;AAAA,IAEV,OAAO,OAA+F;AA3PxG;AA4PG,YAAM,MAAM,YAAY,IAAI,MAAM,IAAI,KAAK,CAAC;AAC5C,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,UAAU,GAAG;AACzB,UAAI,CAAC,IAAI,UAAU;AAClB,eAAO;AAAA,MACR;AAEA,UAAI,IAAI,cAAc,QAAQ,IAAI,aAAa,KAAK;AACnD,eAAO;AAAA,MACR;AACA,UAAI,IAAI,WAAW,MAAM,QAAQ;AAChC,eAAO;AAAA,MACR;AAEA,aAAO,cAAc,IAAI,YAAY,MAAM,SAAS,IAAI,MAAM;AAAA,IAC/D;AAAA,IAEA,MAAM,OAA2C;AAhRnD;AAiRG,qBAAe,KAAI,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,MAAM,EAAE;AAAA,IACxE;AAAA,IAEA,OAAO,OAAwF;AApRjG;AAqRG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,OAAO,CAAC,IAAI,UAAU;AAC1B,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AA1R1C,YAAAD;AA2RI,mBAAW,IAAI,MAAM,EAAE;AACvB,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAAA,UAC3C,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,EACD;AACD;",
+  "sourcesContent": ["/**\n * RFID/NFC tags (`rfid_tags`).\n *\n * A tag is a **signed deep link**: `uid.userId.exp.signature`, where the signature is\n * `HMAC-SHA256(hmacSecret, \"uid.userId.exp\")`. That way a tag needs no login on the scanning phone, cannot be\n * guessed (a forged payload fails the signature) and can be revoked or given an expiry. The stored `token_hash`\n * is the signature itself; the extra `uid` row keeps the lookup cheap and lets a tag be revoked individually.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type { Db } from \"../database\";\nimport { ValidationError } from \"../../errors\";\nimport { writeAuditLog } from \"./audit\";\n\n/** A tag as it is stored (without the signature). */\nexport interface RfidTagRecord {\n\t/** Primary key */\n\tid: number;\n\t/** Identifier of the tag (`uid` of the NFC tag or a generated value) */\n\tuid: string;\n\t/** Owner of the tag, `null` after the user was deleted */\n\tuserId: number | null;\n\t/** Free-form label */\n\tlabel: string | null;\n\t/** False for revoked tags */\n\tisActive: boolean;\n\t/** Instant the tag stops working, `null` = never */\n\texpiresAt: number | null;\n\t/** Instant of the last scan, `null` if never used */\n\tlastUsedAt: number | null;\n\t/** Instant of creation, UTC epoch seconds */\n\tcreatedAt: number;\n}\n\n/** Tag storage operations. */\nexport interface RfidRepository {\n\t/** Creates a tag and audits it (the signature is never written to the audit trail) */\n\tcreate(input: {\n\t\tuid: string;\n\t\tuserId: number;\n\t\tsignature: string;\n\t\tlabel?: string | null;\n\t\t/** Instant the tag stops working, `null` = never */\n\t\texpiresAt?: number | null;\n\t\tactorId: number;\n\t\tactorIp?: string | null;\n\t\tnow?: number;\n\t}): RfidTagRecord;\n\t/** All tags, optionally including the revoked ones */\n\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[];\n\t/** Reads a tag by id */\n\tfindById(id: number): RfidTagRecord | null;\n\t/** Checks a scanned token and returns the tag when signature, activity, owner and expiry match */\n\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null;\n\t/** Records a successful scan */\n\ttouch(input: { id: number; now?: number }): void;\n\t/** Revokes a tag */\n\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean;\n\t/** Deletes a tag for good \u2014 for a revoked badge that should disappear from the list */\n\tremove(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean;\n\t/**\n\t * Changes label, owner, expiry and \u2014 when a new signature is passed \u2014 the link of a badge.\n\t *\n\t * The signature binds `uid`, owner and expiry, so handing in `signature` is what issues a new link: the stored\n\t * hash is replaced and every link given out before stops working immediately. `activate` brings a revoked badge\n\t * back into use.\n\t */\n\tupdate(input: {\n\t\tid: number;\n\t\tlabel?: string | null;\n\t\tuserId?: number | null;\n\t\texpiresAt?: number | null;\n\t\tsignature?: string;\n\t\tactivate?: boolean;\n\t\tactorId: number;\n\t\tactorIp?: string | null;\n\t\tnow?: number;\n\t}): RfidTagRecord | null;\n}\n\n/**\n * Creates a random tag identifier.\n *\n * @returns base64url encoded identifier\n */\nexport function newTagUid(): string {\n\treturn randomBytes(16).toString(\"base64url\");\n}\n\n/**\n * Signs a tag payload.\n *\n * @param secret - instance secret (`hmacSecret`)\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload, UTC epoch seconds\n * @returns base64url encoded signature\n */\nexport function signTag(secret: string, uid: string, userId: number, expiresAt: number): string {\n\treturn createHmac(\"sha256\", secret).update(`${uid}.${userId}.${expiresAt}`).digest(\"base64url\");\n}\n\n/**\n * Builds the token a tag carries.\n *\n * @param uid - tag identifier\n * @param userId - owner of the tag\n * @param expiresAt - expiry of the payload\n * @param signature - signature of the payload\n * @returns the token\n */\nexport function buildTagToken(uid: string, userId: number, expiresAt: number, signature: string): string {\n\treturn `${uid}.${userId}.${expiresAt}.${signature}`;\n}\n\n/**\n * Splits a scanned token.\n *\n * @param token - token from the deep link or the QR code\n * @returns the parsed payload or `null` when the token is malformed\n */\nexport function parseTagToken(\n\ttoken: string,\n): { uid: string; userId: number; expiresAt: number; signature: string } | null {\n\tconst parts = token.trim().split(\".\");\n\tif (parts.length !== 4) {\n\t\treturn null;\n\t}\n\tconst [uid, rawUserId, rawExpires, signature] = parts;\n\tconst userId = Number(rawUserId);\n\tconst expiresAt = Number(rawExpires);\n\tif (!uid || !signature || !Number.isInteger(userId) || !Number.isInteger(expiresAt)) {\n\t\treturn null;\n\t}\n\treturn { uid, userId, expiresAt, signature };\n}\n\n/**\n * Compares two signatures without leaking the position of the first difference.\n *\n * @param expected - signature computed by the server\n * @param received - signature from the token\n * @returns true when both are identical\n */\nexport function sameSignature(expected: string, received: string): boolean {\n\tconst left = Buffer.from(expected);\n\tconst right = Buffer.from(received);\n\treturn left.length === right.length && timingSafeEqual(left, right);\n}\n\ninterface RfidRow {\n\tid: number;\n\tuid: string;\n\ttoken_hash: string;\n\tuser_id: number | null;\n\tlabel: string | null;\n\tis_active: number;\n\texpires_at: number | null;\n\tlast_used_at: number | null;\n\tcreated_at: number;\n}\n\nconst TAG_COLUMNS = `id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at`;\n\n/**\n * Maps a database row to a tag record (the signature stays inside the repository).\n *\n * @param row - raw database row\n * @returns tag record\n */\nfunction mapTagRow(row: RfidRow): RfidTagRecord {\n\treturn {\n\t\tid: row.id,\n\t\tuid: row.uid,\n\t\tuserId: row.user_id,\n\t\tlabel: row.label,\n\t\tisActive: row.is_active !== 0,\n\t\texpiresAt: row.expires_at,\n\t\tlastUsedAt: row.last_used_at,\n\t\tcreatedAt: row.created_at,\n\t};\n}\n\n/**\n * Creates the tag repository.\n *\n * @param db - open database handle\n * @returns repository instance\n */\nexport function createRfidRepository(db: Db): RfidRepository {\n\tconst insertTag = db.prepare(\n\t\t`INSERT INTO rfid_tags (uid, token_hash, user_id, label, is_active, expires_at, created_at)\n\t\t VALUES (?, ?, ?, ?, 1, ?, ?)`,\n\t);\n\tconst selectById = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE id = ?`);\n\tconst selectByUid = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE uid = ?`);\n\tconst selectAll = db.prepare(`SELECT ${TAG_COLUMNS} FROM rfid_tags ORDER BY created_at DESC, id DESC`);\n\tconst selectActive = db.prepare(\n\t\t`SELECT ${TAG_COLUMNS} FROM rfid_tags WHERE is_active = 1 ORDER BY created_at DESC, id DESC`,\n\t);\n\tconst updateLastUsed = db.prepare(\"UPDATE rfid_tags SET last_used_at = ? WHERE id = ?\");\n\tconst deactivate = db.prepare(\"UPDATE rfid_tags SET is_active = 0 WHERE id = ?\");\n\tconst deleteTag = db.prepare(\"DELETE FROM rfid_tags WHERE id = ?\");\n\t// the visible fields and the credential are changed separately: a label edit must not touch the signature\n\tconst changeFields = db.prepare(\n\t\t\"UPDATE rfid_tags SET user_id = ?, label = ?, expires_at = ?, is_active = ? WHERE id = ?\",\n\t);\n\tconst changeSignature = db.prepare(\"UPDATE rfid_tags SET token_hash = ? WHERE id = ?\");\n\n\t/**\n\t * Reads a tag.\n\t *\n\t * @param id - tag id\n\t * @returns tag or `null`\n\t */\n\tconst read = (id: number): RfidTagRecord | null => {\n\t\tconst row = selectById.get(id) as RfidRow | undefined;\n\t\treturn row ? mapTagRow(row) : null;\n\t};\n\n\treturn {\n\t\tcreate(input: {\n\t\t\tuid: string;\n\t\t\tuserId: number;\n\t\t\tsignature: string;\n\t\t\tlabel?: string | null;\n\t\t\texpiresAt?: number | null;\n\t\t\tactorId: number;\n\t\t\tactorIp?: string | null;\n\t\t\tnow?: number;\n\t\t}): RfidTagRecord {\n\t\t\tconst uid = input.uid.trim();\n\t\t\tif (!uid) {\n\t\t\t\tthrow new ValidationError(\"uid is required\");\n\t\t\t}\n\t\t\t// the caller passes the expiry it signed, so the stored value and the token cannot drift apart\n\t\t\tconst expiresAt = input.expiresAt ?? null;\n\t\t\tif (expiresAt !== null && (!Number.isInteger(expiresAt) || expiresAt <= 0)) {\n\t\t\t\tthrow new ValidationError(`expiresAt must be a positive instant (got ${input.expiresAt})`);\n\t\t\t}\n\t\t\tif (!input.signature) {\n\t\t\t\tthrow new ValidationError(\"signature is required\");\n\t\t\t}\n\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\n\t\t\tlet tagId = 0;\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tconst result = insertTag.run(uid, input.signature, input.userId, input.label ?? null, expiresAt, now);\n\t\t\t\ttagId = Number(result.lastInsertRowid);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.create\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: tagId,\n\t\t\t\t\t// the signature is a credential and never part of the audit trail\n\t\t\t\t\tdetail: { uid, userId: input.userId, label: input.label ?? null, expiresAt },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\n\t\t\tconst tag = read(tagId);\n\t\t\tif (!tag) {\n\t\t\t\tthrow new Error(`tag ${tagId} disappeared right after creation`);\n\t\t\t}\n\t\t\treturn tag;\n\t\t},\n\n\t\tlist(options?: { includeInactive?: boolean }): RfidTagRecord[] {\n\t\t\tconst rows = (options?.includeInactive === true ? selectAll : selectActive).all() as RfidRow[];\n\t\t\treturn rows.map(mapTagRow);\n\t\t},\n\n\t\tfindById: read,\n\n\t\tverify(input: { uid: string; userId: number; signature: string; now?: number }): RfidTagRecord | null {\n\t\t\tconst row = selectByUid.get(input.uid.trim()) as RfidRow | undefined;\n\t\t\tif (!row) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst tag = mapTagRow(row);\n\t\t\tif (!tag.isActive) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// an expired tag (or payload) is worthless even when the signature is correct\n\t\t\tif (tag.expiresAt !== null && tag.expiresAt <= now) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (tag.userId !== input.userId) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// the stored signature has to match the signature of the scanned payload\n\t\t\treturn sameSignature(row.token_hash, input.signature) ? tag : null;\n\t\t},\n\n\t\ttouch(input: { id: number; now?: number }): void {\n\t\t\tupdateLastUsed.run(input.now ?? Math.floor(Date.now() / 1000), input.id);\n\t\t},\n\n\t\trevoke(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag || !tag.isActive) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tdeactivate.run(input.id);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.revoke\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\tdetail: { uid: tag.uid, userId: tag.userId },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\n\t\tremove(input: { id: number; actorId: number; actorIp?: string | null; now?: number }): boolean {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tdeleteTag.run(input.id);\n\t\t\t\t// the row is gone, the audit trail keeps the trace of it\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.delete\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\tdetail: { uid: tag.uid, userId: tag.userId, isActive: tag.isActive },\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\n\t\tupdate(input: {\n\t\t\tid: number;\n\t\t\tlabel?: string | null;\n\t\t\tuserId?: number | null;\n\t\t\texpiresAt?: number | null;\n\t\t\tsignature?: string;\n\t\t\tactivate?: boolean;\n\t\t\tactorId: number;\n\t\t\tactorIp?: string | null;\n\t\t\tnow?: number;\n\t\t}): RfidTagRecord | null {\n\t\t\tconst tag = read(input.id);\n\t\t\tif (!tag) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst userId = input.userId === undefined ? tag.userId : input.userId;\n\t\t\tif (userId !== null && (!Number.isInteger(userId) || userId <= 0)) {\n\t\t\t\tthrow new ValidationError(`userId must be a positive whole number (got ${input.userId})`);\n\t\t\t}\n\t\t\tconst expiresAt = input.expiresAt === undefined ? tag.expiresAt : input.expiresAt;\n\t\t\tif (expiresAt !== null && (!Number.isInteger(expiresAt) || expiresAt <= 0)) {\n\t\t\t\tthrow new ValidationError(`expiresAt must be a positive instant (got ${input.expiresAt})`);\n\t\t\t}\n\t\t\t// a new link always carries a signature: an empty one would leave a signatureless badge behind\n\t\t\tif (input.signature !== undefined && !input.signature) {\n\t\t\t\tthrow new ValidationError(\"signature must not be empty\");\n\t\t\t}\n\t\t\tconst label = input.label === undefined ? tag.label : input.label;\n\t\t\tconst isActive = input.activate === undefined ? tag.isActive : input.activate;\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tchangeFields.run(userId, label, expiresAt, isActive ? 1 : 0, input.id);\n\t\t\t\tif (input.signature !== undefined) {\n\t\t\t\t\tchangeSignature.run(input.signature, input.id);\n\t\t\t\t}\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\taction: \"rfid.update\",\n\t\t\t\t\tentity: \"rfid_tag\",\n\t\t\t\t\tentityId: input.id,\n\t\t\t\t\t// the signature itself stays out of the audit trail, whether it was replaced is what counts\n\t\t\t\t\tdetail: {\n\t\t\t\t\t\tuid: tag.uid,\n\t\t\t\t\t\tuserId,\n\t\t\t\t\t\tlabel,\n\t\t\t\t\t\texpiresAt,\n\t\t\t\t\t\tisActive,\n\t\t\t\t\t\treissued: input.signature !== undefined,\n\t\t\t\t\t},\n\t\t\t\t\tip: input.actorIp ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn read(input.id);\n\t\t},\n\t};\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,yBAAyD;AAEzD,oBAAgC;AAChC,mBAA8B;AAyEvB,SAAS,YAAoB;AACnC,aAAO,gCAAY,EAAE,EAAE,SAAS,WAAW;AAC5C;AAWO,SAAS,QAAQ,QAAgB,KAAa,QAAgB,WAA2B;AAC/F,aAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,EAAE,EAAE,OAAO,WAAW;AAC/F;AAWO,SAAS,cAAc,KAAa,QAAgB,WAAmB,WAA2B;AACxG,SAAO,GAAG,GAAG,IAAI,MAAM,IAAI,SAAS,IAAI,SAAS;AAClD;AAQO,SAAS,cACf,OAC+E;AAC/E,QAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,GAAG;AACpC,MAAI,MAAM,WAAW,GAAG;AACvB,WAAO;AAAA,EACR;AACA,QAAM,CAAC,KAAK,WAAW,YAAY,SAAS,IAAI;AAChD,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,UAAU,MAAM,KAAK,CAAC,OAAO,UAAU,SAAS,GAAG;AACpF,WAAO;AAAA,EACR;AACA,SAAO,EAAE,KAAK,QAAQ,WAAW,UAAU;AAC5C;AASO,SAAS,cAAc,UAAkB,UAA2B;AAC1E,QAAM,OAAO,OAAO,KAAK,QAAQ;AACjC,QAAM,QAAQ,OAAO,KAAK,QAAQ;AAClC,SAAO,KAAK,WAAW,MAAM,cAAU,oCAAgB,MAAM,KAAK;AACnE;AAcA,MAAM,cAAc;AAQpB,SAAS,UAAU,KAA6B;AAC/C,SAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,KAAK,IAAI;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,UAAU,IAAI,cAAc;AAAA,IAC5B,WAAW,IAAI;AAAA,IACf,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,EAChB;AACD;AAQO,SAAS,qBAAqB,IAAwB;AAC5D,QAAM,YAAY,GAAG;AAAA,IACpB;AAAA;AAAA,EAED;AACA,QAAM,aAAa,GAAG,QAAQ,UAAU,WAAW,8BAA8B;AACjF,QAAM,cAAc,GAAG,QAAQ,UAAU,WAAW,+BAA+B;AACnF,QAAM,YAAY,GAAG,QAAQ,UAAU,WAAW,mDAAmD;AACrG,QAAM,eAAe,GAAG;AAAA,IACvB,UAAU,WAAW;AAAA,EACtB;AACA,QAAM,iBAAiB,GAAG,QAAQ,oDAAoD;AACtF,QAAM,aAAa,GAAG,QAAQ,iDAAiD;AAC/E,QAAM,YAAY,GAAG,QAAQ,oCAAoC;AAEjE,QAAM,eAAe,GAAG;AAAA,IACvB;AAAA,EACD;AACA,QAAM,kBAAkB,GAAG,QAAQ,kDAAkD;AAQrF,QAAM,OAAO,CAAC,OAAqC;AAClD,UAAM,MAAM,WAAW,IAAI,EAAE;AAC7B,WAAO,MAAM,UAAU,GAAG,IAAI;AAAA,EAC/B;AAEA,SAAO;AAAA,IACN,OAAO,OASW;AAtOpB;AAuOG,YAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,8BAAgB,iBAAiB;AAAA,MAC5C;AAEA,YAAM,aAAY,WAAM,cAAN,YAAmB;AACrC,UAAI,cAAc,SAAS,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,IAAI;AAC3E,cAAM,IAAI,8BAAgB,6CAA6C,MAAM,SAAS,GAAG;AAAA,MAC1F;AACA,UAAI,CAAC,MAAM,WAAW;AACrB,cAAM,IAAI,8BAAgB,uBAAuB;AAAA,MAClD;AAEA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAErD,UAAI,QAAQ;AACZ,YAAM,MAAM,GAAG,YAAY,MAAY;AAvP1C,YAAAA,KAAAC,KAAA;AAwPI,cAAM,SAAS,UAAU,IAAI,KAAK,MAAM,WAAW,MAAM,SAAQD,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,WAAW,GAAG;AACpG,gBAAQ,OAAO,OAAO,eAAe;AACrC,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA;AAAA,UAEV,QAAQ,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAOC,MAAA,MAAM,UAAN,OAAAA,MAAe,MAAM,UAAU;AAAA,UAC3E,KAAI,WAAM,YAAN,YAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AAEJ,YAAM,MAAM,KAAK,KAAK;AACtB,UAAI,CAAC,KAAK;AACT,cAAM,IAAI,MAAM,OAAO,KAAK,mCAAmC;AAAA,MAChE;AACA,aAAO;AAAA,IACR;AAAA,IAEA,KAAK,SAA0D;AAC9D,YAAM,SAAQ,mCAAS,qBAAoB,OAAO,YAAY,cAAc,IAAI;AAChF,aAAO,KAAK,IAAI,SAAS;AAAA,IAC1B;AAAA,IAEA,UAAU;AAAA,IAEV,OAAO,OAA+F;AArRxG;AAsRG,YAAM,MAAM,YAAY,IAAI,MAAM,IAAI,KAAK,CAAC;AAC5C,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,UAAU,GAAG;AACzB,UAAI,CAAC,IAAI,UAAU;AAClB,eAAO;AAAA,MACR;AAEA,UAAI,IAAI,cAAc,QAAQ,IAAI,aAAa,KAAK;AACnD,eAAO;AAAA,MACR;AACA,UAAI,IAAI,WAAW,MAAM,QAAQ;AAChC,eAAO;AAAA,MACR;AAEA,aAAO,cAAc,IAAI,YAAY,MAAM,SAAS,IAAI,MAAM;AAAA,IAC/D;AAAA,IAEA,MAAM,OAA2C;AA1SnD;AA2SG,qBAAe,KAAI,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,MAAM,EAAE;AAAA,IACxE;AAAA,IAEA,OAAO,OAAwF;AA9SjG;AA+SG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,OAAO,CAAC,IAAI,UAAU;AAC1B,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AApT1C,YAAAD;AAqTI,mBAAW,IAAI,MAAM,EAAE;AACvB,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAAA,UAC3C,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,IAEA,OAAO,OAAwF;AApUjG;AAqUG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AA1U1C,YAAAA;AA2UI,kBAAU,IAAI,MAAM,EAAE;AAEtB,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,QAAQ,EAAE,KAAK,IAAI,KAAK,QAAQ,IAAI,QAAQ,UAAU,IAAI,SAAS;AAAA,UACnE,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,IAEA,OAAO,OAUkB;AArW3B;AAsWG,YAAM,MAAM,KAAK,MAAM,EAAE;AACzB,UAAI,CAAC,KAAK;AACT,eAAO;AAAA,MACR;AACA,YAAM,SAAS,MAAM,WAAW,SAAY,IAAI,SAAS,MAAM;AAC/D,UAAI,WAAW,SAAS,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,IAAI;AAClE,cAAM,IAAI,8BAAgB,+CAA+C,MAAM,MAAM,GAAG;AAAA,MACzF;AACA,YAAM,YAAY,MAAM,cAAc,SAAY,IAAI,YAAY,MAAM;AACxE,UAAI,cAAc,SAAS,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,IAAI;AAC3E,cAAM,IAAI,8BAAgB,6CAA6C,MAAM,SAAS,GAAG;AAAA,MAC1F;AAEA,UAAI,MAAM,cAAc,UAAa,CAAC,MAAM,WAAW;AACtD,cAAM,IAAI,8BAAgB,6BAA6B;AAAA,MACxD;AACA,YAAM,QAAQ,MAAM,UAAU,SAAY,IAAI,QAAQ,MAAM;AAC5D,YAAM,WAAW,MAAM,aAAa,SAAY,IAAI,WAAW,MAAM;AACrE,YAAM,OAAM,WAAM,QAAN,YAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAErD,YAAM,MAAM,GAAG,YAAY,MAAY;AA1X1C,YAAAA;AA2XI,qBAAa,IAAI,QAAQ,OAAO,WAAW,WAAW,IAAI,GAAG,MAAM,EAAE;AACrE,YAAI,MAAM,cAAc,QAAW;AAClC,0BAAgB,IAAI,MAAM,WAAW,MAAM,EAAE;AAAA,QAC9C;AACA,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,UACf,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA;AAAA,UAEhB,QAAQ;AAAA,YACP,KAAK,IAAI;AAAA,YACT;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,UAAU,MAAM,cAAc;AAAA,UAC/B;AAAA,UACA,KAAIA,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QACtB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO,KAAK,MAAM,EAAE;AAAA,IACrB;AAAA,EACD;AACD;",
   "names": ["_a", "_b"]
 }

package/build/lib/web/api.js

@@ -2131,6 +2131,39 @@ function createApi(deps) {
     }
     return secret;
   };
+  const tagLink = (context, token) => {
+    var _a2;
+    const host = (_a2 = context.header("host")) != null ? _a2 : "localhost";
+    const scheme = host.includes("://") ? "" : `${context.secure ? "https" : "http"}://`;
+    return `${scheme}${host}/?tag=${token}`;
+  };
+  const reissueLink = (context, tag, ttlDays, label) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    if (tag.userId === null) {
+      throw new import_errors.ValidationError("the badge has no employee any more \u2014 give it one first");
+    }
+    const timestamp = now();
+    const expiresAt = timestamp + ttlDays * 86400;
+    const signature = (0, import_rfid.signTag)(requireHmacSecret(), tag.uid, tag.userId, expiresAt);
+    const updated = rfid.update({
+      id: tag.id,
+      userId: tag.userId,
+      expiresAt,
+      signature,
+      activate: true,
+      ...label === void 0 ? {} : { label },
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: timestamp
+    });
+    if (!updated) {
+      throw new import_errors.NotFoundError(`tag ${tag.id} not found`);
+    }
+    return { tag: updated, token: (0, import_rfid.buildTagToken)(updated.uid, tag.userId, expiresAt, signature) };
+  };
   route(
     "GET",
     "/rfid/tags",
@@ -2138,7 +2171,7 @@ function createApi(deps) {
     () => (0, import_router.json)(200, { tags: rfid.list({ includeInactive: true }) })
   );
   route("POST", "/rfid/tags", { permission: "rfid.manage", csrf: true }, (context) => {
-    var _a2, _b2, _c2, _d2, _e;
+    var _a2, _b2, _c2, _d2;
     if (!context.auth) {
       throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
     }
@@ -2167,9 +2200,7 @@ function createApi(deps) {
       now: timestamp
     });
     const token = (0, import_rfid.buildTagToken)(uid, target, expiresAt, signature);
-    const host = (_e = context.header("host")) != null ? _e : "localhost";
-    const scheme = host.includes("://") ? "" : `${context.secure ? "https" : "http"}://`;
-    return (0, import_router.json)(201, { tag, token, url: `${scheme}${host}/?tag=${token}` }, { location: `/rfid/tags/${tag.id}` });
+    return (0, import_router.json)(201, { tag, token, url: tagLink(context, token) }, { location: `/rfid/tags/${tag.id}` });
   });
   route("DELETE", "/rfid/tags/:id", { permission: "rfid.manage", csrf: true }, (context) => {
     var _a2;
@@ -2187,6 +2218,75 @@ function createApi(deps) {
     }
     return (0, import_router.noContent)();
   });
+  route("DELETE", "/rfid/tags/:id/permanent", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const removed = rfid.remove({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    return (0, import_router.noContent)();
+  });
+  route("PATCH", "/rfid/tags/:id", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    const body = context.jsonBody();
+    const current = rfid.findById(id);
+    if (!current) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    const userId = body.userId === void 0 ? current.userId : Number(body.userId);
+    if (userId === null || !Number.isInteger(userId) || !users.findById(userId)) {
+      throw new import_errors.ValidationError("userId must reference an existing employee");
+    }
+    const ttlDays = (_a2 = optionalNumber(body, "ttlDays")) != null ? _a2 : void 0;
+    if (ttlDays !== void 0 && (!Number.isInteger(ttlDays) || ttlDays <= 0)) {
+      throw new import_errors.ValidationError(`ttlDays must be a positive whole number (got ${ttlDays})`);
+    }
+    const label = body.label === void 0 ? void 0 : optionalString(body, "label");
+    if (userId !== current.userId || ttlDays !== void 0) {
+      const signed = reissueLink(context, { ...current, userId }, ttlDays != null ? ttlDays : 365, label);
+      return (0, import_router.json)(200, { tag: signed.tag, token: signed.token, url: tagLink(context, signed.token) });
+    }
+    const changed = rfid.update({
+      id,
+      userId,
+      ...label === void 0 ? {} : { label },
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    if (!changed) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    return (0, import_router.json)(200, { tag: changed });
+  });
+  route("POST", "/rfid/tags/:id/link", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const tag = rfid.findById(numberParam(context, "id"));
+    if (!tag) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    const ttlDays = (_a2 = optionalNumber(context.jsonBody(), "ttlDays")) != null ? _a2 : 365;
+    if (!Number.isInteger(ttlDays) || ttlDays <= 0) {
+      throw new import_errors.ValidationError(`ttlDays must be a positive whole number (got ${ttlDays})`);
+    }
+    const signed = reissueLink(context, tag, ttlDays);
+    return (0, import_router.json)(200, { tag: signed.tag, token: signed.token, url: tagLink(context, signed.token) });
+  });
   route(
     "POST",
     "/rfid/scan",