admin/dh-inspeccion-v2
1
0
Fork 0
Code Issues Pull Requests 2 Actions 2 Packages Projects Releases 1 Wiki Activity

fix(F6.1): enforce Yacimiento scope end to end

Browse Source
This commit is contained in:
github-actions[bot]
2026-09-10 18:45:42 +00:00
parent f99452c21c
commit b1f0064b40
8 changed files with 129 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api-v3/src/inspection-visits/field-findings.service.ts
+10 -7
View File
@@ -129,6 +129,7 @@ export class FieldFindingsService {
visit.id AS "visitId",
visit.code AS "visitCode",
visit.status AS "visitStatus",
COALESCE(visit.scope_asset_id, visit.operational_area_id) AS "scopeAssetId",
visit.operational_area_id AS "areaId",
area.code AS "areaCode",
area.name AS "areaName",
@@ -139,8 +140,7 @@ export class FieldFindingsService {
asset_type.code AS "assetTypeCode",
asset.inventory_family_id AS "inventoryFamilyId",
(
asset.operational_area_id=visit.operational_area_id
OR asset.id=visit.operational_area_id
asset.id=COALESCE(visit.scope_asset_id, visit.operational_area_id)
OR EXISTS (
WITH RECURSIVE ancestors AS (
SELECT id,parent_id FROM assets WHERE id=asset.parent_id
@@ -148,9 +148,11 @@ export class FieldFindingsService {
SELECT parent.id,parent.parent_id
FROM assets parent JOIN ancestors child ON parent.id=child.parent_id
)
SELECT 1 FROM ancestors WHERE id=visit.operational_area_id LIMIT 1
SELECT 1 FROM ancestors
WHERE id=COALESCE(visit.scope_asset_id, visit.operational_area_id)
LIMIT 1
)
) AS "insideArea",
) AS "insideScope",
EXISTS (
SELECT 1
FROM area_company_relations relation
@@ -213,6 +215,7 @@ export class FieldFindingsService {
visitId: string;
visitCode: string;
visitStatus: string;
scopeAssetId: string | null;
areaId: string | null;
areaCode: string | null;
areaName: string | null;
@@ -222,7 +225,7 @@ export class FieldFindingsService {
assetId: string | null;
assetTypeCode: string | null;
inventoryFamilyId: string | null;
insideArea: boolean;
insideScope: boolean;
operatorRelationValid: boolean;
assigned: boolean;
selected: boolean;
@@ -278,10 +281,10 @@ export class FieldFindingsService {
message: 'La Instalación/Subinstalación debe tener una clasificación técnica antes de registrar Hallazgos',
});
}
if (!row.insideArea) {
if (!row.insideScope) {
throw new BadRequestException({
code: 'FIELD_FINDING_INVENTORY_OUTSIDE_CONTEXT',
message: 'El Inventario no pertenece al Área de esta inspección',
message: 'El Inventario no pertenece al Yacimiento definido como alcance de esta inspección',
});
}
if (!row.selected) {
api-v3/src/inspection-visits/field-inventory.service.ts
+19 -17
View File
@@ -23,6 +23,7 @@ interface MobileVisitContext {
code: string;
status: string;
areaId: string;
scopeAssetId: string;
areaCode: string;
areaName: string;
companyId: string;
@@ -80,12 +81,12 @@ export class FieldInventoryService {
const context = await this.requireVisitContext(visitId, principal, false);
if (query.parentId) await this.requireParentInContext(query.parentId, context);
// Empresa is visit context, never physical ownership. Search by Area ancestry.
const args: unknown[] = [context.areaId, visitId];
// Empresa is visit context, never physical ownership. Search stays inside the frozen Yacimiento scope.
const args: unknown[] = [context.scopeAssetId, visitId];
const conditions = [
"asset.information_status <> 'INACTIVE'",
`(
asset.operational_area_id = $1::uuid
asset.id = $1::uuid
OR EXISTS (
WITH RECURSIVE ancestors AS (
SELECT id,parent_id FROM assets WHERE id=asset.parent_id
@@ -198,7 +199,7 @@ export class FieldInventoryService {
principal: AuthPrincipal,
) {
const context = await this.requireVisitContext(visitId, principal, false);
const effectiveParentId = parentId ?? context.areaId;
const effectiveParentId = parentId ?? context.scopeAssetId;
const parent = await this.requireParentInContext(effectiveParentId, context);
const data = await this.dataSource.query(`
@@ -272,7 +273,7 @@ export class FieldInventoryService {
request: RequestWithContext,
) {
const context = await this.requireVisitContext(visitId, principal, true);
const parentId = dto.parentId ?? context.areaId;
const parentId = dto.parentId ?? context.scopeAssetId;
await this.requireParentInContext(parentId, context);
const capturedAt = new Date(dto.deviceCapturedAt);
@@ -412,6 +413,7 @@ export class FieldInventoryService {
visit.id,
visit.code,
visit.status,
COALESCE(visit.scope_asset_id, visit.operational_area_id) AS "scopeAssetId",
visit.operational_area_id AS "areaId",
area.code AS "areaCode",
area.name AS "areaName",
@@ -485,6 +487,7 @@ export class FieldInventoryService {
private publicContext(context: MobileVisitContext) {
return {
inspection: { id: context.id, code: context.code, status: context.status },
scopeAssetId: context.scopeAssetId,
area: { id: context.areaId, code: context.areaCode, name: context.areaName },
operatorCompany: {
id: context.companyId,
@@ -503,7 +506,6 @@ export class FieldInventoryService {
asset.asset_type_id AS "typeId",
(
asset.id=$2::uuid
OR asset.operational_area_id=$2::uuid
OR EXISTS (
WITH RECURSIVE ancestors AS (
SELECT id,parent_id FROM assets WHERE id=asset.parent_id
@@ -512,16 +514,16 @@ export class FieldInventoryService {
FROM assets parent JOIN ancestors child ON parent.id=child.parent_id
) SELECT 1 FROM ancestors WHERE id=$2::uuid LIMIT 1
)
) AS "insideArea"
) AS "insideScope"
FROM assets asset
WHERE asset.id = $1::uuid
AND asset.information_status <> 'INACTIVE'
`, [parentId, context.areaId])) as Array<{
`, [parentId, context.scopeAssetId])) as Array<{
id: string;
code: string;
name: string;
typeId: string;
insideArea: boolean;
insideScope: boolean;
}>;
if (!parent) {
@@ -530,10 +532,10 @@ export class FieldInventoryService {
message: 'La ubicación padre no existe',
});
}
if (!parent.insideArea) {
if (!parent.insideScope) {
throw new BadRequestException({
code: 'FIELD_INVENTORY_PARENT_OUTSIDE_CONTEXT',
message: 'La ubicación padre no pertenece al Área de la inspección',
message: 'La ubicación padre no pertenece al Yacimiento definido como alcance de la inspección',
});
}
return parent;
@@ -545,7 +547,7 @@ export class FieldInventoryService {
asset.id,
(asset.is_inventory_instance=true OR lower(type.code)='yacimiento') AS "eligibleTarget",
(
asset.operational_area_id=$2::uuid
asset.id=$2::uuid
OR EXISTS (
WITH RECURSIVE ancestors AS (
SELECT id,parent_id FROM assets WHERE id=asset.parent_id
@@ -554,15 +556,15 @@ export class FieldInventoryService {
FROM assets parent JOIN ancestors child ON parent.id=child.parent_id
) SELECT 1 FROM ancestors WHERE id=$2::uuid LIMIT 1
)
) AS "insideArea"
) AS "insideScope"
FROM assets asset
JOIN asset_types type ON type.id=asset.asset_type_id
WHERE asset.id = $1::uuid
AND asset.information_status <> 'INACTIVE'
`, [assetId, context.areaId])) as Array<{
`, [assetId, context.scopeAssetId])) as Array<{
id: string;
eligibleTarget: boolean;
insideArea: boolean;
insideScope: boolean;
}>;
if (!asset) {
@@ -571,10 +573,10 @@ export class FieldInventoryService {
message: 'Registro de Inventario no encontrado',
});
}
if (!asset.insideArea) {
if (!asset.insideScope) {
throw new BadRequestException({
code: 'FIELD_INVENTORY_OUTSIDE_CONTEXT',
message: 'El registro no pertenece al Área de esta inspección',
message: 'El registro no pertenece al Yacimiento definido como alcance de esta inspección',
});
}
if (!asset.eligibleTarget) {
api-v3/src/inspection-visits/inspection-planning-create.service.ts
+43
View File
@@ -167,6 +167,49 @@ export class InspectionPlanningCreateService {
ORDER BY finding.created_at,finding.id
`, [visit.id, dto.operationalAreaId, scopeAssetId, plannedStartAt.toISOString().slice(0, 10)]);
stage = 'checklist:assets';
await manager.query(`
INSERT INTO inspection_visit_assets (
visit_id, asset_id, included, planning_source, added_by
)
SELECT DISTINCT $1::uuid, item.asset_id, true, 'AUTOMATIC', $2::uuid
FROM inspection_visit_checklist_items item
WHERE item.visit_id=$1::uuid
AND item.generation_number=1
AND item.item_kind IN ('COMPANY_OVERDUE','VERIFICATION_OVERDUE','UPCOMING_CONTROL')
ON CONFLICT (visit_id,asset_id) DO UPDATE SET
included=true,
planning_source=CASE
WHEN inspection_visit_assets.planning_source='VERIFICATION' THEN 'VERIFICATION'
ELSE 'AUTOMATIC'
END,
exclusion_reason=NULL,
excluded_by=NULL,
excluded_at=NULL,
added_by=EXCLUDED.added_by,
updated_at=CURRENT_TIMESTAMP
`, [visit.id, principal.userId]);
stage = 'checklist:asset-events';
await manager.query(`
INSERT INTO inspection_visit_asset_events (
visit_id, asset_id, event_type, reason, actor_user_id, metadata
)
SELECT DISTINCT
$1::uuid, item.asset_id, 'AUTO_INCLUDED', NULL, $2::uuid,
jsonb_build_object('generation',1,'source','F6.1_CREATE')
FROM inspection_visit_checklist_items item
WHERE item.visit_id=$1::uuid
AND item.generation_number=1
AND item.item_kind IN ('COMPANY_OVERDUE','VERIFICATION_OVERDUE','UPCOMING_CONTROL')
AND NOT EXISTS (
SELECT 1 FROM inspection_visit_asset_events event
WHERE event.visit_id=$1::uuid
AND event.asset_id=item.asset_id
AND event.event_type='AUTO_INCLUDED'
)
`, [visit.id, principal.userId]);
stage = 'audit:record';
await this.audit.record({
...administrationAuditContext(principal, request),
api-v3/src/inspection-visits/inspection-visits.controller.ts
+2 -1
View File
@@ -82,8 +82,9 @@ export class InspectionVisitsController {
@RequirePermissions('inspections.read')
planningOperators(
@Param('areaId', new ParseUUIDPipe({ version: '4' })) areaId: string,
@Query('at') at?: string,
) {
return this.visits.listPlanningOperators(areaId);
return this.planningHierarchy.operatorsForArea(areaId, at);
}
@Get('mobile/planning-context/areas')
api-v3/src/inspection-visits/inspection-visits.service.ts
+31 -25
View File
@@ -23,6 +23,7 @@ import type { ReplaceInspectionVisitAssetsDto } from './dto/replace-inspection-v
import type { ReplaceInspectionVisitTeamDto } from './dto/replace-inspection-visit-team.dto';
import type { UpdateInspectionVisitDto } from './dto/update-inspection-visit.dto';
import { nextInspectionVisitCode } from './inspection-visit-code';
import { validateInspectionPlanningScope } from './inspection-planning-scope';
export interface InspectionPerson {
id: string;
@@ -312,7 +313,7 @@ export class InspectionVisitsService {
}
const operationalAreaId = dto.operationalAreaId;
const operatorCompanyId = dto.operatorCompanyId;
await this.validatePlanningContext(manager, operationalAreaId, operatorCompanyId);
await this.validatePlanningContext(manager, operationalAreaId, operatorCompanyId, plannedStartAt);
await this.requireAsset(manager, operationalAreaId);
await this.requireInspectors(manager, [dto.leadInspectorUserId]);
const code = await nextInspectionVisitCode(manager, plannedStartAt);
@@ -382,29 +383,24 @@ export class InspectionVisitsService {
? visit.operatorCompanyId
: dto.operatorCompanyId;
const contextTouched = dto.operationalAreaId !== undefined || dto.operatorCompanyId !== undefined;
const nextScope = contextTouched
? nextAreaId
: dto.scopeAssetId === undefined
? visit.scopeAssetId
: dto.scopeAssetId;
await this.validatePlanningContext(manager, nextAreaId, nextCompanyId);
const nextScope = dto.scopeAssetId === undefined ? visit.scopeAssetId : dto.scopeAssetId;
await this.validatePlanningContext(manager, nextAreaId, nextCompanyId, nextStart);
await this.requireAsset(manager, nextScope);
if (contextTouched && nextAreaId && nextCompanyId) {
await this.assertCurrentAssetsMatchContext(manager, id, nextAreaId, nextCompanyId);
} else if (dto.scopeAssetId !== undefined) {
if (nextAreaId && nextScope) {
await validateInspectionPlanningScope(manager, nextAreaId, nextScope);
await this.assertCurrentAssetsInScope(manager, id, nextScope);
}
if (dto.objective !== undefined) visit.objective = dto.objective;
if (contextTouched) {
visit.operationalAreaId = nextAreaId;
visit.operatorCompanyId = nextCompanyId;
visit.scopeAssetId = nextAreaId;
} else if (dto.scopeAssetId !== undefined) {
}
if (dto.scopeAssetId !== undefined) {
visit.scopeAssetId = dto.scopeAssetId;
}
if (dto.plannedStartAt !== undefined) visit.plannedStartAt = nextStart;
if (dto.instructions !== undefined) visit.instructions = dto.instructions;
if (contextTouched || dto.plannedStartAt !== undefined) visit.checklistGeneratedAt = null;
if (contextTouched || dto.scopeAssetId !== undefined || dto.plannedStartAt !== undefined) visit.checklistGeneratedAt = null;
visit.updatedBy = principal.userId;
await manager.getRepository(InspectionVisit).save(visit);
const updated = await this.loadView(manager, id);
@@ -463,11 +459,10 @@ export class InspectionVisitsService {
message: 'Seleccioná Área y Operadora antes de agregar registros preventivos',
});
}
await this.assertAssetsMatchContext(
await this.assertAssetsInScope(
manager,
additions,
visit.operationalAreaId,
visit.operatorCompanyId,
visit.scopeAssetId ?? visit.operationalAreaId,
);
for (const assetId of additions) {
await manager.query(`
@@ -629,11 +624,10 @@ export class InspectionVisitsService {
if (!visit.operationalAreaId || !visit.operatorCompanyId) {
throw new BadRequestException({ code: 'INSPECTION_CONTEXT_REQUIRED', message: 'La visita no tiene Área y Operadora definidas' });
}
await this.assertAssetsMatchContext(
await this.assertAssetsInScope(
manager,
[assetId],
visit.operationalAreaId,
visit.operatorCompanyId,
visit.scopeAssetId ?? visit.operationalAreaId,
);
await manager.query(`
UPDATE inspection_visit_assets
@@ -920,6 +914,7 @@ export class InspectionVisitsService {
manager: EntityManager,
operationalAreaId: string | null,
operatorCompanyId: string | null,
effectiveAt: Date | null = null,
): Promise<void> {
if (!operationalAreaId && !operatorCompanyId) return;
if (!operationalAreaId || !operatorCompanyId) {
@@ -938,8 +933,8 @@ export class InspectionVisitsService {
WHERE relation.area_id = area.id
AND relation.company_id = company.id
AND relation.relation_role = 'OPERATOR'
AND relation.valid_from <= CURRENT_TIMESTAMP
AND (relation.valid_until IS NULL OR relation.valid_until > CURRENT_TIMESTAMP)
AND relation.valid_from <= $3::timestamptz
AND (relation.valid_until IS NULL OR relation.valid_until > $3::timestamptz)
) AS "activeOperatorRelation"
FROM assets area
INNER JOIN asset_types area_type ON area_type.id = area.asset_type_id
@@ -951,7 +946,7 @@ export class InspectionVisitsService {
AND company_type.operational_role = 'COMPANY'
AND area.information_status <> 'INACTIVE'
AND company.information_status <> 'INACTIVE'
`, [operationalAreaId, operatorCompanyId])) as Array<{
`, [operationalAreaId, operatorCompanyId, effectiveAt ?? new Date()])) as Array<{
areaId: string;
companyId: string;
activeOperatorRelation: boolean;
@@ -1041,7 +1036,7 @@ export class InspectionVisitsService {
message: 'Indicá la fecha prevista antes de generar el checklist',
});
}
await this.validatePlanningContext(manager, visit.operationalAreaId, visit.operatorCompanyId);
await this.validatePlanningContext(manager, visit.operationalAreaId, visit.operatorCompanyId, visit.plannedStartAt);
const generation = visit.checklistGeneration + 1;
await manager.query(`
INSERT INTO inspection_visit_checklist_items (
@@ -1106,14 +1101,25 @@ export class InspectionVisitsService {
FROM inspection_findings finding
INNER JOIN assets asset ON asset.id = finding.asset_id
WHERE asset.operational_area_id = $3
AND asset.operator_company_id = $4
AND finding.status <> 'VOIDED'
AND (
asset.id=$4::uuid
OR EXISTS (
WITH RECURSIVE ancestors AS (
SELECT id,parent_id FROM assets WHERE id=asset.parent_id
UNION ALL
SELECT parent.id,parent.parent_id
FROM assets parent JOIN ancestors child ON parent.id=child.parent_id
)
SELECT 1 FROM ancestors WHERE id=$4::uuid LIMIT 1
)
)
ORDER BY finding.created_at, finding.id
`, [
visit.id,
generation,
visit.operationalAreaId,
visit.operatorCompanyId,
visit.scopeAssetId ?? visit.operationalAreaId,
visit.plannedStartAt.toISOString().slice(0, 10),
]);