/* ============================================================
CurrencyDesk OS — Clients & KYC
A proper contact book for a money-services business. Each client
is an individual or a corporation with full KYC: ID, contact,
date of birth / incorporation, address, occupation / nature of
business, a contact photo (separate from the ID document image),
a photo gallery, notes and risk rating.
Interaction:
• single click → QuickCard popup (key info, update ID, view txns)
• double click → full Profile page (everything + transaction
history + one-touch printable client report)
Clients created inline from the Ledger's New-Transaction flow show
up here automatically (records are merged with the contact store).
============================================================ */
(function () {
const { useState, useMemo, useRef, useEffect } = React;
const { CD, Ic, fmt, num, crossRate, businessDate, deskPack, reportingLimit } = window.CDOS;
/* THE DESK'S OWN MONEY.
Every money figure in this file — a client's lifetime volume, the fees
they have paid, the structuring aggregate on a compliance banner, and
the printed client report's four headline tiles — was formatted as
Canadian dollars. Home currency belongs to the jurisdiction pack.
`homeOf` returns NULL rather than a number when the desk's books are
kept in a currency the browser's rate board cannot convert into: the
board is quoted in units per CANADIAN dollar (`PER_CAD`), so it can
only produce this total for a Canadian desk. Elsewhere the figure is
absent and says so — see docs/ABSENT_FIGURES.md. */
const homeCcy = () => { const p = deskPack(); return (p && p.homeCurrency) || (reportingLimit(null) || {}).currency || null; };
const computeFlags = window.CDOS.computeFlags;
// render overlays at the document root so the window's stacking context
// (and the rate ticker at z-360) can never occlude them
const Portal = ({ children }) => ReactDOM.createPortal(children, document.body);
/* ============================================================
THE CUSTOMER FILE IS NOT IN THIS BROWSER ANY MORE
It used to be. `cdos_clients_v1`, in localStorage, keyed BY THE
CUSTOMER'S NAME — which meant two people called David Chen were one
file, correcting a spelling orphaned a person's history, the second
till was a different shop, and the passport scans inside it were the
largest single contributor to a four-megabyte saving ceiling that,
when reached, stopped this desk saving ANYTHING.
The record now lives on the server, keyed by an id that is never a
name, scoped to the legal entity so every counter and every branch
sees it. See server/src/clients/records.ts and
docs/CLIENT_RECORDS.md.
WHAT THE OLD `clients` OBJECT IS NOW. It is a PROJECTION of what the
server holds, in the shape the screens that have not moved yet still
read — the Ledger, the transaction modal, compliance, reports, the
dashboard. Those files are not being rewritten in this change and
must not break, so the server record is flattened back into the old
name-keyed form on every load and handed to `setClients`.
Two rules that projection obeys, and both matter:
• It never DELETES anything it did not put there. A record the
server has never heard of — created on a desk with no ledger
database, or before this change — stays exactly where it is.
• It drops a scan only when the SERVER holds that scan. That is
the byte weight that was breaking saving, and it is the one
thing this projection is allowed to take away.
A desk that cannot reach these routes keeps the browser-only store
it has always had, silently, because that is what it had yesterday.
A desk that reaches them and gets a fault says so, because a shared
record quietly falling back to a private one is the failure nobody
notices until two tills disagree.
============================================================ */
const ClientRecords = (function () {
const api = () => (window.CDOS.Backend && window.CDOS.Backend.Clients) || null;
let records = null; // server records, or null before any answer
let mode = 'unknown'; // 'unknown' | 'server' | 'local'
let trouble = ''; // a fault worth a sentence on screen
let inflight = null;
let listeners = [];
const key = (name) => String(name || '').trim().replace(/\s+/g, ' ').toLowerCase();
const announce = () => listeners.slice().forEach(fn => { try { fn(); } catch (e) {} });
function load(force) {
const client = api();
if (!client) { mode = 'local'; announce(); return Promise.resolve(null); }
if (inflight && !force) return inflight;
inflight = client.list().then(body => {
records = body.clients || [];
mode = 'server';
trouble = '';
return records;
}).catch(err => {
records = null;
mode = 'local';
/* 401 / 403 / a route that is not there are all "this desk is
not server-backed", which is an ordinary state. A 5xx is a
fault, and a fault that silently degrades to a private store
is how two tills come to hold different customers without
anybody being told. */
trouble = (err && err.status >= 500)
? 'CurrencyDesk could not load this desk’s customer records from the server. What is on screen is this browser’s own copy, and it is not shared with the other tills.'
: '';
return null;
}).then(result => { inflight = null; announce(); return result; });
return inflight;
}
const all = () => records || [];
const byId = (clientId) => all().filter(r => r.clientId === clientId)[0] || null;
/* Every client whose CURRENT name or any ALIAS matches. More than
one is a legitimate answer — two people share a name — and the
caller is expected to say so rather than silently pick one. */
const byName = (name) => {
const want = key(name);
return all().filter(r => key(r.legalName) === want
|| (r.aliases || []).some(a => key(a.alias) === want));
};
/* An identity document, where one was described. The desk's flat
`idType` / `idNum` / `photo` fields are three different things now
— a document, its number and a picture of it — and this is where a
caller who still holds them as one object gets them filed
correctly. */
async function applyDocument(clientId, rec) {
const client = api();
if (!client || !clientId) return;
if (!rec || (!rec.idType && !rec.idNum && !rec.photo)) return;
await client.addDocument(clientId, {
docType: rec.idType || 'Not stated',
docNumber: rec.idNum || null,
issuedOn: rec.idIssued || null,
expiresOn: rec.idExpiry || null,
isPrimary: true,
scanDataUrl: rec.photo || null,
});
}
/* The server's records, flattened into the old name-keyed shape and
laid over whatever the browser already had. */
function project(previous) {
const client = api();
if (mode !== 'server' || !client || !records) return previous;
const next = Object.assign({}, previous || {});
/* A record that was renamed on the server leaves a stale entry
under its old name here. The alias rows are exactly what
identifies it, which is the reason they exist. */
records.forEach(record => {
(record.aliases || []).forEach(alias => {
if (key(alias.alias) !== key(record.legalName)) delete next[alias.alias];
});
});
records.forEach(record => {
next[record.legalName] = client.toDeskRecord(record, (previous || {})[record.legalName] || {});
});
return next;
}
return {
load,
all,
byId,
byName,
project,
key,
mode: () => mode,
trouble: () => trouble,
serverBacked: () => mode === 'server',
subscribe(fn) { listeners.push(fn); return () => { listeners = listeners.filter(f => f !== fn); }; },
/* Open a file on somebody, from a screen that is not this one —
the new-contact flow in cdos-kyc.jsx runs at the till and from
the transaction modal, and a contact made there used to exist in
one browser and nowhere else.
It ALWAYS creates. It deliberately does not attach to an
existing record with the same name, and that is the whole
subject of this change: silently folding a second David Chen
into the first one's file is precisely the defect being
removed. Somebody who reaches for "add a new contact" is saying
this is a new person; the record comes back knowing who else
shares the name and the profile says so on screen. Choosing an
EXISTING customer is what the picker is for.
Returns the created record, or null when this desk is not
server-backed. */
async open(name, deskRecord) {
const client = api();
if (!client || mode === 'local') return null;
const rec = deskRecord || {};
const created = await client.create(Object.assign(
{ legalName: String(name).trim(), kind: rec.kind === 'corporate' ? 'business' : 'individual' },
client.fromDeskFields(rec)));
await applyDocument(created.clientId, rec);
await load(true);
return created;
},
/* Fold what a verification read off the document into a file that
already exists — the same record, not a second one. */
async record(clientId, deskRecord) {
const client = api();
if (!client || mode === 'local' || !clientId) return null;
const rec = deskRecord || {};
const changes = client.fromDeskFields(rec);
const updated = Object.keys(changes).length ? await client.update(clientId, changes) : null;
await applyDocument(clientId, rec);
await load(true);
return updated;
},
};
})();
/* Redraw whenever the server record changes under us. */
function useClientRecords() {
const [, bump] = useState(0);
useEffect(() => ClientRecords.subscribe(() => bump(n => n + 1)), []);
return ClientRecords;
}
/* ---- changing a customer file --------------------------------------
One object, so that every editor on this screen writes through the
same place and none of them has to know whether this desk is
server-backed.
The routing is the interesting part, and it is the identifying /
signal split showing through into the UI. The old editors treat a
customer as ONE flat object — `idType` sits next to `occupation`
next to `photo` — because the blob was one flat object. It is not
one thing any more: the person, their identity DOCUMENTS and the
PICTURES of those documents are three tables with three different
retention answers, and `field()` below is where a screen that has
not caught up gets sent to the right one.
What is deliberately NOT sent to the server: supporting documents,
the extra photo gallery and the ledger ids the till caches. Those
have not moved in this change and are still the browser's, so they
fall through to the local setter untouched rather than being
silently dropped. */
const stampToday = () => new Date().toISOString().slice(0, 10);
function clientWriter({ name, rec, setClients, reload, onError }) {
const api = (window.CDOS.Backend && window.CDOS.Backend.Clients) || null;
rec = rec || {};
const clientId = rec.clientId;
const onServer = !!(api && clientId && ClientRecords.serverBacked());
const localSet = (k, v) => setClients(c => ({ ...c, [name]: { ...(c[name] || {}), [k]: v, updatedAt: stampToday() } }));
/* Every server write refreshes and every failure is SAID. A save
that failed into a swallowed catch, while the screen went on
showing the new value, is the shape of defect this project keeps
finding — the teller believes the file is updated and the next
till sees the old one. */
const send = (run) => Promise.resolve()
.then(run)
.then(() => reload(true))
.catch(e => onError((e && e.message) || 'CurrencyDesk could not save that change. Nothing was saved.'));
const extraDoc = (i) => (rec.ids || [])[i] || {};
function field(k, v) {
if (!onServer) return localSet(k, v);
const DOC = api.DOCUMENT_FIELDS;
if (DOC[k]) {
const patch = {}; patch[DOC[k]] = v || null;
if (rec.primaryDocumentId) return send(() => api.updateDocument(clientId, rec.primaryDocumentId, patch));
/* Typing a document's details when the file has none is how a
document gets created — the same gesture the old flat editor
made, landing in the right table. */
return send(() => api.addDocument(clientId, Object.assign(
{ docType: k === 'idType' ? (v || 'Not stated') : (rec.idType || 'Not stated'), isPrimary: true },
k === 'idType' ? {} : patch)));
}
if (k === 'photo') {
if (!v) return rec.primaryDocumentId && rec.primaryHasScan
? send(() => api.removeDocumentScan(clientId, rec.primaryDocumentId))
: localSet(k, null);
return scan(v);
}
if (k === 'avatar') {
return v ? send(() => api.setPhotograph(clientId, v)) : localSet(k, null);
}
const changes = api.fromDeskFields({ [k]: v });
/* Nothing this record has a column for — supporting documents, the
gallery, cached ledger ids. Still the browser's. */
if (!Object.keys(changes).length) return localSet(k, v);
return send(() => api.update(clientId, changes));
}
function scan(dataUrl) {
if (!onServer) return localSet('photo', dataUrl);
if (rec.primaryDocumentId)
return send(() => api.updateDocument(clientId, rec.primaryDocumentId, { scanDataUrl: dataUrl }));
return send(() => api.addDocument(clientId, {
docType: rec.idType || 'Not stated', isPrimary: true, scanDataUrl: dataUrl,
}));
}
function addId() {
if (!onServer) return setClients(c => { const cur = c[name] || {}; return { ...c, [name]: { ...cur, ids: (cur.ids || []).concat({ type: '', num: '', issued: '', expiry: '', photo: null }), updatedAt: stampToday() } }; });
/* 'Not stated' rather than a guessed type. A document this desk
has asserted is a passport, because the form needed a default,
is a worse record than one that says nobody has said yet. */
return send(() => api.addDocument(clientId, { docType: 'Not stated', isPrimary: false }));
}
function setId(i, k, v) {
if (!onServer) return setClients(c => { const cur = c[name] || {}; const ids = (cur.ids || []).slice(); ids[i] = { ...(ids[i] || {}), [k]: v }; return { ...c, [name]: { ...cur, ids, updatedAt: stampToday() } }; });
const document = extraDoc(i);
if (!document.documentId) return;
const columns = { type: 'docType', num: 'docNumber', issued: 'issuedOn', expiry: 'expiresOn' };
if (k === 'photo') {
return v
? send(() => api.updateDocument(clientId, document.documentId, { scanDataUrl: v }))
: send(() => api.removeDocumentScan(clientId, document.documentId));
}
if (!columns[k]) return;
const patch = {}; patch[columns[k]] = v || null;
return send(() => api.updateDocument(clientId, document.documentId, patch));
}
function rmId(i) {
if (!onServer) return setClients(c => { const cur = c[name] || {}; const ids = (cur.ids || []).slice(); ids.splice(i, 1); return { ...c, [name]: { ...cur, ids, updatedAt: stampToday() } }; });
const document = extraDoc(i);
if (!document.documentId) return;
return send(() => api.removeDocument(clientId, document.documentId));
}
return { onServer, clientId, field, scan, addId, setId, rmId, localSet };
}
/* Photo affordance — a badge that opens a small menu: take a photo (live
camera) or upload one. onPhoto receives a data-URL string either way. */
function PhotoCaptureMenu({ onPhoto, badge, title }) {
const [menu, setMenu] = useState(false);
const [cam, setCam] = useState(false);
const [camErr, setCamErr] = useState('');
const videoRef = useRef(null);
const streamRef = useRef(null);
const wrapRef = useRef(null);
const btnRef = useRef(null);
const menuRef = useRef(null);
const [pos, setPos] = useState(null);
const openMenu = () => { const r = btnRef.current && btnRef.current.getBoundingClientRect(); if (r) setPos({ left: r.left + r.width / 2, top: r.bottom + 6 }); setMenu(m => !m); };
const closeCamera = () => { if (streamRef.current) { streamRef.current.getTracks().forEach(t => t.stop()); streamRef.current = null; } setCam(false); };
const openCamera = async () => {
setMenu(false); setCamErr(''); setCam(true);
try {
const s = await navigator.mediaDevices.getUserMedia({ video: { facingMode: 'user', width: { ideal: 1280 } }, audio: false });
streamRef.current = s;
const attach = () => { if (videoRef.current) { videoRef.current.srcObject = s; videoRef.current.play().catch(() => {}); } else setTimeout(attach, 30); };
attach();
} catch (e) { setCamErr(e && e.name === 'NotAllowedError' ? 'Camera access was blocked. Allow it in your browser, or upload a photo instead.' : 'No camera available on this device. Upload a photo instead.'); }
};
/* Both ways in go through the same ceiling. A camera frame is already
a data URL and still wants downscaling — a 1280-wide sensor frame is
not small — and an uploaded phone photo is the case that could stop
the whole desk saving. See intakeIdImage in cdos-base.jsx. */
const capture = async () => {
const v = videoRef.current; if (!v || !v.videoWidth) return;
const cv = document.createElement('canvas'); cv.width = v.videoWidth; cv.height = v.videoHeight;
cv.getContext('2d').drawImage(v, 0, 0);
onPhoto(await window.CDOS.shrinkDataUrl(cv.toDataURL('image/jpeg', 0.85)));
closeCamera();
};
const onFile = async (file) => {
if (!file) return;
setMenu(false);
const taken = await window.CDOS.intakeIdImage(file);
if (!taken.ok) { setCamErr(taken.why); return; }
onPhoto(taken.dataUrl);
};
useEffect(() => () => closeCamera(), []);
useEffect(() => { if (!menu) return; const h = (e) => { if (wrapRef.current && wrapRef.current.contains(e.target)) return; if (menuRef.current && menuRef.current.contains(e.target)) return; setMenu(false); }; window.addEventListener('mousedown', h); return () => window.removeEventListener('mousedown', h); }, [menu]);
return (
{menu && pos &&
}
{cam &&
Take a photo
{camErr ?
{camErr}
: }
{camErr ?
: <>
}
}
);
}
const ID_TYPES_IND = ["Driver's Licence", 'Passport', 'Provincial ID', 'PR Card', 'Citizenship Card', 'Health Card', 'Permanent Resident Card'];
const ID_TYPES_CORP = ['Business Number', 'Incorporation Certificate', 'Master Business Licence', 'Articles of Incorporation'];
const PROVINCES = ['', 'AB', 'BC', 'MB', 'NB', 'NL', 'NS', 'NT', 'NU', 'ON', 'PE', 'QC', 'SK', 'YT'];
const US_STATES = ['', 'AL', 'AK', 'AZ', 'AR', 'CA', 'CO', 'CT', 'DE', 'FL', 'GA', 'HI', 'ID', 'IL', 'IN', 'IA', 'KS', 'KY', 'LA', 'ME', 'MD', 'MA', 'MI', 'MN', 'MS', 'MO', 'MT', 'NE', 'NV', 'NH', 'NJ', 'NM', 'NY', 'NC', 'ND', 'OH', 'OK', 'OR', 'PA', 'RI', 'SC', 'SD', 'TN', 'TX', 'UT', 'VT', 'VA', 'WA', 'WV', 'WI', 'WY', 'DC'];
const COUNTRIES = ['Canada', 'United States', 'Other'];
// join an address, including the country only when it isn't the default (Canada)
const fullAddr = (rec) => [rec.address, rec.city, rec.province, rec.postal, (rec.country && rec.country !== 'Canada') ? rec.country : ''].filter(Boolean).join(', ');
const RISK = window.CDOS.RISK_TIERS || ['Normal', 'Low', 'Medium', 'High'];
const normalizeRisk = window.CDOS.normalizeRisk, riskTone = window.CDOS.riskTone;
const homeOf = (a, ccy) => { const home = homeCcy(); if (!home) return null; if (ccy === home) return +a || 0; if (home !== 'CAD') return null; const r = crossRate('CAD', ccy); return r ? (+a || 0) / r : null; };
/* A total across currencies, or nothing. One leg this desk cannot price
makes the whole total unknown; a sum quietly missing a currency looks
complete and is the shape of wrong this project keeps finding. */
const fmtHome = (v) => v == null ? '—' : fmt(v, homeCcy());
const initials = (n) => (n || '?').split(/[\s.]+/).filter(Boolean).map(x => x[0]).join('').slice(0, 2).toUpperCase();
const ageFrom = (dob) => { if (!dob) return null; const d = new Date(dob); if (isNaN(d)) return null; const t = new Date(window.CDOS.wallClock()); let a = t.getFullYear() - d.getFullYear(); const m = t.getMonth() - d.getMonth(); if (m < 0 || (m === 0 && t.getDate() < d.getDate())) a--; return a; };
// The highest verification a contact has actually PAID FOR through the provider.
// Reads the KYC check history — never inferred from typed-in ID fields.
// plus → Verified Plus (ID + biometric + deep DB)
// verify → Verified (ID authenticated + screened)
// quick → Screened (name/DOB watchlist screen — NOT identity verification)
function kycTier(name) {
if (!name) return null;
try {
const checks = (window.CDOS.KYC && window.CDOS.KYC.checksFor(name)) || [];
const ok = (t) => checks.some(c => c.template === t && c.status === 'completed' && c.result && c.result.decision === 'approved');
if (ok('plus')) return 'plus';
if (ok('verify')) return 'verify';
if (ok('quick')) return 'quick';
} catch (e) {}
return null;
}
// Badge ladder: Missing ID → ID on hand → Screened → Verified → Verified Plus.
// "ID on hand" is a NEUTRAL state: the desk holds an ID but has not run a provider
// verification. Only a $6.99+ inquiry that returns approved earns the green "Verified".
function kycStatus(rec, settings, name) {
const tier = kycTier(name);
/* Has this document expired? A question about the calendar, so the
WALL CLOCK — but read now rather than from the snapshot taken when
the page loaded, which on a desk left open overnight went on saying
an ID expiring at midnight was still valid. */
const expired = rec && rec.idExpiry && rec.idExpiry < window.CDOS.wallClock();
// provider-verified identity — the only true KYC states
if (tier === 'plus') return expired ? ['ID expired', CD.flag, CD.flagSoft] : ['Verified Plus', CD.green, CD.greenSoft];
if (tier === 'verify') return expired ? ['ID expired', CD.flag, CD.flagSoft] : ['Verified', CD.green, CD.greenSoft];
// watchlist screen only — clean name, but identity NOT verified under FINTRAC
if (tier === 'quick') return ['Screened', CD.amber, CD.amberSoft];
// no provider check on file — judge by the ID the desk is holding
if (!rec || !rec.idType || !rec.idNum) return ['Missing ID', CD.flag, CD.flagSoft];
if (expired) return ['ID expired', CD.flag, CD.flagSoft];
const warn = settings && +settings.idExpiryWarnDays;
if (warn && rec.idExpiry) { const days = (new Date(rec.idExpiry) - new Date(window.CDOS.wallClock())) / 86400000; if (days >= 0 && days <= warn) return ['ID expiring', CD.amber, CD.amberSoft]; }
return ['ID on hand', CD.amber, CD.amberSoft];
}
const isVerified = (s) => s === 'Verified' || s === 'Verified Plus';
function clientStats(rows, name) {
const mine = rows.filter(r => r.customer === name && r.status !== 'void');
let fees = 0, last = '';
mine.forEach(r => { fees += (+r.fee || 0); if (r.date > last) last = r.date; });
/* The leg that IS the desk's own currency, which is what the book
counts — not the in-leg re-priced at today's mid. dealHome in
cdos-base.jsx, and the note there on why the two differ. */
const vol = window.CDOS.sumDealHome(mine, homeCcy()).total;
return { n: mine.length, vol, fees, last };
}
/* ---------- atoms ---------- */
/* A photograph the desk took of the customer, cached for as long as
this component is mounted. Deliberately NOT audited the way an
identity document is: it is a different thing for a different
purpose — recognising a regular at the counter — and treating a face
the desk photographed itself as equivalent to a government document
would fill the ID trail with noise and make the rows that matter
harder to find. See docs/CLIENT_RECORDS.md. */
const photoCache = {};
function Avatar({ rec, name, size = 44, ring }) {
const corp = rec && rec.kind === 'corporate';
const st = { width: size, height: size, borderRadius: corp ? Math.round(size * 0.22) : '50%', flex: 'none' };
const clientId = rec && rec.clientId;
const wanted = !!(rec && rec.hasPhotograph && !rec.avatar && clientId);
const [fetched, setFetched] = useState(() => (clientId && photoCache[clientId]) || null);
useEffect(() => {
if (!wanted || fetched) return;
const api = (window.CDOS.Backend && window.CDOS.Backend.Clients) || null;
if (!api) return;
let live = true;
api.photograph(clientId)
.then(body => { photoCache[clientId] = body.dataUrl; if (live) setFetched(body.dataUrl); })
.catch(() => {});
return () => { live = false; };
}, [clientId, wanted]);
const picture = (rec && rec.avatar) || fetched;
if (picture) return ;
return (
);
}
/* `who` and `log` are threaded in rather than closed over. They used to
be neither: this component referenced a bare `name` (which resolved
to `window.name` — the empty string) and a bare `log` (which was not
defined at all, so rendering a client who had a scan on file threw).
A covered ID that crashes the profile is the worst of both. */
function KycEditor({ rec, set, kind, onUpload, canEdit, who, log }) {
const types = kind === 'corporate' ? ID_TYPES_CORP : ID_TYPES_IND;
const stated = rec.idType && types.indexOf(rec.idType) < 0 ? rec.idType : null;
return (
RPT = reportable${limit.amount == null ? ' — no reporting line is set for this desk, so nothing here is flagged' : ` ≥ ${esc(limit.label)}`} · STR = structuring watch · ID = KYC exception.${authority ? ` Prepared for ${esc(authority)} record-keeping.` : ' This desk\'s regulator is not stated on its jurisdiction pack, so none is named here.'} ${homeCcy() ? `Volumes in ${esc(homeCcy())}-equivalent at the desk's live mid; a client whose deals include a currency this branch has never published a rate for shows no total.` : 'This desk has no home currency on file, so no cross-currency total is shown.'}
No beneficiaries on file. {canEdit ? `Add who ${first} sends money to — it'll be ready at the counter.` : ''}
)}
{edit && setEdit(null)} onSave={save} />}
);
}
/* ---------- CLIENT COMPLIANCE SUMMARY (top of profile) ---------- */
/* mirrors the bell / computeAlerts logic exactly so what's flagged at the
menu bar is the same thing surfaced here on the contact. */
function CompRow({ tone, soft, icon, title, sub, actionLabel, onAction }) {
return (
);
}
/* ---- an identity document on screen ------------------------------------
A scan of somebody's passport is the most sensitive thing this desk
holds, and it used to sit rendered on any screen that happened to show
the client — over the shoulder of whoever is at the counter, on a
monitor a customer can see, for as long as the tab is open.
So it is obscured until somebody asks for it, and asking is recorded.
Not a permission — anybody who can open the client file can already
see this if they want to, and pretending otherwise would be theatre.
What it changes is that looking becomes deliberate and leaves a trace,
which is the honest control: "who looked at this customer's passport,
and when" is a question a regulator asks, and the answer used to be
that nobody could say.
WHAT CHANGED. That trace used to be a line in the browser's own audit
list, which is a place a disclosure record cannot live: it dies with
the browser profile, and — worse — the bytes were sitting in
localStorage the whole time, so "recorded" was a promise this file
made and any reader of the JSON could decline.
Now the picture is on the server and there is no other copy. Clicking
asks for it; the server writes who asked, when, at which till, and
about which document, in the SAME transaction that returns the bytes.
There is no path to the picture that does not write the row, because
there is no other path to the picture.
A desk with no server keeps the old behaviour — a local `src` and a
local log line — because that is what it had yesterday and losing the
scan would be worse than logging it locally.
It re-covers when it unmounts, so walking away from the screen does
not leave a document uncovered on it. */
function IdScan({ src, alt, height, who, what, log, clientId, documentId, hasScan }) {
const [shown, setShown] = useState(false);
const [fetched, setFetched] = useState(null);
const [busy, setBusy] = useState(false);
const [err, setErr] = useState('');
const api = (window.CDOS.Backend && window.CDOS.Backend.Clients) || null;
const fromServer = !!(api && clientId && documentId && (hasScan !== false));
const picture = fetched || src;
if (!fromServer && !src) return null;
const box = { border: `1px solid ${CD.line}`, borderRadius: 8, display: 'block', maxHeight: height || 120 };
const reveal = async () => {
if (!fromServer) {
setShown(true);
log && log('Identity document viewed', `${who || ''}${what ? ' · ' + what : ''}`.trim());
return;
}
setBusy(true); setErr('');
try {
const opened = await api.revealDocument(clientId, documentId, what || '');
setFetched(opened.dataUrl);
setShown(true);
/* The desk's own activity list still gets a line, because a
teller watching that list should see this happen. The RECORD,
though, is the server's row — this is a courtesy copy. */
log && log('Identity document viewed', `${who || ''}${what ? ' · ' + what : ''} · recorded on the server`.trim());
} catch (e) {
setErr((e && e.message) || 'CurrencyDesk could not open that document.');
} finally { setBusy(false); }
};
if (!shown) {
return (
{err && {err}}
);
}
return (
{fromServer && opening recorded}
);
}
/* ---- the same document, from anywhere else in the desk ----------------
The owner wants a teller to be able to open a customer's ID from the
TRANSACTION screen, not only from the client file — which is where
they actually are when the question comes up.
This is that, as one component. It takes the only thing the till has
to hand — the customer's NAME — and resolves it to a client record
through `lookup`, which searches aliases too, so a customer whose
name was corrected last month still resolves from a transaction
filed under the old spelling.
More than one match is shown as more than one match. Two people
share a name; picking one and rendering their passport beside
somebody else's deal is the exact defect this whole change exists to
end, and it would be a much worse version of it.
Drop-in from cdos-txmodal.jsx, immediately after the CustomerCard:
{customer && window.CDOS.ClientIdViewer && React.createElement(window.CDOS.ClientIdViewer, { name: customer, rec: clients[customer], log })}
*/
function ClientIdViewer({ name, rec, log, height, compact }) {
const api = (window.CDOS.Backend && window.CDOS.Backend.Clients) || null;
const [state, setState] = useState({ status: 'idle', clients: [] });
useEffect(() => {
let live = true;
if (!api || !name || !String(name).trim()) { setState({ status: 'none', clients: [] }); return; }
setState({ status: 'loading', clients: [] });
api.lookup(String(name).trim())
.then(body => { if (live) setState({ status: 'ready', clients: body.clients || [] }); })
/* A desk with no server, or a till whose session has gone, shows
nothing here rather than an error beside a deal in progress —
the client file is one click away and this is a convenience. */
.catch(() => { if (live) setState({ status: 'none', clients: [] }); });
return () => { live = false; };
}, [name]);
if (state.status !== 'ready' || !state.clients.length) return null;
const withScans = state.clients
.map(c => ({ client: c, documents: (c.documents || []).filter(d => d.hasScan) }))
.filter(entry => entry.documents.length);
if (!withScans.length) return null;
const ambiguous = state.clients.length > 1;
return (
Identity documents on file
{/* Said plainly, because a teller about to hand over cash is the
person who needs to know it. */}
{ambiguous &&
This desk has {state.clients.length} customers named {name}. Check you are looking at the right file before you open a document.
{/* THE COLLISION, SAID OUT LOUD.
The old store keyed customers by name, so two people called
David Chen were one file and nobody was ever told. They are
two records now — which is correct — and the desk is told
every time it opens either of them, because the moment that
matters is the one where somebody is about to hand cash to
the wrong person's compliance history.
`possibleDuplicate` is the migration's flag on a file whose
SHAPE says it may already be two people merged: two
documents of one type with different numbers. Nothing was
split on the strength of it — splitting on a guess invents
a customer who never existed — so it asks for a human. */}
{(rec.possibleDuplicate || (rec.sameNameClientIds || []).length > 0) && (
{(rec.sameNameClientIds || []).length > 0 && (
This desk has {(rec.sameNameClientIds || []).length + 1} customers called {name}. They are separate files with separate histories. Check you are on the right one.
)}
{rec.duplicateReason &&
{rec.duplicateReason}
}
)}
{/* COMPLIANCE — first thing the owner sees, mirrors the menu-bar bell */}
setEdit(true)} />
{/* risk rating — always visible on the profile, set inline without entering edit mode */}
{/* identity verification — partner KYC / sanctions screening (compliance) */}
{/* A refused scan has to say so. The whole reason the ceiling
exists is that oversized images used to be accepted and then
silently lost when the desk's state would not save. */}
{intakeErr && (
: