@7365admin1/core 3.130.0 → 3.131.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/core
 
+## 3.131.0
+
+### Minor Changes
+
+- cb3d862: `POST /members/direct` enrolling somebody else now needs the Site access editor rule (organisation owner, cross-client Seven365 staff, or an organisation-wide member with members:assign-member-role; never a site-confined member), only at a site the organisation serves, never an owner role the caller does not hold, and never the owner's own access. Enrolling yourself is unchanged. `GET /members?type=organization&people=1` lists every person of the organisation: organisation-wide rows as before plus one row per site-limited person with `limitedTo` (site and role); without `people` the answer is unchanged.
+
 ## 3.130.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -446,7 +446,16 @@ declare function useMemberRepo(): {
     getByUserIdType: (user: string | ObjectId, type: string) => Promise<TMember>;
     getByRoleId: (role: string | ObjectId) => Promise<any>;
     getAssignedByRoleId: (role: string | ObjectId) => Promise<TMember[]>;
-    getAll: ({ search, page, limit, user, org, siteId, siteIds, type, status, roleState, }: {
+    getAll: ({ search, page, limit, user, org, siteId, siteIds, type, status, roleState, people, }: {
+        /**
+         * The Organization app's Members list (owner report 2026-09-29, Aigle /
+         * Kanesan): EVERY person of the organisation, once - the organisation-wide
+         * rows as before, plus people whose organisation access was removed and
+         * who are now limited to sites (their per-site rows, grouped into one row
+         * carrying `limitedTo`). Only with `type=organization`, an `org`, no
+         * `siteId` and no `roleState`; residents and Seven365 staff never.
+         */
+        people?: boolean | undefined;
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;

package/dist/index.js

@@ -4834,6 +4834,63 @@ function useMemberRepo() {
       throw error;
     }
   }
+  async function peoplePage(query2, page2, limit, rowStages) {
+    const noSite = { $in: ["", null] };
+    const orgWide = await collection.distinct("user", {
+      org: query2.org,
+      type: query2.type,
+      siteId: noSite,
+      status: { $ne: "deleted" }
+    });
+    const { type: orgType, siteId: pinned, ...rest } = query2;
+    const limitedRow = {
+      siteId: pinned ?? { $nin: ["", null] },
+      user: { $nin: orgWide }
+    };
+    const head = [
+      // `$text` (search) may only sit in the first stage.
+      { $match: { ...rest, type: { $nin: ["resident", "admin"] } } },
+      { $match: pinned ? limitedRow : { $or: [{ type: orgType }, limitedRow] } },
+      { $sort: { _id: -1 } },
+      {
+        $group: {
+          _id: { $ifNull: ["$user", "$_id"] },
+          doc: { $first: "$$ROOT" },
+          orgWide: {
+            $max: { $and: [{ $eq: ["$type", orgType] }, { $in: [{ $ifNull: ["$siteId", ""] }, ["", null]] }] }
+          },
+          limitedTo: { $push: { siteId: "$siteId", siteName: "$siteName", role: "$role" } }
+        }
+      },
+      {
+        $replaceRoot: {
+          newRoot: { $mergeObjects: ["$doc", { limitedTo: { $cond: ["$orgWide", [], "$limitedTo"] } }] }
+        }
+      }
+    ];
+    const items = await collection.aggregate([...head, { $sort: { _id: -1 } }, { $skip: page2 * limit }, { $limit: limit }, ...rowStages]).toArray();
+    const [counted] = await collection.aggregate([...head, { $count: "n" }]).toArray();
+    const ids2 = (key) => [...new Set(items.flatMap((i) => (i.limitedTo ?? []).map((l) => l[key]?.toString?.() ?? "")))].filter((id) => import_mongodb14.ObjectId.isValid(id)).map((id) => new import_mongodb14.ObjectId(id));
+    const [sites, roles] = await Promise.all([
+      db2.collection("sites").find({ _id: { $in: ids2("siteId") } }, { projection: { name: 1 } }).toArray(),
+      db2.collection("roles").find({ _id: { $in: ids2("role") } }, { projection: { name: 1 } }).toArray()
+    ]);
+    const nameOf = (list) => new Map(list.map((d) => [d._id.toString(), d.name ?? ""]));
+    const siteName = nameOf(sites);
+    const roleName = nameOf(roles);
+    for (const item of items) {
+      const bySite = /* @__PURE__ */ new Map();
+      for (const l of item.limitedTo ?? []) {
+        const site = l.siteId?.toString?.() ?? "";
+        const role = roleName.get(l.role?.toString?.() ?? "") ?? "";
+        const entry = bySite.get(site) ?? { siteId: site, siteName: siteName.get(site) || l.siteName || "", roleName: "" };
+        entry.roleName = [entry.roleName, role].filter(Boolean).join(", ");
+        bySite.set(site, entry);
+      }
+      item.limitedTo = [...bySite.values()].sort((a, b) => a.siteName.localeCompare(b.siteName));
+    }
+    return { items, length: counted?.n ?? 0 };
+  }
   async function getAll({
     search = "",
     page: page2 = 1,
@@ -4844,7 +4901,8 @@ function useMemberRepo() {
     siteIds,
     type = "",
     status = "",
-    roleState = ""
+    roleState = "",
+    people = false
   }) {
     limit = limit > 0 ? limit : 10;
     search = search || "";
@@ -4903,6 +4961,9 @@ function useMemberRepo() {
       query2.$or = await otherSiteRoleClauses2(query2.org);
       cacheOptions.roleState = roleState;
     }
+    const peopleMode = people && type === "organization" && !!query2.org && !siteId && !roleState;
+    if (peopleMode)
+      cacheOptions.people = 1;
     const cacheKey = (0, import_node_server_utils15.makeCacheKey)(namespace_collection3, cacheOptions);
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
@@ -4910,15 +4971,7 @@ function useMemberRepo() {
       return cachedData;
     }
     try {
-      const items = await collection.aggregate([
-        { $match: query2 },
-        { $sort: { _id: -1 } },
-        // `paginate()` only LABELS the range ("11-20 of 42"); it does not
-        // slice. Without this $skip every page returned page 1's rows under
-        // a later page's heading. `page` is already zero-based above, and
-        // this is the same $skip/$limit pair the two getOrgs* reads use.
-        { $skip: page2 * limit },
-        { $limit: limit },
+      const rowStages = [
         {
           $lookup: {
             from: "roles",
@@ -4992,11 +5045,29 @@ function useMemberRepo() {
             dateInvited: { $ifNull: ["$dateInvited", "$createdAt"] },
             siteId: 1,
             siteName: 1,
-            type: 1
+            type: 1,
+            limitedTo: 1
           }
         }
-      ]).toArray();
-      const length = await collection.countDocuments(query2);
+      ];
+      let items;
+      let length;
+      if (peopleMode) {
+        ({ items, length } = await peoplePage(query2, page2, limit, rowStages));
+      } else {
+        items = await collection.aggregate([
+          { $match: query2 },
+          { $sort: { _id: -1 } },
+          // `paginate()` only LABELS the range ("11-20 of 42"); it does not
+          // slice. Without this $skip every page returned page 1's rows under
+          // a later page's heading. `page` is already zero-based above, and
+          // this is the same $skip/$limit pair the two getOrgs* reads use.
+          { $skip: page2 * limit },
+          { $limit: limit },
+          ...rowStages
+        ]).toArray();
+        length = await collection.countDocuments(query2);
+      }
       const data = { ...(0, import_node_server_utils15.paginate)(items, page2, limit, length), total: length };
       setCache(cacheKey, data, 15 * 60).then(() => {
         import_node_server_utils15.logger.info(`Cache set for key: ${cacheKey}`);
@@ -24001,6 +24072,29 @@ async function requireNotOwnerUnlessOwner(req, orgId, targetUser) {
     return;
   throw new import_node_server_utils58.UnauthorizedError("Only the organisation's owner can change the owner's access.");
 }
+async function requireMemberGrantor(req, input) {
+  const { orgId, targetUser, roleId } = input;
+  const siteId = input.siteId?.toString() ?? "";
+  const id = await requireSiteAccessEditor(req, orgId);
+  await requireNotOwnerUnlessOwner(req, orgId, targetUser);
+  if (staffMayBypass(await resolveInviteActor(id)))
+    return;
+  if (siteId)
+    await requireSiteServedByOrg(siteId, orgId);
+  if (await hasOrgOwnership(id, orgId))
+    return;
+  const db2 = import_node_server_utils58.useAtlas.getDb();
+  if (!db2 || !import_mongodb54.ObjectId.isValid(roleId))
+    return;
+  const role = await db2.collection("roles").findOne({ _id: new import_mongodb54.ObjectId(roleId) }, { projection: { permissions: 1 } });
+  if (isOwnerRole(role)) {
+    const rows = await db2.collection("members").find({ user: new import_mongodb54.ObjectId(id), org: new import_mongodb54.ObjectId(orgId), status: "active" }, { projection: { role: 1 } }).toArray();
+    const held = rows.map((m) => m.role?.toString?.() ?? "").filter((r) => import_mongodb54.ObjectId.isValid(r)).map((r) => new import_mongodb54.ObjectId(r));
+    const holdsOwner = held.length ? await db2.collection("roles").countDocuments({ _id: { $in: held }, permissions: "*", status: "active" }) : 0;
+    if (!holdsOwner)
+      throw new import_node_server_utils58.UnauthorizedError("Only the organisation's owner can give an owner role.");
+  }
+}
 async function requireSiteReachInOrg(req, siteId, orgId) {
   if (await hasOrgOwnership(callerId(req), orgId)) {
     await requireSiteServedByOrg(siteId, orgId);
@@ -29244,7 +29338,9 @@ function useMemberController() {
       siteId: import_joi29.default.string().hex().optional().allow("", null),
       type: import_joi29.default.string().required(),
       status: import_joi29.default.string().required(),
-      roleState: import_joi29.default.string().valid("other-site").optional().allow("", null)
+      roleState: import_joi29.default.string().valid("other-site").optional().allow("", null),
+      // Organization app Members: every person, site-limited ones included.
+      people: import_joi29.default.boolean().truthy("1").falsy("0").optional().allow("", null)
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2);
@@ -29299,7 +29395,8 @@ function useMemberController() {
         siteIds,
         type,
         status,
-        roleState: req.query.roleState ?? ""
+        roleState: req.query.roleState ?? "",
+        people: ["1", "true"].includes(String(req.query.people ?? ""))
       });
       res.json(items);
       return;
@@ -29440,7 +29537,7 @@ function useMemberController() {
         await requireOrgReach(req, orgId);
         await requireSelfEnrolRole(req, orgId, roleId);
       } else {
-        await requireOrgAccess(req, orgId);
+        await requireMemberGrantor(req, { orgId, targetUser: userId, roleId, siteId });
       }
       const data = await _createMemberDirect({ userId, orgId, roleId, app, siteId, siteName, onboardingRequired, callerId: callerId(req) });
       res.status(201).json(data);