@7365admin1/core 3.130.0 → 3.131.0

package/dist/index.mjs

@@ -3703,6 +3703,63 @@ function useMemberRepo() {
       throw error;
     }
   }
+  async function peoplePage(query2, page2, limit, rowStages) {
+    const noSite = { $in: ["", null] };
+    const orgWide = await collection.distinct("user", {
+      org: query2.org,
+      type: query2.type,
+      siteId: noSite,
+      status: { $ne: "deleted" }
+    });
+    const { type: orgType, siteId: pinned, ...rest } = query2;
+    const limitedRow = {
+      siteId: pinned ?? { $nin: ["", null] },
+      user: { $nin: orgWide }
+    };
+    const head = [
+      // `$text` (search) may only sit in the first stage.
+      { $match: { ...rest, type: { $nin: ["resident", "admin"] } } },
+      { $match: pinned ? limitedRow : { $or: [{ type: orgType }, limitedRow] } },
+      { $sort: { _id: -1 } },
+      {
+        $group: {
+          _id: { $ifNull: ["$user", "$_id"] },
+          doc: { $first: "$$ROOT" },
+          orgWide: {
+            $max: { $and: [{ $eq: ["$type", orgType] }, { $in: [{ $ifNull: ["$siteId", ""] }, ["", null]] }] }
+          },
+          limitedTo: { $push: { siteId: "$siteId", siteName: "$siteName", role: "$role" } }
+        }
+      },
+      {
+        $replaceRoot: {
+          newRoot: { $mergeObjects: ["$doc", { limitedTo: { $cond: ["$orgWide", [], "$limitedTo"] } }] }
+        }
+      }
+    ];
+    const items = await collection.aggregate([...head, { $sort: { _id: -1 } }, { $skip: page2 * limit }, { $limit: limit }, ...rowStages]).toArray();
+    const [counted] = await collection.aggregate([...head, { $count: "n" }]).toArray();
+    const ids2 = (key) => [...new Set(items.flatMap((i) => (i.limitedTo ?? []).map((l) => l[key]?.toString?.() ?? "")))].filter((id) => ObjectId14.isValid(id)).map((id) => new ObjectId14(id));
+    const [sites, roles] = await Promise.all([
+      db2.collection("sites").find({ _id: { $in: ids2("siteId") } }, { projection: { name: 1 } }).toArray(),
+      db2.collection("roles").find({ _id: { $in: ids2("role") } }, { projection: { name: 1 } }).toArray()
+    ]);
+    const nameOf = (list) => new Map(list.map((d) => [d._id.toString(), d.name ?? ""]));
+    const siteName = nameOf(sites);
+    const roleName = nameOf(roles);
+    for (const item of items) {
+      const bySite = /* @__PURE__ */ new Map();
+      for (const l of item.limitedTo ?? []) {
+        const site = l.siteId?.toString?.() ?? "";
+        const role = roleName.get(l.role?.toString?.() ?? "") ?? "";
+        const entry = bySite.get(site) ?? { siteId: site, siteName: siteName.get(site) || l.siteName || "", roleName: "" };
+        entry.roleName = [entry.roleName, role].filter(Boolean).join(", ");
+        bySite.set(site, entry);
+      }
+      item.limitedTo = [...bySite.values()].sort((a, b) => a.siteName.localeCompare(b.siteName));
+    }
+    return { items, length: counted?.n ?? 0 };
+  }
   async function getAll({
     search = "",
     page: page2 = 1,
@@ -3713,7 +3770,8 @@ function useMemberRepo() {
     siteIds,
     type = "",
     status = "",
-    roleState = ""
+    roleState = "",
+    people = false
   }) {
     limit = limit > 0 ? limit : 10;
     search = search || "";
@@ -3772,6 +3830,9 @@ function useMemberRepo() {
       query2.$or = await otherSiteRoleClauses2(query2.org);
       cacheOptions.roleState = roleState;
     }
+    const peopleMode = people && type === "organization" && !!query2.org && !siteId && !roleState;
+    if (peopleMode)
+      cacheOptions.people = 1;
     const cacheKey = makeCacheKey5(namespace_collection3, cacheOptions);
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
@@ -3779,15 +3840,7 @@ function useMemberRepo() {
       return cachedData;
     }
     try {
-      const items = await collection.aggregate([
-        { $match: query2 },
-        { $sort: { _id: -1 } },
-        // `paginate()` only LABELS the range ("11-20 of 42"); it does not
-        // slice. Without this $skip every page returned page 1's rows under
-        // a later page's heading. `page` is already zero-based above, and
-        // this is the same $skip/$limit pair the two getOrgs* reads use.
-        { $skip: page2 * limit },
-        { $limit: limit },
+      const rowStages = [
         {
           $lookup: {
             from: "roles",
@@ -3861,11 +3914,29 @@ function useMemberRepo() {
             dateInvited: { $ifNull: ["$dateInvited", "$createdAt"] },
             siteId: 1,
             siteName: 1,
-            type: 1
+            type: 1,
+            limitedTo: 1
           }
         }
-      ]).toArray();
-      const length = await collection.countDocuments(query2);
+      ];
+      let items;
+      let length;
+      if (peopleMode) {
+        ({ items, length } = await peoplePage(query2, page2, limit, rowStages));
+      } else {
+        items = await collection.aggregate([
+          { $match: query2 },
+          { $sort: { _id: -1 } },
+          // `paginate()` only LABELS the range ("11-20 of 42"); it does not
+          // slice. Without this $skip every page returned page 1's rows under
+          // a later page's heading. `page` is already zero-based above, and
+          // this is the same $skip/$limit pair the two getOrgs* reads use.
+          { $skip: page2 * limit },
+          { $limit: limit },
+          ...rowStages
+        ]).toArray();
+        length = await collection.countDocuments(query2);
+      }
       const data = { ...paginate5(items, page2, limit, length), total: length };
       setCache(cacheKey, data, 15 * 60).then(() => {
         logger8.info(`Cache set for key: ${cacheKey}`);
@@ -23028,6 +23099,29 @@ async function requireNotOwnerUnlessOwner(req, orgId, targetUser) {
     return;
   throw new UnauthorizedError3("Only the organisation's owner can change the owner's access.");
 }
+async function requireMemberGrantor(req, input) {
+  const { orgId, targetUser, roleId } = input;
+  const siteId = input.siteId?.toString() ?? "";
+  const id = await requireSiteAccessEditor(req, orgId);
+  await requireNotOwnerUnlessOwner(req, orgId, targetUser);
+  if (staffMayBypass(await resolveInviteActor(id)))
+    return;
+  if (siteId)
+    await requireSiteServedByOrg(siteId, orgId);
+  if (await hasOrgOwnership(id, orgId))
+    return;
+  const db2 = useAtlas36.getDb();
+  if (!db2 || !ObjectId54.isValid(roleId))
+    return;
+  const role = await db2.collection("roles").findOne({ _id: new ObjectId54(roleId) }, { projection: { permissions: 1 } });
+  if (isOwnerRole(role)) {
+    const rows = await db2.collection("members").find({ user: new ObjectId54(id), org: new ObjectId54(orgId), status: "active" }, { projection: { role: 1 } }).toArray();
+    const held = rows.map((m) => m.role?.toString?.() ?? "").filter((r) => ObjectId54.isValid(r)).map((r) => new ObjectId54(r));
+    const holdsOwner = held.length ? await db2.collection("roles").countDocuments({ _id: { $in: held }, permissions: "*", status: "active" }) : 0;
+    if (!holdsOwner)
+      throw new UnauthorizedError3("Only the organisation's owner can give an owner role.");
+  }
+}
 async function requireSiteReachInOrg(req, siteId, orgId) {
   if (await hasOrgOwnership(callerId(req), orgId)) {
     await requireSiteServedByOrg(siteId, orgId);
@@ -28311,7 +28405,9 @@ function useMemberController() {
       siteId: Joi29.string().hex().optional().allow("", null),
       type: Joi29.string().required(),
       status: Joi29.string().required(),
-      roleState: Joi29.string().valid("other-site").optional().allow("", null)
+      roleState: Joi29.string().valid("other-site").optional().allow("", null),
+      // Organization app Members: every person, site-limited ones included.
+      people: Joi29.boolean().truthy("1").falsy("0").optional().allow("", null)
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2);
@@ -28366,7 +28462,8 @@ function useMemberController() {
         siteIds,
         type,
         status,
-        roleState: req.query.roleState ?? ""
+        roleState: req.query.roleState ?? "",
+        people: ["1", "true"].includes(String(req.query.people ?? ""))
       });
       res.json(items);
       return;
@@ -28507,7 +28604,7 @@ function useMemberController() {
         await requireOrgReach(req, orgId);
         await requireSelfEnrolRole(req, orgId, roleId);
       } else {
-        await requireOrgAccess(req, orgId);
+        await requireMemberGrantor(req, { orgId, targetUser: userId, roleId, siteId });
       }
       const data = await _createMemberDirect({ userId, orgId, roleId, app, siteId, siteName, onboardingRequired, callerId: callerId(req) });
       res.status(201).json(data);