@7365admin1/core 3.130.0 → 3.131.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.130.0",
+  "version": "3.131.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/member-direct-grantor.e2e.test.mjs

@@ -0,0 +1,137 @@
+// POST /api/members/direct enrolling SOMEBODY ELSE (follow-up of Site access,
+// 2026-09-29): it needed only org membership, so a member confined to ONE site
+// could create another person's membership anywhere in the organisation with
+// any of its roles. Now the Site access editor rule applies (core
+// `requireMemberGrantor`): the owner, cross-client staff, or an org-WIDE member
+// who may assign roles - never a site-confined member - and never beyond what
+// the organisation can give at a site it serves, nor an owner role the caller
+// does not hold, nor the owner's own access.
+//
+// Nothing outside the harness is touched. Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "DirectGrant-Passw0rd!";
+const SEC = "security_agency";
+const U = {
+  owner: "mdg-owner@e2e.example.com",
+  orgAdmin: "mdg-org-admin@e2e.example.com",
+  assigner: "mdg-assigner@e2e.example.com",
+  viewer: "mdg-viewer@e2e.example.com",
+  siteAdmin: "mdg-site-admin@e2e.example.com",
+  support: "mdg-support@e2e.example.com",
+  n1: "mdg-n1@e2e.example.com",
+  n2: "mdg-n2@e2e.example.com",
+  n3: "mdg-n3@e2e.example.com",
+  n4: "mdg-n4@e2e.example.com",
+};
+
+describe("members/direct: enrolling somebody else", { concurrency: 1 }, () => {
+  let h;
+  const sid = {};
+  const id = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const k of ["owner", "orgAdmin", "assigner", "viewer", "siteAdmin"]) sid[k] = await h.login(U[k], PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const refused = (res) => [401, 403].includes(res.status);
+  const refused404 = (res) => [400, 401, 403, 404].includes(res.status);
+  const direct = (who, target, roleId, siteId = "", app = SEC) =>
+    h.api("/members/direct", {
+      method: "POST",
+      sid: sid[who],
+      body: { userId: String(id.users[target]), orgId: String(id.org), roleId: String(roleId), app, siteId: siteId ? String(siteId) : "", siteName: "" },
+    });
+  const rows = (target) => h.db.collection("members").countDocuments({ user: id.users[target] });
+
+  it("1. ESCALATION: a site-confined member cannot enrol anybody - at their own site, another site, or org-wide", async () => {
+    assert.ok(refused(await direct("siteAdmin", "n1", id.X, id.A)));
+    assert.ok(refused(await direct("siteAdmin", "n1", id.Y, id.B)));
+    assert.ok(refused(await direct("siteAdmin", "n1", id.orgRole, "", "organization")));
+    assert.equal(await rows("n1"), 0);
+  });
+
+  it("2. an org-wide member without Assign Role permission cannot enrol anybody", async () => {
+    assert.ok(refused(await direct("viewer", "n1", id.X, id.A)));
+    assert.equal(await rows("n1"), 0);
+  });
+
+  it("3. the owner enrols a colleague at a site, and the Seven365 support account org-wide with the owner role", async () => {
+    const res = await direct("owner", "n1", id.X, id.A);
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    const sup = await direct("owner", "support", id.ownerRole, "", "organization");
+    assert.equal(sup.status, 201, JSON.stringify(sup.body));
+  });
+
+  it("4. an org-wide admin enrols a colleague with that site's role", async () => {
+    const res = await direct("orgAdmin", "n2", id.Y, id.B);
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  it("5. the admin cannot go beyond the organisation: another site's role, another client's role or site", async () => {
+    assert.equal((await direct("orgAdmin", "n3", id.X, id.B)).status, 400, "role of site A at site B");
+    assert.equal((await direct("orgAdmin", "n3", id.foreignRole, id.A)).status, 400, "another client's role");
+    { const r = await direct("orgAdmin", "n3", id.foreignRole, id.foreign); assert.ok([400, 401, 403, 404].includes(r.status), `another client site: ${r.status} ${JSON.stringify(r.body)}`); }
+    assert.ok(refused404(await direct("owner", "n3", id.X, id.foreign)), "not even the owner at another client's site");
+    assert.equal(await rows("n3"), 0);
+  });
+
+  it("6. an owner role only from somebody who holds one; the owner's access never from an admin", async () => {
+    assert.ok(refused(await direct("assigner", "n4", id.ownerRole, "", "organization")));
+    assert.equal(await rows("n4"), 0);
+    assert.equal((await direct("assigner", "n4", id.Y, id.B)).status, 201, "a site role is fine");
+    assert.ok(refused(await direct("orgAdmin", "owner", id.Z, id.C)));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId(), other = new ObjectId();
+  const A = new ObjectId(), B = new ObjectId(), C = new ObjectId(), foreign = new ObjectId();
+  const X = new ObjectId(), Y = new ObjectId(), Z = new ObjectId(), orgRole = new ObjectId(), ownerRole = new ObjectId();
+  const assignRole = new ObjectId(), viewRole = new ObjectId(), foreignRole = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: org, name: "Aigle MDG", email: "aigle-mdg@e2e.example.com", type: "org", nature: SEC, status: "active", createdAt: now },
+    { _id: other, name: "Other MDG", email: "other-mdg@e2e.example.com", type: "org", nature: SEC, status: "active", createdAt: now },
+  ]);
+  const site = (_id, name, o) => ({ _id, name, org: o, orgId: o, status: "active", createdAt: now });
+  await h.db.collection("sites").insertMany([site(A, "One Pearl MDG", org), site(B, "The Loft MDG", org), site(C, "Third MDG", org), site(foreign, "Foreign MDG", other)]);
+  await h.db.collection("roles").insertMany([
+    { _id: X, name: "X at A", type: SEC, org, site: A, permissions: ["*"], status: "active" },
+    { _id: Y, name: "Y at B", type: SEC, org, site: B, permissions: ["dashboard:view"], status: "active" },
+    { _id: Z, name: "Z at C", type: SEC, org, site: C, permissions: ["dashboard:view"], status: "active" },
+    { _id: orgRole, name: "Org Admin", type: "organization", org, site: "", permissions: ["*"], status: "active" },
+    { _id: ownerRole, name: "owner", type: "organization", org, site: "", permissions: ["*"], default: true, status: "active" },
+    { _id: assignRole, name: "Assigner", type: "organization", org, site: "", permissions: ["members:assign-member-role"], status: "active" },
+    { _id: viewRole, name: "Viewer", type: "organization", org, site: "", permissions: ["dashboard:view"], status: "active" },
+    { _id: foreignRole, name: "Foreign", type: SEC, org: other, site: foreign, permissions: ["*"], status: "active" },
+  ]);
+  const users = {};
+  for (const [k, email] of Object.entries(U)) {
+    const { insertedId } = await h.db.collection("users").insertOne({ email, name: k, status: "active", createdAt: now });
+    await h.db.collection("users").updateOne({ _id: insertedId }, { $set: { password: await h.hashPassword(PASSWORD) } });
+    users[k] = insertedId;
+  }
+  await h.db.collection("organizations").updateOne({ _id: org }, { $set: { createdBy: users.owner } });
+  const m = (k, role, type = "organization", siteId = "") => ({ user: users[k], email: U[k], org, type, role, siteId, status: "active", deletedAt: "", createdAt: now });
+  await h.db.collection("members").insertMany([
+    m("owner", ownerRole),
+    m("orgAdmin", orgRole),
+    m("assigner", assignRole),
+    m("viewer", viewRole),
+    m("siteAdmin", X, SEC, A),
+  ]);
+  return { org, other, A, B, C, foreign, X, Y, Z, orgRole, ownerRole, foreignRole, users };
+}

package/test/e2e/org-members-people.e2e.test.mjs

@@ -0,0 +1,137 @@
+// Organization app -> Members lists EVERY person of the organisation (owner
+// report 2026-09-29, Aigle / Kanesan): after the owner removed Kanesan's
+// organisation access and limited him to sites, he vanished from the list, so
+// Site access could not be opened again. `GET /members?type=organization&
+// people=1` now returns the organisation-wide rows as before PLUS one row per
+// site-limited person carrying `limitedTo` (site + role). Residents, Seven365
+// staff, other organisations and removed rows never appear. Without `people`
+// the answer is unchanged.
+//
+// Nothing outside the harness is touched. Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OrgPeople-Passw0rd!";
+const SEC = "security_agency";
+const U = {
+  owner: "mop-owner@e2e.example.com",
+  admin: "mop-admin@e2e.example.com",
+  kanesan: "mop-kanesan@e2e.example.com",
+  both: "mop-both@e2e.example.com",
+  siteGuard: "mop-guard@e2e.example.com",
+  pinnedOrg: "mop-pinned-org@e2e.example.com",
+  resident: "mop-resident@e2e.example.com",
+  gone: "mop-gone@e2e.example.com",
+  outsider: "mop-outsider@e2e.example.com",
+};
+
+describe("org Members: every person, site-limited ones included", { concurrency: 1 }, () => {
+  let h;
+  const sid = {};
+  const id = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const k of ["owner", "siteGuard"]) sid[k] = await h.login(U[k], PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const list = (who, extra = "&people=1", status = "active") =>
+    h.api(`/members?org=${id.org}&type=organization&status=${status}&page=1&limit=50${extra}`, { sid: sid[who] });
+  const byEmail = (res) => Object.fromEntries(res.body.items.map((i) => [i.email, i]));
+
+  it("1. the owner sees every person once: org-wide people with no limit, Kanesan limited to A and B", async () => {
+    const res = await list("owner");
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const rows = byEmail(res);
+    assert.deepEqual(Object.keys(rows).sort(), [U.admin, U.both, U.kanesan, U.owner, U.siteGuard, U.pinnedOrg].sort());
+    assert.equal(res.body.items.length, 6, "one row per person");
+    assert.equal(res.body.total, 6);
+    assert.deepEqual(rows[U.pinnedOrg].limitedTo.map((l) => l.siteName), ["The Loft MOP"], "an organisation row pinned to a site is limited");
+    assert.deepEqual(rows[U.owner].limitedTo, []);
+    assert.deepEqual(rows[U.both].limitedTo, [], "an org-wide person with site rows too is 'All sites'");
+    assert.deepEqual(
+      rows[U.kanesan].limitedTo.map((l) => `${l.siteName}:${l.roleName}`),
+      ["One Pearl MOP:X at A", "The Loft MOP:Y at B"],
+    );
+  });
+
+  it("2. residents, removed rows, suspended-only and other organisations never appear", async () => {
+    const rows = byEmail(await list("owner"));
+    for (const e of [U.resident, U.gone, U.outsider]) assert.ok(!rows[e], e);
+  });
+
+  it("3. without people=1 the list is unchanged (organisation rows only)", async () => {
+    const rows = byEmail(await list("owner", ""));
+    assert.deepEqual(Object.keys(rows).sort(), [U.admin, U.both, U.owner, U.pinnedOrg].sort());
+  });
+
+  it("4. paging and totals count people, not rows", async () => {
+    const res = await h.api(`/members?org=${id.org}&type=organization&status=active&page=2&limit=2&people=1`, { sid: sid.owner });
+    assert.equal(res.status, 200);
+    assert.equal(res.body.items.length, 2);
+    assert.equal(res.body.total, 6);
+  });
+
+  it("5. a site-confined member sees only people limited to their own site", async () => {
+    const res = await list("siteGuard");
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const rows = byEmail(res);
+    assert.deepEqual(Object.keys(rows).sort(), [U.kanesan, U.siteGuard].sort());
+    assert.deepEqual(rows[U.kanesan].limitedTo.map((l) => l.siteName), ["One Pearl MOP"], "never another site's name");
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId(), other = new ObjectId();
+  const A = new ObjectId(), B = new ObjectId();
+  const X = new ObjectId(), Y = new ObjectId(), orgRole = new ObjectId(), ownerRole = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: org, name: "Aigle MOP", email: "aigle-mop@e2e.example.com", type: "org", nature: SEC, status: "active", createdAt: now },
+    { _id: other, name: "Other MOP", email: "other-mop@e2e.example.com", type: "org", nature: SEC, status: "active", createdAt: now },
+  ]);
+  await h.db.collection("sites").insertMany([
+    { _id: A, name: "One Pearl MOP", org, orgId: org, status: "active", createdAt: now },
+    { _id: B, name: "The Loft MOP", org, orgId: org, status: "active", createdAt: now },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: X, name: "X at A", type: SEC, org, site: A, permissions: ["dashboard:view"], status: "active" },
+    { _id: Y, name: "Y at B", type: SEC, org, site: B, permissions: ["dashboard:view"], status: "active" },
+    { _id: orgRole, name: "Org Admin", type: "organization", org, site: "", permissions: ["*"], status: "active" },
+    { _id: ownerRole, name: "owner", type: "organization", org, site: "", permissions: ["*"], status: "active" },
+  ]);
+  const users = {};
+  for (const [k, email] of Object.entries(U)) {
+    const { insertedId } = await h.db.collection("users").insertOne({ email, name: k, status: "active", createdAt: now });
+    await h.db.collection("users").updateOne({ _id: insertedId }, { $set: { password: await h.hashPassword(PASSWORD) } });
+    users[k] = insertedId;
+  }
+  await h.db.collection("organizations").updateOne({ _id: org }, { $set: { createdBy: users.owner } });
+  const m = (k, role, type = "organization", siteId = "", status = "active", o = org) =>
+    ({ _id: new ObjectId(), user: users[k], email: U[k], name: k, org: o, type, role, siteId, siteName: "", status, deletedAt: "", createdAt: now });
+  await h.db.collection("members").insertMany([
+    m("owner", ownerRole),
+    m("admin", orgRole),
+    m("kanesan", orgRole, "organization", "", "deleted"),
+    m("kanesan", X, SEC, A),
+    m("kanesan", Y, SEC, B),
+    m("both", orgRole),
+    m("both", X, SEC, A),
+    m("siteGuard", X, SEC, A),
+    m("pinnedOrg", orgRole, "organization", B),
+    m("resident", X, "resident", A),
+    m("gone", X, SEC, A, "deleted"),
+    m("outsider", X, SEC, A, "active", other),
+  ]);
+  return { org, A, B, users };
+}

package/test/e2e/privilege-escalation.e2e.test.mjs

@@ -253,7 +253,7 @@ describe("privilege escalation to platform staff, end to end", { concurrency: 1
     assert.equal(res.status, 201, JSON.stringify(res.body));
   });
 
-  record("10. the onboarding flows that pass an ordinary app still work", async () => {
+  record("10. CLOSED 2026-09-29: a resident cannot enrol somebody ELSE (the live sign-in flows enrol the signed-in user themselves)", async () => {
     // web-app-main pages/sign-in.vue:347 and web-app-org
     // onboarding/getting-started/index.vue:357 both post
     // `app: "organization"` for an org the caller is not yet a member of. That
@@ -276,10 +276,12 @@ describe("privilege escalation to platform staff, end to end", { concurrency: 1
       },
     });
 
-    assert.equal(res.status, 201, JSON.stringify(res.body));
+    // The Site access editor rule (`requireMemberGrantor`): a resident is none of
+    // owner, cross-client staff or org-wide admin.
+    assert.equal(res.status, 401, JSON.stringify(res.body));
   });
 
-  record("11. and so does a service-provider membership", async () => {
+  record("11. CLOSED 2026-09-29: nor with a service-provider membership", async () => {
     const fresh = await h.db.collection("users").insertOne({
       email: "guard@e2e.example.com",
       name: "guard",
@@ -298,10 +300,12 @@ describe("privilege escalation to platform staff, end to end", { concurrency: 1
       },
     });
 
-    assert.equal(res.status, 201, JSON.stringify(res.body));
+    // The Site access editor rule (`requireMemberGrantor`): a resident is none of
+    // owner, cross-client staff or org-wide admin.
+    assert.equal(res.status, 401, JSON.stringify(res.body));
   });
 
-  record("12. TRANSITIONAL: an org id sent as `app` still works", async () => {
+  record("12. CLOSED 2026-09-29: nor with an org id sent as `app`", async () => {
     // `web-app-org pages/org/[organization]/invitations/invite.vue:122` and
     // `web-app-hygiene pages/[org]/[site]/invitations/invite.vue:135` send the
     // ORGANISATION ID as `app`. It is a defect in those two screens, but it is
@@ -325,7 +329,9 @@ describe("privilege escalation to platform staff, end to end", { concurrency: 1
       },
     });
 
-    assert.equal(res.status, 201, JSON.stringify(res.body));
+    // The Site access editor rule (`requireMemberGrantor`): a resident is none of
+    // owner, cross-client staff or org-wide admin.
+    assert.equal(res.status, 401, JSON.stringify(res.body));
   });
 });
 

package/test/role-member-org-scope.test.mjs

@@ -85,12 +85,13 @@ test("the org a NEW role is filed under is checked, on both mounts", () => {
   );
 });
 
-test("enrolling yourself needs reach; enrolling anybody else needs membership", () => {
+test("enrolling yourself needs reach; enrolling anybody else needs the Site access editor rule", () => {
   const body = fn(memberController, "createMemberDirect");
   assert.match(
     body,
-    // ...and yourself only with a role you may give yourself (requireSelfEnrolRole).
-    /if \(userId === callerId\(req\)\)[\s\S]{0,120}await requireOrgReach\(req, orgId\)[\s\S]{0,120}await requireSelfEnrolRole\(req, orgId, roleId\)[\s\S]{0,40}else[\s\S]{0,80}await requireOrgAccess\(req, orgId\)/,
+    // ...and yourself only with a role you may give yourself (requireSelfEnrolRole);
+    // somebody else only as owner / staff / org-wide admin (2026-09-29).
+    /if \(userId === callerId\(req\)\)[\s\S]{0,120}await requireOrgReach\(req, orgId\)[\s\S]{0,120}await requireSelfEnrolRole\(req, orgId, roleId\)[\s\S]{0,40}else[\s\S]{0,400}await requireMemberGrantor\(req, \{ orgId, targetUser: userId, roleId, siteId \}\)/,
   );
 });