@7365admin1/core 3.134.0 → 3.135.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.134.0",
+  "version": "3.135.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/member-site-access.e2e.test.mjs

@@ -13,6 +13,7 @@
 import { after, before, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { ObjectId } from "mongodb";
+import { readFileSync } from "node:fs";
 
 import { startHarness } from "./harness.mjs";
 
@@ -25,6 +26,9 @@ const U = {
   orgAdmin: "msa-org-admin@e2e.example.com",
   dual: "msa-dual@e2e.example.com",
   resident: "msa-resident@e2e.example.com",
+  tan: "msa-tan@e2e.example.com",
+  stray: "msa-stray@e2e.example.com",
+  pinnedGuard: "msa-pinned-guard@e2e.example.com",
 };
 
 describe("member site access", { concurrency: 1 }, () => {
@@ -69,7 +73,8 @@ describe("member site access", { concurrency: 1 }, () => {
     assert.equal(res.body.sites.length, 3);
     assert.equal(res.body.orgWide.length, 1);
     const a = res.body.sites.find((s) => s.site === String(id.A));
-    assert.deepEqual(a.roles.map((r) => r.name).sort(), ["Cleaner at A", "X at A"]);
+    assert.deepEqual(a.roles.map((r) => r.name).sort(), ["Cleaner at A", "Security (Org)", "X at A"]);
+    assert.deepEqual(a.roles.filter((r) => r.scope === "organisation").map((r) => r.name), ["Security (Org)"], "org console roles are never offered");
   });
 
   it("3. A (role X) + B (role Y), organisation role removed: sees only A and B", async () => {
@@ -146,6 +151,84 @@ describe("member site access", { concurrency: 1 }, () => {
     assert.ok(refused(await save("orgAdmin", [[id.A, id.X]], { removeOrgAccess: true }, id.users.owner)));
     assert.equal((await save("owner", [[id.A, id.X]], {}, id.users.resident)).status, 400);
   });
+
+  // Owner request 2026-09-30: create a role ONCE at organisation level and give it to an
+  // organisation member at the sites picked - reaching those sites only, never org-wide.
+  describe("organisation roles used per site", () => {
+    const readTan = () => h.api(`/members/site-access?org=${id.org}&user=${id.users.tan}`, { sid: sid.tan });
+
+    it("15. before: Tan (organisation level) reaches every site", async () => {
+      assert.deepEqual((await sitesSeen("tan")).sites, sort(id.A, id.B, id.C));
+    });
+
+    it("16. owner gives Tan the organisation role Security (Org) at A and B only: he reaches A and B, nothing else", async () => {
+      const res = await save("owner", [[id.A, id.orgSec], [id.B, id.orgSec]], { removeOrgAccess: true }, id.users.tan);
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      const rows = await h.db.collection("members").find({ user: id.users.tan, status: { $ne: "deleted" } }).toArray();
+      assert.deepEqual(rows.map((m) => `${m.siteId}:${m.role}:${m.type}`).sort(), [`${id.A}:${id.orgSec}:${SEC}`, `${id.B}:${id.orgSec}:${SEC}`].sort());
+      assert.ok(rows.every((m) => String(m.createdBy) === String(id.users.owner)), "rows are stamped by the owner");
+      assert.deepEqual((await sitesSeen("tan")).sites, sort(id.A, id.B));
+      assert.equal((await invitesAt("tan", id.A)).status, 200, "acts at A");
+      assert.ok(refused(await invitesAt("tan", id.C)), "site C refused");
+    });
+
+    it("17. no organisation scope: Tan (role holds *) cannot open site access for anybody, nor list org-wide invitations", async () => {
+      assert.ok(refused(await readTan()));
+      assert.ok(refused(await view("tan", id.users.dual)));
+      assert.ok(refused(await save("tan", [[id.A, id.orgSec]], {}, id.users.dual)));
+      const orgInvites = await h.api(`/verifications?status=pending&type=member-invite&orgId=${id.org}`, { sid: sid.tan });
+      assert.ok(refused(orgInvites) || (orgInvites.body?.items ?? []).every((v) => String(v.metadata?.siteId ?? "") !== ""), JSON.stringify(orgInvites.body));
+    });
+
+    it("18. the 09-02 rule is untouched: an older pinned row with an organisation role (not placed by anyone) still reaches every site", async () => {
+      assert.deepEqual((await sitesSeen("stray")).sites, sort(id.A, id.B, id.C));
+    });
+
+    it("19. choosing the SAME organisation role in Site access re-stamps that row: then it reaches only its site", async () => {
+      assert.equal((await save("owner", [[id.A, id.orgSec]], {}, id.users.stray)).status, 200);
+      assert.deepEqual((await sitesSeen("stray")).sites, sort(id.A));
+    });
+
+    it("20. an organisation role of another organisation, or the org-console role, is refused for a site", async () => {
+      assert.equal((await save("owner", [[id.A, id.foreignOrgSec]], {}, id.users.tan)).status, 400);
+      assert.equal((await save("owner", [[id.A, id.orgRole]], {}, id.users.tan)).status, 400);
+    });
+
+    it("21. the owner creates an organisation role in the Organization app (full Security catalogue + inventory staff preset); the org list shows only site-less roles and Site access offers it at every site at once", async () => {
+      const catalogue = JSON.parse(readFileSync(new URL("./fixtures/lc-role-catalogues.json", import.meta.url), "utf8"));
+      const permissions = catalogue.security_agency ?? catalogue.catalogues?.security_agency;
+      assert.ok(Array.isArray(permissions) && permissions.includes("inventory:request-stock"), "fixture has the security catalogue");
+      const created = await h.api("/roles", { method: "POST", sid: sid.owner, body: { name: "Guard (Org)", permissions, type: SEC, org: String(id.org) } });
+      assert.equal(created.status, 201, JSON.stringify(created.body));
+      const staff = await h.api("/roles", { method: "POST", sid: sid.owner, body: { name: "Store staff (Org)", permissions: ["inventory:view-inventory", "inventory:request-stock", "inventory:record-usage"], type: SEC, org: String(id.org) } });
+      assert.equal(staff.status, 201, JSON.stringify(staff.body));
+
+      const list = await h.api(`/roles?org=${id.org}&type=${SEC}&scope=organisation&limit=100`, { sid: sid.owner });
+      assert.equal(list.status, 200, JSON.stringify(list.body));
+      assert.deepEqual(list.body.items.map((r) => r.name).sort(), ["Guard (Org)", "Security (Org)", "Store staff (Org)"]);
+      assert.equal((await h.api(`/roles?org=${id.org}&scope=everything`, { sid: sid.owner })).status, 400);
+
+      const box = await h.api(`/members/site-access?org=${id.org}&user=${id.users.tan}`, { sid: sid.owner });
+      for (const site of box.body.sites) {
+        assert.deepEqual(site.roles.filter((r) => r.scope === "organisation").map((r) => r.name).sort(), ["Guard (Org)", "Security (Org)", "Store staff (Org)"], site.name);
+      }
+    });
+
+    it("23. Assign Role (site Members) giving an organisation role to a member pinned to A keeps him at A", async () => {
+      const row = await h.db.collection("members").findOne({ user: id.users.pinnedGuard });
+      const res = await h.api(`/members/id/${row._id}/role/${id.orgSec}/type/${SEC}/org/${id.org}`, { method: "PUT", sid: sid.owner });
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      assert.equal(String((await h.db.collection("members").findOne({ _id: row._id })).role), String(id.orgSec));
+      assert.deepEqual((await sitesSeen("pinnedGuard")).sites, sort(id.A));
+      assert.ok(refused(await invitesAt("pinnedGuard", id.B)));
+    });
+
+    it("22. a site-confined member cannot create or list the organisation's roles for another organisation", async () => {
+      const res = await h.api("/roles", { method: "POST", sid: sid.tan, body: { name: "Sneaky", permissions: ["*"], type: SEC, org: String(id.other) } });
+      assert.ok(refused(res), JSON.stringify(res.body));
+      assert.ok(refused(await h.api(`/roles?org=${id.other}&scope=organisation`, { sid: sid.tan })));
+    });
+  });
 });
 
 async function seed(h) {
@@ -154,6 +237,7 @@ async function seed(h) {
   const A = new ObjectId(), B = new ObjectId(), C = new ObjectId(), foreign = new ObjectId();
   const W = new ObjectId();
   const X = new ObjectId(), Y = new ObjectId(), Z = new ObjectId(), orgRole = new ObjectId(), ownerRole = new ObjectId(), foreignRole = new ObjectId();
+  const orgSec = new ObjectId(), foreignOrgSec = new ObjectId();
 
   await h.db.collection("organizations").insertMany([
     { _id: org, name: "Aigle MSA", email: "aigle-msa@e2e.example.com", type: "org", nature: SEC, status: "active", createdAt: now },
@@ -171,6 +255,8 @@ async function seed(h) {
     { _id: orgRole, name: "Org Admin", type: "organization", org, site: "", permissions: ["*"], status: "active" },
     { _id: ownerRole, name: "owner", type: "organization", org, site: "", permissions: ["*"], default: true, status: "active" },
     { _id: foreignRole, name: "Foreign", type: SEC, org: other, site: foreign, permissions: ["*"], status: "active" },
+    { _id: orgSec, name: "Security (Org)", type: SEC, org, site: "", permissions: ["*"], status: "active" },
+    { _id: foreignOrgSec, name: "Foreign (Org)", type: SEC, org: other, site: "", permissions: ["*"], status: "active" },
   ]);
   const users = {};
   for (const [k, email] of Object.entries(U)) {
@@ -190,6 +276,9 @@ async function seed(h) {
     { user: users.resident, email: U.resident, org, type: "resident", role: X, siteId: A, status: "active", deletedAt: "", createdAt: now },
     { user: users.kanesan, email: U.kanesan, org, type: "organization", role: orgRole, status: "active", deletedAt: "", createdAt: now },
     { user: users.siteAdmin, email: U.siteAdmin, org, type: SEC, role: X, siteId: A, status: "active", deletedAt: "", createdAt: now },
+    { user: users.tan, email: U.tan, org, type: "organization", role: orgRole, status: "active", deletedAt: "", createdAt: now },
+    { user: users.pinnedGuard, email: U.pinnedGuard, org, type: SEC, role: X, siteId: A, status: "active", deletedAt: "", createdAt: now },
+    { user: users.stray, email: U.stray, org, type: SEC, role: orgSec, siteId: A, status: "active", deletedAt: "", createdAt: now },
   ]);
-  return { org, other, A, B, C, foreign, X, Y, Z, orgRole, foreignRole, users };
+  return { org, other, A, B, C, foreign, X, Y, Z, orgRole, foreignRole, orgSec, foreignOrgSec, users };
 }