@7365admin1/core 3.134.0 → 3.136.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.134.0",
+  "version": "3.136.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/harness.mjs

@@ -205,6 +205,9 @@ function startMailSink() {
           sock.write("221 Bye\r\n");
           sock.end();
           return;
+        } else if (cmd === "RCPT" && /bounce/i.test(line)) {
+          // a mailbox the server refuses - proves a failed send is recorded
+          sock.write("550 5.1.1 Mailbox unavailable\r\n");
         } else {
           sock.write("250 2.0.0 Ok\r\n"); // AUTH, MAIL FROM, RCPT TO, RSET, NOOP
         }
@@ -566,6 +569,10 @@ function buildApp(nsu, core) {
       remove,
       decline,
       accept,
+      acceptNewCompany,
+      wrongJoinPreview,
+      wrongJoinRepair,
+      wrongJoinUndo,
       linkSite,
       received,
       getOne,
@@ -583,6 +590,10 @@ function buildApp(nsu, core) {
     invitations.get("/:id", requireAuth, getOne);
     invitations.put("/:id/decline", requireAuth, decline);
     invitations.put("/:id/accept", requireAuth, accept);
+    invitations.put("/:id/accept-new-company", requireAuth, acceptNewCompany);
+    invitations.get("/:id/wrong-join", requireAuth, wrongJoinPreview);
+    invitations.put("/:id/wrong-join/repair", requireAuth, wrongJoinRepair);
+    invitations.put("/:id/wrong-join/undo", requireAuth, wrongJoinUndo);
     invitations.put("/:id/link-site", requireAuth, linkSite);
   }
 

package/test/e2e/member-direct-self-enrol-role.e2e.test.mjs

@@ -116,10 +116,12 @@ describe("self-enrolment only with a role the caller may give themselves", { con
     assert.equal((await enrol("NEWCOMER", "NEWCOMER", "narrowRole", "property_management_agency")).status, 201);
   });
 
-  record("6. SP sign-in: the org's Admin Service Provider role of the invite's app, both rows", async () => {
+  record("6. CLOSED 2026-09-30: an SP invitation never enrols the provider into the org that SENT it", async () => {
+    // the provider joins as its own company (accept / accept-new-company); the
+    // old sign-in wrote it into the client's organisation with a "*" role
     const extra = { siteId: id.siteB.toString(), siteName: "SE Site B" };
-    assert.equal((await enrol("SP", "SP", "spRole", "organization", extra)).status, 201);
-    assert.equal((await enrol("SP", "SP", "spRole", "security_agency", extra)).status, 201);
+    assert.equal((await enrol("SP", "SP", "spRole", "organization", extra)).status, 401);
+    assert.equal((await enrol("SP", "SP", "spRole", "security_agency", extra)).status, 401);
   });
 
   record("7. onboarding owner: organisation row and app row with the owner role", async () => {

package/test/e2e/member-site-access.e2e.test.mjs

@@ -13,6 +13,7 @@
 import { after, before, describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { ObjectId } from "mongodb";
+import { readFileSync } from "node:fs";
 
 import { startHarness } from "./harness.mjs";
 
@@ -25,6 +26,9 @@ const U = {
   orgAdmin: "msa-org-admin@e2e.example.com",
   dual: "msa-dual@e2e.example.com",
   resident: "msa-resident@e2e.example.com",
+  tan: "msa-tan@e2e.example.com",
+  stray: "msa-stray@e2e.example.com",
+  pinnedGuard: "msa-pinned-guard@e2e.example.com",
 };
 
 describe("member site access", { concurrency: 1 }, () => {
@@ -69,7 +73,8 @@ describe("member site access", { concurrency: 1 }, () => {
     assert.equal(res.body.sites.length, 3);
     assert.equal(res.body.orgWide.length, 1);
     const a = res.body.sites.find((s) => s.site === String(id.A));
-    assert.deepEqual(a.roles.map((r) => r.name).sort(), ["Cleaner at A", "X at A"]);
+    assert.deepEqual(a.roles.map((r) => r.name).sort(), ["Cleaner at A", "Security (Org)", "X at A"]);
+    assert.deepEqual(a.roles.filter((r) => r.scope === "organisation").map((r) => r.name), ["Security (Org)"], "org console roles are never offered");
   });
 
   it("3. A (role X) + B (role Y), organisation role removed: sees only A and B", async () => {
@@ -146,6 +151,84 @@ describe("member site access", { concurrency: 1 }, () => {
     assert.ok(refused(await save("orgAdmin", [[id.A, id.X]], { removeOrgAccess: true }, id.users.owner)));
     assert.equal((await save("owner", [[id.A, id.X]], {}, id.users.resident)).status, 400);
   });
+
+  // Owner request 2026-09-30: create a role ONCE at organisation level and give it to an
+  // organisation member at the sites picked - reaching those sites only, never org-wide.
+  describe("organisation roles used per site", () => {
+    const readTan = () => h.api(`/members/site-access?org=${id.org}&user=${id.users.tan}`, { sid: sid.tan });
+
+    it("15. before: Tan (organisation level) reaches every site", async () => {
+      assert.deepEqual((await sitesSeen("tan")).sites, sort(id.A, id.B, id.C));
+    });
+
+    it("16. owner gives Tan the organisation role Security (Org) at A and B only: he reaches A and B, nothing else", async () => {
+      const res = await save("owner", [[id.A, id.orgSec], [id.B, id.orgSec]], { removeOrgAccess: true }, id.users.tan);
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      const rows = await h.db.collection("members").find({ user: id.users.tan, status: { $ne: "deleted" } }).toArray();
+      assert.deepEqual(rows.map((m) => `${m.siteId}:${m.role}:${m.type}`).sort(), [`${id.A}:${id.orgSec}:${SEC}`, `${id.B}:${id.orgSec}:${SEC}`].sort());
+      assert.ok(rows.every((m) => String(m.createdBy) === String(id.users.owner)), "rows are stamped by the owner");
+      assert.deepEqual((await sitesSeen("tan")).sites, sort(id.A, id.B));
+      assert.equal((await invitesAt("tan", id.A)).status, 200, "acts at A");
+      assert.ok(refused(await invitesAt("tan", id.C)), "site C refused");
+    });
+
+    it("17. no organisation scope: Tan (role holds *) cannot open site access for anybody, nor list org-wide invitations", async () => {
+      assert.ok(refused(await readTan()));
+      assert.ok(refused(await view("tan", id.users.dual)));
+      assert.ok(refused(await save("tan", [[id.A, id.orgSec]], {}, id.users.dual)));
+      const orgInvites = await h.api(`/verifications?status=pending&type=member-invite&orgId=${id.org}`, { sid: sid.tan });
+      assert.ok(refused(orgInvites) || (orgInvites.body?.items ?? []).every((v) => String(v.metadata?.siteId ?? "") !== ""), JSON.stringify(orgInvites.body));
+    });
+
+    it("18. the 09-02 rule is untouched: an older pinned row with an organisation role (not placed by anyone) still reaches every site", async () => {
+      assert.deepEqual((await sitesSeen("stray")).sites, sort(id.A, id.B, id.C));
+    });
+
+    it("19. choosing the SAME organisation role in Site access re-stamps that row: then it reaches only its site", async () => {
+      assert.equal((await save("owner", [[id.A, id.orgSec]], {}, id.users.stray)).status, 200);
+      assert.deepEqual((await sitesSeen("stray")).sites, sort(id.A));
+    });
+
+    it("20. an organisation role of another organisation, or the org-console role, is refused for a site", async () => {
+      assert.equal((await save("owner", [[id.A, id.foreignOrgSec]], {}, id.users.tan)).status, 400);
+      assert.equal((await save("owner", [[id.A, id.orgRole]], {}, id.users.tan)).status, 400);
+    });
+
+    it("21. the owner creates an organisation role in the Organization app (full Security catalogue + inventory staff preset); the org list shows only site-less roles and Site access offers it at every site at once", async () => {
+      const catalogue = JSON.parse(readFileSync(new URL("./fixtures/lc-role-catalogues.json", import.meta.url), "utf8"));
+      const permissions = catalogue.security_agency ?? catalogue.catalogues?.security_agency;
+      assert.ok(Array.isArray(permissions) && permissions.includes("inventory:request-stock"), "fixture has the security catalogue");
+      const created = await h.api("/roles", { method: "POST", sid: sid.owner, body: { name: "Guard (Org)", permissions, type: SEC, org: String(id.org) } });
+      assert.equal(created.status, 201, JSON.stringify(created.body));
+      const staff = await h.api("/roles", { method: "POST", sid: sid.owner, body: { name: "Store staff (Org)", permissions: ["inventory:view-inventory", "inventory:request-stock", "inventory:record-usage"], type: SEC, org: String(id.org) } });
+      assert.equal(staff.status, 201, JSON.stringify(staff.body));
+
+      const list = await h.api(`/roles?org=${id.org}&type=${SEC}&scope=organisation&limit=100`, { sid: sid.owner });
+      assert.equal(list.status, 200, JSON.stringify(list.body));
+      assert.deepEqual(list.body.items.map((r) => r.name).sort(), ["Guard (Org)", "Security (Org)", "Store staff (Org)"]);
+      assert.equal((await h.api(`/roles?org=${id.org}&scope=everything`, { sid: sid.owner })).status, 400);
+
+      const box = await h.api(`/members/site-access?org=${id.org}&user=${id.users.tan}`, { sid: sid.owner });
+      for (const site of box.body.sites) {
+        assert.deepEqual(site.roles.filter((r) => r.scope === "organisation").map((r) => r.name).sort(), ["Guard (Org)", "Security (Org)", "Store staff (Org)"], site.name);
+      }
+    });
+
+    it("23. Assign Role (site Members) giving an organisation role to a member pinned to A keeps him at A", async () => {
+      const row = await h.db.collection("members").findOne({ user: id.users.pinnedGuard });
+      const res = await h.api(`/members/id/${row._id}/role/${id.orgSec}/type/${SEC}/org/${id.org}`, { method: "PUT", sid: sid.owner });
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      assert.equal(String((await h.db.collection("members").findOne({ _id: row._id })).role), String(id.orgSec));
+      assert.deepEqual((await sitesSeen("pinnedGuard")).sites, sort(id.A));
+      assert.ok(refused(await invitesAt("pinnedGuard", id.B)));
+    });
+
+    it("22. a site-confined member cannot create or list the organisation's roles for another organisation", async () => {
+      const res = await h.api("/roles", { method: "POST", sid: sid.tan, body: { name: "Sneaky", permissions: ["*"], type: SEC, org: String(id.other) } });
+      assert.ok(refused(res), JSON.stringify(res.body));
+      assert.ok(refused(await h.api(`/roles?org=${id.other}&scope=organisation`, { sid: sid.tan })));
+    });
+  });
 });
 
 async function seed(h) {
@@ -154,6 +237,7 @@ async function seed(h) {
   const A = new ObjectId(), B = new ObjectId(), C = new ObjectId(), foreign = new ObjectId();
   const W = new ObjectId();
   const X = new ObjectId(), Y = new ObjectId(), Z = new ObjectId(), orgRole = new ObjectId(), ownerRole = new ObjectId(), foreignRole = new ObjectId();
+  const orgSec = new ObjectId(), foreignOrgSec = new ObjectId();
 
   await h.db.collection("organizations").insertMany([
     { _id: org, name: "Aigle MSA", email: "aigle-msa@e2e.example.com", type: "org", nature: SEC, status: "active", createdAt: now },
@@ -171,6 +255,8 @@ async function seed(h) {
     { _id: orgRole, name: "Org Admin", type: "organization", org, site: "", permissions: ["*"], status: "active" },
     { _id: ownerRole, name: "owner", type: "organization", org, site: "", permissions: ["*"], default: true, status: "active" },
     { _id: foreignRole, name: "Foreign", type: SEC, org: other, site: foreign, permissions: ["*"], status: "active" },
+    { _id: orgSec, name: "Security (Org)", type: SEC, org, site: "", permissions: ["*"], status: "active" },
+    { _id: foreignOrgSec, name: "Foreign (Org)", type: SEC, org: other, site: "", permissions: ["*"], status: "active" },
   ]);
   const users = {};
   for (const [k, email] of Object.entries(U)) {
@@ -190,6 +276,9 @@ async function seed(h) {
     { user: users.resident, email: U.resident, org, type: "resident", role: X, siteId: A, status: "active", deletedAt: "", createdAt: now },
     { user: users.kanesan, email: U.kanesan, org, type: "organization", role: orgRole, status: "active", deletedAt: "", createdAt: now },
     { user: users.siteAdmin, email: U.siteAdmin, org, type: SEC, role: X, siteId: A, status: "active", deletedAt: "", createdAt: now },
+    { user: users.tan, email: U.tan, org, type: "organization", role: orgRole, status: "active", deletedAt: "", createdAt: now },
+    { user: users.pinnedGuard, email: U.pinnedGuard, org, type: SEC, role: X, siteId: A, status: "active", deletedAt: "", createdAt: now },
+    { user: users.stray, email: U.stray, org, type: SEC, role: orgSec, siteId: A, status: "active", deletedAt: "", createdAt: now },
   ]);
-  return { org, other, A, B, C, foreign, X, Y, Z, orgRole, foreignRole, users };
+  return { org, other, A, B, C, foreign, X, Y, Z, orgRole, foreignRole, orgSec, foreignOrgSec, users };
 }

package/test/e2e/org-scoping-roles-members.e2e.test.mjs

@@ -441,10 +441,12 @@ async function seed(h) {
   ]);
 
   await h.db.collection("verifications").insertMany([
-    // the service-provider invitation the sign-in flow reads: addressed to the
-    // newcomer, naming org B, stored as an ObjectId — the shape MVerification writes
+    // a member invitation into org B (the admin-member sign-up), addressed to
+    // the newcomer, stored as an ObjectId — the shape MVerification writes. A
+    // service-provider invitation no longer reaches the org that sent it
+    // (2026-09-30), see member-direct-self-enrol-role test 6.
     {
-      type: "service-provider-invite",
+      type: "member-invite",
       email: NEWCOMER,
       status: "pending",
       metadata: { org: orgB, siteId: siteB, app: "security_agency", role: roleB },

package/test/e2e/service-provider-invite-approval.e2e.test.mjs

@@ -257,7 +257,8 @@ describe("service-provider invitation approval, end to end", { concurrency: 1 },
 
     // the audit trail
     const actions = after.history.map((e) => e.action);
-    assert.deepEqual(actions.slice(0, 3), ["created", "approved", "provider-notified"]);
+    // the send's own outcome is recorded before "provider-notified"
+    assert.deepEqual(actions.slice(0, 4), ["created", "approved", "email-sent", "provider-notified"]);
     assert.equal(after.history[1].byName, "Sasha Seven");
   });
 
@@ -431,6 +432,20 @@ describe("service-provider invitation approval, end to end", { concurrency: 1 },
     const rowsBefore = await h.db
       .collection("verifications")
       .countDocuments({ email: PROVIDER_EMAIL, "metadata.siteId": id.siteD });
+    // right after the approval email, Resend is held back (rate limit)...
+    const tooSoon = await h.api(`/service-provider-invitations/${inviteD}/resend`, {
+      method: "PUT",
+      sid: pmSid,
+    });
+    assert.equal(tooSoon.status, 400);
+    assert.match(tooSoon.body.message, /resend it in/);
+    // ...until the last attempt is old enough
+    await h.db.collection("verifications").updateOne(
+      { _id: new ObjectId(inviteD) },
+      { $set: { "history.$[e].at": new Date(Date.now() - 10 * 60_000).toISOString() } },
+      { arrayFilters: [{ "e.action": "email-sent" }] },
+    );
+
     const mailsBefore = h.mails.length;
 
     const res = await h.api(`/service-provider-invitations/${inviteD}/resend`, {