@7365admin1/core 3.135.0 → 3.136.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.135.0",
+  "version": "3.136.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/harness.mjs

@@ -205,6 +205,9 @@ function startMailSink() {
           sock.write("221 Bye\r\n");
           sock.end();
           return;
+        } else if (cmd === "RCPT" && /bounce/i.test(line)) {
+          // a mailbox the server refuses - proves a failed send is recorded
+          sock.write("550 5.1.1 Mailbox unavailable\r\n");
         } else {
           sock.write("250 2.0.0 Ok\r\n"); // AUTH, MAIL FROM, RCPT TO, RSET, NOOP
         }
@@ -566,6 +569,10 @@ function buildApp(nsu, core) {
       remove,
       decline,
       accept,
+      acceptNewCompany,
+      wrongJoinPreview,
+      wrongJoinRepair,
+      wrongJoinUndo,
       linkSite,
       received,
       getOne,
@@ -583,6 +590,10 @@ function buildApp(nsu, core) {
     invitations.get("/:id", requireAuth, getOne);
     invitations.put("/:id/decline", requireAuth, decline);
     invitations.put("/:id/accept", requireAuth, accept);
+    invitations.put("/:id/accept-new-company", requireAuth, acceptNewCompany);
+    invitations.get("/:id/wrong-join", requireAuth, wrongJoinPreview);
+    invitations.put("/:id/wrong-join/repair", requireAuth, wrongJoinRepair);
+    invitations.put("/:id/wrong-join/undo", requireAuth, wrongJoinUndo);
     invitations.put("/:id/link-site", requireAuth, linkSite);
   }
 

package/test/e2e/member-direct-self-enrol-role.e2e.test.mjs

@@ -116,10 +116,12 @@ describe("self-enrolment only with a role the caller may give themselves", { con
     assert.equal((await enrol("NEWCOMER", "NEWCOMER", "narrowRole", "property_management_agency")).status, 201);
   });
 
-  record("6. SP sign-in: the org's Admin Service Provider role of the invite's app, both rows", async () => {
+  record("6. CLOSED 2026-09-30: an SP invitation never enrols the provider into the org that SENT it", async () => {
+    // the provider joins as its own company (accept / accept-new-company); the
+    // old sign-in wrote it into the client's organisation with a "*" role
     const extra = { siteId: id.siteB.toString(), siteName: "SE Site B" };
-    assert.equal((await enrol("SP", "SP", "spRole", "organization", extra)).status, 201);
-    assert.equal((await enrol("SP", "SP", "spRole", "security_agency", extra)).status, 201);
+    assert.equal((await enrol("SP", "SP", "spRole", "organization", extra)).status, 401);
+    assert.equal((await enrol("SP", "SP", "spRole", "security_agency", extra)).status, 401);
   });
 
   record("7. onboarding owner: organisation row and app row with the owner role", async () => {

package/test/e2e/org-scoping-roles-members.e2e.test.mjs

@@ -441,10 +441,12 @@ async function seed(h) {
   ]);
 
   await h.db.collection("verifications").insertMany([
-    // the service-provider invitation the sign-in flow reads: addressed to the
-    // newcomer, naming org B, stored as an ObjectId — the shape MVerification writes
+    // a member invitation into org B (the admin-member sign-up), addressed to
+    // the newcomer, stored as an ObjectId — the shape MVerification writes. A
+    // service-provider invitation no longer reaches the org that sent it
+    // (2026-09-30), see member-direct-self-enrol-role test 6.
     {
-      type: "service-provider-invite",
+      type: "member-invite",
       email: NEWCOMER,
       status: "pending",
       metadata: { org: orgB, siteId: siteB, app: "security_agency", role: roleB },

package/test/e2e/service-provider-invite-approval.e2e.test.mjs

@@ -257,7 +257,8 @@ describe("service-provider invitation approval, end to end", { concurrency: 1 },
 
     // the audit trail
     const actions = after.history.map((e) => e.action);
-    assert.deepEqual(actions.slice(0, 3), ["created", "approved", "provider-notified"]);
+    // the send's own outcome is recorded before "provider-notified"
+    assert.deepEqual(actions.slice(0, 4), ["created", "approved", "email-sent", "provider-notified"]);
     assert.equal(after.history[1].byName, "Sasha Seven");
   });
 
@@ -431,6 +432,20 @@ describe("service-provider invitation approval, end to end", { concurrency: 1 },
     const rowsBefore = await h.db
       .collection("verifications")
       .countDocuments({ email: PROVIDER_EMAIL, "metadata.siteId": id.siteD });
+    // right after the approval email, Resend is held back (rate limit)...
+    const tooSoon = await h.api(`/service-provider-invitations/${inviteD}/resend`, {
+      method: "PUT",
+      sid: pmSid,
+    });
+    assert.equal(tooSoon.status, 400);
+    assert.match(tooSoon.body.message, /resend it in/);
+    // ...until the last attempt is old enough
+    await h.db.collection("verifications").updateOne(
+      { _id: new ObjectId(inviteD) },
+      { $set: { "history.$[e].at": new Date(Date.now() - 10 * 60_000).toISOString() } },
+      { arrayFilters: [{ "e.action": "email-sent" }] },
+    );
+
     const mailsBefore = h.mails.length;
 
     const res = await h.api(`/service-provider-invitations/${inviteD}/resend`, {

package/test/e2e/service-provider-invite-email-new-company.e2e.test.mjs

@@ -0,0 +1,425 @@
+// End-to-end proof for the owner's report of 2026-09-30 (Latitude / JLL
+// Singapore invited latitude.sec@ as Security):
+//
+//   A. "No email was received" - the invitation was still waiting for Seven365.
+//      Now: every Seven365 administrator is emailed (not only those who opted
+//      in) when an invitation waits; approval sends the provider's email and
+//      RECORDS the outcome on the invitation ("email-sent" / "email-failed" +
+//      reason); a failed send is shown, not thrown, and Resend (rate-limited)
+//      tries again.
+//   B. "Signed up as a new company but it shows as Property Management" - the
+//      browser enrolled the invitee into the SENDER's organisation. Now: an SP
+//      invitation never reaches the sender's organisation, and a new company
+//      is created as its OWN organisation typed by the invited service, owner
+//      in that service's app, with the site on its list.
+//
+// Real Express stack, in-process MongoDB, loopback mail sink (a "bounce"
+// address is refused by the sink with 550). Nothing leaves the machine.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Inv-Passw0rd!";
+const PM_EMAIL = "pm-inv@e2e.example.com";
+// staff address on the non-production allow-list (*@seven365.com.sg); the
+// mailer points at the loopback sink, so nothing is really sent
+const ADMIN_EMAIL = "sp-approvals-e2e@seven365.com.sg";
+const EXISTING_EMAIL = "existing-guard@e2e.example.com";
+
+const SERVICES = [
+  ["security_agency", "security_agency"],
+  ["cleaning_services", "cleaning_services"],
+  ["mechanical_electrical_services", "mechanical_electrical_services"],
+  ["pest_control_services", "pest_control_services"],
+  ["landscaping_services", "landscaping_services"],
+  ["pool_maintenance_services", "pool_maintenance_services"],
+  // an older row carrying the short app name
+  ["security", "security_agency"],
+];
+
+describe("SP invitation: email status, Super Admin alert, new company typed by service", { concurrency: 1 }, () => {
+  let h;
+  let id;
+  let pmSid;
+  let adminSid;
+
+  before(async () => {
+    h = await startHarness();
+    id = await seed(h);
+    pmSid = await h.login(PM_EMAIL, PASSWORD);
+    adminSid = await h.login(ADMIN_EMAIL, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  async function invite(email, app, site = id.site) {
+    const res = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: pmSid,
+      body: {
+        email,
+        orgId: id.pmOrg.toString(),
+        siteId: site.toString(),
+        siteName: "Latitude",
+        inviteType: "organization-invite",
+        app,
+      },
+    });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const row = await h.db.collection("verifications").findOne({ email, "metadata.siteId": site });
+    assert.equal(row.status, "awaiting-approval");
+    return row._id.toString();
+  }
+
+  const approve = (inviteId) =>
+    h.api(`/service-provider-invitations/${inviteId}/approve`, { method: "PUT", sid: adminSid });
+
+  async function newAccount(email) {
+    await h.db.collection("users").insertOne({
+      email,
+      password: await h.hashPassword(PASSWORD),
+      name: "New Co Owner",
+      status: "active",
+      createdAt: new Date().toISOString(),
+    });
+    return h.login(email, PASSWORD);
+  }
+
+  // ---------------------------------------------------------------- A. email
+
+  it("A1. pending: every Seven365 administrator is emailed, not only those who opted in", async () => {
+    const before = h.mails.length;
+    await invite("waiting-co@e2e.example.com", "security_agency", id.site2);
+
+    const mail = await h.mailAt(before);
+    // the sink keeps the multipart body quoted-printable: undo soft breaks and =3D
+    const body = mail.body.replace(/=\r?\n/g, "").replace(/=3D/g, "=");
+    assert.match(mail.to, /sp-approvals-e2e@seven365\.com\.sg/);
+    assert.match(mail.subject, /Service provider invitation to approve/);
+    assert.match(body, /only after a Seven365 administrator approves/);
+    assert.match(body, /notifications\/open\?kind=spApproval/);
+    // and the bell
+    const bell = await h.db.collection("notifications").findOne({ userId: id.adminUser, title: /to approve/ });
+    assert.ok(bell, "the in-app bell row is written too");
+    // nothing reached the provider
+    assert.ok(!h.mails.some((m) => /waiting-co@/.test(m.to)));
+  });
+
+  it("A2. the inviter sees who must act while it waits", async () => {
+    const res = await h.api(`/service-provider-invitations?org=${id.pmOrg}&siteId=${id.site2}`, { sid: pmSid });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const row = res.body.items.find((r) => r.email === "waiting-co@e2e.example.com");
+    assert.equal(row.statusLabel, "Waiting for Seven365");
+    assert.equal(row.emailStatus, null, "no email has been attempted yet");
+  });
+
+  it("A3. approve -> the provider's email is sent and the invitation says so", async () => {
+    const inviteId = await invite("sent-co@e2e.example.com", "security_agency", id.site3);
+    await new Promise((r) => setTimeout(r, 200)); // let the staff email drain
+    const before = h.mails.length;
+
+    const res = await approve(inviteId);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body.emailSent, true);
+    assert.match(res.body.message, /email has been sent/);
+
+    const mail = await h.mailAt(before);
+    assert.match(mail.to, /sent-co@/);
+    assert.match(mail.body, new RegExp(`/verify/service-provider-invite/${inviteId}`));
+
+    const list = await h.api(`/service-provider-invitations?org=${id.pmOrg}&siteId=${id.site3}`, { sid: pmSid });
+    const row = list.body.items.find((r) => r._id === inviteId);
+    assert.equal(row.emailStatus.state, "sent");
+    assert.ok(row.emailStatus.at);
+  });
+
+  it("A4. a refused send: approved anyway, status 'failed' + reason, no 500, Resend offered", async () => {
+    const inviteId = await invite("bounce-co@e2e.example.com", "cleaning_services", id.site4);
+    const res = await approve(inviteId);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body.emailSent, false);
+    assert.match(res.body.message, /could not be sent: the email address was refused/);
+    assert.match(res.body.message, /Resend/);
+
+    const row = await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) });
+    assert.equal(row.status, "pending", "approval stands");
+    const last = row.history.at(-1);
+    assert.equal(last.action, "email-failed");
+    assert.match(last.reason, /refused/);
+    assert.ok(!row.history.some((e) => e.action === "provider-notified"), "not claimed as notified");
+    // no secret anywhere in what was stored
+    assert.ok(!JSON.stringify(row.history).includes("e2e-mailer-secret"));
+
+    const list = await h.api(`/service-provider-invitations?org=${id.pmOrg}&siteId=${id.site4}`, { sid: pmSid });
+    const view = list.body.items.find((r) => r._id === inviteId);
+    assert.equal(view.emailStatus.state, "failed");
+    assert.match(view.emailStatus.reason, /refused/);
+  });
+
+  it("A5. Resend is rate-limited, then records its own outcome", async () => {
+    const row = await h.db.collection("verifications").findOne({ email: "bounce-co@e2e.example.com" });
+    const inviteId = row._id.toString();
+
+    const early = await h.api(`/service-provider-invitations/${inviteId}/resend`, { method: "PUT", sid: pmSid });
+    assert.equal(early.status, 400);
+    assert.match(early.body.message, /resend it in \d+ minute/);
+
+    // the clock moves on: age the last attempt past the limit
+    await h.db.collection("verifications").updateOne(
+      { _id: row._id },
+      { $set: { "history.$[e].at": new Date(Date.now() - 10 * 60_000).toISOString() } },
+      { arrayFilters: [{ "e.action": "email-failed" }] },
+    );
+    // fix the address, as the sender would (a new send to a good mailbox)
+    await h.db.collection("verifications").updateOne({ _id: row._id }, { $set: { email: "fixed-co@e2e.example.com" } });
+
+    const before = h.mails.length;
+    const again = await h.api(`/service-provider-invitations/${inviteId}/resend`, { method: "PUT", sid: pmSid });
+    assert.equal(again.status, 200, JSON.stringify(again.body));
+    assert.match((await h.mailAt(before)).to, /fixed-co@/);
+    const after = await h.db.collection("verifications").findOne({ _id: row._id });
+    assert.equal(after.history.at(-1).action, "email-sent");
+  });
+
+  it("A6. the Super Admin may resend too; an outsider may not", async () => {
+    const row = await h.db.collection("verifications").findOne({ email: "sent-co@e2e.example.com" });
+    await h.db.collection("verifications").updateOne(
+      { _id: row._id },
+      { $set: { "history.$[e].at": new Date(Date.now() - 10 * 60_000).toISOString() } },
+      { arrayFilters: [{ "e.action": "email-sent" }] },
+    );
+    const res = await h.api(`/service-provider-invitations/${row._id}/resend`, { method: "PUT", sid: adminSid });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+
+  // ---------------------------------------------------- B. new company typed
+
+  for (const [app, nature] of SERVICES) {
+    it(`B. new company invited for ${app} -> its own ${nature} organisation, owner in that app, site linked`, async () => {
+      const email = `newco-${app.replace(/_/g, "-")}@e2e.example.com`;
+      const site = new ObjectId();
+      await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+      const inviteId = await invite(email, app, site);
+      await approve(inviteId);
+
+      const sid = await newAccount(email);
+      const res = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, {
+        method: "PUT",
+        sid,
+        body: { companyName: `New ${app} Pte Ltd`, country: "Singapore" },
+      });
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+      assert.equal(res.body.nature, nature);
+
+      const org = await h.db.collection("organizations").findOne({ _id: new ObjectId(res.body.orgId) });
+      assert.equal(org.nature, nature, "typed by the invited service");
+      assert.equal(org.type, nature);
+      assert.equal(org.name, `New ${app} Pte Ltd`);
+      assert.notEqual(org._id.toString(), id.pmOrg.toString());
+
+      const user = await h.db.collection("users").findOne({ email });
+      assert.equal(user.defaultOrg?.toString(), org._id.toString());
+
+      const rows = await h.db.collection("members").find({ user: user._id, status: "active" }).toArray();
+      assert.deepEqual(rows.map((m) => m.type).sort(), ["organization", nature].sort());
+      assert.ok(rows.every((m) => m.org.toString() === org._id.toString()), "memberships only in its own company");
+      assert.equal(
+        await h.db.collection("members").countDocuments({ user: user._id, org: { $in: [id.pmOrg, id.pmOrg.toString()] } }),
+        0,
+        "never a member of the property manager",
+      );
+
+      const link = await h.db.collection("customer.sites").findOne({ org: org._id, site });
+      assert.ok(link, "the site is on the new company's list as a service provider");
+      const after = await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) });
+      assert.equal(after.status, "complete");
+    });
+  }
+
+  it("B2. an EXISTING company is not re-created: refused here, accepts as itself, unchanged", async () => {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const inviteId = await invite(EXISTING_EMAIL, "security_agency", site);
+    await approve(inviteId);
+    const sid = await h.login(EXISTING_EMAIL, PASSWORD);
+    const orgsBefore = await h.db.collection("organizations").countDocuments();
+
+    const refused = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, {
+      method: "PUT",
+      sid,
+      body: { companyName: "Dup" },
+    });
+    assert.equal(refused.status, 400);
+    assert.match(refused.body.message, /already have a Security company/);
+
+    const ok = await h.api(`/service-provider-invitations/${inviteId}/accept`, {
+      method: "PUT",
+      sid,
+      body: { org: id.existingOrg.toString() },
+    });
+    assert.equal(ok.status, 200, JSON.stringify(ok.body));
+    assert.equal(await h.db.collection("organizations").countDocuments(), orgsBefore);
+    const org = await h.db.collection("organizations").findOne({ _id: id.existingOrg });
+    assert.equal(org.nature, "security_agency");
+    assert.ok(await h.db.collection("customer.sites").findOne({ org: id.existingOrg, site }));
+  });
+
+  it("B3. only the invited account; not while held; not twice", async () => {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const inviteId = await invite("held-co@e2e.example.com", "security_agency", site);
+    const sid = await newAccount("held-co@e2e.example.com");
+
+    const held = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, { method: "PUT", sid, body: {} });
+    assert.equal(held.status, 404, "not before Seven365 approves");
+
+    await approve(inviteId);
+    const other = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, { method: "PUT", sid: pmSid, body: {} });
+    assert.equal(other.status, 401);
+
+    const first = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, { method: "PUT", sid, body: { companyName: "Held Co" } });
+    assert.equal(first.status, 200, JSON.stringify(first.body));
+    const second = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, { method: "PUT", sid, body: { companyName: "Held Co 2" } });
+    assert.equal(second.status, 400);
+  });
+
+  it("B4. the old browser path is closed: an SP invitee cannot enrol into the SENDER's organisation", async () => {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const email = "legacy-co@e2e.example.com";
+    const inviteId = await invite(email, "security_agency", site);
+    await approve(inviteId);
+    const sid = await newAccount(email);
+    const user = await h.db.collection("users").findOne({ email });
+
+    const role = await h.api("/roles", {
+      method: "POST",
+      sid,
+      body: { name: "Admin Service Provider", permissions: ["*"], type: "security_agency", org: id.pmOrg.toString(), site: site.toString(), platform: "website" },
+    });
+    assert.equal(role.status, 401, JSON.stringify(role.body));
+
+    const enrol = await h.api("/members/direct", {
+      method: "POST",
+      sid,
+      body: { userId: user._id.toString(), orgId: id.pmOrg.toString(), roleId: id.pmRole.toString(), app: "organization", siteId: site.toString(), siteName: "Latitude" },
+    });
+    assert.equal(enrol.status, 401, JSON.stringify(enrol.body));
+    assert.equal(await h.db.collection("members").countDocuments({ user: user._id }), 0);
+  });
+
+  // ------------------------------------------- C. repair the live wrong join
+
+  it("C1. Super Admin repair: preview (read only) -> repair -> undo -> repair; then the right path works", async () => {
+    // the production state of latitude.sec@: approved invitation, an account,
+    // and two memberships the OLD web flow wrote into the SENDER's organisation
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const email = "latitude-sec@e2e.example.com";
+    const inviteId = await invite(email, "security_agency", site);
+    await approve(inviteId);
+    const sid = await newAccount(email);
+    const user = await h.db.collection("users").findOne({ email });
+    const spRole = new ObjectId();
+    await h.db.collection("roles").insertOne({ _id: spRole, name: "Admin Service Provider", type: "security_agency", org: id.pmOrg.toString(), site: site.toString(), permissions: ["*"], status: "active" });
+    const later = new Date(Date.now() + 1000);
+    await h.db.collection("members").insertMany([
+      { user: user._id, org: id.pmOrg, role: spRole, type: "organization", siteId: site, siteName: "Latitude", status: "active", createdAt: later },
+      { user: user._id, org: id.pmOrg, role: spRole, type: "security_agency", siteId: site, siteName: "Latitude", status: "active", createdAt: later },
+    ]);
+    await h.db.collection("users").updateOne({ _id: user._id }, { $set: { defaultOrg: id.pmOrg.toString() } });
+
+    // not for the property manager, not for the invitee
+    for (const who of [pmSid, sid]) {
+      const refused = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: who });
+      assert.ok([401, 403].includes(refused.status), JSON.stringify(refused.body));
+    }
+
+    const before = JSON.stringify(await h.db.collection("members").find({ user: user._id }).toArray());
+    const preview = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: adminSid });
+    assert.equal(preview.status, 200, JSON.stringify(preview.body));
+    assert.equal(preview.body.senderOrgName, "JLL Singapore");
+    assert.equal(preview.body.memberships.length, 2);
+    assert.ok(preview.body.memberships.every((m) => m.fullAccess && m.roleName === "Admin Service Provider"));
+    assert.equal(preview.body.defaultOrgIsSender, true);
+    assert.equal(preview.body.repaired, null);
+    assert.equal(JSON.stringify(await h.db.collection("members").find({ user: user._id }).toArray()), before, "preview writes nothing");
+
+    const repaired = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
+    assert.equal(repaired.status, 200, JSON.stringify(repaired.body));
+    assert.equal(repaired.body.changed, 2);
+    assert.equal(await h.db.collection("members").countDocuments({ user: user._id, status: "active" }), 0);
+
+    const undone = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/undo`, { method: "PUT", sid: adminSid });
+    assert.equal(undone.status, 200, JSON.stringify(undone.body));
+    assert.equal(await h.db.collection("members").countDocuments({ user: user._id, status: "active" }), 2);
+
+    await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
+    const again = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: adminSid });
+    assert.equal(again.body.memberships.length, 0);
+    assert.ok(again.body.repaired);
+    // the pending invitation is untouched by all of this
+    assert.equal((await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) })).status, "pending");
+
+    // and now the invitee takes the right path: its own Security company
+    const res = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, {
+      method: "PUT",
+      sid,
+      body: { companyName: "Latitude Security" },
+    });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const org = await h.db.collection("organizations").findOne({ _id: new ObjectId(res.body.orgId) });
+    assert.equal(org.nature, "security_agency");
+    assert.ok(await h.db.collection("customer.sites").findOne({ org: org._id, site }));
+    assert.equal(
+      (await h.db.collection("users").findOne({ _id: user._id })).defaultOrg?.toString(),
+      org._id.toString(),
+      "the account now opens its own company",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const pmOrg = new ObjectId();
+  const existingOrg = new ObjectId();
+  const pmUser = new ObjectId();
+  const adminUser = new ObjectId();
+  const existingUser = new ObjectId();
+  const adminRole = new ObjectId();
+  const pmRole = new ObjectId();
+  const existingRole = new ObjectId();
+  const [site, site2, site3, site4] = [0, 1, 2, 3].map(() => new ObjectId());
+
+  await h.db.collection("organizations").insertMany([
+    { _id: pmOrg, name: "JLL Singapore", email: "pm-org-inv@e2e.example.com", type: "property_management_agency", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: existingOrg, name: "Existing Guards", email: EXISTING_EMAIL, type: "security_agency", nature: "security_agency", createdBy: existingUser, status: "active", createdAt: now },
+  ]);
+  await h.db.collection("sites").insertMany(
+    [site, site2, site3, site4].map((_id) => ({ _id, name: "Latitude", orgId: pmOrg, status: "active", createdAt: now })),
+  );
+  const pw = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").insertMany([
+    { _id: pmUser, email: PM_EMAIL, password: pw, name: "Latitude", status: "active", defaultOrg: pmOrg.toString(), createdAt: now },
+    { _id: adminUser, email: ADMIN_EMAIL, password: pw, name: "Master7365", status: "active", createdAt: now },
+    { _id: existingUser, email: EXISTING_EMAIL, password: pw, name: "Existing Owner", status: "active", defaultOrg: existingOrg.toString(), createdAt: now },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: adminRole, name: "Super Admin", type: "admin", default: true, permissions: ["*"], status: "active" },
+    { _id: pmRole, name: "owner", type: "property_management_agency", org: pmOrg.toString(), permissions: ["*"], status: "active" },
+    { _id: existingRole, name: "owner", type: "organization", org: existingOrg.toString(), permissions: ["*"], status: "active" },
+  ]);
+  await h.db.collection("members").insertMany([
+    { user: adminUser, name: "Master7365", role: adminRole, type: "admin", org: "", status: "active", createdAt: now },
+    { user: pmUser, name: "Latitude", role: pmRole, type: "property_management_agency", org: pmOrg, status: "active", createdAt: now },
+    { user: existingUser, name: "Existing Owner", role: existingRole, type: "organization", org: existingOrg, status: "active", createdAt: now },
+  ]);
+  return { pmOrg, existingOrg, pmUser, adminUser, pmRole, site, site2, site3, site4 };
+}

package/test/role-member-org-scope.test.mjs

@@ -143,8 +143,10 @@ test("only invitation types count, not any verification", () => {
   const body = fn(inviteActor, "hasOrgInvitation");
   assert.match(
     body,
-    /\$in: \["user-invite", "member-invite", "service-provider-invite"\]/,
+    /\$in: \["user-invite", "member-invite"\]/,
   );
+  // a service-provider invitation names the SENDER: never a key to it (2026-09-30)
+  assert.doesNotMatch(body, /"service-provider-invite"/);
   // a forgotten-password or sign-up code must not be a key to an organisation
   assert.doesNotMatch(body, /forget-password|user-sign-up/);
 });

package/test/sp-invite-email-status.test.mjs

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  inviteEmailStatus,
+  inviteEmailFailureReason,
+  inviteResendWaitMinutes,
+  serviceProviderNatureFor,
+} from "./.build/utils/service-provider-invite.util.mjs";
+import { notificationEmail } from "./.build/utils/notification-email.util.mjs";
+
+// Owner report 2026-09-30: did the invitation email go out, and why not.
+
+test("email status is the LATEST send attempt", () => {
+  assert.equal(inviteEmailStatus([{ action: "created" }]), null);
+  assert.deepEqual(
+    inviteEmailStatus([
+      { action: "email-failed", at: "t1", reason: "could not reach the mail server" },
+      { action: "resent", at: "t2" },
+      { action: "email-sent", at: "t3" },
+    ]),
+    { state: "sent", at: "t3" },
+  );
+  assert.equal(inviteEmailStatus([{ action: "email-failed", at: "t" }]).reason, "unknown error");
+});
+
+test("failure reasons come from the error CODE only, never its message", () => {
+  const leaky = { code: "EAUTH", message: "Invalid login: user@x pass=hunter2" };
+  const reason = inviteEmailFailureReason(leaky);
+  assert.match(reason, /refused Seven365's login/);
+  assert.ok(!reason.includes("hunter2"));
+  assert.match(inviteEmailFailureReason({ code: "EENVELOPE" }), /address was refused/);
+  assert.match(inviteEmailFailureReason({ responseCode: 550 }), /address was refused/);
+  assert.match(inviteEmailFailureReason({ code: "ETIMEDOUT" }), /did not answer/);
+  assert.match(inviteEmailFailureReason({ code: "ECONNECTION" }), /could not reach/);
+  assert.match(inviteEmailFailureReason({ responseCode: 421 }), /busy/);
+  assert.match(inviteEmailFailureReason({ code: "ETEMPLATE" }), /could not be prepared/);
+  assert.equal(inviteEmailFailureReason(new Error("x")), "the email could not be sent");
+});
+
+test("Resend waits 2 minutes after the last attempt", () => {
+  const now = new Date("2026-09-30T10:00:00Z");
+  assert.equal(inviteResendWaitMinutes([], now), 0);
+  assert.equal(inviteResendWaitMinutes([{ action: "email-sent", at: "2026-09-30T09:59:30Z" }], now), 2);
+  assert.equal(inviteResendWaitMinutes([{ action: "email-failed", at: "2026-09-30T09:58:30Z" }], now), 1);
+  assert.equal(inviteResendWaitMinutes([{ action: "email-sent", at: "2026-09-30T09:57:00Z" }], now), 0);
+});
+
+test("a new company's nature comes from the invited service; never property management", () => {
+  assert.equal(serviceProviderNatureFor("security_agency"), "security_agency");
+  assert.equal(serviceProviderNatureFor("Security"), "security_agency");
+  assert.equal(serviceProviderNatureFor("hygiene"), "cleaning_services");
+  assert.equal(serviceProviderNatureFor("pool"), "pool_maintenance_services");
+  assert.equal(serviceProviderNatureFor("property_management_agency"), "");
+  assert.equal(serviceProviderNatureFor("real_estate_developer"), "");
+  assert.equal(serviceProviderNatureFor(""), "");
+  assert.equal(serviceProviderNatureFor("rocket_science"), "");
+});
+
+test("a role-based email has no turn-off link and says why it was sent", () => {
+  const m = notificationEmail({
+    title: "Service provider invitation to approve",
+    body: "x",
+    moduleLabel: "Seven365 platform",
+    openUrl: "https://a/notifications/open?kind=spApproval",
+    settingsUrl: "https://a/notification-settings",
+    why: "You are a Seven365 administrator.",
+  });
+  assert.ok(!/Turn off email/.test(m.html) && !/Turn off email/.test(m.text));
+  assert.match(m.text, /You are a Seven365 administrator/);
+  // the opt-in email is unchanged
+  const optIn = notificationEmail({ title: "t", body: "b", moduleLabel: "M", openUrl: "o", offUrl: "off", settingsUrl: "s" });
+  assert.match(optIn.text, /Turn off email for M: off/);
+});