@7365admin1/core 3.136.2 → 3.137.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.136.2",
+  "version": "3.137.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/harness.mjs

@@ -573,6 +573,9 @@ function buildApp(nsu, core) {
       wrongJoinPreview,
       wrongJoinRepair,
       wrongJoinUndo,
+      finishSetupPreview,
+      finishSetupApply,
+      finishSetupUndo,
       linkSite,
       received,
       getOne,
@@ -594,6 +597,9 @@ function buildApp(nsu, core) {
     invitations.get("/:id/wrong-join", requireAuth, wrongJoinPreview);
     invitations.put("/:id/wrong-join/repair", requireAuth, wrongJoinRepair);
     invitations.put("/:id/wrong-join/undo", requireAuth, wrongJoinUndo);
+    invitations.get("/:id/finish-setup", requireAuth, finishSetupPreview);
+    invitations.put("/:id/finish-setup", requireAuth, finishSetupApply);
+    invitations.put("/:id/finish-setup/undo", requireAuth, finishSetupUndo);
     invitations.put("/:id/link-site", requireAuth, linkSite);
   }
 

package/test/e2e/service-provider-invite-email-new-company.e2e.test.mjs

@@ -384,6 +384,145 @@ describe("SP invitation: email status, Super Admin alert, new company typed by s
       "the account now opens its own company",
     );
   });
+
+  // ------------------------- D. sign-in keeps landing in the sender (2026-10-01)
+
+  // The production state of latitude.sec@ after the 30 Sep Repair: the two
+  // memberships in JLL are inactive, but the account's default organisation
+  // still points at JLL - which is what every later sign-in opened.
+  async function repairedAccount(email) {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const inviteId = await invite(email, "security_agency", site);
+    await approve(inviteId);
+    const sid = await newAccount(email);
+    const user = await h.db.collection("users").findOne({ email });
+    const later = new Date(Date.now() + 1000);
+    await h.db.collection("members").insertMany([
+      { user: user._id, org: id.pmOrg, role: new ObjectId(), type: "organization", siteId: site, siteName: "Latitude", status: "inactive", createdAt: later },
+      { user: user._id, org: id.pmOrg, role: new ObjectId(), type: "security_agency", siteId: site, siteName: "Latitude", status: "inactive", createdAt: later },
+    ]);
+    await h.db.collection("users").updateOne({ _id: user._id }, { $set: { defaultOrg: id.pmOrg.toString() } });
+    return { site, inviteId, sid, user };
+  }
+
+  it("D1. Repair also clears a default organisation that points at the sender; Undo restores it", async () => {
+    const email = "repair-default@e2e.example.com";
+    const { inviteId, user } = await repairedAccount(email);
+    // memberships are already inactive: only the default org is left to fix
+    const preview = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: adminSid });
+    assert.equal(preview.body.memberships.length, 0);
+    assert.equal(preview.body.defaultOrgIsSender, true);
+
+    const repaired = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
+    assert.equal(repaired.status, 200, JSON.stringify(repaired.body));
+    assert.equal(String((await h.db.collection("users").findOne({ _id: user._id })).defaultOrg ?? ""), "");
+
+    const undone = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/undo`, { method: "PUT", sid: adminSid });
+    assert.equal(undone.status, 200, JSON.stringify(undone.body));
+    assert.equal(String((await h.db.collection("users").findOne({ _id: user._id })).defaultOrg), id.pmOrg.toString());
+  });
+
+  it("D2. Finish setup for invitee: Super Admin only; preview writes nothing; apply creates the typed company, links the site, accepts; undo reverses; apply again", async () => {
+    const email = "latitude-finish@e2e.example.com";
+    const { site, inviteId, sid, user } = await repairedAccount(email);
+    const NAME = "Henderson Security Services Pte Ltd";
+
+    for (const who of [pmSid, sid]) {
+      const refused = await h.api(`/service-provider-invitations/${inviteId}/finish-setup`, { sid: who });
+      assert.ok([401, 403].includes(refused.status), JSON.stringify(refused.body));
+      const refusedPut = await h.api(`/service-provider-invitations/${inviteId}/finish-setup`, { method: "PUT", sid: who, body: { companyName: NAME } });
+      assert.ok([401, 403].includes(refusedPut.status), JSON.stringify(refusedPut.body));
+    }
+
+    const orgsBefore = await h.db.collection("organizations").countDocuments();
+    const preview = await h.api(`/service-provider-invitations/${inviteId}/finish-setup?companyName=${encodeURIComponent(NAME)}`, { sid: adminSid });
+    assert.equal(preview.status, 200, JSON.stringify(preview.body));
+    assert.equal(preview.body.canApply, true, preview.body.blocked);
+    assert.equal(preview.body.companyName, NAME);
+    assert.equal(preview.body.service, "security_agency");
+    assert.equal(preview.body.usesExistingCompany, false);
+    assert.equal(preview.body.currentDefaultOrgName, "JLL Singapore");
+    assert.equal(await h.db.collection("organizations").countDocuments(), orgsBefore, "preview writes nothing");
+
+    const applied = await h.api(`/service-provider-invitations/${inviteId}/finish-setup`, { method: "PUT", sid: adminSid, body: { companyName: `  ${NAME} ` } });
+    assert.equal(applied.status, 200, JSON.stringify(applied.body));
+    assert.equal(applied.body.message, `${NAME} is set up and linked to Latitude.`);
+    const org = await h.db.collection("organizations").findOne({ _id: new ObjectId(applied.body.orgId) });
+    assert.equal(org.name, NAME);
+    assert.equal(org.nature, "security_agency");
+    assert.equal(String(org.createdBy), user._id.toString(), "the invitee's company, not the Super Admin's");
+    const owners = await h.db.collection("members").find({ user: user._id, org: org._id, status: "active" }).toArray();
+    assert.deepEqual(owners.map((m) => m.type).sort(), ["organization", "security_agency"]);
+    assert.ok(await h.db.collection("customer.sites").findOne({ org: org._id, site, status: "active" }), "site linked");
+    assert.equal((await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) })).status, "complete");
+    assert.equal(String((await h.db.collection("users").findOne({ _id: user._id })).defaultOrg), org._id.toString());
+    // and the invitee's own sign-in now finds its Security company
+    const mine = await h.api(`/members/users/${user._id}`, { sid });
+    assert.ok(mine.body.items.some((m) => String(m.org) === org._id.toString() && m.type === "security_agency" && m.status === "active"));
+
+    // a second apply is refused (no longer waiting), nothing duplicated
+    const twice = await h.api(`/service-provider-invitations/${inviteId}/finish-setup`, { method: "PUT", sid: adminSid, body: { companyName: NAME } });
+    assert.equal(twice.status, 400, JSON.stringify(twice.body));
+
+    const undone = await h.api(`/service-provider-invitations/${inviteId}/finish-setup/undo`, { method: "PUT", sid: adminSid });
+    assert.equal(undone.status, 200, JSON.stringify(undone.body));
+    assert.equal((await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) })).status, "pending");
+    assert.equal(await h.db.collection("customer.sites").countDocuments({ org: org._id, site, status: "active" }), 0);
+    assert.equal(await h.db.collection("members").countDocuments({ org: org._id, status: "active" }), 0);
+    assert.equal(String((await h.db.collection("users").findOne({ _id: user._id })).defaultOrg), id.pmOrg.toString());
+
+    const again = await h.api(`/service-provider-invitations/${inviteId}/finish-setup`, { method: "PUT", sid: adminSid, body: { companyName: NAME } });
+    assert.equal(again.status, 200, JSON.stringify(again.body));
+    assert.notEqual(again.body.orgId, org._id.toString(), "a fresh company, not the undone one");
+  });
+
+  it("D3. existing account signs in to accept: the typed name (sanitised) + invited type + site link; plain sign-in can find the open invitation", async () => {
+    const email = "latitude-signin@e2e.example.com";
+    const { site, inviteId, sid, user } = await repairedAccount(email);
+
+    // plain sign-in (no invitation in the link): the account has no company,
+    // and the open invitation is found from its own session
+    const received = await h.api(`/service-provider-invitations/received`, { sid });
+    assert.equal(received.status, 200, JSON.stringify(received.body));
+    const row = received.body.items.find((r) => String(r._id) === inviteId);
+    assert.ok(row, "the pending invitation is listed for the signed-in invitee");
+    assert.equal(row.service, "security_agency");
+
+    const res = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, {
+      method: "PUT",
+      sid,
+      body: { companyName: " <b>Henderson</b>   Security Services Pte Ltd " },
+    });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body.companyName, "b Henderson /b Security Services Pte Ltd");
+    assert.equal(res.body.siteName, "Latitude");
+    const org = await h.db.collection("organizations").findOne({ _id: new ObjectId(res.body.orgId) });
+    assert.equal(org.nature, "security_agency");
+    assert.ok(await h.db.collection("customer.sites").findOne({ org: org._id, site, status: "active" }));
+    assert.equal(String((await h.db.collection("users").findOne({ _id: user._id })).defaultOrg), org._id.toString());
+  });
+
+  it("D4. a new account creates: the same result", async () => {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const email = "brand-new-guard@e2e.example.com";
+    const inviteId = await invite(email, "security_agency", site);
+    await approve(inviteId);
+    const sid = await newAccount(email);
+    const res = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, {
+      method: "PUT",
+      sid,
+      body: { companyName: "Henderson Security Services Pte Ltd", country: "Singapore" },
+    });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body.companyName, "Henderson Security Services Pte Ltd");
+    assert.equal(res.body.nature, "security_agency");
+    const org = await h.db.collection("organizations").findOne({ _id: new ObjectId(res.body.orgId) });
+    assert.equal(org.name, "Henderson Security Services Pte Ltd");
+    assert.ok(await h.db.collection("customer.sites").findOne({ org: org._id, site, status: "active" }));
+    assert.equal((await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) })).status, "complete");
+  });
 });
 
 async function seed(h) {

package/test/service-provider-invite.test.mjs

@@ -13,6 +13,7 @@ import {
   isServiceProviderInviteExpired,
   serviceProviderInviteViewStatus,
 } from "./.build/utils/service-provider-invite.util.mjs";
+import { sanitizeCompanyName } from "./.build/utils/service-provider-invite.util.mjs";
 
 /**
  * Inviting a service provider to a site.
@@ -391,3 +392,11 @@ test("accept is bound to a company the caller belongs to, and records which comp
   assert.match(cs, /"metadata\.providerOrg": providerOrgId/);
   assert.match(cs, /set: accepted,\s*session,/);
 });
+
+test("sanitizeCompanyName: keeps the typed name, drops markup and control characters", () => {
+  assert.equal(sanitizeCompanyName("  Henderson   Security Services Pte Ltd "), "Henderson Security Services Pte Ltd");
+  assert.equal(sanitizeCompanyName("<b>Acme</b>\u0000 Guards"), "b Acme /b Guards");
+  assert.equal(sanitizeCompanyName("x".repeat(300)).length, 120);
+  assert.equal(sanitizeCompanyName(null), "");
+  assert.equal(sanitizeCompanyName(" \n\t "), "");
+});