@7365admin1/core 3.138.0 → 3.139.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/core
 
+## 3.139.1
+
+### Patch Changes
+
+- 45755c1: Security: a membership that was taken away ("inactive" after the service-provider Repair or Finish-setup Undo, or "deleted") no longer grants organisation, site or role reach (resolveInviteActor, camera site entitlement, role-holder check).
+
+## 3.139.0
+
+### Minor Changes
+
+- 2b2960d: Membership lookup and organisation switcher ignore memberships that were taken away (inactive/deleted) and prefer the account's default organisation; SP-invite Repair also retires the unused full-access role the old sign-up left in the client's role list (Undo restores it); accept-new-company reuses the company its own invitation already created (retry/double click).
+
 ## 3.138.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -17891,6 +17891,10 @@ declare function useServiceProviderInviteService(): {
             siteName: string;
             createdAt: any;
         }[];
+        leftoverRoles: {
+            _id: string;
+            name: string;
+        }[];
         defaultOrgIsSender: boolean;
         repaired: {
             at: any;
@@ -19114,7 +19118,7 @@ declare function MHidAmicoIdentity(value: THidAmicoIdentity): {
     member: ObjectId | undefined;
     serviceProvider: ObjectId | undefined;
     visitor: ObjectId | undefined;
-    type: "admin" | "resident" | "staff" | "visitor" | "contractor" | "unknown";
+    type: "resident" | "admin" | "staff" | "visitor" | "contractor" | "unknown";
     status: "deleted" | "active" | "inactive";
     metadata: Record<string, unknown>;
     createdAt: string | Date;
@@ -19226,7 +19230,7 @@ declare function useHidAmicoRepo(): {
         member: ObjectId | undefined;
         serviceProvider: ObjectId | undefined;
         visitor: ObjectId | undefined;
-        type: "admin" | "resident" | "staff" | "visitor" | "contractor" | "unknown";
+        type: "resident" | "admin" | "staff" | "visitor" | "contractor" | "unknown";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;
@@ -19630,7 +19634,7 @@ declare function useHidAmicoService(): {
         member: bson.ObjectId | undefined;
         serviceProvider: bson.ObjectId | undefined;
         visitor: bson.ObjectId | undefined;
-        type: "admin" | "resident" | "staff" | "visitor" | "contractor" | "unknown";
+        type: "resident" | "admin" | "staff" | "visitor" | "contractor" | "unknown";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;

package/dist/index.js

@@ -4371,6 +4371,54 @@ function sameAppType(a, b) {
   return !!a && !!b && serviceAppType(a) === serviceAppType(b);
 }
 
+// src/utils/member-lookup.util.ts
+var idOf = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
+function isLiveMembership(m) {
+  return m.status !== "deleted" && !m.deletedAt;
+}
+function pickSiteMembership(rows, type, site, org = "") {
+  site = site.toLowerCase();
+  org = org.toLowerCase();
+  if (!site)
+    return null;
+  const live2 = rows.filter(
+    (m) => sameAppType(m.type, type) && isLiveMembership(m) && (!org || idOf(m.org) === org)
+  );
+  const atSite = live2.find((m) => idOf(m.siteId) === site);
+  if (atSite)
+    return atSite;
+  if (!org)
+    return null;
+  return live2.find((m) => !idOf(m.siteId)) ?? live2[0] ?? null;
+}
+function pickLookupMembership(rows, type, site = "", org = "") {
+  const list = Array.isArray(rows) ? rows : [];
+  const atSite = site ? pickSiteMembership(list, type, site, org) : null;
+  if (atSite)
+    return atSite;
+  const inOrg = org ? list.find((m) => sameAppType(m.type, type) && idOf(m.org) === org.toLowerCase()) : void 0;
+  if (inOrg && isLiveMembership(inOrg))
+    return inOrg;
+  return preferWorkingMembership(list.filter((m) => sameAppType(m.type, type)));
+}
+var WORKING = /* @__PURE__ */ new Set(["active", "approved"]);
+var TAKEN_AWAY_MEMBER_STATUSES = ["deleted", "inactive"];
+function preferWorkingMembership(rows, defaultOrg = "") {
+  const list = Array.isArray(rows) ? rows : [];
+  const working = list.filter((m) => WORKING.has(String(m.status ?? "")) && !m.deletedAt);
+  const home = idOf(defaultOrg);
+  return (home ? working.find((m) => idOf(m.org) === home) : void 0) ?? working[0] ?? list.find(isLiveMembership) ?? list[0] ?? null;
+}
+function memberListSiteScope(memberships, org) {
+  const inOrg = (memberships ?? []).filter((m) => idOf(m.org) === idOf(org));
+  const here = inOrg.filter((m) => m.type !== "resident");
+  if (!inOrg.length)
+    return null;
+  if (here.some((m) => !idOf(m.siteId) || m.orgLevelRole))
+    return null;
+  return [...new Set(here.map((m) => idOf(m.siteId)))];
+}
+
 // src/repositories/member.repo.ts
 var import_node_server_utils15 = require("@7365admin1/node-server-utils");
 
@@ -4493,10 +4541,10 @@ var import_mongodb13 = require("mongodb");
 function crossSiteRoleMode() {
   return (process.env.CROSS_SITE_ROLE_MODE ?? "").trim().toLowerCase() === "enforce" ? "enforce" : "log";
 }
-var idOf = (value) => value === null || value === void 0 ? "" : String(value?.toString?.() ?? value);
+var idOf2 = (value) => value === null || value === void 0 ? "" : String(value?.toString?.() ?? value);
 function isCrossSiteRole(role, memberSite) {
-  const roleSite = idOf(role?.site);
-  return !!roleSite && roleSite !== idOf(memberSite);
+  const roleSite = idOf2(role?.site);
+  return !!roleSite && roleSite !== idOf2(memberSite);
 }
 var THROTTLE_MS = 10 * 60 * 1e3;
 var lastLogged = /* @__PURE__ */ new Map();
@@ -4505,7 +4553,7 @@ function crossSiteRoleGrants(input) {
     return true;
   const mode = crossSiteRoleMode();
   const granted = mode !== "enforce";
-  const key = [mode, idOf(input.member) || idOf(input.user), idOf(input.role?._id), input.where].join("|");
+  const key = [mode, idOf2(input.member) || idOf2(input.user), idOf2(input.role?._id), input.where].join("|");
   const now = Date.now();
   if ((lastLogged.get(key) ?? 0) + THROTTLE_MS <= now) {
     lastLogged.set(key, now);
@@ -4513,7 +4561,7 @@ function crossSiteRoleGrants(input) {
       lastLogged.clear();
     import_node_server_utils14.logger.log({
       level: "warn",
-      message: `cross-site-role mode=${mode} ${granted ? "granted" : "refused"} where=${input.where} member=${idOf(input.member) || "-"} user=${idOf(input.user) || "-"} site=${idOf(input.memberSite) || "-"} role=${idOf(input.role?._id) || "-"} roleSite=${idOf(input.role?.site)}`
+      message: `cross-site-role mode=${mode} ${granted ? "granted" : "refused"} where=${input.where} member=${idOf2(input.member) || "-"} user=${idOf2(input.user) || "-"} site=${idOf2(input.memberSite) || "-"} role=${idOf2(input.role?._id) || "-"} roleSite=${idOf2(input.role?.site)}`
     });
   }
   return granted;
@@ -4524,7 +4572,7 @@ function crossSiteRoleRefusal(roleName, roleSiteName) {
   return `${role} belongs to ${site}. Choose a role for this site, or an org-wide role.`;
 }
 async function requireRoleFitsSite(roleId, siteId) {
-  const id = idOf(roleId);
+  const id = idOf2(roleId);
   if (!id || !import_mongodb13.ObjectId.isValid(id))
     return;
   const db2 = import_node_server_utils14.useAtlas.getDb();
@@ -4533,7 +4581,7 @@ async function requireRoleFitsSite(roleId, siteId) {
   const role = await db2.collection("roles").findOne({ _id: new import_mongodb13.ObjectId(id) }, { projection: { name: 1, site: 1 } });
   if (!isCrossSiteRole(role, siteId))
     return;
-  const site = import_mongodb13.ObjectId.isValid(idOf(role?.site)) ? await db2.collection("sites").findOne({ _id: new import_mongodb13.ObjectId(idOf(role?.site)) }, { projection: { name: 1 } }) : null;
+  const site = import_mongodb13.ObjectId.isValid(idOf2(role?.site)) ? await db2.collection("sites").findOne({ _id: new import_mongodb13.ObjectId(idOf2(role?.site)) }, { projection: { name: 1 } }) : null;
   throw new import_node_server_utils14.BadRequestError(crossSiteRoleRefusal(role?.name, site?.name));
 }
 async function otherSiteRoleClauses(roles, org) {
@@ -4541,7 +4589,7 @@ async function otherSiteRoleClauses(roles, org) {
     { ...org ? { org } : { org: { $nin: ["", null] } }, site: { $nin: ["", null] }, status: "active" },
     { projection: { site: 1, org: 1 } }
   ).toArray();
-  const both3 = (v) => import_mongodb13.ObjectId.isValid(idOf(v)) ? [new import_mongodb13.ObjectId(idOf(v)), idOf(v)] : [v];
+  const both3 = (v) => import_mongodb13.ObjectId.isValid(idOf2(v)) ? [new import_mongodb13.ObjectId(idOf2(v)), idOf2(v)] : [v];
   const clauses = (list ?? []).map((r) => ({
     role: r._id,
     org: { $in: both3(r.org) },
@@ -4724,9 +4772,12 @@ function useMemberRepo() {
     } catch (error) {
       throw new import_node_server_utils15.BadRequestError("Invalid user ID format.");
     }
+    const account = await db2?.collection("users").findOne({ _id: user }, { projection: { defaultOrg: 1 } }).catch(() => null);
+    const defaultOrg = String(account?.defaultOrg ?? "");
     const cacheKey = (0, import_node_server_utils15.makeCacheKey)(namespace_collection3, {
       user: user.toString(),
-      type
+      type,
+      defaultOrg
     });
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
@@ -4734,7 +4785,10 @@ function useMemberRepo() {
       return cachedData;
     }
     try {
-      const data = await collection.findOne({ user, type: appTypeQuery(type) });
+      const data = preferWorkingMembership(
+        await collection.find({ user, type: appTypeQuery(type) }).toArray(),
+        defaultOrg
+      );
       if (!data) {
         throw new import_node_server_utils15.NotFoundError("Member not found.");
       }
@@ -5197,7 +5251,12 @@ function useMemberRepo() {
     const query2 = {
       user,
       org: { $nin: [null, ""] },
-      type: appTypeQuery(type)
+      type: appTypeQuery(type),
+      // The organisation switcher. A membership that was taken away (Repair
+      // sets it inactive, removal deletes it) must not keep the organisation
+      // on the person's list: latitude.sec@ still saw JLL Singapore beside its
+      // own company after the repair (owner report 2026-09-30).
+      status: { $nin: TAKEN_AWAY_MEMBER_STATUSES }
     };
     const cacheOptions = {
       page: page2,
@@ -9847,7 +9906,7 @@ async function resolveInviteActor(userId) {
   const db2 = import_node_server_utils28.useAtlas.getDb();
   if (!db2)
     return { ...EMPTY, id };
-  const members = await db2.collection("members").find({ user: new import_mongodb26.ObjectId(id), status: { $ne: "deleted" } }).toArray();
+  const members = await db2.collection("members").find({ user: new import_mongodb26.ObjectId(id), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).toArray();
   const adminMember = members.find((m) => m.type === "admin");
   let isSuperAdmin2 = false;
   let staffPermissions;
@@ -10154,7 +10213,7 @@ async function holdsRole(userId, roleId, orgId) {
   const member = await db2.collection("members").findOne({
     user: new import_mongodb26.ObjectId(id),
     role: new import_mongodb26.ObjectId(role),
-    status: { $ne: "deleted" },
+    status: { $nin: TAKEN_AWAY_MEMBER_STATUSES },
     // both shapes, as `hasOrgInvitation` does for `metadata.org`
     ...org ? { org: { $in: [new import_mongodb26.ObjectId(org), org] } } : {}
   });
@@ -11619,7 +11678,7 @@ function enforcedModuleList(stored, save) {
     return NO_LIST;
   return { list, since: typeof save?.createdAt === "string" ? save.createdAt : "" };
 }
-var idOf2 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
+var idOf3 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 function deniedForMembership({
   membership,
   org,
@@ -11627,12 +11686,12 @@ function deniedForMembership({
   site,
   siteSave
 }) {
-  const memberOrg = idOf2(membership?.org);
+  const memberOrg = idOf3(membership?.org);
   if (!membership || membership.type === "resident" || !memberOrg) {
     return { denied: [], since: "" };
   }
   const orgTier = enforcedModuleList(org?.modules, orgSave);
-  const siteTier = site && idOf2(site.orgId) === memberOrg ? enforcedModuleList(site.metadata?.modules, siteSave) : NO_LIST;
+  const siteTier = site && idOf3(site.orgId) === memberOrg ? enforcedModuleList(site.metadata?.modules, siteSave) : NO_LIST;
   const denied = deniedModules(orgTier.list, siteTier.list);
   if (!denied.length)
     return { denied: [], since: "" };
@@ -12201,46 +12260,6 @@ function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
   return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
 }
 
-// src/utils/member-lookup.util.ts
-var idOf3 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
-function isLiveMembership(m) {
-  return m.status !== "deleted" && !m.deletedAt;
-}
-function pickSiteMembership(rows, type, site, org = "") {
-  site = site.toLowerCase();
-  org = org.toLowerCase();
-  if (!site)
-    return null;
-  const live2 = rows.filter(
-    (m) => sameAppType(m.type, type) && isLiveMembership(m) && (!org || idOf3(m.org) === org)
-  );
-  const atSite = live2.find((m) => idOf3(m.siteId) === site);
-  if (atSite)
-    return atSite;
-  if (!org)
-    return null;
-  return live2.find((m) => !idOf3(m.siteId)) ?? live2[0] ?? null;
-}
-function pickLookupMembership(rows, type, site = "", org = "") {
-  const list = Array.isArray(rows) ? rows : [];
-  const atSite = site ? pickSiteMembership(list, type, site, org) : null;
-  if (atSite)
-    return atSite;
-  const inOrg = org ? list.find((m) => sameAppType(m.type, type) && idOf3(m.org) === org.toLowerCase()) : void 0;
-  if (inOrg && isLiveMembership(inOrg))
-    return inOrg;
-  return list.find((m) => sameAppType(m.type, type)) ?? null;
-}
-function memberListSiteScope(memberships, org) {
-  const inOrg = (memberships ?? []).filter((m) => idOf3(m.org) === idOf3(org));
-  const here = inOrg.filter((m) => m.type !== "resident");
-  if (!inOrg.length)
-    return null;
-  if (here.some((m) => !idOf3(m.siteId) || m.orgLevelRole))
-    return null;
-  return [...new Set(here.map((m) => idOf3(m.siteId)))];
-}
-
 // src/services/module-gate.service.ts
 var idOf4 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 var isId = (v) => /^[0-9a-f]{24}$/i.test(v);
@@ -23225,7 +23244,7 @@ function useCameraViewService() {
     }
   }
   async function resolveSiteAccess(params) {
-    const memberships = await params.db.collection("members").find({ user: new import_mongodb52.ObjectId(params.userId), status: { $ne: "deleted" } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
+    const memberships = await params.db.collection("members").find({ user: new import_mongodb52.ObjectId(params.userId), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
     const memberOrgIds = [
       ...new Map(
         memberships.filter((membership) => membership.org).map((membership) => [String(membership.org), membership.org])
@@ -25553,7 +25572,7 @@ function useServiceProviderInviteService() {
       );
     }
     const existing = await getByCreatorAndNature(actor.id, nature).catch(() => null);
-    if (existing) {
+    if (existing && String(existing.invitedFrom ?? "") !== String(invite._id)) {
       throw new import_node_server_utils61.BadRequestError(
         `You already have a ${serviceTypeLabel(nature)} company on iService365 (${existing.name}). Accept the invitation from that company instead.`
       );
@@ -25584,12 +25603,21 @@ function useServiceProviderInviteService() {
     country
   }) {
     const inviteeId = String(user?._id ?? "");
-    const name = sanitizeCompanyName(companyName) || sanitizeCompanyName(invite.metadata?.name) || sanitizeCompanyName(user?.name);
+    let name = sanitizeCompanyName(companyName) || sanitizeCompanyName(invite.metadata?.name) || sanitizeCompanyName(user?.name);
     if (!name)
       throw new import_node_server_utils61.BadRequestError("Enter your company's name.");
     const email = String(invite.email ?? "").trim().toLowerCase();
     const actor = { id: inviteeId };
-    const orgId = String(
+    const db2 = import_node_server_utils61.useAtlas.getDb();
+    const actorIds = [actor.id, ...import_mongodb56.ObjectId.isValid(actor.id) ? [new import_mongodb56.ObjectId(actor.id)] : []];
+    const made = db2 ? await db2.collection("organizations").findOne({
+      invitedFrom: { $in: [String(invite._id), invite._id] },
+      createdBy: { $in: actorIds },
+      status: { $ne: "deleted" }
+    }) : null;
+    if (made)
+      name = String(made.name ?? name);
+    const orgId = made ? String(made._id) : String(
       await addOrg({
         name,
         type: nature,
@@ -25601,8 +25629,17 @@ function useServiceProviderInviteService() {
         invitedFrom: String(invite._id)
       })
     );
-    const roles = await seedDefaultOrgRoles(useRoleRepo().addRole, orgId, nature);
     const appType = serviceAppType(nature);
+    const owners = made && db2 ? await db2.collection("roles").find({
+      org: { $in: [new import_mongodb56.ObjectId(orgId), orgId] },
+      name: "owner",
+      status: { $ne: "deleted" }
+    }).toArray() : [];
+    const ownerRole = (type) => {
+      const r = owners.find((x) => x.type === type);
+      return r ? { id: String(r._id), type, name: "owner" } : null;
+    };
+    const roles = ownerRole("organization") && ownerRole(appType) ? [ownerRole("organization"), ownerRole(appType)] : await seedDefaultOrgRoles(useRoleRepo().addRole, orgId, nature);
     const orgOwner = roles.find((r) => r.type === "organization" && r.name === "owner");
     const appOwner = roles.find((r) => r.type === appType && r.name === "owner");
     if (!orgOwner || !appOwner) {
@@ -25625,8 +25662,18 @@ function useServiceProviderInviteService() {
       siteName: "",
       onboardingRequired: false
     };
-    await addMember({ ...base, role: orgOwner.id, type: "organization" });
-    await addMember({ ...base, role: appOwner.id, type: appType });
+    const hasOwnerRow = async (type) => !!made && !!await db2?.collection("members").findOne({
+      user: { $in: actorIds },
+      org: { $in: [new import_mongodb56.ObjectId(orgId), orgId] },
+      type,
+      status: "active"
+    });
+    if (!await hasOwnerRow("organization")) {
+      await addMember({ ...base, role: orgOwner.id, type: "organization" });
+    }
+    if (!await hasOwnerRow(appType)) {
+      await addMember({ ...base, role: appOwner.id, type: appType });
+    }
     await useUserRepo().updateUserFieldById({ _id: actor.id, field: "defaultOrg", value: orgId }).catch(() => void 0);
     import_node_server_utils61.logger.log({
       level: "info",
@@ -25682,10 +25729,60 @@ function useServiceProviderInviteService() {
     const last = [...history].reverse().find((e) => ["wrong-join-repaired", "wrong-join-undone"].includes(e?.action));
     return last?.action === "wrong-join-repaired" ? last : null;
   }
+  async function leftoverRoles(invite, senderOrg, user) {
+    const db2 = import_node_server_utils61.useAtlas.getDb();
+    if (!db2 || !user?._id || !import_mongodb56.ObjectId.isValid(senderOrg))
+      return [];
+    const since = new Date(String(invite.createdAt ?? 0)).getTime();
+    const rows = await db2.collection("members").find({
+      user: { $in: [user._id, String(user._id)] },
+      org: { $in: [new import_mongodb56.ObjectId(senderOrg), senderOrg] }
+    }).project({ role: 1 }).toArray();
+    const roleIds = [
+      ...new Set(
+        rows.map((m) => m.role?.toString?.() ?? "").filter((r) => import_mongodb56.ObjectId.isValid(r))
+      )
+    ].map((r) => new import_mongodb56.ObjectId(r));
+    if (!roleIds.length)
+      return [];
+    const roles = await db2.collection("roles").find({
+      _id: { $in: roleIds },
+      org: { $in: [new import_mongodb56.ObjectId(senderOrg), senderOrg] },
+      status: { $ne: "deleted" }
+    }).project({ name: 1, permissions: 1, createdAt: 1 }).toArray();
+    const out = [];
+    for (const role of roles) {
+      if (!(Array.isArray(role.permissions) && role.permissions.includes("*")))
+        continue;
+      if (role.createdAt && Number.isFinite(since) && new Date(role.createdAt).getTime() < since)
+        continue;
+      const inUse = await db2.collection("members").countDocuments({
+        role: { $in: [role._id, role._id.toString()] },
+        status: "active"
+      });
+      if (inUse)
+        continue;
+      out.push({ _id: role._id.toString(), name: String(role.name ?? "") });
+    }
+    return out;
+  }
+  async function setRoleStatus(ids2, status) {
+    const db2 = import_node_server_utils61.useAtlas.getDb();
+    const valid = ids2.filter((r) => import_mongodb56.ObjectId.isValid(r)).map((r) => new import_mongodb56.ObjectId(r));
+    if (!db2 || !valid.length)
+      return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await db2.collection("roles").updateMany(
+      { _id: { $in: valid } },
+      { $set: { status, deletedAt: status === "deleted" ? now : "", updatedAt: now } }
+    );
+    await (0, import_node_server_utils61.useCache)("roles").delNamespace().catch(() => void 0);
+  }
   async function wrongJoinPreview({ id, userId }) {
     const { invite, senderOrg, user } = await wrongJoinContext(id, userId);
     const org = await getOrgById(senderOrg).catch(() => null);
     const memberships = await wrongJoinRows(invite, senderOrg, user);
+    const roles = await leftoverRoles(invite, senderOrg, user);
     const repaired = lastRepair(invite);
     return {
       invitationId: id,
@@ -25694,6 +25791,8 @@ function useServiceProviderInviteService() {
       senderOrgId: senderOrg,
       senderOrgName: String(org?.name ?? ""),
       memberships,
+      // Left in the sender's role list by the old sign-up; Repair retires them.
+      leftoverRoles: roles,
       defaultOrgIsSender: String(user?.defaultOrg ?? "") === senderOrg,
       repaired: repaired ? { at: repaired.at, by: repaired.byName, memberIds: repaired.memberIds ?? [] } : null
     };
@@ -25702,15 +25801,17 @@ function useServiceProviderInviteService() {
     const { actor, invite, senderOrg, user } = await wrongJoinContext(id, userId);
     const rows = await wrongJoinRows(invite, senderOrg, user);
     const defaultOrgIsSender = !!user?._id && String(user?.defaultOrg ?? "") === senderOrg;
-    if (!rows.length && !defaultOrgIsSender) {
+    const { updateMemberStatus } = useMemberRepo();
+    for (const row of rows)
+      await updateMemberStatus(row._id, { status: "inactive" });
+    const roles = await leftoverRoles(invite, senderOrg, user);
+    if (!rows.length && !defaultOrgIsSender && !roles.length) {
       return {
         message: "Nothing to repair: this account is not in the sender's organisation.",
         changed: 0
       };
     }
-    const { updateMemberStatus } = useMemberRepo();
-    for (const row of rows)
-      await updateMemberStatus(row._id, { status: "inactive" });
+    await setRoleStatus(roles.map((r) => r._id), "deleted");
     if (defaultOrgIsSender)
       await setDefaultOrg(String(user._id), "");
     await _transition({
@@ -25719,6 +25820,7 @@ function useServiceProviderInviteService() {
       event: {
         ...event("wrong-join-repaired", actor),
         memberIds: rows.map((row) => row._id),
+        roleIds: roles.map((r) => r._id),
         ...defaultOrgIsSender ? { defaultOrgWas: senderOrg } : {}
       }
     });
@@ -25727,8 +25829,8 @@ function useServiceProviderInviteService() {
       message: `[sp-invite] wrong-join repaired invite=${id} memberships=${rows.length} by=${actor.id}`
     });
     return {
-      message: `Repaired: ${rows.length} membership${rows.length === 1 ? "" : "s"} in the sender's organisation set inactive. Undo is available.`,
-      changed: rows.length
+      message: `Repaired: ${rows.length} membership${rows.length === 1 ? "" : "s"} in the sender's organisation set inactive` + (roles.length ? `, ${roles.length} unused full-access role${roles.length === 1 ? "" : "s"} removed from its role list` : "") + ". Undo is available.",
+      changed: rows.length + roles.length
     };
   }
   async function undoWrongJoin({ id, userId }) {
@@ -25740,6 +25842,7 @@ function useServiceProviderInviteService() {
     const ids2 = (repaired.memberIds ?? []).filter((m) => import_mongodb56.ObjectId.isValid(m));
     for (const m of ids2)
       await updateMemberStatus(m, { status: "active" }).catch(() => 0);
+    await setRoleStatus(repaired.roleIds ?? [], "active");
     const { user } = await wrongJoinContext(id, userId);
     if (repaired.defaultOrgWas && user?._id && !String(user.defaultOrg ?? "")) {
       await setDefaultOrg(String(user._id), String(repaired.defaultOrgWas));