@7365admin1/core 3.138.0 → 3.139.1

package/dist/index.mjs

@@ -3200,6 +3200,54 @@ function sameAppType(a, b) {
   return !!a && !!b && serviceAppType(a) === serviceAppType(b);
 }
 
+// src/utils/member-lookup.util.ts
+var idOf = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
+function isLiveMembership(m) {
+  return m.status !== "deleted" && !m.deletedAt;
+}
+function pickSiteMembership(rows, type, site, org = "") {
+  site = site.toLowerCase();
+  org = org.toLowerCase();
+  if (!site)
+    return null;
+  const live2 = rows.filter(
+    (m) => sameAppType(m.type, type) && isLiveMembership(m) && (!org || idOf(m.org) === org)
+  );
+  const atSite = live2.find((m) => idOf(m.siteId) === site);
+  if (atSite)
+    return atSite;
+  if (!org)
+    return null;
+  return live2.find((m) => !idOf(m.siteId)) ?? live2[0] ?? null;
+}
+function pickLookupMembership(rows, type, site = "", org = "") {
+  const list = Array.isArray(rows) ? rows : [];
+  const atSite = site ? pickSiteMembership(list, type, site, org) : null;
+  if (atSite)
+    return atSite;
+  const inOrg = org ? list.find((m) => sameAppType(m.type, type) && idOf(m.org) === org.toLowerCase()) : void 0;
+  if (inOrg && isLiveMembership(inOrg))
+    return inOrg;
+  return preferWorkingMembership(list.filter((m) => sameAppType(m.type, type)));
+}
+var WORKING = /* @__PURE__ */ new Set(["active", "approved"]);
+var TAKEN_AWAY_MEMBER_STATUSES = ["deleted", "inactive"];
+function preferWorkingMembership(rows, defaultOrg = "") {
+  const list = Array.isArray(rows) ? rows : [];
+  const working = list.filter((m) => WORKING.has(String(m.status ?? "")) && !m.deletedAt);
+  const home = idOf(defaultOrg);
+  return (home ? working.find((m) => idOf(m.org) === home) : void 0) ?? working[0] ?? list.find(isLiveMembership) ?? list[0] ?? null;
+}
+function memberListSiteScope(memberships, org) {
+  const inOrg = (memberships ?? []).filter((m) => idOf(m.org) === idOf(org));
+  const here = inOrg.filter((m) => m.type !== "resident");
+  if (!inOrg.length)
+    return null;
+  if (here.some((m) => !idOf(m.siteId) || m.orgLevelRole))
+    return null;
+  return [...new Set(here.map((m) => idOf(m.siteId)))];
+}
+
 // src/repositories/member.repo.ts
 import {
   AppError as AppError2,
@@ -3332,10 +3380,10 @@ import { ObjectId as ObjectId13 } from "mongodb";
 function crossSiteRoleMode() {
   return (process.env.CROSS_SITE_ROLE_MODE ?? "").trim().toLowerCase() === "enforce" ? "enforce" : "log";
 }
-var idOf = (value) => value === null || value === void 0 ? "" : String(value?.toString?.() ?? value);
+var idOf2 = (value) => value === null || value === void 0 ? "" : String(value?.toString?.() ?? value);
 function isCrossSiteRole(role, memberSite) {
-  const roleSite = idOf(role?.site);
-  return !!roleSite && roleSite !== idOf(memberSite);
+  const roleSite = idOf2(role?.site);
+  return !!roleSite && roleSite !== idOf2(memberSite);
 }
 var THROTTLE_MS = 10 * 60 * 1e3;
 var lastLogged = /* @__PURE__ */ new Map();
@@ -3344,7 +3392,7 @@ function crossSiteRoleGrants(input) {
     return true;
   const mode = crossSiteRoleMode();
   const granted = mode !== "enforce";
-  const key = [mode, idOf(input.member) || idOf(input.user), idOf(input.role?._id), input.where].join("|");
+  const key = [mode, idOf2(input.member) || idOf2(input.user), idOf2(input.role?._id), input.where].join("|");
   const now = Date.now();
   if ((lastLogged.get(key) ?? 0) + THROTTLE_MS <= now) {
     lastLogged.set(key, now);
@@ -3352,7 +3400,7 @@ function crossSiteRoleGrants(input) {
       lastLogged.clear();
     logger7.log({
       level: "warn",
-      message: `cross-site-role mode=${mode} ${granted ? "granted" : "refused"} where=${input.where} member=${idOf(input.member) || "-"} user=${idOf(input.user) || "-"} site=${idOf(input.memberSite) || "-"} role=${idOf(input.role?._id) || "-"} roleSite=${idOf(input.role?.site)}`
+      message: `cross-site-role mode=${mode} ${granted ? "granted" : "refused"} where=${input.where} member=${idOf2(input.member) || "-"} user=${idOf2(input.user) || "-"} site=${idOf2(input.memberSite) || "-"} role=${idOf2(input.role?._id) || "-"} roleSite=${idOf2(input.role?.site)}`
     });
   }
   return granted;
@@ -3363,7 +3411,7 @@ function crossSiteRoleRefusal(roleName, roleSiteName) {
   return `${role} belongs to ${site}. Choose a role for this site, or an org-wide role.`;
 }
 async function requireRoleFitsSite(roleId, siteId) {
-  const id = idOf(roleId);
+  const id = idOf2(roleId);
   if (!id || !ObjectId13.isValid(id))
     return;
   const db2 = useAtlas7.getDb();
@@ -3372,7 +3420,7 @@ async function requireRoleFitsSite(roleId, siteId) {
   const role = await db2.collection("roles").findOne({ _id: new ObjectId13(id) }, { projection: { name: 1, site: 1 } });
   if (!isCrossSiteRole(role, siteId))
     return;
-  const site = ObjectId13.isValid(idOf(role?.site)) ? await db2.collection("sites").findOne({ _id: new ObjectId13(idOf(role?.site)) }, { projection: { name: 1 } }) : null;
+  const site = ObjectId13.isValid(idOf2(role?.site)) ? await db2.collection("sites").findOne({ _id: new ObjectId13(idOf2(role?.site)) }, { projection: { name: 1 } }) : null;
   throw new BadRequestError13(crossSiteRoleRefusal(role?.name, site?.name));
 }
 async function otherSiteRoleClauses(roles, org) {
@@ -3380,7 +3428,7 @@ async function otherSiteRoleClauses(roles, org) {
     { ...org ? { org } : { org: { $nin: ["", null] } }, site: { $nin: ["", null] }, status: "active" },
     { projection: { site: 1, org: 1 } }
   ).toArray();
-  const both3 = (v) => ObjectId13.isValid(idOf(v)) ? [new ObjectId13(idOf(v)), idOf(v)] : [v];
+  const both3 = (v) => ObjectId13.isValid(idOf2(v)) ? [new ObjectId13(idOf2(v)), idOf2(v)] : [v];
   const clauses = (list ?? []).map((r) => ({
     role: r._id,
     org: { $in: both3(r.org) },
@@ -3563,9 +3611,12 @@ function useMemberRepo() {
     } catch (error) {
       throw new BadRequestError14("Invalid user ID format.");
     }
+    const account = await db2?.collection("users").findOne({ _id: user }, { projection: { defaultOrg: 1 } }).catch(() => null);
+    const defaultOrg = String(account?.defaultOrg ?? "");
     const cacheKey = makeCacheKey5(namespace_collection3, {
       user: user.toString(),
-      type
+      type,
+      defaultOrg
     });
     const cachedData = await getCache(cacheKey);
     if (cachedData) {
@@ -3573,7 +3624,10 @@ function useMemberRepo() {
       return cachedData;
     }
     try {
-      const data = await collection.findOne({ user, type: appTypeQuery(type) });
+      const data = preferWorkingMembership(
+        await collection.find({ user, type: appTypeQuery(type) }).toArray(),
+        defaultOrg
+      );
       if (!data) {
         throw new NotFoundError5("Member not found.");
       }
@@ -4036,7 +4090,12 @@ function useMemberRepo() {
     const query2 = {
       user,
       org: { $nin: [null, ""] },
-      type: appTypeQuery(type)
+      type: appTypeQuery(type),
+      // The organisation switcher. A membership that was taken away (Repair
+      // sets it inactive, removal deletes it) must not keep the organisation
+      // on the person's list: latitude.sec@ still saw JLL Singapore beside its
+      // own company after the repair (owner report 2026-09-30).
+      status: { $nin: TAKEN_AWAY_MEMBER_STATUSES }
     };
     const cacheOptions = {
       page: page2,
@@ -8745,7 +8804,7 @@ async function resolveInviteActor(userId) {
   const db2 = useAtlas17.getDb();
   if (!db2)
     return { ...EMPTY, id };
-  const members = await db2.collection("members").find({ user: new ObjectId26(id), status: { $ne: "deleted" } }).toArray();
+  const members = await db2.collection("members").find({ user: new ObjectId26(id), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).toArray();
   const adminMember = members.find((m) => m.type === "admin");
   let isSuperAdmin2 = false;
   let staffPermissions;
@@ -9052,7 +9111,7 @@ async function holdsRole(userId, roleId, orgId) {
   const member = await db2.collection("members").findOne({
     user: new ObjectId26(id),
     role: new ObjectId26(role),
-    status: { $ne: "deleted" },
+    status: { $nin: TAKEN_AWAY_MEMBER_STATUSES },
     // both shapes, as `hasOrgInvitation` does for `metadata.org`
     ...org ? { org: { $in: [new ObjectId26(org), org] } } : {}
   });
@@ -10541,7 +10600,7 @@ function enforcedModuleList(stored, save) {
     return NO_LIST;
   return { list, since: typeof save?.createdAt === "string" ? save.createdAt : "" };
 }
-var idOf2 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
+var idOf3 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 function deniedForMembership({
   membership,
   org,
@@ -10549,12 +10608,12 @@ function deniedForMembership({
   site,
   siteSave
 }) {
-  const memberOrg = idOf2(membership?.org);
+  const memberOrg = idOf3(membership?.org);
   if (!membership || membership.type === "resident" || !memberOrg) {
     return { denied: [], since: "" };
   }
   const orgTier = enforcedModuleList(org?.modules, orgSave);
-  const siteTier = site && idOf2(site.orgId) === memberOrg ? enforcedModuleList(site.metadata?.modules, siteSave) : NO_LIST;
+  const siteTier = site && idOf3(site.orgId) === memberOrg ? enforcedModuleList(site.metadata?.modules, siteSave) : NO_LIST;
   const denied = deniedModules(orgTier.list, siteTier.list);
   if (!denied.length)
     return { denied: [], since: "" };
@@ -11128,46 +11187,6 @@ function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
   return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
 }
 
-// src/utils/member-lookup.util.ts
-var idOf3 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
-function isLiveMembership(m) {
-  return m.status !== "deleted" && !m.deletedAt;
-}
-function pickSiteMembership(rows, type, site, org = "") {
-  site = site.toLowerCase();
-  org = org.toLowerCase();
-  if (!site)
-    return null;
-  const live2 = rows.filter(
-    (m) => sameAppType(m.type, type) && isLiveMembership(m) && (!org || idOf3(m.org) === org)
-  );
-  const atSite = live2.find((m) => idOf3(m.siteId) === site);
-  if (atSite)
-    return atSite;
-  if (!org)
-    return null;
-  return live2.find((m) => !idOf3(m.siteId)) ?? live2[0] ?? null;
-}
-function pickLookupMembership(rows, type, site = "", org = "") {
-  const list = Array.isArray(rows) ? rows : [];
-  const atSite = site ? pickSiteMembership(list, type, site, org) : null;
-  if (atSite)
-    return atSite;
-  const inOrg = org ? list.find((m) => sameAppType(m.type, type) && idOf3(m.org) === org.toLowerCase()) : void 0;
-  if (inOrg && isLiveMembership(inOrg))
-    return inOrg;
-  return list.find((m) => sameAppType(m.type, type)) ?? null;
-}
-function memberListSiteScope(memberships, org) {
-  const inOrg = (memberships ?? []).filter((m) => idOf3(m.org) === idOf3(org));
-  const here = inOrg.filter((m) => m.type !== "resident");
-  if (!inOrg.length)
-    return null;
-  if (here.some((m) => !idOf3(m.siteId) || m.orgLevelRole))
-    return null;
-  return [...new Set(here.map((m) => idOf3(m.siteId)))];
-}
-
 // src/services/module-gate.service.ts
 var idOf4 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 var isId = (v) => /^[0-9a-f]{24}$/i.test(v);
@@ -22224,7 +22243,7 @@ function useCameraViewService() {
     }
   }
   async function resolveSiteAccess(params) {
-    const memberships = await params.db.collection("members").find({ user: new ObjectId52(params.userId), status: { $ne: "deleted" } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
+    const memberships = await params.db.collection("members").find({ user: new ObjectId52(params.userId), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
     const memberOrgIds = [
       ...new Map(
         memberships.filter((membership) => membership.org).map((membership) => [String(membership.org), membership.org])
@@ -24560,7 +24579,7 @@ function useServiceProviderInviteService() {
       );
     }
     const existing = await getByCreatorAndNature(actor.id, nature).catch(() => null);
-    if (existing) {
+    if (existing && String(existing.invitedFrom ?? "") !== String(invite._id)) {
       throw new BadRequestError47(
         `You already have a ${serviceTypeLabel(nature)} company on iService365 (${existing.name}). Accept the invitation from that company instead.`
       );
@@ -24591,12 +24610,21 @@ function useServiceProviderInviteService() {
     country
   }) {
     const inviteeId = String(user?._id ?? "");
-    const name = sanitizeCompanyName(companyName) || sanitizeCompanyName(invite.metadata?.name) || sanitizeCompanyName(user?.name);
+    let name = sanitizeCompanyName(companyName) || sanitizeCompanyName(invite.metadata?.name) || sanitizeCompanyName(user?.name);
     if (!name)
       throw new BadRequestError47("Enter your company's name.");
     const email = String(invite.email ?? "").trim().toLowerCase();
     const actor = { id: inviteeId };
-    const orgId = String(
+    const db2 = useAtlas38.getDb();
+    const actorIds = [actor.id, ...ObjectId56.isValid(actor.id) ? [new ObjectId56(actor.id)] : []];
+    const made = db2 ? await db2.collection("organizations").findOne({
+      invitedFrom: { $in: [String(invite._id), invite._id] },
+      createdBy: { $in: actorIds },
+      status: { $ne: "deleted" }
+    }) : null;
+    if (made)
+      name = String(made.name ?? name);
+    const orgId = made ? String(made._id) : String(
       await addOrg({
         name,
         type: nature,
@@ -24608,8 +24636,17 @@ function useServiceProviderInviteService() {
         invitedFrom: String(invite._id)
       })
     );
-    const roles = await seedDefaultOrgRoles(useRoleRepo().addRole, orgId, nature);
     const appType = serviceAppType(nature);
+    const owners = made && db2 ? await db2.collection("roles").find({
+      org: { $in: [new ObjectId56(orgId), orgId] },
+      name: "owner",
+      status: { $ne: "deleted" }
+    }).toArray() : [];
+    const ownerRole = (type) => {
+      const r = owners.find((x) => x.type === type);
+      return r ? { id: String(r._id), type, name: "owner" } : null;
+    };
+    const roles = ownerRole("organization") && ownerRole(appType) ? [ownerRole("organization"), ownerRole(appType)] : await seedDefaultOrgRoles(useRoleRepo().addRole, orgId, nature);
     const orgOwner = roles.find((r) => r.type === "organization" && r.name === "owner");
     const appOwner = roles.find((r) => r.type === appType && r.name === "owner");
     if (!orgOwner || !appOwner) {
@@ -24632,8 +24669,18 @@ function useServiceProviderInviteService() {
       siteName: "",
       onboardingRequired: false
     };
-    await addMember({ ...base, role: orgOwner.id, type: "organization" });
-    await addMember({ ...base, role: appOwner.id, type: appType });
+    const hasOwnerRow = async (type) => !!made && !!await db2?.collection("members").findOne({
+      user: { $in: actorIds },
+      org: { $in: [new ObjectId56(orgId), orgId] },
+      type,
+      status: "active"
+    });
+    if (!await hasOwnerRow("organization")) {
+      await addMember({ ...base, role: orgOwner.id, type: "organization" });
+    }
+    if (!await hasOwnerRow(appType)) {
+      await addMember({ ...base, role: appOwner.id, type: appType });
+    }
     await useUserRepo().updateUserFieldById({ _id: actor.id, field: "defaultOrg", value: orgId }).catch(() => void 0);
     logger36.log({
       level: "info",
@@ -24689,10 +24736,60 @@ function useServiceProviderInviteService() {
     const last = [...history].reverse().find((e) => ["wrong-join-repaired", "wrong-join-undone"].includes(e?.action));
     return last?.action === "wrong-join-repaired" ? last : null;
   }
+  async function leftoverRoles(invite, senderOrg, user) {
+    const db2 = useAtlas38.getDb();
+    if (!db2 || !user?._id || !ObjectId56.isValid(senderOrg))
+      return [];
+    const since = new Date(String(invite.createdAt ?? 0)).getTime();
+    const rows = await db2.collection("members").find({
+      user: { $in: [user._id, String(user._id)] },
+      org: { $in: [new ObjectId56(senderOrg), senderOrg] }
+    }).project({ role: 1 }).toArray();
+    const roleIds = [
+      ...new Set(
+        rows.map((m) => m.role?.toString?.() ?? "").filter((r) => ObjectId56.isValid(r))
+      )
+    ].map((r) => new ObjectId56(r));
+    if (!roleIds.length)
+      return [];
+    const roles = await db2.collection("roles").find({
+      _id: { $in: roleIds },
+      org: { $in: [new ObjectId56(senderOrg), senderOrg] },
+      status: { $ne: "deleted" }
+    }).project({ name: 1, permissions: 1, createdAt: 1 }).toArray();
+    const out = [];
+    for (const role of roles) {
+      if (!(Array.isArray(role.permissions) && role.permissions.includes("*")))
+        continue;
+      if (role.createdAt && Number.isFinite(since) && new Date(role.createdAt).getTime() < since)
+        continue;
+      const inUse = await db2.collection("members").countDocuments({
+        role: { $in: [role._id, role._id.toString()] },
+        status: "active"
+      });
+      if (inUse)
+        continue;
+      out.push({ _id: role._id.toString(), name: String(role.name ?? "") });
+    }
+    return out;
+  }
+  async function setRoleStatus(ids2, status) {
+    const db2 = useAtlas38.getDb();
+    const valid = ids2.filter((r) => ObjectId56.isValid(r)).map((r) => new ObjectId56(r));
+    if (!db2 || !valid.length)
+      return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await db2.collection("roles").updateMany(
+      { _id: { $in: valid } },
+      { $set: { status, deletedAt: status === "deleted" ? now : "", updatedAt: now } }
+    );
+    await useCache21("roles").delNamespace().catch(() => void 0);
+  }
   async function wrongJoinPreview({ id, userId }) {
     const { invite, senderOrg, user } = await wrongJoinContext(id, userId);
     const org = await getOrgById(senderOrg).catch(() => null);
     const memberships = await wrongJoinRows(invite, senderOrg, user);
+    const roles = await leftoverRoles(invite, senderOrg, user);
     const repaired = lastRepair(invite);
     return {
       invitationId: id,
@@ -24701,6 +24798,8 @@ function useServiceProviderInviteService() {
       senderOrgId: senderOrg,
       senderOrgName: String(org?.name ?? ""),
       memberships,
+      // Left in the sender's role list by the old sign-up; Repair retires them.
+      leftoverRoles: roles,
       defaultOrgIsSender: String(user?.defaultOrg ?? "") === senderOrg,
       repaired: repaired ? { at: repaired.at, by: repaired.byName, memberIds: repaired.memberIds ?? [] } : null
     };
@@ -24709,15 +24808,17 @@ function useServiceProviderInviteService() {
     const { actor, invite, senderOrg, user } = await wrongJoinContext(id, userId);
     const rows = await wrongJoinRows(invite, senderOrg, user);
     const defaultOrgIsSender = !!user?._id && String(user?.defaultOrg ?? "") === senderOrg;
-    if (!rows.length && !defaultOrgIsSender) {
+    const { updateMemberStatus } = useMemberRepo();
+    for (const row of rows)
+      await updateMemberStatus(row._id, { status: "inactive" });
+    const roles = await leftoverRoles(invite, senderOrg, user);
+    if (!rows.length && !defaultOrgIsSender && !roles.length) {
       return {
         message: "Nothing to repair: this account is not in the sender's organisation.",
         changed: 0
       };
     }
-    const { updateMemberStatus } = useMemberRepo();
-    for (const row of rows)
-      await updateMemberStatus(row._id, { status: "inactive" });
+    await setRoleStatus(roles.map((r) => r._id), "deleted");
     if (defaultOrgIsSender)
       await setDefaultOrg(String(user._id), "");
     await _transition({
@@ -24726,6 +24827,7 @@ function useServiceProviderInviteService() {
       event: {
         ...event("wrong-join-repaired", actor),
         memberIds: rows.map((row) => row._id),
+        roleIds: roles.map((r) => r._id),
         ...defaultOrgIsSender ? { defaultOrgWas: senderOrg } : {}
       }
     });
@@ -24734,8 +24836,8 @@ function useServiceProviderInviteService() {
       message: `[sp-invite] wrong-join repaired invite=${id} memberships=${rows.length} by=${actor.id}`
     });
     return {
-      message: `Repaired: ${rows.length} membership${rows.length === 1 ? "" : "s"} in the sender's organisation set inactive. Undo is available.`,
-      changed: rows.length
+      message: `Repaired: ${rows.length} membership${rows.length === 1 ? "" : "s"} in the sender's organisation set inactive` + (roles.length ? `, ${roles.length} unused full-access role${roles.length === 1 ? "" : "s"} removed from its role list` : "") + ". Undo is available.",
+      changed: rows.length + roles.length
     };
   }
   async function undoWrongJoin({ id, userId }) {
@@ -24747,6 +24849,7 @@ function useServiceProviderInviteService() {
     const ids2 = (repaired.memberIds ?? []).filter((m) => ObjectId56.isValid(m));
     for (const m of ids2)
       await updateMemberStatus(m, { status: "active" }).catch(() => 0);
+    await setRoleStatus(repaired.roleIds ?? [], "active");
     const { user } = await wrongJoinContext(id, userId);
     if (repaired.defaultOrgWas && user?._id && !String(user.defaultOrg ?? "")) {
       await setDefaultOrg(String(user._id), String(repaired.defaultOrgWas));