@7365admin1/core 3.138.0 → 3.139.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.138.0",
+  "version": "3.139.1",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/service-provider-invite-email-new-company.e2e.test.mjs

@@ -354,12 +354,15 @@ describe("SP invitation: email status, Super Admin alert, new company typed by s
 
     const repaired = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
     assert.equal(repaired.status, 200, JSON.stringify(repaired.body));
-    assert.equal(repaired.body.changed, 2);
+    // 2 memberships + the unused "Admin Service Provider" role left in JLL's role list
+    assert.equal(repaired.body.changed, 3);
     assert.equal(await h.db.collection("members").countDocuments({ user: user._id, status: "active" }), 0);
+    assert.equal((await h.db.collection("roles").findOne({ _id: spRole })).status, "deleted");
 
     const undone = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/undo`, { method: "PUT", sid: adminSid });
     assert.equal(undone.status, 200, JSON.stringify(undone.body));
     assert.equal(await h.db.collection("members").countDocuments({ user: user._id, status: "active" }), 2);
+    assert.equal((await h.db.collection("roles").findOne({ _id: spRole })).status, "active", "undo restores the role");
 
     await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
     const again = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: adminSid });
@@ -523,6 +526,125 @@ describe("SP invitation: email status, Super Admin alert, new company typed by s
     assert.ok(await h.db.collection("customer.sites").findOne({ org: org._id, site, status: "active" }));
     assert.equal((await h.db.collection("verifications").findOne({ _id: new ObjectId(inviteId) })).status, "complete");
   });
+
+  // ------------------- E. "two organisations" after Finish setup (2026-09-30)
+
+  // latitude.sec@ on production after Repair + Finish setup: two INACTIVE
+  // JLL memberships (older) + the unused "*" role the old sign-up left in JLL,
+  // and its own Henderson Security company with org-level owner rows (no site)
+  // engaged at Latitude through customer.sites.
+  async function latitudeShape(email) {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const inviteId = await invite(email, "security_agency", site);
+    await approve(inviteId);
+    const sid = await newAccount(email);
+    const user = await h.db.collection("users").findOne({ email });
+    const spRole = new ObjectId();
+    await h.db.collection("roles").insertOne({ _id: spRole, name: "Admin Service Provider", type: "security_agency", org: id.pmOrg.toString(), site: site.toString(), permissions: ["*"], status: "active", createdAt: new Date(Date.now() + 500).toISOString() });
+    const later = new Date(Date.now() + 1000);
+    await h.db.collection("members").insertMany([
+      { user: user._id, org: id.pmOrg, role: spRole, type: "organization", siteId: site, siteName: "Latitude", status: "active", createdAt: later },
+      { user: user._id, org: id.pmOrg, role: spRole, type: "security_agency", siteId: site, siteName: "Latitude", status: "active", createdAt: later },
+    ]);
+    await h.db.collection("users").updateOne({ _id: user._id }, { $set: { defaultOrg: id.pmOrg.toString() } });
+    // the 30 Sep Repair as it ran then: memberships only (the role stayed)
+    await h.db.collection("members").updateMany({ user: user._id, org: id.pmOrg }, { $set: { status: "inactive" } });
+    await h.db.collection("users").updateOne({ _id: user._id }, { $unset: { defaultOrg: "" } });
+    const applied = await h.api(`/service-provider-invitations/${inviteId}/finish-setup`, { method: "PUT", sid: adminSid, body: { companyName: "Henderson Security Services Pte Ltd" } });
+    assert.equal(applied.status, 200, JSON.stringify(applied.body));
+    return { site, inviteId, sid, user, spRole, orgId: applied.body.orgId };
+  }
+
+  it("E1. every app finds the account's OWN company: membership lookup, organisation switcher, sites", async () => {
+    const { site, sid, user, orgId } = await latitudeShape("latitude-shape@e2e.example.com");
+    for (const app of ["organization", "security_agency"]) {
+      const m = await h.api(`/members/user/${user._id}/app/${app}`, { sid });
+      assert.equal(m.status, 200, JSON.stringify(m.body));
+      assert.equal(String(m.body.org), orgId, `${app}: Henderson, not the inactive JLL row`);
+      assert.equal(m.body.status, "active");
+      assert.ok(!m.body.siteId, "org-level owner row: no site of its own");
+    }
+    const orgs = await h.api(`/organizations/user/${user._id}?type=organization&limit=50`, { sid });
+    assert.equal(orgs.status, 200, JSON.stringify(orgs.body));
+    assert.deepEqual(orgs.body.items.map((o) => String(o.value)), [orgId], "one organisation, not JLL beside it");
+    // the security app's (and the mobile apps') site list: the engaged site
+    const sites = await h.api(`/customer-sites?org=${orgId}&status=active&limit=50`, { sid });
+    assert.equal(sites.status, 200, JSON.stringify(sites.body));
+    assert.deepEqual(sites.body.items.map((x) => String(x.site)), [site.toString()]);
+  });
+
+  it("E1b. SECURITY: an inactive (repaired) membership reaches NOTHING in the sender - no members, roles, sites", async () => {
+    const { sid, orgId } = await latitudeShape("latitude-reach@e2e.example.com");
+    const jll = id.pmOrg.toString();
+    for (const path of [
+      `/members?org=${jll}&type=property_management_agency&status=active&limit=5`,
+      `/members?org=${jll}&type=organization&status=active&limit=5`,
+      `/roles?org=${jll}&limit=5`,
+      `/sites?org=${jll}&limit=5`,
+      `/customer-sites?org=${jll}&status=active&limit=5`,
+    ]) {
+      const res = await h.api(path, { sid });
+      assert.ok([401, 403].includes(res.status), `${path} -> ${res.status} ${JSON.stringify(res.body).slice(0, 200)}`);
+    }
+    // its own company still works
+    const own = await h.api(`/members?org=${orgId}&type=organization&status=active&limit=5`, { sid });
+    assert.equal(own.status, 200, JSON.stringify(own.body));
+  });
+
+  it("E2. Repair on an already-repaired account retires the leftover full-access role only while nobody uses it; Undo restores it", async () => {
+    const { inviteId, spRole, user } = await latitudeShape("latitude-role@e2e.example.com");
+    const preview = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: adminSid });
+    assert.equal(preview.status, 200, JSON.stringify(preview.body));
+    assert.equal(preview.body.memberships.length, 0);
+    assert.deepEqual(preview.body.leftoverRoles.map((r) => r.name), ["Admin Service Provider"]);
+
+    // someone at JLL was since given that role -> it is JLL's now, never touched
+    const other = await h.db.collection("members").insertOne({ user: new ObjectId(), org: id.pmOrg, role: spRole, type: "security_agency", status: "active", createdAt: new Date() });
+    const kept = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
+    assert.equal(kept.body.changed, 0, JSON.stringify(kept.body));
+    assert.equal((await h.db.collection("roles").findOne({ _id: spRole })).status, "active");
+    await h.db.collection("members").deleteOne({ _id: other.insertedId });
+
+    const repaired = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/repair`, { method: "PUT", sid: adminSid });
+    assert.equal(repaired.status, 200, JSON.stringify(repaired.body));
+    assert.equal(repaired.body.changed, 1);
+    assert.equal((await h.db.collection("roles").findOne({ _id: spRole })).status, "deleted");
+    // Henderson is untouched
+    assert.equal(await h.db.collection("members").countDocuments({ user: user._id, status: "active" }), 2);
+
+    const undone = await h.api(`/service-provider-invitations/${inviteId}/wrong-join/undo`, { method: "PUT", sid: adminSid });
+    assert.equal(undone.status, 200, JSON.stringify(undone.body));
+    assert.equal((await h.db.collection("roles").findOne({ _id: spRole })).status, "active");
+    // Undo of a role-only repair re-activates no membership
+    assert.equal(await h.db.collection("members").countDocuments({ user: user._id, org: id.pmOrg, status: "active" }), 0);
+  });
+
+  it("E3. accept-new-company is idempotent per invitation: a retry after a half-finished attempt reuses the company; a second click is refused; one company", async () => {
+    const site = new ObjectId();
+    await h.db.collection("sites").insertOne({ _id: site, name: "Latitude", orgId: id.pmOrg, status: "active" });
+    const email = "double-click@e2e.example.com";
+    const inviteId = await invite(email, "security_agency", site);
+    await approve(inviteId);
+    const sid = await newAccount(email);
+    const user = await h.db.collection("users").findOne({ email });
+    // the first attempt died after creating the organisation (no roles, no members, invite still pending)
+    const half = new ObjectId();
+    await h.db.collection("organizations").insertOne({ _id: half, name: "Henderson Security Services Pte Ltd", type: "security_agency", nature: "security_agency", email, createdBy: user._id, invitedFrom: inviteId, status: "active", createdAt: new Date().toISOString() });
+
+    const retry = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, { method: "PUT", sid, body: { companyName: "Henderson Security Services Pte Ltd" } });
+    assert.equal(retry.status, 200, JSON.stringify(retry.body));
+    assert.equal(retry.body.orgId, half.toString(), "the half-made company, not a second one");
+    assert.equal(await h.db.collection("organizations").countDocuments({ invitedFrom: inviteId }), 1);
+    const owners = await h.db.collection("members").find({ user: user._id, org: half, status: "active" }).toArray();
+    assert.deepEqual(owners.map((m) => m.type).sort(), ["organization", "security_agency"]);
+    assert.ok(await h.db.collection("customer.sites").findOne({ org: half, site, status: "active" }));
+
+    const again = await h.api(`/service-provider-invitations/${inviteId}/accept-new-company`, { method: "PUT", sid, body: { companyName: "Henderson Security Services Pte Ltd" } });
+    assert.equal(again.status, 400, JSON.stringify(again.body));
+    assert.equal(await h.db.collection("organizations").countDocuments({ createdBy: { $in: [user._id, user._id.toString()] } }), 1);
+    assert.equal(await h.db.collection("members").countDocuments({ user: user._id, org: half }), 2, "no duplicate owner rows");
+  });
 });
 
 async function seed(h) {

package/test/member-working-membership.test.mjs

@@ -0,0 +1,28 @@
+// latitude.sec@ (2026-09-30): an INACTIVE membership in another organisation
+// (the sender, after Repair) must never be the app's membership over the
+// person's live one. See preferWorkingMembership in member-lookup.util.ts.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { preferWorkingMembership, pickLookupMembership } from "./.build/utils/member-lookup.util.mjs";
+
+const jll = { org: "jll", type: "organization", status: "inactive", siteId: "latitude" };
+const hen = { org: "hen", type: "organization", status: "active", siteId: "" };
+const other = { org: "oth", type: "organization", status: "active" };
+
+test("a working row beats an older inactive one", () => {
+  assert.equal(preferWorkingMembership([jll, hen]), hen);
+});
+test("the default organisation wins among working rows", () => {
+  assert.equal(preferWorkingMembership([jll, other, hen], "HEN"), hen);
+  assert.equal(preferWorkingMembership([jll, other, hen]), other);
+});
+test("no working row: the old answer (never not-found), deleted last", () => {
+  const sus = { org: "a", status: "suspended" };
+  const del = { org: "b", status: "deleted" };
+  assert.equal(preferWorkingMembership([del, sus]), sus);
+  assert.equal(preferWorkingMembership([del]), del);
+  assert.equal(preferWorkingMembership([]), null);
+});
+test("the lookup used by the module gate follows the same rule", () => {
+  assert.equal(pickLookupMembership([jll, hen], "organization"), hen);
+});