@7365admin1/core 3.139.0 → 3.139.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.139.0",
+  "version": "3.139.1",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/service-provider-invite-email-new-company.e2e.test.mjs

@@ -574,6 +574,24 @@ describe("SP invitation: email status, Super Admin alert, new company typed by s
     assert.deepEqual(sites.body.items.map((x) => String(x.site)), [site.toString()]);
   });
 
+  it("E1b. SECURITY: an inactive (repaired) membership reaches NOTHING in the sender - no members, roles, sites", async () => {
+    const { sid, orgId } = await latitudeShape("latitude-reach@e2e.example.com");
+    const jll = id.pmOrg.toString();
+    for (const path of [
+      `/members?org=${jll}&type=property_management_agency&status=active&limit=5`,
+      `/members?org=${jll}&type=organization&status=active&limit=5`,
+      `/roles?org=${jll}&limit=5`,
+      `/sites?org=${jll}&limit=5`,
+      `/customer-sites?org=${jll}&status=active&limit=5`,
+    ]) {
+      const res = await h.api(path, { sid });
+      assert.ok([401, 403].includes(res.status), `${path} -> ${res.status} ${JSON.stringify(res.body).slice(0, 200)}`);
+    }
+    // its own company still works
+    const own = await h.api(`/members?org=${orgId}&type=organization&status=active&limit=5`, { sid });
+    assert.equal(own.status, 200, JSON.stringify(own.body));
+  });
+
   it("E2. Repair on an already-repaired account retires the leftover full-access role only while nobody uses it; Undo restores it", async () => {
     const { inviteId, spRole, user } = await latitudeShape("latitude-role@e2e.example.com");
     const preview = await h.api(`/service-provider-invitations/${inviteId}/wrong-join`, { sid: adminSid });