@7365admin1/core 3.139.0 → 3.140.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/core
 
+## 3.140.0
+
+### Minor Changes
+
+- ff48585: A person's memberships list (`GET /members/users/:id`) leaves out taken-away (inactive / deleted) memberships by default; `?include=removed` returns the history. One shared entitlement test (`isEntitledMembership`, `entitledMemberships`) now also drives the site/org membership lookup, notification categories and role permissions.
+
+## 3.139.1
+
+### Patch Changes
+
+- 45755c1: Security: a membership that was taken away ("inactive" after the service-provider Repair or Finish-setup Undo, or "deleted") no longer grants organisation, site or role reach (resolveInviteActor, camera site entitlement, role-holder check).
+
 ## 3.139.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -1095,7 +1095,9 @@ declare function useMemberService(): {
     updateSiteById: (id: string, siteId: string, siteName: string) => Promise<{
         message: string;
     }>;
-    getAllByUser: (user: string) => Promise<{
+    getAllByUser: (user: string, { includeRemoved }?: {
+        includeRemoved?: boolean | undefined;
+    }) => Promise<{
         items: TMember[];
         total: number;
     }>;

package/dist/index.js

@@ -4374,7 +4374,10 @@ function sameAppType(a, b) {
 // src/utils/member-lookup.util.ts
 var idOf = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 function isLiveMembership(m) {
-  return m.status !== "deleted" && !m.deletedAt;
+  return !TAKEN_AWAY_MEMBER_STATUSES.includes(String(m?.status ?? "")) && !m?.deletedAt;
+}
+function entitledMemberships(rows) {
+  return (Array.isArray(rows) ? rows : []).filter(isLiveMembership);
 }
 function pickSiteMembership(rows, type, site, org = "") {
   site = site.toLowerCase();
@@ -4402,6 +4405,7 @@ function pickLookupMembership(rows, type, site = "", org = "") {
   return preferWorkingMembership(list.filter((m) => sameAppType(m.type, type)));
 }
 var WORKING = /* @__PURE__ */ new Set(["active", "approved"]);
+var TAKEN_AWAY_MEMBER_STATUSES = ["deleted", "inactive"];
 function preferWorkingMembership(rows, defaultOrg = "") {
   const list = Array.isArray(rows) ? rows : [];
   const working = list.filter((m) => WORKING.has(String(m.status ?? "")) && !m.deletedAt);
@@ -5255,7 +5259,7 @@ function useMemberRepo() {
       // sets it inactive, removal deletes it) must not keep the organisation
       // on the person's list: latitude.sec@ still saw JLL Singapore beside its
       // own company after the repair (owner report 2026-09-30).
-      status: { $nin: ["inactive", "deleted"] }
+      status: { $nin: TAKEN_AWAY_MEMBER_STATUSES }
     };
     const cacheOptions = {
       page: page2,
@@ -9905,7 +9909,7 @@ async function resolveInviteActor(userId) {
   const db2 = import_node_server_utils28.useAtlas.getDb();
   if (!db2)
     return { ...EMPTY, id };
-  const members = await db2.collection("members").find({ user: new import_mongodb26.ObjectId(id), status: { $ne: "deleted" } }).toArray();
+  const members = await db2.collection("members").find({ user: new import_mongodb26.ObjectId(id), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).toArray();
   const adminMember = members.find((m) => m.type === "admin");
   let isSuperAdmin2 = false;
   let staffPermissions;
@@ -10212,7 +10216,7 @@ async function holdsRole(userId, roleId, orgId) {
   const member = await db2.collection("members").findOne({
     user: new import_mongodb26.ObjectId(id),
     role: new import_mongodb26.ObjectId(role),
-    status: { $ne: "deleted" },
+    status: { $nin: TAKEN_AWAY_MEMBER_STATUSES },
     // both shapes, as `hasOrgInvitation` does for `metadata.org`
     ...org ? { org: { $in: [new import_mongodb26.ObjectId(org), org] } } : {}
   });
@@ -23153,7 +23157,8 @@ async function getUserPermissions(params) {
   if (!roleId || !import_mongodb51.ObjectId.isValid(roleId)) {
     const memberQuery = {
       user: new import_mongodb51.ObjectId(user),
-      status: { $ne: "deleted" }
+      // A taken-away (inactive) row grants no permissions either.
+      status: { $nin: TAKEN_AWAY_MEMBER_STATUSES }
     };
     if (org && import_mongodb51.ObjectId.isValid(org)) {
       memberQuery.org = new import_mongodb51.ObjectId(org);
@@ -23243,7 +23248,7 @@ function useCameraViewService() {
     }
   }
   async function resolveSiteAccess(params) {
-    const memberships = await params.db.collection("members").find({ user: new import_mongodb52.ObjectId(params.userId), status: { $ne: "deleted" } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
+    const memberships = await params.db.collection("members").find({ user: new import_mongodb52.ObjectId(params.userId), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).project({ siteId: 1, org: 1, role: 1, type: 1 }).toArray();
     const memberOrgIds = [
       ...new Map(
         memberships.filter((membership) => membership.org).map((membership) => [String(membership.org), membership.org])
@@ -29441,9 +29446,10 @@ function useMemberService() {
       throw error;
     }
   }
-  async function getAllByUser(user) {
+  async function getAllByUser(user, { includeRemoved = false } = {}) {
     try {
-      const members = await _getAllByUserId(user);
+      const all = await _getAllByUserId(user);
+      const members = includeRemoved ? all : entitledMemberships(all);
       return {
         items: members,
         total: members.length
@@ -30004,7 +30010,9 @@ function useMemberController() {
       return;
     }
     try {
-      const data = await _getAllByUser(userId);
+      const data = await _getAllByUser(userId, {
+        includeRemoved: req.query.include === "removed"
+      });
       const whole = await requireSelfOrPlatformStaff(req, userId, {
         resource: "members",
         action: "view-members"
@@ -30045,7 +30053,7 @@ function useMemberController() {
         org
       ) : null;
       const inOrg = org && !atSite ? await _getByUserIdTypeOrg(user, type, org).catch(() => null) : null;
-      const liveInOrg = inOrg && inOrg.status !== "deleted" && !inOrg.deletedAt ? inOrg : null;
+      const liveInOrg = inOrg && isLiveMembership(inOrg) ? inOrg : null;
       const data = atSite ?? liveInOrg ?? await _getByUserIdType(user, type);
       res.json(data);
       return;
@@ -108074,7 +108082,7 @@ function useNotificationPreferenceService() {
     const db2 = import_node_server_utils330.useAtlas.getDb();
     if (!db2)
       return [];
-    const members = await db2.collection("members").find({ user: new import_mongodb200.ObjectId(userId), status: { $ne: "deleted" } }).toArray();
+    const members = await db2.collection("members").find({ user: new import_mongodb200.ObjectId(userId), status: { $nin: TAKEN_AWAY_MEMBER_STATUSES } }).toArray();
     if (!members.length)
       return [];
     const isResident = members.some((m) => m.type === "resident");