@7365admin1/core 3.139.0 → 3.140.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.139.0",
+  "version": "3.140.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/service-provider-invite-email-new-company.e2e.test.mjs

@@ -572,6 +572,31 @@ describe("SP invitation: email status, Super Admin alert, new company typed by s
     const sites = await h.api(`/customer-sites?org=${orgId}&status=active&limit=50`, { sid });
     assert.equal(sites.status, 200, JSON.stringify(sites.body));
     assert.deepEqual(sites.body.items.map((x) => String(x.site)), [site.toString()]);
+    // the Account app's "iService365 Services" menu (owner 2026-10-01): Henderson only
+    const services = await h.api(`/members/users/${user._id}`, { sid });
+    assert.equal(services.status, 200, JSON.stringify(services.body));
+    assert.deepEqual([...new Set(services.body.items.map((m) => String(m.org)))], [orgId], "no inactive JLL rows");
+    // the history is still there on request (onboarding resume)
+    const history = await h.api(`/members/users/${user._id}?include=removed`, { sid });
+    assert.ok(history.body.items.some((m) => m.status === "inactive"));
+  });
+
+  it("E1b. SECURITY: an inactive (repaired) membership reaches NOTHING in the sender - no members, roles, sites", async () => {
+    const { sid, orgId } = await latitudeShape("latitude-reach@e2e.example.com");
+    const jll = id.pmOrg.toString();
+    for (const path of [
+      `/members?org=${jll}&type=property_management_agency&status=active&limit=5`,
+      `/members?org=${jll}&type=organization&status=active&limit=5`,
+      `/roles?org=${jll}&limit=5`,
+      `/sites?org=${jll}&limit=5`,
+      `/customer-sites?org=${jll}&status=active&limit=5`,
+    ]) {
+      const res = await h.api(path, { sid });
+      assert.ok([401, 403].includes(res.status), `${path} -> ${res.status} ${JSON.stringify(res.body).slice(0, 200)}`);
+    }
+    // its own company still works
+    const own = await h.api(`/members?org=${orgId}&type=organization&status=active&limit=5`, { sid });
+    assert.equal(own.status, 200, JSON.stringify(own.body));
   });
 
   it("E2. Repair on an already-repaired account retires the leftover full-access role only while nobody uses it; Undo restores it", async () => {

package/test/member-entitled-list.test.mjs

@@ -0,0 +1,60 @@
+/*
+ * ONE "ENTITLED" SOURCE FOR EVERY LIST OF A PERSON'S ORGANISATIONS/SERVICES
+ * (owner 2026-10-01, latitude.sec@): the Account app's "iService365 Services"
+ * menu listed JLL Singapore under Security from two INACTIVE memberships.
+ * A taken-away row (deleted / inactive / soft-deleted) is listed nowhere and
+ * picked nowhere; "suspended" keeps today's behaviour (owner decision pending).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+import {
+  entitledMemberships,
+  isEntitledMembership,
+  pickSiteMembership,
+  TAKEN_AWAY_MEMBER_STATUSES,
+} from "./.build/utils/member-lookup.util.mjs";
+
+const HENDERSON = "a".repeat(24);
+const JLL = "b".repeat(24);
+const LATITUDE = "c".repeat(24);
+
+const rows = [
+  { id: "jll-org", org: JLL, type: "organization", siteId: LATITUDE, status: "inactive" },
+  { id: "jll-sec", org: JLL, type: "security_agency", siteId: LATITUDE, status: "inactive" },
+  { id: "hen-org", org: HENDERSON, type: "organization", siteId: "", status: "active" },
+  { id: "hen-sec", org: HENDERSON, type: "security_agency", siteId: "", status: "active" },
+  { id: "gone", org: JLL, type: "security_agency", status: "deleted" },
+  { id: "soft", org: JLL, type: "security_agency", status: "active", deletedAt: "2026-09-30" },
+];
+
+test("the list keeps only memberships that still grant access", () => {
+  assert.deepEqual(entitledMemberships(rows).map((m) => m.id), ["hen-org", "hen-sec"]);
+  assert.deepEqual(entitledMemberships(null), []);
+});
+
+test("inactive and deleted are taken away; suspended still counts until the owner decides", () => {
+  assert.deepEqual(TAKEN_AWAY_MEMBER_STATUSES, ["deleted", "inactive"]);
+  assert.equal(isEntitledMembership({ status: "inactive" }), false);
+  assert.equal(isEntitledMembership({ status: "suspended" }), true);
+  assert.equal(isEntitledMembership({ status: "active" }), true);
+});
+
+test("an inactive row pinned to the site never wins the site lookup", () => {
+  assert.equal(pickSiteMembership(rows, "security_agency", LATITUDE, JLL), null);
+});
+
+test("GET /members/users/:id filters by default; ?include=removed is the history", () => {
+  const service = readFileSync("src/services/member.service.ts", "utf8");
+  assert.match(service, /includeRemoved \? all : entitledMemberships\(all\)/);
+  const controller = readFileSync("src/controllers/member.controller.ts", "utf8");
+  assert.match(controller, /includeRemoved: req\.query\.include === "removed"/);
+  assert.match(controller, /inOrg && isLiveMembership\(inOrg\) \? inOrg : null/);
+});
+
+test("notification categories and role permissions ignore taken-away rows", () => {
+  for (const file of ["src/services/notification-preference.service.ts", "src/utils/permission.util.ts"]) {
+    assert.match(readFileSync(file, "utf8"), /status: \{ \$nin: TAKEN_AWAY_MEMBER_STATUSES \}/, file);
+  }
+});

package/test/member-lookup-honours-org.test.mjs

@@ -28,9 +28,9 @@ test("the membership in the requested org is looked up first", () => {
   assert.match(BODY, /_getByUserIdTypeOrg\(user, type, org\)\.catch\(\(\) => null\)/);
 });
 
-test("a removed membership in that org never wins", () => {
-  assert.match(BODY, /inOrg\.status !== "deleted"/);
-  assert.match(BODY, /!inOrg\.deletedAt/);
+test("a removed (or taken-away) membership in that org never wins", () => {
+  // isLiveMembership: not deleted / inactive, no deletedAt (member-entitled-list test)
+  assert.match(BODY, /inOrg && isLiveMembership\(inOrg\)/);
 });
 
 test("a miss (or a removed row) falls back to the old lookup instead of failing", () => {

package/test/member-lookup-site.test.mjs

@@ -74,6 +74,7 @@ test("a removed membership never wins; a suspended one is still returned, as bef
   assert.equal(pick([row("gone", { status: "deleted" })]), null);
   assert.equal(pick([row("s", { siteId: SITE, status: "suspended" })]), "s");
   assert.equal(isLiveMembership({ status: "suspended", deletedAt: "" }), true);
+  assert.equal(isLiveMembership({ status: "inactive", deletedAt: "" }), false);
 });
 
 test("another app type is never picked", () => {