@7365admin1/core 3.142.0 → 3.143.0

package/dist/index.mjs

@@ -4818,6 +4818,100 @@ import { ObjectId as ObjectId17 } from "mongodb";
 // src/utils/super-admin.util.ts
 import { useAtlas as useAtlas10 } from "@7365admin1/node-server-utils";
 import { ObjectId as ObjectId16 } from "mongodb";
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name2) => `${name2}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name2) => consoleSpellings(resource, name2).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+var CROSS_CLIENT_GRANT = {
+  resource: "organizations"
+};
+function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
+  if (!actor.isSuperAdmin)
+    return false;
+  return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
+}
+
+// src/utils/super-admin.util.ts
 var LIVE_ROLE = { status: { $ne: "deleted" } };
 async function resolveStaffRole(userId) {
   const id = userId?.toString() ?? "";
@@ -4857,6 +4951,13 @@ async function isSuperAdmin(userId) {
 async function isPlatformOwner(userId) {
   return (await resolveStaffRole(userId))?.default === true;
 }
+async function staffReachesEveryClient(userId) {
+  const role = await resolveStaffRole(userId);
+  if (!role)
+    return false;
+  return consoleRoleAllows(role.permissions, "organizations");
+}
+var STAFF_CLIENT_PERMISSIONS = Object.freeze(["*"]);
 
 // src/utils/org-suspension.util.ts
 var ORG_SUSPENDED_MESSAGE = "Your organisation's access is currently suspended. Please contact your administrator.";
@@ -11218,98 +11319,6 @@ async function recordConsoleAction(entry) {
   }
 }
 
-// src/utils/console-permission.util.ts
-var CONSOLE_PERMISSIONS = Object.freeze({
-  organizations: Object.freeze([
-    "see-all-organizations",
-    "see-organization-details"
-  ]),
-  "promo-codes": Object.freeze([
-    "create-promo-code",
-    "see-promo-code-details",
-    "edit-promo-code-details",
-    "change-promo-code-status",
-    "delete-promo-code"
-  ]),
-  users: Object.freeze(["see-all-users", "see-user-details"]),
-  invitations: Object.freeze([
-    "create-invitation",
-    "view-invitations",
-    "cancel-invitation"
-  ]),
-  subscriptions: Object.freeze([
-    "see-all-subscriptions",
-    "see-subscription-details",
-    "manage-subscription"
-  ]),
-  "sp-approvals": Object.freeze([
-    "see-all-sp-approvals",
-    "approve-sp",
-    "reject-sp",
-    "delete-sp-approval"
-  ]),
-  "marketplace-vendors": Object.freeze([
-    "see-all-marketplace-vendors",
-    "see-marketplace-vendor-details"
-  ]),
-  "platform-terms": Object.freeze([
-    "see-platform-terms",
-    "edit-platform-terms"
-  ]),
-  "activity-history": Object.freeze(["see-activity-history"]),
-  members: Object.freeze([
-    "view-members",
-    "assign-member-role",
-    "suspend-member",
-    "activate-member",
-    "delete-member"
-  ]),
-  "roles-and-permissions": Object.freeze([
-    "add-role",
-    "see-all-roles",
-    "see-role-details",
-    "update-role",
-    "delete-role"
-  ])
-});
-var RESOURCE_SPELLINGS = Object.freeze({
-  "roles-and-permissions": Object.freeze([
-    "roles-and-permissions",
-    "roles"
-  ]),
-  roles: Object.freeze(["roles", "roles-and-permissions"])
-});
-function consoleSpellings(resource, action) {
-  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
-  return resources.map((name2) => `${name2}:${action}`);
-}
-function consoleRoleAllowsAll(held) {
-  if (!Array.isArray(held) || held.length === 0)
-    return true;
-  return held.includes("*");
-}
-function consoleRoleAllows(held, resource, action) {
-  if (consoleRoleAllowsAll(held))
-    return true;
-  const actions = CONSOLE_PERMISSIONS[resource];
-  if (!actions?.length)
-    return false;
-  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
-  return wanted.some(
-    (name2) => consoleSpellings(resource, name2).some(
-      (spelling) => held.includes(spelling)
-    )
-  );
-}
-var CROSS_CLIENT_GRANT = {
-  resource: "organizations"
-};
-function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
-  if (!actor.isSuperAdmin)
-    return false;
-  return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
-}
-
 // src/services/module-gate.service.ts
 var idOf4 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 var isId = (v) => /^[0-9a-f]{24}$/i.test(v);
@@ -22270,6 +22279,9 @@ async function getUserPermissions(params) {
   if (!db3) {
     return [];
   }
+  if (await staffReachesEveryClient(user)) {
+    return [...STAFF_CLIENT_PERMISSIONS];
+  }
   let roleId = grantingRole;
   let memberSite = params.memberSite;
   let memberId;
@@ -22410,6 +22422,12 @@ function useCameraViewService() {
       engagedOrgs,
       prefer: params.prefer
     });
+    if (!grant && await staffReachesEveryClient(params.userId)) {
+      return {
+        memberships,
+        grant: { org: params.site?.orgId ?? params.site?.org, siteId: params.siteObjectId }
+      };
+    }
     return { memberships, grant };
   }
   async function permissionsForGrant(userId, grant, memberships) {
@@ -25259,7 +25277,7 @@ function useServiceProviderInviteService() {
     const runs = ObjectId57.isValid(id) && actor.memberships.some(
       (m) => m.org === id && (m.companyWideRole === true || !m.siteId && m.orgLevelRole === true)
     );
-    if (!runs) {
+    if (!runs && !staffMayBypass(actor)) {
       throw new UnauthorizedError4(
         "Only an administrator of that company can answer this invitation for it."
       );
@@ -109809,6 +109827,7 @@ export {
   SERVICE_TYPE_LABELS,
   SITE_STATES_MAX,
   SOFTWARE_VERSION_ENDPOINT,
+  STAFF_CLIENT_PERMISSIONS,
   STAFF_VIEW_APPS,
   STAFF_VIEW_HISTORY_ACTIONS,
   SUBCONTRACT_ADMIN_REFUSAL,
@@ -110424,6 +110443,7 @@ export {
   snapshotRefusalReason,
   splitRobotSn,
   staffMayBypass,
+  staffReachesEveryClient,
   staffViewWriteAudit,
   startDemoTracking,
   startPadbotDrive,