@7365admin1/core 3.142.0 → 3.143.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.142.0",
+  "version": "3.143.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/staff-access.e2e.test.mjs

@@ -164,6 +164,19 @@ describe("Seven365 staff access", { concurrency: 1 }, () => {
     assert.equal((await audit("staff-view.write")).length, before);
   });
 
+  record("9b. inside a client, staff reach its cameras and vehicles like its owner; an outsider still cannot", async () => {
+    // Owner 2026-10-01 "no missed out": the camera wall (entitleSite) and every
+    // getUserPermissions(org) check (cameras, ANPR, vehicles) honour staff.
+    const { getSiteWall } = h.core.useCameraViewService();
+    const wall = await getSiteWall({ siteId: id.ownSite.toString(), userId: id.staff.toString() });
+    assert.ok(wall, "staff got the wall");
+    await assert.rejects(
+      getSiteWall({ siteId: id.ownSite.toString(), userId: id.otherOwner.toString() }),
+      /not found/i,
+      "another client's owner is still refused",
+    );
+  });
+
   record("10. support@ preview lists every membership, named, with the cross-client site", async () => {
     const res = await h.api(`${B}/memberships?email=${SUPPORT}`, { sid: staffSid });
     assert.equal(res.status, 200, JSON.stringify(res.body));
@@ -264,5 +277,5 @@ async function seed(h) {
     { _id: supportClientMember, user: support, org: agency, siteId: strangerSite, siteName: "Stranger Condo", role: agencyRole, type: "security_agency", status: "active", createdBy: staff, createdAt: now },
   ]);
 
-  return { client, agency, ownSite, servedSite, strangerSite, staff, supportClientMember, supportStaffMember };
+  return { client, agency, ownSite, servedSite, strangerSite, staff, otherOwner: other, supportClientMember, supportStaffMember };
 }

package/test/staff-camera-status.test.mjs

@@ -111,14 +111,13 @@ test("add and delete gained nothing - staff still cannot create or destroy a cam
   }
 });
 
-test("staff have NOT gained a cross-organisation camera list", () => {
-  // The whole reason the bypass is in the controller: entitleSite is the
-  // tenant boundary for every camera READ, and it is untouched.
-  assert.equal(
-    /isSuperAdmin|super-admin\.util/.test(CAMERA_SERVICE),
-    false,
-    "entitleSite/authorizeSite now knows about staff - reads are widened",
-  );
+test("staff reach a client's cameras ONLY through the explicit staff rule (Open as staff, 2026-10-01)", () => {
+  // Owner decision 2026-10-01 ("no missed out"): Seven365 staff working inside
+  // a client see and set up its cameras like the owner. The only door is
+  // `staffReachesEveryClient` (live staff membership + cross-client tick), taken
+  // when no membership grants the site - never a bare isSuperAdmin.
+  assert.equal(/isSuperAdmin/.test(CAMERA_SERVICE), false, "a bare isSuperAdmin bypass appeared");
+  assert.match(CAMERA_SERVICE, /if \(!grant && \(await staffReachesEveryClient\(params\.userId\)\)\)/);
   const list = handler("getAll");
   assert.match(list, /entitleSite\(\{ siteId: site, userId: callerId\(req\) \}\)/);
   assert.equal(/staffStatusChange|isSuperAdmin/.test(list), false);