@7365admin1/core 3.32.2-staging.68 → 3.32.2-staging.69

package/.changeset/camera-engagement-site-scope.md

@@ -0,0 +1,15 @@
+---
+"@7365admin1/core": patch
+---
+
+Camera entitlement: an engagement grants a site only to an org-level membership, and permissions resolve against the granting role
+
+Two follow-ups to the camera entitlement change:
+
+- the engagement branch of `cameraGrant` ignored `members.siteId`, so a member
+  pinned to one site could reach every site their organisation is engaged at.
+  It now requires an org-level membership, matching the owning-org branch above
+  it: a membership pinned to a site never grants a different site.
+- `getUserPermissions` accepts the granting membership's `role`, so a caller
+  holding several memberships in one organisation is no longer resolved by
+  whichever member document Mongo returns first.

package/dist/index.d.ts

@@ -2658,6 +2658,12 @@ declare function hasAnyPermission(permissions: unknown, allowed: Array<string>):
 type CameraMembership = {
     siteId?: unknown;
     org?: unknown;
+    /**
+     * The role this membership carries. Returned with the grant so permissions
+     * are read off the role that actually granted access — see
+     * `permissionsForGrant` in the service.
+     */
+    role?: unknown;
 };
 /**
  * WHICH membership lets this caller reach this site, or `null` for none.
@@ -2669,12 +2675,35 @@ type CameraMembership = {
  * 2. **A membership at the site's OWNING organisation, with no site on it** —
  *    an org-wide role. 90 rows, 56 people, are recorded this way.
  * 3. **An engagement** — an ACTIVE `customer.sites` row saying one of the
- *    caller's organisations is contracted to serve this site. This is how the
- *    product routes a security agency to a property manager's site, and it is
- *    the list the web apps' own site switcher is built from
- *    (`useCustomerSite().getAll()` in the Security app's layout). Nothing in the
- *    camera path read it before, so a guard whose agency is engaged at a site
- *    was refused a camera the switcher had just offered them.
+ *    caller's organisations is contracted to serve this site, AND a membership
+ *    that is not pinned to some other site. This is how the product routes a
+ *    security agency to a property manager's site, and it is the list the web
+ *    apps' own site switcher is built from (`useCustomerSite().getAll()` in the
+ *    Security app's layout). Nothing in the camera path read it before, so a
+ *    guard whose agency is engaged at a site was refused a camera the switcher
+ *    had just offered them.
+ *
+ * ## Why the engagement branch requires an ORG-LEVEL membership
+ *
+ * **Product decision, owner, 2026-08-10, settled:** an agency engaged at several
+ * sites gives its staff access to **the site each person is assigned to, and no
+ * other**. It matches how the rest of the product is described — modules are set
+ * up per site.
+ *
+ * So `!idOf(membership.siteId)` is required here exactly as branch 2 requires
+ * it. Before, this branch matched on organisation alone, which made a person
+ * pinned to site X reach every site their agency serves — while somebody pinned
+ * to site X of the site's OWNING organisation could not reach its other sites.
+ * The two branches now say the same thing: **a membership pinned to a site never
+ * grants a different site**, and a membership with no site is an org-wide role
+ * within whichever organisation holds it.
+ *
+ * Measured on staging before the change: this removes 68 (user, camera-site)
+ * grants, all of them cross-organisation engagements held by a membership pinned
+ * elsewhere; every one of those 68 belongs to somebody whose organisation is
+ * engaged at the site they ARE pinned to, so nobody is left without their own
+ * site. 0 grants through branch 2 are affected — **estate-side org-level access
+ * is a different path and is untouched.**
  *
  * The membership is RETURNED, not just a yes/no, because the caller's
  * permissions must then be resolved against the organisation that actually

package/dist/index.js

@@ -27401,6 +27401,7 @@ var import_mongodb49 = require("mongodb");
 async function getUserPermissions(params) {
   const user = params.user?.toString();
   const org = params.org?.toString();
+  const grantingRole = params.role?.toString();
   if (!user || !import_mongodb49.ObjectId.isValid(user)) {
     return [];
   }
@@ -27408,19 +27409,23 @@ async function getUserPermissions(params) {
   if (!db) {
     return [];
   }
-  const memberQuery = {
-    user: new import_mongodb49.ObjectId(user),
-    status: { $ne: "deleted" }
-  };
-  if (org && import_mongodb49.ObjectId.isValid(org)) {
-    memberQuery.org = new import_mongodb49.ObjectId(org);
-  }
-  const member = await db.collection("members").findOne(memberQuery);
-  if (!member?.role || !import_mongodb49.ObjectId.isValid(member.role)) {
-    return [];
+  let roleId = grantingRole;
+  if (!roleId || !import_mongodb49.ObjectId.isValid(roleId)) {
+    const memberQuery = {
+      user: new import_mongodb49.ObjectId(user),
+      status: { $ne: "deleted" }
+    };
+    if (org && import_mongodb49.ObjectId.isValid(org)) {
+      memberQuery.org = new import_mongodb49.ObjectId(org);
+    }
+    const member = await db.collection("members").findOne(memberQuery);
+    if (!member?.role || !import_mongodb49.ObjectId.isValid(member.role)) {
+      return [];
+    }
+    roleId = member.role.toString();
   }
   const role = await db.collection("roles").findOne({
-    _id: new import_mongodb49.ObjectId(member.role),
+    _id: new import_mongodb49.ObjectId(roleId),
     status: "active"
   });
   if (!role || !Array.isArray(role.permissions)) {
@@ -32349,7 +32354,7 @@ function cameraGrant(params) {
   if (atOrg)
     return atOrg;
   const engaged = params.engagedOrgs?.size ? params.memberships.find(
-    (membership) => params.engagedOrgs.has(idOf(membership.org))
+    (membership) => !idOf(membership.siteId) && params.engagedOrgs.has(idOf(membership.org))
   ) : void 0;
   return engaged ?? null;
 }
@@ -33691,7 +33696,8 @@ function useCameraViewService() {
   async function permissionsForGrant(userId, grant, memberships) {
     return getUserPermissions({
       user: userId,
-      org: grant?.org ?? memberships[0]?.org
+      org: grant?.org ?? memberships[0]?.org,
+      role: grant?.role
     });
   }
   async function authorizeCamera(params) {