@7365admin1/core 3.42.0 → 3.42.2

package/test/e2e/service-provider-invite.e2e.test.mjs

@@ -0,0 +1,471 @@
+// End-to-end proof that a property manager can invite a service provider that
+// already has an account, over real HTTP, against a throwaway database.
+//
+// This is the case reported from production: the provider already worked on
+// another site, the browser guessed "new company", the API trusted that guess,
+// and the invitation dead-ended on "User already exists".
+//
+// Every request below goes through the real Express stack: the real
+// `requireAuth` middleware, the real controllers, the real services and
+// repositories, against an in-process MongoDB replica set. Sessions are
+// obtained by logging in through POST /auth like any client. No credential
+// belonging to a real person is used, and the mailer is pointed at a loopback
+// sink, so no mail can leave the machine.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PM_PASSWORD = "Pm-Passw0rd!";
+const SP_PASSWORD = "Sp-Passw0rd!";
+const OUTSIDER_PASSWORD = "Out-Passw0rd!";
+const NEWCO_PASSWORD = "New-Passw0rd!";
+
+const PROVIDER_EMAIL = "provider@e2e.example.com";
+const NEWCO_EMAIL = "newco@e2e.example.com";
+
+describe("service-provider invite, end to end", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const said = {}; // the exact wording the API gave back, reported at the end
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  let pmSid;
+  let providerSid;
+  let inviteId; // the invitation for the new site
+
+  it("a. inviting an existing provider takes the existing-account path, not sign-up", async () => {
+    pmSid = await h.login("pm@e2e.example.com", PM_PASSWORD);
+
+    const before = h.mails.length;
+
+    const res = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: pmSid,
+      body: {
+        email: PROVIDER_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteA.toString(),
+        siteName: "Aurora Residences",
+        // The browser's guess, and it is wrong: this provider does have an
+        // account. The server must ignore it and decide on the facts.
+        inviteType: "organization-invite",
+        app: "security",
+      },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.match(JSON.stringify(res.body), /Successfully invited service provider/);
+    assert.doesNotMatch(JSON.stringify(res.body), /User already exists/i);
+
+    const invite = await h.db
+      .collection("verifications")
+      .findOne({ email: PROVIDER_EMAIL, "metadata.siteId": id.siteA });
+
+    assert.ok(invite, "an invitation was written");
+    assert.equal(
+      invite.type,
+      "service-provider-create-org",
+      "existing provider must get the sign-in invitation type, not the sign-up one",
+    );
+    inviteId = invite._id.toString();
+
+    // and the email that would have gone out
+    const mail = await h.mailAt(before);
+    assert.ok(mail, "an invitation email was produced");
+    assert.match(mail.to, new RegExp(PROVIDER_EMAIL));
+    assert.equal(mail.subject, "Service Provider Organization Invite");
+    assert.match(mail.body, new RegExp(`/verify/service-provider-invite/${inviteId}`));
+  });
+
+  it("b. the provider signs in and accepts the invitation", async () => {
+    providerSid = await h.login(PROVIDER_EMAIL, SP_PASSWORD);
+
+    const res = await h.api(`/customer-sites/invite/${inviteId}`, {
+      method: "POST",
+      sid: providerSid,
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    said.accepted = res.body;
+    assert.match(String(res.body), /successfully added site/i);
+  });
+
+  it("c. exactly one engagement row exists, and accepting again does not add a second", async () => {
+    const query = {
+      org: id.providerOrg,
+      siteOrg: id.pmOrg,
+      site: id.siteA,
+      status: "active",
+    };
+
+    assert.equal(await h.db.collection("customer.sites").countDocuments(query), 1);
+
+    const again = await h.api(`/customer-sites/invite/${inviteId}`, {
+      method: "POST",
+      sid: providerSid,
+    });
+
+    said.acceptedTwice = again.body;
+    assert.equal(await h.db.collection("customer.sites").countDocuments(query), 1);
+  });
+
+  it("d. the invitation is marked complete", async () => {
+    const invite = await h.db
+      .collection("verifications")
+      .findOne({ _id: new ObjectId(inviteId) });
+
+    assert.equal(invite.status, "complete");
+  });
+
+  it("e. the new site appears in the provider's own site list", async () => {
+    const res = await h.api(
+      `/customer-sites?org=${id.providerOrg.toString()}&status=active&page=1&limit=20`,
+      { sid: providerSid },
+    );
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const names = JSON.stringify(res.body);
+    assert.match(names, /Aurora Residences/, "the newly accepted site is listed");
+    assert.match(names, /Beacon Court/, "the site they already worked on is still listed");
+  });
+
+  it("f. inviting the same provider to the same site again is refused, in plain words", async () => {
+    const res = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: pmSid,
+      body: {
+        email: PROVIDER_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteA.toString(),
+        siteName: "Aurora Residences",
+        inviteType: "create-org",
+        app: "security",
+      },
+    });
+
+    assert.equal(res.status, 400);
+    said.alreadyOnSite = res.body.message;
+    assert.doesNotMatch(said.alreadyOnSite, /User already exists/i);
+    assert.equal(
+      said.alreadyOnSite,
+      "This service provider is already working on this site. There is nothing to accept — you can find them under Service Providers.",
+    );
+
+    assert.equal(
+      await h.db.collection("customer.sites").countDocuments({
+        org: id.providerOrg,
+        site: id.siteA,
+        status: "active",
+      }),
+      1,
+      "a refused invitation writes no engagement",
+    );
+  });
+
+  it("g. inviting while an invitation is already pending is refused, in plain words", async () => {
+    const first = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: pmSid,
+      body: {
+        email: PROVIDER_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteC.toString(),
+        siteName: "Cedar Park",
+        inviteType: "organization-invite",
+        app: "security",
+      },
+    });
+    assert.equal(first.status, 200, JSON.stringify(first.body));
+
+    const second = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: pmSid,
+      body: {
+        email: PROVIDER_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteC.toString(),
+        siteName: "Cedar Park",
+        inviteType: "organization-invite",
+        app: "security",
+      },
+    });
+
+    assert.equal(second.status, 400);
+    said.alreadyPending = second.body.message;
+    assert.doesNotMatch(said.alreadyPending, /User already exists/i);
+    assert.equal(
+      said.alreadyPending,
+      "An invitation to this site is already waiting for this email address. Cancel the pending invitation first if you want to send a new one.",
+    );
+
+    assert.equal(
+      await h.db.collection("verifications").countDocuments({
+        email: PROVIDER_EMAIL,
+        "metadata.siteId": id.siteC,
+        status: "pending",
+      }),
+      1,
+      "no duplicate pending invitation",
+    );
+  });
+
+  it("h. regression: a brand-new email still completes the original sign-up path", async () => {
+    const before = h.mails.length;
+
+    const invite = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: pmSid,
+      body: {
+        email: NEWCO_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteA.toString(),
+        siteName: "Aurora Residences",
+        inviteType: "create-org", // the browser's guess is wrong the other way round
+        app: "security",
+      },
+    });
+    assert.equal(invite.status, 200, JSON.stringify(invite.body));
+
+    const written = await h.db
+      .collection("verifications")
+      .findOne({ email: NEWCO_EMAIL, "metadata.siteId": id.siteA });
+    assert.equal(
+      written.type,
+      "service-provider-invite",
+      "an unknown email must still be sent to sign-up",
+    );
+    assert.equal((await h.mailAt(before)).subject, "Service Provider Invite");
+
+    // ... and the sign-up itself still works, OTP and all.
+    const signUpMailIndex = h.mails.length;
+    const signUp = await h.api("/auth/v2/sign-up", {
+      method: "POST",
+      body: {
+        email: NEWCO_EMAIL,
+        password: NEWCO_PASSWORD,
+        country: "SGP",
+        orgName: "Newco Cleaning",
+      },
+    });
+    assert.equal(signUp.status, 200, JSON.stringify(signUp.body));
+
+    const otpMail = await h.mailAt(signUpMailIndex);
+    assert.equal(otpMail.subject, "Sign Up Verification");
+    // the lookbehind skips six-digit hex colours in the template's styling
+    const code = otpMail.body.match(/(?<![#\w])(\d{6})(?!\w)/)?.[1];
+    assert.ok(code, "a six-digit code was emailed");
+
+    const verified = await h.api(`/auth/v2/verify/${code}`);
+    assert.equal(verified.status, 200, JSON.stringify(verified.body));
+
+    const created = await h.api(`/users/v2/invite/${verified.body._id}`, {
+      method: "POST",
+      body: { name: "Newco Cleaning", password: NEWCO_PASSWORD, type: "user-sign-up" },
+    });
+    assert.equal(created.status, 201, JSON.stringify(created.body));
+    assert.doesNotMatch(JSON.stringify(created.body), /User already exists/i);
+
+    // the account is real: it can sign in
+    const sid = await h.login(NEWCO_EMAIL, NEWCO_PASSWORD);
+    assert.ok(sid);
+  });
+
+  it("i. authorisation: the fix did not widen access", async () => {
+    // i.1 — the invite endpoint still requires a session.
+    const anonymous = await h.api("/service-providers/invite", {
+      method: "POST",
+      body: {
+        email: PROVIDER_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteD.toString(),
+        siteName: "Dover Mews",
+        inviteType: "organization-invite",
+        app: "security",
+      },
+    });
+    assert.equal(anonymous.status, 401, "no session, no invite");
+
+    // i.2 — a signed-in user from an unrelated organisation.
+    //
+    // KNOWN GAP, pre-dating this change and untouched by it: the endpoint
+    // authenticates the caller but never checks that the caller belongs to the
+    // organisation named in the payload. It is asserted here so the hole is
+    // visible in a test rather than only in a note, and so this test fails
+    // loudly on the day someone closes it — at which point flip the
+    // expectation to 401/403.
+    const outsiderSid = await h.login("outsider@e2e.example.com", OUTSIDER_PASSWORD);
+    const crossOrg = await h.api("/service-providers/invite", {
+      method: "POST",
+      sid: outsiderSid,
+      body: {
+        email: PROVIDER_EMAIL,
+        orgId: id.pmOrg.toString(),
+        siteId: id.siteD.toString(),
+        siteName: "Dover Mews",
+        inviteType: "organization-invite",
+        app: "security",
+      },
+    });
+    said.crossOrgInvite = `${crossOrg.status} ${JSON.stringify(crossOrg.body)}`;
+    assert.equal(
+      crossOrg.status,
+      200,
+      "unchanged by this fix: the endpoint does not scope the invite to the caller's organisation",
+    );
+
+    // i.3 — accepting. POST /customer-sites/invite/:id is unauthenticated as
+    // shipped (also pre-existing, also flagged). What matters for "did the fix
+    // widen access" is what accepting can reach: the engagement is derived from
+    // the invitation, so it lands on the invited provider only. An outsider
+    // cannot use somebody else's invitation to put their OWN organisation on
+    // the site.
+    const pendingC = await h.db.collection("verifications").findOne({
+      email: PROVIDER_EMAIL,
+      "metadata.siteId": id.siteC,
+      status: "pending",
+    });
+
+    const accepted = await h.api(`/customer-sites/invite/${pendingC._id.toString()}`, {
+      method: "POST",
+      sid: outsiderSid,
+    });
+    said.crossOrgAccept = `${accepted.status} ${JSON.stringify(accepted.body)}`;
+    assert.equal(accepted.status, 201);
+
+    assert.equal(
+      await h.db.collection("customer.sites").countDocuments({
+        org: id.outsiderOrg,
+      }),
+      0,
+      "accepting somebody else's invitation gives the caller's organisation nothing",
+    );
+    assert.equal(
+      await h.db.collection("customer.sites").countDocuments({
+        org: id.providerOrg,
+        site: id.siteC,
+        status: "active",
+      }),
+      1,
+      "the engagement lands on the invited provider, exactly once",
+    );
+
+    // and the outsider's own site was never reachable by the provider
+    assert.equal(
+      await h.db.collection("customer.sites").countDocuments({ site: id.siteE }),
+      0,
+    );
+  });
+
+  it("reports the exact wording the API returned", () => {
+    console.log("\n--- verbatim API messages ---");
+    for (const [k, v] of Object.entries(said)) console.log(`${k}: ${v}`);
+    console.log("-----------------------------\n");
+  });
+});
+
+/* ------------------------------------------------------------------- seed */
+
+async function seed(h) {
+  const now = new Date().toISOString();
+
+  const pmOrg = new ObjectId();
+  const providerOrg = new ObjectId();
+  const outsiderOrg = new ObjectId();
+  const siteA = new ObjectId(); // the new site the provider is invited to
+  const siteB = new ObjectId(); // the site the provider already works on
+  const siteC = new ObjectId(); // used for the "already pending" case
+  const siteD = new ObjectId(); // used for the authorisation case
+  const siteE = new ObjectId(); // belongs to the unrelated organisation
+
+  await h.db.collection("organizations").insertMany([
+    {
+      _id: pmOrg,
+      name: "Northwind Property Management",
+      email: "pm-org@e2e.example.com",
+      type: "property-management",
+      status: "active",
+      createdAt: now,
+    },
+    {
+      _id: providerOrg,
+      name: "Sentry Security Services",
+      email: PROVIDER_EMAIL,
+      type: "security_agency",
+      status: "active",
+      createdAt: now,
+    },
+    {
+      _id: outsiderOrg,
+      name: "Vega Facilities",
+      email: "outsider@e2e.example.com",
+      type: "property-management",
+      status: "active",
+      createdAt: now,
+    },
+  ]);
+
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "Aurora Residences", org: pmOrg.toString(), status: "active", createdAt: now },
+    { _id: siteB, name: "Beacon Court", org: pmOrg.toString(), status: "active", createdAt: now },
+    { _id: siteC, name: "Cedar Park", org: pmOrg.toString(), status: "active", createdAt: now },
+    { _id: siteD, name: "Dover Mews", org: pmOrg.toString(), status: "active", createdAt: now },
+    { _id: siteE, name: "Vega Tower", org: outsiderOrg.toString(), status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("users").insertMany([
+    {
+      email: "pm@e2e.example.com",
+      password: await h.hashPassword(PM_PASSWORD),
+      name: "Pat Manager",
+      status: "active",
+      defaultOrg: pmOrg.toString(),
+      createdAt: now,
+    },
+    {
+      email: PROVIDER_EMAIL,
+      password: await h.hashPassword(SP_PASSWORD),
+      name: "Sam Provider",
+      status: "active",
+      defaultOrg: providerOrg.toString(),
+      createdAt: now,
+    },
+    {
+      email: "outsider@e2e.example.com",
+      password: await h.hashPassword(OUTSIDER_PASSWORD),
+      name: "Olive Outsider",
+      status: "active",
+      defaultOrg: outsiderOrg.toString(),
+      createdAt: now,
+    },
+  ]);
+
+  // the provider is already engaged — on a DIFFERENT site. This is the case
+  // that used to fail.
+  await h.db.collection("customer.sites").insertOne({
+    name: "Beacon Court",
+    site: siteB,
+    siteOrg: pmOrg,
+    siteOrgName: "Northwind Property Management",
+    org: providerOrg,
+    status: "active",
+    createdAt: new Date(),
+    updatedAt: "",
+    deletedAt: "",
+  });
+
+  return { pmOrg, providerOrg, outsiderOrg, siteA, siteB, siteC, siteD, siteE };
+}

package/test/service-provider-invite.test.mjs

@@ -0,0 +1,198 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import {
+  decideServiceProviderInvite,
+  SERVICE_PROVIDER_SIGN_IN_TYPE,
+  SERVICE_PROVIDER_SIGN_UP_TYPE,
+} from "./.build/utils/service-provider-invite.util.mjs";
+
+/**
+ * Inviting a service provider to a site.
+ *
+ * The DECISION (sign-up or sign-in, or refuse with something the property
+ * manager can act on) is pure and is tested directly. The WIRING — that both
+ * invite endpoints ask this decision instead of branching on the inviting
+ * organisation, and that accepting an invitation writes the engagement once and
+ * closes the invitation — is asserted against the service source, because
+ * constructing those services needs a live Atlas connection.
+ *
+ * Nothing here opens a connection, sends an email, or writes anything.
+ */
+
+const src = (p) =>
+  readFileSync(
+    fileURLToPath(new URL(`../src/${p}`, import.meta.url)),
+    "utf8",
+  );
+
+const facts = (over = {}) => ({
+  hasUser: false,
+  hasProviderOrg: false,
+  engagedOnSite: false,
+  invitePending: false,
+  ...over,
+});
+
+test("a brand new company is sent to sign-up, exactly as before", () => {
+  const d = decideServiceProviderInvite(facts());
+
+  assert.equal(d.ok, true);
+  assert.equal(d.type, SERVICE_PROVIDER_SIGN_UP_TYPE);
+  assert.equal(d.existingProvider, false);
+});
+
+test("the case Harris hit: the email already has an account and an organisation", () => {
+  // security@… already exists, so sign-up would die on "User already exists".
+  const d = decideServiceProviderInvite(
+    facts({ hasUser: true, hasProviderOrg: true }),
+  );
+
+  assert.equal(d.ok, true);
+  assert.equal(d.type, SERVICE_PROVIDER_SIGN_IN_TYPE);
+  assert.equal(d.existingProvider, true);
+});
+
+test("a provider engaged on another site is invited to a second site", () => {
+  // The common case in this product: same company, different property manager,
+  // different site. Still sign-in, still additive.
+  const d = decideServiceProviderInvite(
+    facts({ hasUser: true, hasProviderOrg: true, engagedOnSite: false }),
+  );
+
+  assert.equal(d.ok, true);
+  assert.equal(d.type, SERVICE_PROVIDER_SIGN_IN_TYPE);
+});
+
+test("already working on THIS site is refused, with a reason", () => {
+  const d = decideServiceProviderInvite(
+    facts({ hasUser: true, hasProviderOrg: true, engagedOnSite: true }),
+  );
+
+  assert.equal(d.ok, false);
+  assert.match(d.reason, /already working on this site/i);
+});
+
+test("an invitation already waiting is refused before a second one is sent", () => {
+  const d = decideServiceProviderInvite(
+    facts({ hasUser: true, hasProviderOrg: true, invitePending: true }),
+  );
+
+  assert.equal(d.ok, false);
+  assert.match(d.reason, /already waiting/i);
+});
+
+test("an engagement that already exists outranks a pending invitation", () => {
+  const d = decideServiceProviderInvite(
+    facts({ hasProviderOrg: true, engagedOnSite: true, invitePending: true }),
+  );
+
+  assert.equal(d.ok, false);
+  assert.match(d.reason, /already working on this site/i);
+});
+
+test("an account with no organisation gets a next step, not a dead end", () => {
+  const d = decideServiceProviderInvite(facts({ hasUser: true }));
+
+  assert.equal(d.ok, false);
+  assert.match(d.reason, /no service provider organisation/i);
+  assert.match(d.reason, /create their organisation first/i);
+});
+
+test("a pending invitation blocks a duplicate even for a brand new email", () => {
+  const d = decideServiceProviderInvite(facts({ invitePending: true }));
+
+  assert.equal(d.ok, false);
+  assert.match(d.reason, /already waiting/i);
+});
+
+test("every refusal says what to do next, and none of them mention a type name", () => {
+  const refusals = [
+    facts({ hasUser: true }),
+    facts({ invitePending: true }),
+    facts({ hasProviderOrg: true, engagedOnSite: true }),
+  ].map((f) => decideServiceProviderInvite(f));
+
+  for (const r of refusals) {
+    assert.equal(r.ok, false);
+    assert.ok(r.reason.length > 40, "a refusal has to explain itself");
+    assert.doesNotMatch(r.reason, /service-provider-(invite|create-org)/);
+  }
+});
+
+// ---------------------------------------------------------------- wiring ----
+
+test("both invite endpoints ask for the decision", () => {
+  for (const file of [
+    "services/verification.service.ts",
+    "services/verification-v2.service.ts",
+  ]) {
+    const text = src(file);
+
+    assert.match(
+      text,
+      /decideServiceProviderInvite\(/,
+      `${file} must decide server-side`,
+    );
+    assert.match(
+      text,
+      /if \(!decision\.ok\) \{\s*throw new BadRequestError\(decision\.reason\)/,
+      `${file} must refuse with the decision's own reason`,
+    );
+  }
+});
+
+test("the browser's inviteType no longer picks the path", () => {
+  const text = src("services/verification.service.ts");
+
+  assert.doesNotMatch(
+    text,
+    /if \(inviteType === "organization-invite"\)/,
+    "the client-supplied inviteType must not steer the invite any more",
+  );
+});
+
+test("v2 no longer branches on the INVITING organisation", () => {
+  const text = src("services/verification-v2.service.ts");
+  const body = text.slice(text.indexOf("async function createServiceProviderInvite"));
+
+  assert.doesNotMatch(
+    body.slice(0, 3000),
+    /if \(org\) \{\s*value\.type/,
+    "the inviting org always exists, so that branch always chose sign-up",
+  );
+});
+
+test("the invitation link points at a page that exists", () => {
+  for (const file of [
+    "services/verification.service.ts",
+    "services/verification-v2.service.ts",
+  ]) {
+    const text = src(file);
+
+    assert.match(
+      text,
+      /verify\/service-provider-invite\/\$\{res\}/,
+      `${file} must link to the landing page, not /verify/<type>/<id>`,
+    );
+  }
+});
+
+test("accepting an invitation writes the engagement once and closes the invite", () => {
+  const text = src("services/customer-site.service.ts");
+  const body = text.slice(text.indexOf("async function addViaInvite"));
+
+  assert.match(body, /_countActiveByOrgAndSite\(/, "must check for a duplicate");
+  assert.match(
+    body,
+    /_updateVerificationStatusById\(\s*invite,\s*"complete"/,
+    "must not leave the row Pending after acceptance",
+  );
+  assert.match(
+    body,
+    /verification\.status !== "pending"/,
+    "must refuse an invitation that is spent, expired or cancelled",
+  );
+});