@7365admin1/core 3.42.2 → 3.43.0

package/test/camera-entitlement-wiring.test.mjs

@@ -0,0 +1,134 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * The three entitlement fixes, asserted on the service source.
+ *
+ * The DECISION is pure and is covered in `camera-view.util.test.mjs`
+ * (`cameraGrant` / `isCameraEntitled`). What cannot be covered there is the
+ * WIRING: constructing the service needs a live Atlas connection, so the only
+ * way to prove the service asks the right questions is to assert the source.
+ *
+ * Each of these three has already been shipped wrong once, which is why they
+ * are pinned:
+ *
+ * 1. the site's organisation was read from `site.org`, a field on 0 of 200 site
+ *    documents, so the org-level branch was dead code;
+ * 2. engagements (`customer.sites`) were not consulted at all, so a security
+ *    agency contracted to a site was refused its cameras;
+ * 3. permissions were resolved against `memberships[0]`, an arbitrary row in
+ *    Mongo natural order, rather than the membership that granted access.
+ */
+const source = readFileSync(
+  fileURLToPath(new URL("../src/services/camera-view.service.ts", import.meta.url)),
+  "utf8",
+);
+
+const permissionSource = readFileSync(
+  fileURLToPath(new URL("../src/utils/permission.util.ts", import.meta.url)),
+  "utf8",
+);
+
+test("a site's organisation is read from orgId, the field that exists", () => {
+  assert.match(source, /cameraOrg:\s*params\.site\?\.orgId/);
+  // Both projections must ask for it, or the field arrives undefined and the
+  // org-level branch goes quietly dead again.
+  const projections = source.match(/projection:\s*\{[^}]*\}/g) ?? [];
+  const siteProjections = projections.filter((p) => /\borg\b|\borgId\b/.test(p));
+  assert.ok(siteProjections.length >= 2, "a site projection stopped asking for the org");
+  for (const projection of siteProjections) {
+    assert.match(projection, /orgId:\s*1/);
+  }
+});
+
+test("engagements are consulted, scoped to the site and to the caller's own orgs", () => {
+  const start = source.indexOf("async function resolveSiteAccess(");
+  assert.notEqual(start, -1, "resolveSiteAccess is gone");
+  const body = source.slice(start, source.indexOf("\n  /**", start + 10));
+
+  assert.match(body, /collection\("customer\.sites"\)/);
+  // All three narrowing clauses matter. Dropping the site turns the query into
+  // "every site this org serves"; dropping the org turns it into "every org";
+  // dropping the status admits terminated contracts.
+  assert.match(body, /org:\s*\{\s*\$in:/);
+  assert.match(body, /site:\s*params\.siteObjectId/);
+  assert.match(body, /status:\s*"active"/);
+  // And the engagement query must not be the thing that authorises: it fills a
+  // set that `cameraGrant` then has to match against a real membership.
+  assert.match(body, /engagedOrgs/);
+  assert.match(body, /cameraGrant\(/);
+});
+
+test("permissions resolve against the granting organisation, not an arbitrary one", () => {
+  assert.match(
+    source,
+    /org:\s*\(grant\?\.org\s*\?\?\s*memberships\[0\]\?\.org\)/,
+  );
+  // Nothing else in the file may resolve permissions off memberships[0] alone.
+  const calls = source.match(/getUserPermissions\(\{[\s\S]{0,200}?\}\)/g) ?? [];
+  assert.equal(calls.length, 1, "getUserPermissions is called from more than one place now");
+});
+
+test("permissions resolve against the granting ROLE, not an arbitrary member row", () => {
+  // The org alone is not enough: 39 camera authorisations on staging are made
+  // by somebody holding more than one membership in the granting organisation,
+  // 9 of those across different roles. Passing the org and letting
+  // `getUserPermissions` pick a row leaves the answer to Mongo's natural order.
+  assert.match(source, /role:\s*grant\?\.role/);
+
+  // The memberships query must keep asking for the role, or `grant.role` is
+  // undefined and this silently falls back to the arbitrary pick.
+  const start = source.indexOf("async function resolveSiteAccess(");
+  const body = source.slice(start, source.indexOf("\n  /**", start + 10));
+  assert.match(body, /\.project\(\{[^}]*role:\s*1/);
+});
+
+test("a supplied role skips the arbitrary member pick but still must be active", () => {
+  // The role short-circuit is the whole fix, so it must actually short-circuit:
+  // the members lookup has to sit behind the "no usable role given" branch.
+  const roleGuard = permissionSource.indexOf("if (!roleId || !ObjectId.isValid(roleId))");
+  const memberLookup = permissionSource.indexOf('collection("members")');
+  const roleLookup = permissionSource.indexOf('collection("roles")');
+  assert.ok(roleGuard !== -1, "the supplied-role branch is gone");
+  assert.ok(roleGuard < memberLookup, "the member lookup no longer runs only as a fallback");
+  assert.ok(memberLookup < roleLookup);
+
+  // A soft-deleted or inactive role must still resolve to no permissions, or a
+  // caller could be authorised by a role that has been switched off.
+  assert.match(permissionSource, /_id:\s*new ObjectId\(roleId\),\s*status:\s*"active"/);
+  // An unauthenticated / invalid caller is refused before any read, as before.
+  const userGuard = permissionSource.indexOf("!ObjectId.isValid(user)");
+  assert.ok(userGuard !== -1 && userGuard < memberLookup);
+});
+
+test("a membership pinned to another site does not grant this one", () => {
+  // Defect 1, pinned at the wiring level too: the util enforces it, but the
+  // service must keep handing the util the memberships' `siteId`, or the rule
+  // has nothing to enforce it on.
+  const start = source.indexOf("async function resolveSiteAccess(");
+  const body = source.slice(start, source.indexOf("\n  /**", start + 10));
+  assert.match(body, /\.project\(\{[^}]*siteId:\s*1/);
+});
+
+test("the entitlement check still runs before the permission check", () => {
+  // A permission failure says "you may not"; an entitlement failure says "not
+  // found". Reversing them tells an outsider that a site exists.
+  const start = source.indexOf("async function authorizeSite(");
+  const body = source.slice(start, source.indexOf("\n  /**", start + 10));
+  const entitle = body.indexOf("entitleSite(");
+  const permission = body.indexOf("permissionsForGrant(");
+  assert.ok(entitle !== -1 && permission !== -1);
+  assert.ok(entitle < permission, "the permission check now runs before entitlement");
+});
+
+test("a caller with no session is refused before anything is read", () => {
+  const start = source.indexOf("async function entitleSite(");
+  assert.notEqual(start, -1, "entitleSite is gone");
+  const body = source.slice(start, source.indexOf("\n  /**", start + 10));
+  const unauthorized = body.indexOf("UnauthorizedError");
+  const read = body.indexOf("useAtlas.getDb()");
+  assert.ok(unauthorized !== -1 && read !== -1);
+  assert.ok(unauthorized < read, "the session check moved after the database read");
+});