@7365admin1/core 3.52.1-staging.232 → 3.52.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @iservice365/core
 
+## 3.52.1
+
+### Patch Changes
+
+- a90696f: Let a client owner save their organisation details during onboarding.
+
+  `PUT /api/organizations/:id` — the write behind step 1 of the onboarding wizard —
+  was gated on `requireOrgAccess` (staff, or a live member of the organisation).
+  The client owner has no `members` row at that point; theirs is created at the
+  last step of the wizard. Every new client therefore got 401 on the first step of
+  onboarding and could not leave it.
+
+  The gate is now `requireOrgReach`: staff, a live member, **or** somebody holding
+  an invitation naming that organisation — the same rule the roles, members and
+  invite endpoints already use for the three pre-membership flows. Nothing is
+  widened: a member of another client, and a caller holding only a password-reset
+  row, are still refused.
+
 ## 3.52.0
 
 ### Minor Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.1-staging.232",
+  "version": "3.52.1",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/harness.mjs

@@ -551,6 +551,14 @@ function buildApp(nsu, core) {
     invitations.put("/:id/decline", requireAuth, decline);
   }
 
+  // mirrors iservice365-API-core/src/routes/verification.route.ts
+  const verifications = express.Router();
+  {
+    const { getVerifications, cancelUserInvitation } = core.useVerificationController();
+    verifications.get("/", requireAuth, getVerifications);
+    verifications.put("/:id/cancel", requireAuth, cancelUserInvitation);
+  }
+
   // mirrors iservice365-API-core/src/routes/customer-site.route.ts
   const customerSites = express.Router();
   {
@@ -1404,6 +1412,7 @@ function buildApp(nsu, core) {
   app.use("/api/users", users);
   app.use("/api/users/v2", usersV2);
   app.use("/api/service-providers", serviceProviders);
+  app.use("/api/verifications", verifications);
   app.use("/api/customer-sites", customerSites);
   app.use("/api/sites", sites);
   app.use("/api/buildings", buildings);

package/test/e2e/onboarding-wizard-walk.e2e.test.mjs

@@ -0,0 +1,370 @@
+// The whole six-step client onboarding wizard, walked over real HTTP, and
+// judged on WHAT ENDED UP IN THE DATABASE.
+//
+// `organization-update-onboarding.e2e.test.mjs` next door proves step 1 can be
+// submitted at all. This walks the rest, because five of the six steps were
+// never checked against the server and two of them were doing the wrong thing:
+//
+//   step 5  "Create Site Admin Role" created an ORGANISATION role - `type:
+//           "organization"`, no site - with props byte-identical to step 2's.
+//           The wizard's gate for it was "any two organisation roles", which
+//           step 2 plus anything already satisfies.
+//   step 6  "Invite Site Admin" invited with no site at all, so the site admin
+//           was never bound to the site the wizard had just created.
+//
+// The web fix (`web-app-org fix/onboarding-wizard-defects`) sends a site-scoped
+// role and a site-bound invitation. This is the other half of that claim: that
+// the SERVER accepts both, stores them, and hands them back in the two reads
+// the wizard uses to recompute its progress - `GET /roles?org=` (does any role
+// carry a site?) and `GET /verifications?type=member-invite` (does any
+// invitation carry a siteId?). Without those two reads answering, the client's
+// progress model would be honest about nothing.
+//
+// Everything here is created and thrown away by the harness: an in-process
+// MongoDB replica set, a loopback Redis, a loopback mail sink. No staging or
+// production database, Redis, mailbox or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OnbWalk-Passw0rd!";
+const OWNER = "ow-owner@e2e.example.com"; // invited into the org, no membership yet
+const ORG_ADMIN = "ow-orgadmin@e2e.example.com"; // step 3 invites this address
+const SITE_ADMIN = "ow-siteadmin@e2e.example.com"; // step 6 invites this address
+
+const NATURE = "property_management_agency";
+
+describe("the six-step onboarding wizard, end to end", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- onboarding wizard walk: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let sid;
+  const created = {};
+
+  record("0. the owner signs in, holding an invitation and no membership", async () => {
+    sid = await h.login(OWNER, PASSWORD);
+
+    const member = await h.db.collection("members").findOne({ user: id.owner });
+    assert.equal(member, null, "the owner has no members row at the start - that is the flow");
+  });
+
+  // ---- step 1 : Set Up Organization ---------------------------------------
+
+  record("1. step 1 saves the organisation details", async () => {
+    const res = await h.api(`/organizations/${id.org}`, {
+      method: "PUT",
+      sid,
+      body: {
+        name: "OW JLL Singapore",
+        type: "org",
+        nature: NATURE,
+        email: "ow-jll@e2e.example.com",
+        contact: "+65 88888888",
+      },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ _id: id.org });
+    assert.equal(org.contact, "+65 88888888");
+  });
+
+  record("1b. and the owner's own membership is written, as the page then does", async () => {
+    // `handleStepSuccess` in `getting-started/index.vue` creates this the moment
+    // step 1 succeeds. Steps 4 onward depend on it: `POST /customer-sites` is
+    // `requireOrgAccess`, i.e. a LIVE MEMBER, not merely an invitation holder.
+    const res = await h.api("/members/direct", {
+      method: "POST",
+      sid,
+      body: {
+        userId: String(id.owner),
+        orgId: String(id.org),
+        roleId: String(id.orgRole),
+        app: "organization",
+        onboardingRequired: true,
+      },
+    });
+
+    assert.ok(res.status < 400, JSON.stringify(res.body));
+
+    const member = await h.db.collection("members").findOne({ user: id.owner });
+    assert.ok(member, "the owner is now a member of their own organisation");
+  });
+
+  // ---- step 2 : Create Organization Admin Role ----------------------------
+
+  record("2. step 2 creates an ORGANISATION role, with no site", async () => {
+    const res = await h.api("/roles", {
+      method: "POST",
+      sid,
+      body: {
+        name: "OW Org Admin",
+        permissions: ["members:see-all-members"],
+        type: "organization",
+        org: String(id.org),
+        site: "",
+        platform: "website",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    // `addRole` returns the inserted id, so `data.role` IS the id.
+    created.orgRole = String(res.body.data.role);
+
+    const role = await h.db.collection("roles").findOne({ _id: new ObjectId(created.orgRole) });
+    assert.equal(role.type, "organization");
+    assert.ok(!role.site, "an organisation role carries no site");
+  });
+
+  // ---- step 3 : Invite Organization Admin ---------------------------------
+
+  record("3. step 3 records an invitation into the organisation", async () => {
+    const res = await h.api("/auth/invite/member", {
+      method: "POST",
+      sid,
+      body: {
+        email: ORG_ADMIN,
+        app: "organization",
+        role: created.orgRole,
+        name: "",
+        org: String(id.org),
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const invite = await h.db
+      .collection("verifications")
+      .findOne({ email: ORG_ADMIN, type: "member-invite" });
+
+    assert.ok(invite, "the invitation is stored");
+    assert.ok(!invite.metadata?.siteId, "an organisation invitation carries no site");
+  });
+
+  // ---- step 4 : Create Your First Site ------------------------------------
+
+  record("4. step 4 creates the site", async () => {
+    const res = await h.api("/customer-sites", {
+      method: "POST",
+      sid,
+      body: {
+        name: "OW Marina One Residences",
+        site: "",
+        siteOrg: String(id.org),
+        siteOrgName: "OW JLL Singapore",
+        org: String(id.org),
+        category: "residential",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const row = await h.db
+      .collection("customer.sites")
+      .findOne({ name: "OW Marina One Residences" });
+
+    assert.ok(row, "a customer-site row exists");
+    assert.ok(row.site, "and it names a site");
+    created.siteId = String(row.site);
+    created.siteName = row.name;
+  });
+
+  // ---- step 5 : Create Site Admin Role. THE DEFECT. -----------------------
+
+  record("5. step 5 creates a role that is SCOPED TO THE SITE", async () => {
+    const res = await h.api("/roles", {
+      method: "POST",
+      sid,
+      body: {
+        name: "OW Site Admin",
+        permissions: ["members:see-all-members"],
+        // what a site-scoped role is everywhere else in the product: the
+        // organisation's line of business, plus the site.
+        type: NATURE,
+        org: String(id.org),
+        site: created.siteId,
+        platform: "website",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    created.siteRole = String(res.body.data.role);
+
+    const role = await h.db.collection("roles").findOne({ _id: new ObjectId(created.siteRole) });
+    assert.equal(role.type, NATURE, "not `organization` - that is step 2's role");
+    assert.equal(String(role.site), created.siteId, "the site is stored on the role");
+  });
+
+  record("5b. and it is a DIFFERENT role from step 2's, not a duplicate of it", async () => {
+    const orgRole = await h.db.collection("roles").findOne({ _id: new ObjectId(created.orgRole) });
+    const siteRole = await h.db.collection("roles").findOne({ _id: new ObjectId(created.siteRole) });
+
+    assert.notEqual(orgRole.type, siteRole.type);
+    assert.equal(Boolean(orgRole.site), false);
+    assert.equal(Boolean(siteRole.site), true);
+  });
+
+  // ---- step 6 : Invite Site Admin. THE OTHER HALF. ------------------------
+
+  record("6. step 6 records an invitation BOUND TO THAT SITE", async () => {
+    const res = await h.api("/auth/invite/member", {
+      method: "POST",
+      sid,
+      body: {
+        email: SITE_ADMIN,
+        app: NATURE,
+        role: created.siteRole,
+        name: "",
+        org: String(id.org),
+        siteId: created.siteId,
+        siteName: created.siteName,
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const invite = await h.db
+      .collection("verifications")
+      .findOne({ email: SITE_ADMIN, type: "member-invite" });
+
+    assert.ok(invite, "the invitation is stored");
+    assert.equal(String(invite.metadata.siteId), created.siteId, "and it names the site");
+    assert.equal(invite.metadata.siteName, created.siteName);
+    assert.equal(invite.metadata.app, NATURE, "into the organisation's own line of business");
+    assert.equal(String(invite.metadata.role), created.siteRole, "with step 5's SITE role");
+  });
+
+  // ---- the two reads the wizard recomputes its progress from ---------------
+
+  record("7. `GET /roles?org=` shows which role carries a site", async () => {
+    const res = await h.api(`/roles?org=${id.org}&limit=100`, { sid });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const withSite = res.body.items.filter((r) => !!r.site);
+    assert.equal(withSite.length, 1, "exactly the one step 5 created");
+    assert.equal(String(withSite[0]._id), created.siteRole);
+  });
+
+  record("8. `GET /verifications` shows which invitation carries the site", async () => {
+    const res = await h.api(
+      `/verifications?type=member-invite&orgId=${id.org}&status=pending&limit=100`,
+      { sid },
+    );
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const bound = res.body.items.filter((v) => !!v.metadata?.siteId);
+    assert.equal(bound.length, 1, "exactly the one step 6 created");
+    assert.equal(bound[0].email, SITE_ADMIN);
+  });
+
+  // ---- and nothing was widened --------------------------------------------
+
+  record("9. none of these writes is open to a caller with no session", async () => {
+    const role = await h.api("/roles", {
+      method: "POST",
+      body: {
+        name: "no session",
+        permissions: [],
+        type: NATURE,
+        org: String(id.org),
+        site: created.siteId,
+      },
+    });
+    assert.equal(role.status, 401, JSON.stringify(role.body));
+
+    const site = await h.api("/customer-sites", {
+      method: "POST",
+      body: { name: "no session", site: "", siteOrg: String(id.org), org: String(id.org) },
+    });
+    assert.equal(site.status, 401, JSON.stringify(site.body));
+
+    assert.equal(
+      await h.db.collection("roles").countDocuments({ name: "no session" }),
+      0,
+      "and nothing was written",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const orgRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org,
+    name: "OW Org",
+    email: "ow-org@e2e.example.com",
+    type: "org",
+    nature: NATURE,
+    status: "active",
+    contact: "+65 00000000",
+    createdAt: now,
+  });
+
+  // `sites.getByName` runs a `$text` search, which needs the index production
+  // creates at boot. A fresh in-memory database has none, and without it the
+  // site create answers 500.
+  await h.db.collection("sites").createIndex({ name: "text" });
+
+  await h.db.collection("roles").insertOne({
+    _id: orgRole,
+    name: "Owner",
+    org,
+    permissions: ["*"],
+    status: "active",
+    type: "organization",
+  });
+
+  const emails = [OWNER];
+  const users = await h.db
+    .collection("users")
+    .insertMany(emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })));
+
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+
+  const owner = users.insertedIds[0];
+
+  // The owner's own sign-up invitation - the only relationship they hold when
+  // the wizard opens.
+  await h.db.collection("verifications").insertOne({
+    type: "user-invite",
+    email: OWNER,
+    status: "complete",
+    metadata: { org, role: orgRole, app: "organization" },
+    createdAt: now,
+  });
+
+  return { org, orgRole, owner };
+}

package/.changeset/onboarding-org-update-reach.md

@@ -1,17 +0,0 @@
----
-"@7365admin1/core": patch
----
-
-Let a client owner save their organisation details during onboarding.
-
-`PUT /api/organizations/:id` — the write behind step 1 of the onboarding wizard —
-was gated on `requireOrgAccess` (staff, or a live member of the organisation).
-The client owner has no `members` row at that point; theirs is created at the
-last step of the wizard. Every new client therefore got 401 on the first step of
-onboarding and could not leave it.
-
-The gate is now `requireOrgReach`: staff, a live member, **or** somebody holding
-an invitation naming that organisation — the same rule the roles, members and
-invite endpoints already use for the three pre-membership flows. Nothing is
-widened: a member of another client, and a caller holding only a password-reset
-row, are still refused.