@7365admin1/core 3.52.10 → 3.52.11

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.10",
+  "version": "3.52.11",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/visitor-document-site-scope.test.mjs

@@ -0,0 +1,82 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Two more instances of the `/api/vehicles` defect, found by sweeping every
+ * list endpoint the mobile apps call:
+ *
+ *   - `GET /api/visitor-transactions` took an OPTIONAL `site` and the repository
+ *     applied it only when it parsed as an ObjectId
+ *     (`visitor-transaction.repo.ts` `...(ObjectId.isValid(site) && ...)`), so a
+ *     request that named no site was answered from the WHOLE collection — every
+ *     customer's visitor records. Nothing checked a NAMED site either.
+ *   - `GET /api/documents` refused a missing site (the repository throws on
+ *     `new ObjectId("")`) but never checked the caller could reach the site they
+ *     DID name, so any signed-in user could read any estate's documents by id.
+ *
+ * The decision itself is `entitledSiteScope` and is covered by
+ * `vehicle-site-scope.test.mjs`. What is asserted here is the WIRING, which
+ * needs a live Atlas connection to exercise — the same approach
+ * `camera-entitlement-wiring.test.mjs` takes.
+ */
+
+const read = (p) =>
+  readFileSync(fileURLToPath(new URL(p, import.meta.url)), "utf8");
+
+const visitorController = read("../src/controllers/visitor-transaction.controller.ts");
+const visitorRepo = read("../src/repositories/visitor-transaction.repo.ts");
+const documentController = read("../src/controllers/document-management.controller.ts");
+
+test("the visitor list resolves a scope when no site is named", () => {
+  assert.equal(
+    visitorController.match(/const siteScope = site \? null : await entitledSites\(req\);/g)?.length,
+    1,
+  );
+
+  // A named site is still authorised, and never trusted.
+  assert.equal(
+    visitorController.match(/if \(site\) await requireSiteReach\(req, site\);/g)?.length,
+    1,
+  );
+
+  assert.ok(
+    /^ {8}siteScope,\s*$/m.test(visitorController),
+    "the scope must reach the repository, not be resolved and dropped",
+  );
+
+  assert.ok(
+    /import \{ entitledSites, requireSiteReach \} from "\.\.\/utils\/site-reach\.util";/.test(
+      visitorController,
+    ),
+    "the rule is the shared one, not a second implementation",
+  );
+});
+
+test("the visitor repository applies an empty scope rather than dropping it", () => {
+  assert.equal(visitorRepo.match(/^ +\.\.\.\(siteScope\s*$/gm)?.length, 1);
+
+  // `siteScope && siteScope.length` here would turn "reaches no site" back into
+  // "sees everything", which is the whole defect.
+  assert.ok(
+    !/siteScope\?\.length|siteScope && siteScope\.length/.test(visitorRepo),
+    "an empty array must not collapse into the no-restriction branch",
+  );
+});
+
+test("the document list authorises the site it is given", () => {
+  const getAll = documentController.slice(
+    documentController.indexOf("async function getAll("),
+    documentController.indexOf("async function getDocumentById("),
+  );
+  assert.ok(getAll.length > 0, "the list handler must still be called getAll");
+  assert.ok(
+    /await requireSiteReach\(req, site\);/.test(getAll),
+    "the list must check the caller reaches the site it was handed",
+  );
+  assert.ok(
+    getAll.indexOf("requireSiteReach") < getAll.indexOf("_getDocuments"),
+    "the check must run BEFORE the read, not after it",
+  );
+});