@7365admin1/core 3.52.11 → 3.52.12

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.11",
+  "version": "3.52.12",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/building-estate-site-scope.test.mjs

@@ -0,0 +1,157 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { entitledSiteScope } from "./.build/utils/camera-view.util.mjs";
+
+/**
+ * The fourth instance of the `/api/vehicles` defect, and the last of the estate
+ * reads: `GET /api/buildings`, `GET /api/building-units` and
+ * `GET /api/building-levels` all took an OPTIONAL `site`, applied it as a plain
+ * filter (`...(site && { site })`) and checked nothing, so a request that named
+ * no site was answered from the WHOLE collection — every client's blocks, units
+ * and levels. `GET /api/building-units/site/:site` took the site from the URL
+ * and never authorised it either, and that one returns units WITH their owners.
+ *
+ * Measured read-only on staging, 2026-09-03: `buildings` 125 rows, 0 with no
+ * site; `building-units` 1386 rows, 0 with no site; `building-levels` 401 rows,
+ * 0 with no site. A `$in` predicate therefore drops nothing that a legitimate
+ * caller can see today.
+ *
+ * The DECISION is `entitledSiteScope`, asked here directly. The WIRING needs a
+ * live Atlas connection to exercise, so it is asserted on the source exactly as
+ * `vehicle-site-scope.test.mjs` and `visitor-document-site-scope.test.mjs` do.
+ */
+
+const ORG_A = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const ORG_B = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const SITE_A1 = "a1a1a1a1a1a1a1a1a1a1a1a1";
+const SITE_A2 = "a2a2a2a2a2a2a2a2a2a2a2a2";
+const SITE_B1 = "b1b1b1b1b1b1b1b1b1b1b1b1";
+
+const sitesByOrg = { [ORG_A]: [SITE_A1, SITE_A2], [ORG_B]: [SITE_B1] };
+
+const read = (p) =>
+  readFileSync(fileURLToPath(new URL(p, import.meta.url)), "utf8");
+
+const controllers = {
+  building: read("../src/controllers/building.controller.ts"),
+  "building-unit": read("../src/controllers/building-unit.controller.ts"),
+  "building-level": read("../src/controllers/building-level.controller.ts"),
+};
+const repositories = {
+  building: read("../src/repositories/building.repository.ts"),
+  "building-unit": read("../src/repositories/building-unit.repository.ts"),
+  "building-level": read("../src/repositories/building-level.repository.ts"),
+};
+
+test("no site + a site-level role sees its own site only", () => {
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: false }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual(scope, [SITE_A1]);
+  assert.ok(!scope.includes(SITE_A2), "must not reach a sibling site");
+  assert.ok(!scope.includes(SITE_B1), "must never reach another organisation");
+});
+
+test("no site + an org-level role sees its whole org and nothing from another", () => {
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: true }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual([...scope].sort(), [SITE_A1, SITE_A2].sort());
+  assert.ok(!scope.includes(SITE_B1), "another organisation is never in scope");
+});
+
+test("a caller with no live membership gets an empty scope, not the estate", () => {
+  const scope = entitledSiteScope({
+    memberships: [],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual(scope, []);
+});
+
+for (const [name, source] of Object.entries(controllers)) {
+  test(`${name}.getAll resolves a scope when no site is named`, () => {
+    assert.equal(
+      source.match(/const siteScope = site \? null : await entitledSites\(req\);/g)
+        ?.length,
+      1,
+      "exactly one list handler resolves the fallback scope",
+    );
+
+    // An explicit site is AUTHORISED, not trusted: a site the caller cannot
+    // reach answers as a site that does not exist.
+    assert.ok(
+      /if \(site\) await requireSiteReach\(req, site\);/.test(source),
+      "an explicit site must be authorised",
+    );
+
+    assert.ok(
+      /^ +siteScope,\s*$/m.test(source),
+      "the scope must reach the repository, not be resolved and dropped",
+    );
+
+    assert.ok(
+      /import \{ entitledSites, requireSiteReach \} from "\.\.\/utils\/site-reach\.util";/.test(
+        source,
+      ),
+      "the rule is the shared one, not a fourth implementation",
+    );
+  });
+}
+
+for (const [name, source] of Object.entries(repositories)) {
+  test(`${name} repository applies an empty scope rather than dropping it`, () => {
+    assert.equal(
+      source.match(/^ +if \(siteScope\) \{$/gm)?.length,
+      1,
+      "exactly one getAll applies the restriction",
+    );
+
+    // `siteScope?.length` here would turn "reaches no site" back into "sees
+    // everything", which is the whole defect.
+    assert.ok(
+      !/siteScope\?\.length|siteScope && siteScope\.length/.test(source),
+      "an empty array must not collapse into the no-restriction branch",
+    );
+
+    // The restriction is part of the CACHE KEY too. These three lists are all
+    // Redis-cached on the query alone, so without this the first caller's page
+    // is served to the second.
+    assert.ok(
+      /cacheParams\.siteScope = scoped\.length/.test(source),
+      "the scope must be part of the cache key",
+    );
+    assert.ok(
+      /"no-site"/.test(source),
+      "an empty scope needs a key that cannot collide with no restriction",
+    );
+  });
+}
+
+test("the owner-bearing unit read authorises the site in its URL", () => {
+  const source = controllers["building-unit"];
+  const handler = source.slice(
+    source.indexOf("async function getBuildingUnitsWithOwner("),
+    source.indexOf("async function getAllLevelsWithUnits("),
+  );
+  assert.ok(handler.length > 0, "the handler must still be there");
+  assert.ok(
+    /await requireSiteReach\(req, site\);/.test(handler),
+    "the site comes from the URL and must be checked",
+  );
+  assert.ok(
+    handler.indexOf("requireSiteReach") <
+      handler.indexOf("_getBuildingUnitsWithOwner("),
+    "the check must run BEFORE the read, not after it",
+  );
+});