@7365admin1/core 3.52.13 → 3.52.14

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.13",
+  "version": "3.52.14",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/org-creator-reach.e2e.test.mjs

@@ -0,0 +1,405 @@
+// DV-0248 - "Organization Not Showing as Active for the User Who Created It
+// Without Permission".
+//
+// A client owner who signs themselves up creates the organisation and then
+// walks a five-step wizard. Their own `members` row is not written until the
+// LAST step, so at every step before it they hold no membership - and a
+// self-signup holds no invitation either, because nobody invited them. Both of
+// the organisation gates only knew those two roads, so the owner was refused by
+// their own wizard from step 1, and the organisation never appeared in their
+// list. On staging, 64 of 195 organisations have neither a member nor an
+// invitation.
+//
+// The five steps and the gate each one hits:
+//
+//   1. save org details   PUT  /api/organizations/:id     requireOrgReach
+//   2. create the site    POST /api/sites                 requireOrgAccess
+//                         POST /api/customer-sites        requireOrgAccess
+//   3. create the roles   POST /api/roles                 requireOrgReach
+//   4. invite the admins  POST /api/auth/invite/member    requireInviteReach
+//                                                         -> requireOrgReach
+//   5. finish             POST /api/members/direct        requireOrgReach
+//
+// Two new roads close it, and this file proves each one on its own:
+//
+//   createdBy   stamped from the SESSION when the organisation is created.
+//               Fixes every new signup. Org N below.
+//   email       the organisation is registered under the caller's own account
+//               address. Repairs the 64 already stuck, with no backfill.
+//               Org S below.
+//
+// The e-mail road is only sound because a user can no longer set their own
+// address. Case 12 is the hostile half: Mallory retypes her address as another
+// client's registered one and must be refused, and must gain nothing.
+//
+// Everything is created and thrown away by the harness: an in-process MongoDB
+// replica set, a loopback Redis, a loopback mail sink. No staging or production
+// database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OrgCreator-Passw0rd!";
+const FOUNDER = "ocr-founder@e2e.example.com";   // signs up, creates org N
+const STUCK = "ocr-stuck@e2e.example.com";       // owns org S, already stuck
+const INVITED = "ocr-invited@e2e.example.com";   // invited into org S, no member
+const MALLORY = "ocr-mallory@e2e.example.com";   // an outsider, member of org A
+const STAFF = "ocr-sevenadmin@e2e.example.com";  // Seven365 platform staff
+
+// Org N's registered address is deliberately NOT the founder's, so the only
+// thing joining them is `createdBy`.
+const ORG_N_EMAIL = "ocr-orgn@e2e.example.com";
+
+describe("DV-0248: a client owner reaches the organisation they created", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- DV-0248 org creator reach: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let founderSid;
+  let stuckSid;
+  let invitedSid;
+  let mallorySid;
+  let staffSid;
+  let orgN;
+  let roleN;
+
+  const memberCount = async (org) =>
+    await h.db.collection("members").countDocuments({ org: new ObjectId(org) });
+
+  record("0. baseline - the founder holds no membership and no invitation anywhere", async () => {
+    founderSid = await h.login(FOUNDER, PASSWORD);
+    stuckSid = await h.login(STUCK, PASSWORD);
+    invitedSid = await h.login(INVITED, PASSWORD);
+    mallorySid = await h.login(MALLORY, PASSWORD);
+    staffSid = await h.login(STAFF, PASSWORD);
+
+    assert.equal(await h.db.collection("members").countDocuments({ user: id.founder }), 0);
+    assert.equal(await h.db.collection("verifications").countDocuments({ email: FOUNDER }), 0);
+
+    // Org S is the shape of the 64: no member, no invitation, no createdBy.
+    assert.equal(await memberCount(id.orgS), 0);
+    const rowS = await h.db.collection("organizations").findOne({ _id: id.orgS });
+    assert.equal(rowS.createdBy, undefined);
+  });
+
+  // ---- the creator road: a brand-new organisation ------------------------
+
+  record("1. she creates the organisation, and the server records her as its creator", async () => {
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: founderSid,
+      body: {
+        name: "OCR New Estates",
+        type: "org",
+        nature: "property_management_agency",
+        email: ORG_N_EMAIL,
+        contact: "60000000",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    orgN = (res.body?.data?._id ?? res.body?.data?.id)?.toString();
+    assert.ok(orgN, `no organisation id came back: ${JSON.stringify(res.body)}`);
+
+    const row = await h.db.collection("organizations").findOne({ _id: new ObjectId(orgN) });
+    assert.equal(row.createdBy?.toString(), id.founder.toString());
+    // zero sites, zero members - the reported case exactly
+    assert.equal(await memberCount(orgN), 0);
+  });
+
+  record("2. the creator cannot be forged from the request body", async () => {
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: mallorySid,
+      body: {
+        name: "OCR Forged",
+        type: "org",
+        nature: "property_management_agency",
+        email: "ocr-forged@e2e.example.com",
+        createdBy: id.founder.toString(),
+      },
+    });
+
+    // Either the body field is rejected outright or it is ignored - what must
+    // never happen is Mallory's organisation carrying the founder as creator.
+    if (res.status === 201) {
+      const row = await h.db.collection("organizations").findOne({ name: "OCR Forged" });
+      assert.equal(row.createdBy?.toString(), id.mallory.toString());
+    } else {
+      assert.equal(res.status, 400, JSON.stringify(res.body));
+    }
+  });
+
+  record("3. step 1 - she can save the organisation details (was 401)", async () => {
+    const res = await h.api(`/organizations/${orgN}`, {
+      method: "PUT",
+      sid: founderSid,
+      body: { name: "OCR New Estates Pte Ltd", contact: "61111111" },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const row = await h.db.collection("organizations").findOne({ _id: new ObjectId(orgN) });
+    assert.equal(row.name, "OCR New Estates Pte Ltd");
+  });
+
+  record("4. step 2 - she can create the first site (was 401)", async () => {
+    const res = await h.api("/sites", {
+      method: "POST",
+      sid: founderSid,
+      body: { name: "OCR Tower One", orgId: orgN },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("5. step 2 - and the customer-site twin (was 401)", async () => {
+    const res = await h.api("/customer-sites", {
+      method: "POST",
+      sid: founderSid,
+      body: {
+        name: "OCR Tower Two",
+        org: orgN,
+        siteOrg: orgN,
+        siteOrgName: "OCR New Estates Pte Ltd",
+      },
+    });
+
+    // The gate is what is under test. Before the fix this was a 401 from
+    // `requireOrgAccess`; the handler's own downstream requirements (an
+    // engagement row this bare body does not carry) are not this file's
+    // subject.
+    assert.notEqual(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("6. step 3 - she can create the organisation's roles (was 401)", async () => {
+    const res = await h.api("/roles", {
+      method: "POST",
+      sid: founderSid,
+      body: { name: "OCR Owner", permissions: ["*"], org: orgN, type: "organization" },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    roleN = (res.body?.data?.role?._id ?? res.body?.data?.role)?.toString();
+    if (!roleN) {
+      const row = await h.db.collection("roles").findOne({ name: "OCR Owner" });
+      roleN = row?._id?.toString();
+    }
+    assert.ok(roleN, `no role id came back: ${JSON.stringify(res.body)}`);
+  });
+
+  record("7. step 4 - she can invite her admins (was 401)", async () => {
+    const res = await h.api("/auth/invite/member", {
+      method: "POST",
+      sid: founderSid,
+      body: {
+        email: "ocr-colleague@e2e.example.com",
+        org: orgN,
+        role: roleN,
+        app: "organization",
+      },
+    });
+
+    // The gate is what is under test. A 401 is the bug; anything else means the
+    // caller got past the gate and into the handler's own validation.
+    assert.notEqual(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("8. step 5 - she can finish, which writes her own membership (was 401)", async () => {
+    const res = await h.api("/members/direct", {
+      method: "POST",
+      sid: founderSid,
+      body: {
+        userId: id.founder.toString(),
+        orgId: orgN,
+        roleId: roleN,
+        app: "organization",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    assert.equal(await memberCount(orgN), 1);
+  });
+
+  record("9. and the organisation now shows in her own list", async () => {
+    const res = await h.api("/organizations?page=1&limit=50", { sid: founderSid });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const names = (res.body?.data ?? res.body?.items ?? []).map((o) => o.name);
+    assert.ok(names.includes("OCR New Estates Pte Ltd"), JSON.stringify(names));
+  });
+
+  // ---- the e-mail road: the 64 already stuck -----------------------------
+
+  record("10. an ALREADY-STUCK organisation repairs itself with no backfill", async () => {
+    // Org S predates `createdBy` and has no member and no invitation. The only
+    // thing joining its owner to it is that it is registered under his own
+    // account address - which is the same comparison the client list already
+    // makes.
+    const res = await h.api(`/organizations/${id.orgS}`, {
+      method: "PUT",
+      sid: stuckSid,
+      body: { contact: "62222222" },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+
+  record("11. the invited admin reaches it too - including the member-only gate", async () => {
+    // `requireOrgAccess` had NO invitation road at all, so this site create
+    // refused the invited owner even though the org save let them through.
+    const res = await h.api("/sites", {
+      method: "POST",
+      sid: invitedSid,
+      body: { name: "OCR Invited Estate", orgId: id.orgS.toString() },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  // ---- the hostile case --------------------------------------------------
+
+  record("12. HOSTILE - she cannot retype her address as another client's", async () => {
+    const res = await h.api(`/users/field/${id.mallory}`, {
+      method: "PATCH",
+      sid: mallorySid,
+      body: { field: "email", value: STUCK },
+    });
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+
+    const row = await h.db.collection("users").findOne({ _id: id.mallory });
+    assert.equal(row.email, MALLORY, "her address must be unchanged");
+  });
+
+  record("13. HOSTILE - and so she gains no reach into that client", async () => {
+    const res = await h.api(`/organizations/${id.orgS}`, {
+      method: "PUT",
+      sid: mallorySid,
+      body: { name: "Mallory Was Here" },
+    });
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    const row = await h.db.collection("organizations").findOne({ _id: id.orgS });
+    assert.notEqual(row.name, "Mallory Was Here");
+  });
+
+  record("14. HOSTILE - nor into the organisation somebody else created", async () => {
+    const res = await h.api(`/organizations/${orgN}`, {
+      method: "PUT",
+      sid: mallorySid,
+      body: { name: "Mallory Was Here Too" },
+    });
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("15. HOSTILE - nor create a site inside it", async () => {
+    const res = await h.api("/sites", {
+      method: "POST",
+      sid: mallorySid,
+      body: { name: "Mallory Estate", orgId: orgN },
+    });
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal(
+      await h.db.collection("sites").countDocuments({ name: "Mallory Estate" }),
+      0,
+    );
+  });
+
+  // ---- nothing else regressed -------------------------------------------
+
+  record("16. the rest of the field allow-list is still self-service", async () => {
+    const res = await h.api(`/users/field/${id.mallory}`, {
+      method: "PATCH",
+      sid: mallorySid,
+      body: { field: "contact", value: "63333333" },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+
+  record("17. Seven365 staff can still change an address on the client's behalf", async () => {
+    const res = await h.api(`/users/field/${id.mallory}`, {
+      method: "PATCH",
+      sid: staffSid,
+      body: { field: "email", value: "ocr-mallory-new@e2e.example.com" },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const orgA = new ObjectId();
+  const orgS = new ObjectId();
+  const staffRole = new ObjectId();
+  const ownerRoleA = new ObjectId();
+  const roleS = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: orgA, name: "OCR Org A", email: "ocr-a@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    // The shape of the 64: registered under its owner's own address, but with
+    // no member, no invitation and no creator recorded.
+    { _id: orgS, name: "OCR Stuck Estates", email: STUCK, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: ownerRoleA, name: "Owner A", org: orgA, type: "organization", permissions: ["*"], status: "active" },
+    { _id: roleS, name: "Owner S", org: orgS, type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const emails = [FOUNDER, STUCK, INVITED, MALLORY, STAFF];
+  const users = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+
+  const [founder, stuck, invited, mallory, staff] = emails.map((_, i) => users.insertedIds[i]);
+
+  await h.db.collection("members").insertMany([
+    { user: mallory, org: orgA, type: "organization", role: ownerRoleA, status: "active" },
+    { user: staff, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  // The invited admin's only relationship to org S.
+  await h.db.collection("verifications").insertOne({
+    email: INVITED,
+    type: "member-invite",
+    status: "pending",
+    metadata: { org: orgS, app: "organization" },
+    createdAt: now,
+  });
+
+  return { orgA, orgS, staffRole, ownerRoleA, roleS, founder, stuck, invited, mallory, staff };
+}