@7365admin1/core 3.52.14 → 3.52.15

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.14",
+  "version": "3.52.15",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/preloved-customer-scope.test.mjs

@@ -0,0 +1,242 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { entitledSiteScope } from "./.build/utils/camera-view.util.mjs";
+
+/**
+ * Two more instances of the `/api/vehicles` defect, plus one of its own.
+ *
+ *  1. `GET /api/post-preloved` took an OPTIONAL `site` and applied it as a
+ *     plain filter (`...(site && { site })`), so a request that simply omitted
+ *     the parameter was answered from the WHOLE marketplace collection - every
+ *     estate's classifieds, with the seller's identity attached.
+ *  2. The same query built `status` twice. `{ status: { $ne: DELETED } }` was
+ *     the first key and `...(status && { status: { $in: [...] } })` the second,
+ *     and the second REPLACED the first - so `?status=deleted` returned every
+ *     soft-deleted post the noticeboard had hidden.
+ *  3. `GET /api/customers` declared `org` as `required()` and then trusted it,
+ *     putting it straight into `{ orgId: org }`. That is a cross-ORGANISATION
+ *     read, not a site one: any signed-in account could list another client's
+ *     customers by changing one query parameter.
+ *
+ * Measured read-only on staging, 2026-09-03: `post-preloved` 24 rows, 0 with no
+ * site, 1 distinct site, and all 3 distinct authors hold a site-pinned
+ * membership on it - so `$in` drops nothing a legitimate caller sees today.
+ * `customers` is EMPTY on staging (0 rows), so no caller can lose a row there.
+ *
+ * The DECISION is `entitledSiteScope` / `requireOrgReach`, asked here directly.
+ * The WIRING needs a live Atlas connection to exercise, so it is asserted on the
+ * source exactly as `vehicle-site-scope.test.mjs` and
+ * `building-estate-site-scope.test.mjs` do.
+ */
+
+const ORG_A = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const ORG_B = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const SITE_A1 = "a1a1a1a1a1a1a1a1a1a1a1a1";
+const SITE_A2 = "a2a2a2a2a2a2a2a2a2a2a2a2";
+const SITE_B1 = "b1b1b1b1b1b1b1b1b1b1b1b1";
+
+const sitesByOrg = { [ORG_A]: [SITE_A1, SITE_A2], [ORG_B]: [SITE_B1] };
+
+const read = (p) =>
+  readFileSync(fileURLToPath(new URL(p, import.meta.url)), "utf8");
+
+const prelovedCtrl = read("../src/controllers/post-preloved.controller.ts");
+const prelovedRepo = read("../src/repositories/post-preloved.repo.ts");
+const customerCtrl = read("../src/controllers/customer.controller.ts");
+
+/* ---------- the site decision, asked directly ---------- */
+
+test("no site + a site-level role sees its own site only", () => {
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: false }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual(scope, [SITE_A1]);
+  assert.ok(!scope.includes(SITE_A2), "must not reach a sibling site");
+  assert.ok(!scope.includes(SITE_B1), "must never reach another organisation");
+});
+
+test("no site + an org-level role sees its whole org and nothing from another", () => {
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: true }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual([...scope].sort(), [SITE_A1, SITE_A2].sort());
+  assert.ok(!scope.includes(SITE_B1), "another organisation is never in scope");
+});
+
+test("a caller with no live membership gets an empty scope, not the marketplace", () => {
+  const scope = entitledSiteScope({
+    memberships: [],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual(scope, []);
+});
+
+/* ---------- 1. the post-preloved site leak ---------- */
+
+test("post-preloved.getAll resolves a scope when no site is named", () => {
+  assert.equal(
+    prelovedCtrl.match(
+      /const siteScope = site \? null : await entitledSites\(req\);/g,
+    )?.length,
+    1,
+    "exactly one list handler resolves the fallback scope",
+  );
+
+  // An explicit site is AUTHORISED, not trusted: a site the caller cannot
+  // reach answers as a site that does not exist.
+  assert.ok(
+    /if \(site\) await requireSiteReach\(req, site\);/.test(prelovedCtrl),
+    "an explicit site must be authorised",
+  );
+
+  assert.ok(
+    /^ +siteScope,\s*$/m.test(prelovedCtrl),
+    "the scope must reach the repository, not be resolved and dropped",
+  );
+
+  assert.ok(
+    /import \{ entitledSites, requireSiteReach \} from "\.\.\/utils\/site-reach\.util";/.test(
+      prelovedCtrl,
+    ),
+    "the rule is the shared one, not another implementation",
+  );
+});
+
+test("the check runs BEFORE the read, not after it", () => {
+  const handler = prelovedCtrl.slice(
+    prelovedCtrl.indexOf("async function getAll("),
+    prelovedCtrl.indexOf("async function updateById("),
+  );
+  assert.ok(handler.length > 0, "the handler must still be there");
+  assert.ok(
+    handler.indexOf("requireSiteReach") < handler.indexOf("_getAll("),
+    "an unreachable site must be refused before the query runs",
+  );
+});
+
+test("post-preloved repository applies an empty scope rather than dropping it", () => {
+  assert.equal(
+    prelovedRepo.match(/^ +siteScope\?: string\[\] \| null;$/gm)?.length,
+    1,
+    "exactly one getAll takes the restriction",
+  );
+
+  assert.ok(
+    /\.\.\.\(siteScope\s*\?\s*\{/.test(prelovedRepo),
+    "the restriction must be applied to the query",
+  );
+
+  // `siteScope?.length` here would turn "reaches no site" back into "sees
+  // everything", which is the whole defect.
+  assert.ok(
+    !/siteScope\?\.length|siteScope && siteScope\.length/.test(prelovedRepo),
+    "an empty array must not collapse into the no-restriction branch",
+  );
+
+  // The `$in` and the page count must come from the SAME object, or the list
+  // is scoped and the pagination still describes the whole collection.
+  assert.equal(
+    prelovedRepo.match(/countDocuments\(query, \{ session \}\)/g)?.length,
+    2,
+    "both list handlers still count the query they matched",
+  );
+});
+
+/* ---------- 2. status must never resurrect deleted rows ---------- */
+
+test("a caller-supplied status cannot return deleted posts", () => {
+  // The defect was two keys named `status` in one object literal. There must
+  // now be no spread that rebuilds the key.
+  assert.ok(
+    !/\.\.\.\(status && \{\s*status: \{ \$in:/.test(prelovedRepo),
+    "the second status spread replaced the deleted exclusion and must be gone",
+  );
+
+  // Both query builders - getAll and getByOwnerId - merge instead.
+  const merged = prelovedRepo.match(
+    /status: \{\s*\$ne: PostStatus\.DELETED,\s*\.\.\.\(status && \{ \$in: Array\.isArray\(status\) \? status : \[status\] \}\),\s*\}/g,
+  );
+  assert.equal(
+    merged?.length,
+    2,
+    "both list queries keep $ne alongside any caller $in",
+  );
+
+  // And the exclusion is still there at all. `>= 2` rather than `=== 2`: a
+  // third, unrelated `$ne` guards a single-post read elsewhere in the file and
+  // is none of this fix's business.
+  assert.ok(
+    (prelovedRepo.match(/\$ne: PostStatus\.DELETED/g)?.length ?? 0) >= 2,
+    "the deleted exclusion must survive in both list queries",
+  );
+});
+
+test("the merged status object is a real AND, not a last-write-wins", () => {
+  // Prove the semantics we rely on: two operators on ONE field are ANDed by
+  // Mongo, whereas two keys of the same name in one literal are not. This is
+  // the exact expression the repository now builds.
+  const build = (status) => ({
+    status: {
+      $ne: "deleted",
+      ...(status && { $in: Array.isArray(status) ? status : [status] }),
+    },
+  });
+
+  assert.deepEqual(build("deleted"), {
+    status: { $ne: "deleted", $in: ["deleted"] },
+  });
+  assert.equal(
+    build("deleted").status.$ne,
+    "deleted",
+    "$ne survives a caller asking for deleted - the $in cannot widen it back",
+  );
+  assert.deepEqual(build(undefined), { status: { $ne: "deleted" } });
+  assert.deepEqual(build(["published", "sold"]), {
+    status: { $ne: "deleted", $in: ["published", "sold"] },
+  });
+});
+
+/* ---------- 3. the customers cross-ORG leak ---------- */
+
+test("GET /api/customers authorises the org it was handed", () => {
+  const handler = customerCtrl.slice(
+    customerCtrl.indexOf("async function getAll("),
+    customerCtrl.indexOf("async function getCustomerById("),
+  );
+  assert.ok(handler.length > 0, "the handler must still be there");
+
+  assert.ok(
+    /await requireOrgReach\(req, org\);/.test(handler),
+    "the org from the query string must be authorised, not trusted",
+  );
+
+  assert.ok(
+    handler.indexOf("requireOrgReach") < handler.indexOf("_getAll("),
+    "the check must run BEFORE the read, not after it",
+  );
+
+  assert.ok(
+    /import \{ requireOrgReach \} from "\.\.\/utils\/console-authz\.util";/.test(
+      customerCtrl,
+    ),
+    "the org rule is the shared one, not a site check standing in for it",
+  );
+
+  // This is an ORG check. Site entitlement is a different question and must
+  // not be conflated with it here.
+  assert.ok(
+    !/entitledSites|requireSiteReach/.test(customerCtrl),
+    "customers is scoped by organisation, not by site entitlement",
+  );
+});