@7365admin1/core 3.52.15 → 3.52.16

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.15",
+  "version": "3.52.16",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/role-read-scope.e2e.test.mjs

@@ -0,0 +1,166 @@
+// End-to-end proof that one client cannot read another client's permission
+// model, and that a member reading their OWN role still works.
+//
+// `GET /api/roles/id/:id` was `requireAuth` and nothing more. The response is a
+// role's `name` and its whole `permissions` array, and the id is in the URL, so
+// any signed-in account could walk another organisation's roles and learn
+// exactly what that client's people are allowed to do.
+//
+// The obvious fix — scope by the role's organisation, the helper the five write
+// paths already use — breaks a real, large population: staging carries roles
+// with NO organisation, one of which ("Org Owner") is held by 119 ordinary
+// tenant members who read it on every session. So the gate allows the caller's
+// OWN role first and falls through to the organisation rule otherwise. Case 4
+// below is that exact row.
+//
+// Everything it talks to is created and thrown away by the harness: an
+// in-process MongoDB replica set, a loopback Redis, a loopback mail sink. No
+// staging or production database is touched. No identity is printed.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Roles-Passw0rd!";
+const ALICE = "alice-roles@e2e.example.com"; // member of org A, holds A's role
+const BOB = "bob-roles@e2e.example.com"; // member of org A, holds a different role
+const MALLORY = "mallory-roles@e2e.example.com"; // member of org B — an outsider to A
+
+describe("role reads are scoped, and a member can still read their own role", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- role read scoping: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let aliceSid;
+  let bobSid;
+  let mallorySid;
+
+  record("0. baseline — everyone can sign in", async () => {
+    aliceSid = await h.login(ALICE, PASSWORD);
+    bobSid = await h.login(BOB, PASSWORD);
+    mallorySid = await h.login(MALLORY, PASSWORD);
+    assert.ok(aliceSid && bobSid && mallorySid);
+  });
+
+  record("1. the caller HOLDS the role -> 200", async () => {
+    const res = await h.api(`/roles/id/${id.roleA}`, { sid: aliceSid });
+    assert.equal(res.status, 200);
+    assert.equal(res.body?.name, "Estate Manager");
+  });
+
+  record("2. the caller's ORGANISATION owns the role -> 200", async () => {
+    // Bob is a live member of org A but holds a different role, so only the
+    // organisation arm can be answering here.
+    const res = await h.api(`/roles/id/${id.roleA}`, { sid: bobSid });
+    assert.equal(res.status, 200);
+    assert.equal(res.body?.name, "Estate Manager");
+  });
+
+  record("3. neither held nor shared organisation -> 401", async () => {
+    const res = await h.api(`/roles/id/${id.roleA}`, { sid: mallorySid });
+    assert.equal(res.status, 401);
+    assert.notEqual(JSON.stringify(res.body ?? ""), JSON.stringify({ name: "Estate Manager" }));
+  });
+
+  record("4. the ORG-LESS role — its holder reads it, an outsider cannot", async () => {
+    // This is the shape that made the organisation-only fix unshippable: a role
+    // with no `org`, held by ordinary tenant members. Bob holds it.
+    const holder = await h.api(`/roles/id/${id.roleOrgless}`, { sid: bobSid });
+    assert.equal(holder.status, 200, "the holder of an org-less role must still read it");
+    assert.equal(holder.body?.name, "Org Owner");
+
+    const outsider = await h.api(`/roles/id/${id.roleOrgless}`, { sid: mallorySid });
+    assert.equal(outsider.status, 401, "a non-holder from another org must be refused");
+  });
+
+  record("5. an unauthenticated read is still refused", async () => {
+    const res = await h.api(`/roles/id/${id.roleA}`);
+    assert.equal(res.status, 401);
+  });
+
+  record("6. a revoked membership stops conferring the read", async () => {
+    await h.db
+      .collection("members")
+      .updateOne({ _id: id.bobOrglessMember }, { $set: { status: "deleted" } });
+
+    const res = await h.api(`/roles/id/${id.roleOrgless}`, { sid: bobSid });
+    assert.equal(res.status, 401, "a soft-deleted members row must not still hold the role");
+
+    await h.db
+      .collection("members")
+      .updateOne({ _id: id.bobOrglessMember }, { $set: { status: "active" } });
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const hashed = await h.hashPassword(PASSWORD);
+
+  const orgs = await h.db.collection("organizations").insertMany([
+    { name: "Org A", status: "active", createdAt: now },
+    { name: "Org B", status: "active", createdAt: now },
+  ]);
+  const orgA = orgs.insertedIds[0];
+  const orgB = orgs.insertedIds[1];
+
+  const roles = await h.db.collection("roles").insertMany([
+    { name: "Estate Manager", type: "organization", org: orgA, permissions: ["view-dashboard"], status: "active", createdAt: now },
+    { name: "Estate Officer", type: "organization", org: orgA, permissions: ["view-dashboard"], status: "active", createdAt: now },
+    { name: "Neighbour Role", type: "organization", org: orgB, permissions: ["view-dashboard"], status: "active", createdAt: now },
+    // no `org` at all — the staging "Org Owner" shape
+    { name: "Org Owner", type: "organization", permissions: ["view-dashboard"], status: "active", createdAt: now },
+  ]);
+  const roleA = roles.insertedIds[0];
+  const roleA2 = roles.insertedIds[1];
+  const roleB = roles.insertedIds[2];
+  const roleOrgless = roles.insertedIds[3];
+
+  const users = await h.db.collection("users").insertMany([
+    { email: ALICE, name: "Alice", status: "active", password: hashed, createdAt: now },
+    { email: BOB, name: "Bob", status: "active", password: hashed, createdAt: now },
+    { email: MALLORY, name: "Mallory", status: "active", password: hashed, createdAt: now },
+  ]);
+
+  const members = await h.db.collection("members").insertMany([
+    { user: users.insertedIds[0], org: orgA, role: roleA, type: "organization", status: "active", createdAt: now },
+    { user: users.insertedIds[1], org: orgA, role: roleA2, type: "organization", status: "active", createdAt: now },
+    { user: users.insertedIds[1], org: orgA, role: roleOrgless, type: "organization", status: "active", createdAt: now },
+    { user: users.insertedIds[2], org: orgB, role: roleB, type: "organization", status: "active", createdAt: now },
+  ]);
+
+  return {
+    orgA,
+    orgB,
+    roleA,
+    roleA2,
+    roleB,
+    roleOrgless,
+    bobOrglessMember: members.insertedIds[2],
+  };
+}