@7365admin1/core 3.52.17 → 3.52.19

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.17",
+  "version": "3.52.19",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/harness.mjs

@@ -345,8 +345,11 @@ function buildApp(nsu, core) {
   // mirrors iservice365-API-core/src/routes/subscription.route.ts
   const subscriptions = express.Router();
   {
-    const { updateSubscriptionSeats } = core.useSubscriptionController();
-    // subscription.route.ts:24
+    const { updateSubscriptionSeats, getByOrgId, getSubscriptions } =
+      core.useSubscriptionController();
+    // subscription.route.ts:21-24
+    subscriptions.get("/", requireAuth, getSubscriptions);
+    subscriptions.get("/org/:id", requireAuth, getByOrgId);
     subscriptions.put("/seats/:id", requireAuth, updateSubscriptionSeats);
   }
 

package/test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs

@@ -0,0 +1,220 @@
+// Why onboarding step 1 answers `{"status":"error","message":"Failed to update
+// organization."}` on production, and what the person is supposed to do about it.
+//
+// Reported live from `org.app.iservice365.org/onboarding/getting-started`: the
+// "Organization Details" modal is filled in, Submit is pressed, and the single
+// `PUT /api/organizations/:id` behind it comes back 500 with that exact body.
+// The web app maps any 5xx to "The server could not save your details. Please
+// try again in a moment." — so nobody, on either side of the wire, learns
+// anything at all about what went wrong.
+//
+// The handler is `organization.repo.ts update()`. Inside its `try` there are
+// exactly two awaited calls: `collection.updateOne` and `delNamespace()`.
+// `delNamespace` swallows every error of its own (`node-server-utils@1.6.0`
+// `useCache`), and `new ObjectId(id)` cannot throw for the 24-hex id in the
+// URL. So the 500 is a MongoDB WRITE ERROR on `organizations` — and the catch
+// throws it away, keeping only `error.message` in a log line with no error
+// code, no key and no organisation id.
+//
+// The write error this collection actually produces is a duplicate key.
+// `organizations` has carried a UNIQUE index since the first version of this
+// repository — `createUniqueIndex()` was `createIndex({ name: 1 }, { unique:
+// true })` (36150ea0), later re-pointed at `email`, and `06ee8915` ("remove
+// unique email index and support multiple orgs per email") stopped CREATING a
+// unique one. Nothing has ever DROPPED the one already built, and `setup.ts`
+// only logs when the re-create conflicts. So the index outlives the code that
+// wanted it.
+//
+// `add()` already knows this — it maps a duplicate to "Organization already
+// exist." `update()` does not, and that asymmetry is the whole defect: create
+// says what is wrong, save says nothing.
+//
+// Everything below is created and thrown away by the harness: an in-process
+// MongoDB replica set, a loopback Redis, a loopback mail sink. No staging or
+// production database, Redis, mailbox or endpoint is touched.
+//
+// Run with: yarn build && node --test test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OrgSave-Passw0rd!";
+const OWNER = "os-owner@e2e.example.com";
+const TAKEN_NAME = "Benar Property Org";
+
+describe("onboarding step 1 says what is wrong when the save is refused", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- onboarding organisation save: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let ownerSid;
+
+  const ownOrg = async () =>
+    await h.db.collection("organizations").findOne({ _id: id.ownOrg });
+
+  /**
+   * The body `OrgDetails.vue submit()` sends, verbatim.
+   *
+   * `utils/onboarding-org-details.js orgUpdatePayload()` deletes every empty
+   * value before it leaves the browser, which is why Industry, Registration
+   * Number, the alternate contact number, Country and State/Province are ABSENT
+   * here rather than sent as "" — the organisation record has no field for the
+   * last two at all, and `Joi.string()` rejects "" for the rest.
+   */
+  const modalBody = (name) => ({
+    name,
+    type: "business",
+    email: "os-benar@e2e.example.com",
+    contact: "+63 9569346664",
+  });
+
+  record("0. baseline — the owner signs in and reaches their own organisation", async () => {
+    ownerSid = await h.login(OWNER, PASSWORD);
+
+    assert.equal(
+      await h.db.collection("members").countDocuments({ user: id.owner }),
+      0,
+      "the owner must hold no membership — reach is by `createdBy` (DV-0248)",
+    );
+    assert.equal((await ownOrg()).name, "Ben Org");
+  });
+
+  record("1. renaming onto a name another organisation already holds", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody(TAKEN_NAME),
+    });
+
+    // Before the fix this is the production failure exactly:
+    //   500 {"status":"error","message":"Failed to update organization."}
+    assert.equal(
+      res.status,
+      400,
+      `expected an actionable 400, got ${res.status} ${JSON.stringify(res.body)}`,
+    );
+    assert.match(
+      String(res.body.message),
+      /already/i,
+      `the person must be told what to change: ${JSON.stringify(res.body)}`,
+    );
+    assert.match(
+      String(res.body.message),
+      /name/i,
+      `and WHICH field: ${JSON.stringify(res.body)}`,
+    );
+    assert.equal((await ownOrg()).name, "Ben Org", "nothing may be written");
+  });
+
+  record("2. the message never quotes the other client's record", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody(TAKEN_NAME),
+    });
+
+    const text = JSON.stringify(res.body);
+    assert.ok(!text.includes(String(id.otherOrg)), `leaks an id: ${text}`);
+    assert.ok(!/index|E11000|keyPattern|dup key/i.test(text), `leaks driver internals: ${text}`);
+  });
+
+  // ---- the control: the same request with a free name MUST go through -------
+
+  record("3. control — a free name saves, so case 1 is the name and not the route", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody("Ben Org Renamed"),
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const saved = await ownOrg();
+    assert.equal(saved.name, "Ben Org Renamed");
+    assert.equal(saved.type, "business");
+    assert.equal(saved.contact, "+63 9569346664");
+  });
+
+  record("4. and the guard is unchanged — no session is still refused", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      body: modalBody("Ben Org Again"),
+    });
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal((await ownOrg()).name, "Ben Org Renamed", "must be untouched");
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const otherOrg = new ObjectId();
+  const ownOrg = new ObjectId();
+
+  const orgs = h.db.collection("organizations");
+
+  // The index the first version of this repository created at every boot
+  // (`setup.ts` -> `createUniqueIndex()`), and which nothing has ever dropped.
+  await orgs.createIndex({ name: 1 }, { unique: true });
+
+  await orgs.insertMany([
+    {
+      _id: otherOrg,
+      name: TAKEN_NAME,
+      email: "os-other@e2e.example.com",
+      type: "business",
+      nature: "property_management_agency",
+      status: "active",
+      createdAt: now,
+    },
+    {
+      _id: ownOrg,
+      name: "Ben Org",
+      email: "os-benorg@e2e.example.com",
+      type: "business",
+      nature: "property_management_agency",
+      status: "active",
+      contact: "+65 00000000",
+      createdAt: now,
+    },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: OWNER, name: "os-owner", status: "active", createdAt: now },
+  ]);
+  const owner = users.insertedIds[0];
+
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateOne({ _id: owner }, { $set: { password: hashed } });
+
+  // DV-0248: the creator road is the only relationship a self-signup owner
+  // holds at step 1.
+  await orgs.updateOne({ _id: ownOrg }, { $set: { createdBy: owner } });
+
+  return { owner, ownOrg, otherOrg };
+}

package/test/e2e/subscription-read-scope.e2e.test.mjs

@@ -0,0 +1,182 @@
+// End-to-end proof that a client's billing record is not readable by every
+// signed-in account on the platform.
+//
+// Two reads on `subscription.route.ts` carried `requireAuth` and nothing else:
+//
+//   - `GET /api/subscriptions/org/:id` — ONE organisation's subscription: its
+//     plan, seat count, price, currency and renewal date. Any signed-in
+//     account — a resident, a guard, a cleaner, another client's admin — could
+//     read any organisation's, given only the org id.
+//   - `GET /api/subscriptions/` — EVERY subscription on the platform in one
+//     searchable, paged list. Not filtered by organisation at all: that is the
+//     Seven365 staff console answer, and it was open to anybody signed in.
+//
+// The gates are the two already used elsewhere in the same file:
+// `requireOrgAccess(req, org)` (the pattern `updateSubscriptionSeats` uses on
+// the same records) and `requirePlatformStaff(req)` (the console gate).
+//
+// No live caller loses access. `/org/:id` has exactly one caller — web-app-org's
+// own subscription and manage-seats pages — and both pass `currentOrg`, the
+// caller's OWN organisation. The list has no caller at all: layer-common
+// exports `getSubscriptions()` and no screen anywhere calls it.
+//
+// Everything runs through the real Express stack against the harness's
+// in-process MongoDB replica set. No staging or production database is touched,
+// no payment gateway is contacted, and every seeded value is obviously fake.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Sub-Read-Passw0rd!";
+const OWN_ADMIN = "sub-read-own@e2e.example.com";
+const OTHER_ADMIN = "sub-read-other@e2e.example.com";
+const STAFF = "sub-read-staff@e2e.example.com";
+
+describe("subscription reads are scoped", { concurrency: 1 }, () => {
+  let h;
+  let id;
+  let ownSid;
+  let otherSid;
+  let staffSid;
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    id = await seed(h);
+    ownSid = await h.login(OWN_ADMIN, PASSWORD);
+    otherSid = await h.login(OTHER_ADMIN, PASSWORD);
+    staffSid = await h.login(STAFF, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- subscription read scope: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const byOrg = (org, sid) =>
+    h.api(`/subscriptions/org/${org.toString()}`, { sid });
+
+  const list = (sid) => h.api("/subscriptions/?status=active", { sid });
+
+  // ---- GET /subscriptions/org/:id ----------------------------------------
+
+  record("1. same tenant: the org's own admin still reads its subscription", async () => {
+    const res = await byOrg(id.ownOrg, ownSid);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    // The page renders the plan and the seat numbers, so the record itself must
+    // still come back, not an empty shell.
+    assert.equal(res.body?._id, id.ownSub.toString());
+    assert.equal(res.body?.maxSeats, 5);
+  });
+
+  record("2. cross tenant: another client's admin is refused", async () => {
+    const res = await byOrg(id.ownOrg, otherSid);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("3. and learns nothing about the record from the refusal", async () => {
+    const res = await byOrg(id.ownOrg, otherSid);
+    const body = JSON.stringify(res.body ?? {});
+    for (const key of ["maxSeats", "currency", "nextBillingDate"]) {
+      assert.ok(!body.includes(key), `refusal must not disclose ${key}`);
+    }
+  });
+
+  record("4. the other admin still reads their OWN organisation", async () => {
+    // Proves case 2 refused for the right reason — the gate, not a broken route.
+    const res = await byOrg(id.otherOrg, otherSid);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body?._id, id.otherSub.toString());
+  });
+
+  record("5. no session at all is still refused", async () => {
+    const res = await byOrg(id.ownOrg);
+    assert.equal(res.status, 401, JSON.stringify(res.status));
+  });
+
+  // ---- GET /subscriptions/ ------------------------------------------------
+
+  record("6. the platform-wide list is refused to an ordinary client admin", async () => {
+    const res = await list(ownSid);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("7. and does not leak the other client's row in the refusal", async () => {
+    const res = await list(ownSid);
+    assert.ok(
+      !JSON.stringify(res.body ?? {}).includes(id.otherSub.toString()),
+      "a refused list must not carry any subscription id",
+    );
+  });
+
+  record("8. Seven365 staff still get the list", async () => {
+    // The console is the legitimate caller. If this fails the gate is too tight.
+    const res = await list(staffSid);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const nextBillingDate = new Date(Date.now() + 20 * 24 * 60 * 60 * 1000);
+  const hashed = await h.hashPassword(PASSWORD);
+
+  const ownOrg = new ObjectId();
+  const otherOrg = new ObjectId();
+  const ownSub = new ObjectId();
+  const otherSub = new ObjectId();
+  const ownRole = new ObjectId();
+  const otherRole = new ObjectId();
+  const staffRole = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: ownOrg, name: "Sub Read Own", email: "sub-read-own-org@e2e.example.com", type: "property-management", status: "active", createdAt: now },
+    { _id: otherOrg, name: "Sub Read Other", email: "sub-read-other-org@e2e.example.com", type: "property-management", status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("roles").insertMany([
+    { _id: ownRole, name: "Organisation Staff", org: ownOrg, status: "active", permissions: [] },
+    { _id: otherRole, name: "Organisation Staff", org: otherOrg, status: "active", permissions: [] },
+    // Staff is a MEMBERSHIP of type "admin" whose role is also type "admin" —
+    // never a role merely NAMED "Super Admin". See `super-admin.util.ts`.
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, status: "active", permissions: [] },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: OWN_ADMIN, password: hashed, name: "Own Admin", status: "active", defaultOrg: ownOrg.toString(), createdAt: now },
+    { email: OTHER_ADMIN, password: hashed, name: "Other Admin", status: "active", defaultOrg: otherOrg.toString(), createdAt: now },
+    { email: STAFF, password: hashed, name: "Platform Staff", status: "active", createdAt: now },
+  ]);
+
+  const [own, other, staff] = [0, 1, 2].map((i) => users.insertedIds[i]);
+
+  await h.db.collection("members").insertMany([
+    { user: own, org: ownOrg, role: ownRole, type: "organization", status: "active" },
+    { user: other, org: otherOrg, role: otherRole, type: "organization", status: "active" },
+    { user: staff, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  await h.db.collection("subscriptions").insertMany([
+    { _id: ownSub, org: ownOrg, user: own, type: "organization", status: "active", currency: "SGD", maxSeats: 5, paidSeats: 5, currentSeats: 1, billingCycle: "monthly", nextBillingDate, createdAt: now },
+    { _id: otherSub, org: otherOrg, user: other, type: "organization", status: "active", currency: "SGD", maxSeats: 9, paidSeats: 9, currentSeats: 1, billingCycle: "monthly", nextBillingDate, createdAt: now },
+  ]);
+
+  return { ownOrg, otherOrg, ownSub, otherSub };
+}

package/test/e2e/user-email-lookup-leak.e2e.test.mjs

@@ -37,6 +37,10 @@ const UNKNOWN = "leak-nobody@e2e.example.com";
 // `sid` are the two the users collection actually stores today; the rest are
 // listed so that the day one of them is added, this test fails rather than the
 // endpoint quietly starting to leak it.
+// The identity fields the users collection stores. None of them is a credential,
+// which is exactly why the remove-list left every one of them on the wire.
+const PERSONAL_KEYS = ["nric", "contact", "dateOfBirth", "gender", "defaultOrg", "status"];
+
 const CREDENTIAL_KEYS = [
   "password",
   "sid",
@@ -151,6 +155,56 @@ describe("account lookup by e-mail never returns credentials", { concurrency: 1
     assert.ok(res.body?._id, "the authenticated reply must still carry _id");
   });
 
+  record("7a. and gets ONLY the three allow-listed identity fields", async () => {
+    // The remove-list left everything that was not a credential on the wire, so
+    // knowing an e-mail address bought the whole identity record. This is the
+    // case that pins the reply to an allow-list.
+    const res = await h.api(`/users/email/${KNOWN}`, { sid: callerSid });
+    assert.deepEqual(
+      Object.keys(res.body ?? {}).sort(),
+      ["_id", "email", "name"],
+      "the authenticated reply must be exactly {_id, name, email}",
+    );
+  });
+
+  record("7b. specifically, none of the personal-detail fields", async () => {
+    const res = await h.api(`/users/email/${KNOWN}`, { sid: callerSid });
+    const leaked = PERSONAL_KEYS.filter((k) => k in (res.body ?? {}));
+    assert.deepEqual(leaked, [], `personal detail leaked: ${leaked.join(", ")}`);
+  });
+
+  record("7c. the seeded record really does carry those details", async () => {
+    // Without this, 7b would pass just as well against an account that never
+    // had an NRIC in the first place.
+    const stored = await h.db.collection("users").findOne({ email: KNOWN });
+    const present = PERSONAL_KEYS.filter((k) => k in (stored ?? {}));
+    assert.deepEqual(
+      present.sort(),
+      [...PERSONAL_KEYS].sort(),
+      "the seeded account must hold every field the reply is being tested for",
+    );
+  });
+
+  record("7d. the invite flow still works end to end on the narrowed reply", async () => {
+    // What all six live call sites actually do: look the invitee up, and use
+    // `_id` (and, in ClientDetailForm, `name`) from the reply. If the allow-list
+    // had dropped either, this is the case that breaks.
+    const res = await h.api(`/users/email/${KNOWN}`, { sid: callerSid });
+    assert.ok(res.body?._id, "InvitationClientForm / ServiceProviderMain read _id");
+    assert.equal(res.body?.name, "Known Account", "ClientDetailForm reads name");
+    assert.equal(res.body?.email, KNOWN, "the caller's own input, echoed back");
+
+    // ...and it is the RIGHT id — the one the forms then pass to the membership
+    // lookup — not merely some id-shaped value.
+    assert.equal(res.body._id, id.known.toString(), "must identify the seeded account");
+  });
+
+  record("7e. an e-mail nobody holds still answers, and answers nothing", async () => {
+    const res = await h.api(`/users/email/${UNKNOWN}`, { sid: callerSid });
+    assert.equal(res.status, 200, JSON.stringify(res.status));
+    assert.ok(!res.body?._id, "an unknown e-mail must not come back with an id");
+  });
+
   record("8. but that reply is stripped of credentials too", async () => {
     const res = await h.api(`/users/email/${KNOWN}`, { sid: callerSid });
     const leaked = CREDENTIAL_KEYS.filter((k) => k in (res.body ?? {}));
@@ -164,6 +218,17 @@ describe("account lookup by e-mail never returns credentials", { concurrency: 1
     assert.deepEqual(leaked, [], `credential keys leaked: ${leaked.join(", ")}`);
   });
 
+  record("9a. the v2 twin is narrowed to the same three fields", async () => {
+    // It has no callers anywhere in the organisation, so it can be narrowed
+    // without asking anyone — and leaving it wide would just move the leak.
+    const res = await h.api(`/users/v2/email/${KNOWN}`, { sid: callerSid });
+    assert.deepEqual(
+      Object.keys(res.body ?? {}).sort(),
+      ["_id", "email", "name"],
+      "the v2 reply must be exactly {_id, name, email}",
+    );
+  });
+
   // ---- and the internal path that genuinely needs the hash is untouched ---
 
   record("10. signing in still works — the hash path is not projected away", async () => {
@@ -182,7 +247,9 @@ async function seed(h) {
   const users = await h.db.collection("users").insertMany([
     // A live `sid` is seeded deliberately: it is the second credential on this
     // document and leaking it is a ready-made session hijack.
-    { email: KNOWN, name: "Known Account", status: "active", password: hashed, sid: "e2e-not-a-real-session", createdAt: now },
+    // The personal detail is seeded so the allow-list cases test a record that
+    // genuinely holds it. Every value is obviously fake and none is printed.
+    { email: KNOWN, name: "Known Account", status: "active", password: hashed, sid: "e2e-not-a-real-session", nric: "S0000000Z", contact: "+65 0000 0000", dateOfBirth: "1970-01-01", gender: "unspecified", defaultOrg: "000000000000000000000000", createdAt: now },
     { email: CALLER, name: "Caller Account", status: "active", password: hashed, sid: "e2e-not-a-real-session-2", createdAt: now },
   ]);