@7365admin1/core 3.52.18 → 3.53.0

package/test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs

@@ -0,0 +1,220 @@
+// Why onboarding step 1 answers `{"status":"error","message":"Failed to update
+// organization."}` on production, and what the person is supposed to do about it.
+//
+// Reported live from `org.app.iservice365.org/onboarding/getting-started`: the
+// "Organization Details" modal is filled in, Submit is pressed, and the single
+// `PUT /api/organizations/:id` behind it comes back 500 with that exact body.
+// The web app maps any 5xx to "The server could not save your details. Please
+// try again in a moment." — so nobody, on either side of the wire, learns
+// anything at all about what went wrong.
+//
+// The handler is `organization.repo.ts update()`. Inside its `try` there are
+// exactly two awaited calls: `collection.updateOne` and `delNamespace()`.
+// `delNamespace` swallows every error of its own (`node-server-utils@1.6.0`
+// `useCache`), and `new ObjectId(id)` cannot throw for the 24-hex id in the
+// URL. So the 500 is a MongoDB WRITE ERROR on `organizations` — and the catch
+// throws it away, keeping only `error.message` in a log line with no error
+// code, no key and no organisation id.
+//
+// The write error this collection actually produces is a duplicate key.
+// `organizations` has carried a UNIQUE index since the first version of this
+// repository — `createUniqueIndex()` was `createIndex({ name: 1 }, { unique:
+// true })` (36150ea0), later re-pointed at `email`, and `06ee8915` ("remove
+// unique email index and support multiple orgs per email") stopped CREATING a
+// unique one. Nothing has ever DROPPED the one already built, and `setup.ts`
+// only logs when the re-create conflicts. So the index outlives the code that
+// wanted it.
+//
+// `add()` already knows this — it maps a duplicate to "Organization already
+// exist." `update()` does not, and that asymmetry is the whole defect: create
+// says what is wrong, save says nothing.
+//
+// Everything below is created and thrown away by the harness: an in-process
+// MongoDB replica set, a loopback Redis, a loopback mail sink. No staging or
+// production database, Redis, mailbox or endpoint is touched.
+//
+// Run with: yarn build && node --test test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OrgSave-Passw0rd!";
+const OWNER = "os-owner@e2e.example.com";
+const TAKEN_NAME = "Benar Property Org";
+
+describe("onboarding step 1 says what is wrong when the save is refused", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- onboarding organisation save: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let ownerSid;
+
+  const ownOrg = async () =>
+    await h.db.collection("organizations").findOne({ _id: id.ownOrg });
+
+  /**
+   * The body `OrgDetails.vue submit()` sends, verbatim.
+   *
+   * `utils/onboarding-org-details.js orgUpdatePayload()` deletes every empty
+   * value before it leaves the browser, which is why Industry, Registration
+   * Number, the alternate contact number, Country and State/Province are ABSENT
+   * here rather than sent as "" — the organisation record has no field for the
+   * last two at all, and `Joi.string()` rejects "" for the rest.
+   */
+  const modalBody = (name) => ({
+    name,
+    type: "business",
+    email: "os-benar@e2e.example.com",
+    contact: "+63 9569346664",
+  });
+
+  record("0. baseline — the owner signs in and reaches their own organisation", async () => {
+    ownerSid = await h.login(OWNER, PASSWORD);
+
+    assert.equal(
+      await h.db.collection("members").countDocuments({ user: id.owner }),
+      0,
+      "the owner must hold no membership — reach is by `createdBy` (DV-0248)",
+    );
+    assert.equal((await ownOrg()).name, "Ben Org");
+  });
+
+  record("1. renaming onto a name another organisation already holds", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody(TAKEN_NAME),
+    });
+
+    // Before the fix this is the production failure exactly:
+    //   500 {"status":"error","message":"Failed to update organization."}
+    assert.equal(
+      res.status,
+      400,
+      `expected an actionable 400, got ${res.status} ${JSON.stringify(res.body)}`,
+    );
+    assert.match(
+      String(res.body.message),
+      /already/i,
+      `the person must be told what to change: ${JSON.stringify(res.body)}`,
+    );
+    assert.match(
+      String(res.body.message),
+      /name/i,
+      `and WHICH field: ${JSON.stringify(res.body)}`,
+    );
+    assert.equal((await ownOrg()).name, "Ben Org", "nothing may be written");
+  });
+
+  record("2. the message never quotes the other client's record", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody(TAKEN_NAME),
+    });
+
+    const text = JSON.stringify(res.body);
+    assert.ok(!text.includes(String(id.otherOrg)), `leaks an id: ${text}`);
+    assert.ok(!/index|E11000|keyPattern|dup key/i.test(text), `leaks driver internals: ${text}`);
+  });
+
+  // ---- the control: the same request with a free name MUST go through -------
+
+  record("3. control — a free name saves, so case 1 is the name and not the route", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody("Ben Org Renamed"),
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const saved = await ownOrg();
+    assert.equal(saved.name, "Ben Org Renamed");
+    assert.equal(saved.type, "business");
+    assert.equal(saved.contact, "+63 9569346664");
+  });
+
+  record("4. and the guard is unchanged — no session is still refused", async () => {
+    const res = await h.api(`/organizations/${id.ownOrg}`, {
+      method: "PUT",
+      body: modalBody("Ben Org Again"),
+    });
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal((await ownOrg()).name, "Ben Org Renamed", "must be untouched");
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const otherOrg = new ObjectId();
+  const ownOrg = new ObjectId();
+
+  const orgs = h.db.collection("organizations");
+
+  // The index the first version of this repository created at every boot
+  // (`setup.ts` -> `createUniqueIndex()`), and which nothing has ever dropped.
+  await orgs.createIndex({ name: 1 }, { unique: true });
+
+  await orgs.insertMany([
+    {
+      _id: otherOrg,
+      name: TAKEN_NAME,
+      email: "os-other@e2e.example.com",
+      type: "business",
+      nature: "property_management_agency",
+      status: "active",
+      createdAt: now,
+    },
+    {
+      _id: ownOrg,
+      name: "Ben Org",
+      email: "os-benorg@e2e.example.com",
+      type: "business",
+      nature: "property_management_agency",
+      status: "active",
+      contact: "+65 00000000",
+      createdAt: now,
+    },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: OWNER, name: "os-owner", status: "active", createdAt: now },
+  ]);
+  const owner = users.insertedIds[0];
+
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateOne({ _id: owner }, { $set: { password: hashed } });
+
+  // DV-0248: the creator road is the only relationship a self-signup owner
+  // holds at step 1.
+  await orgs.updateOne({ _id: ownOrg }, { $set: { createdBy: owner } });
+
+  return { owner, ownOrg, otherOrg };
+}

package/test/e2e/organizations-name-index.e2e.test.mjs

@@ -0,0 +1,122 @@
+// Proves the drop-selection rule in `scripts/organizations-name-index.mjs` against a
+// real MongoDB — an in-process, throwaway one (mongodb-memory-server). Nothing here
+// reaches a shared cluster, and the script's `main()` is never called; only its pure
+// `planIndexDrop()` is, and the drop it selects is applied by hand so the surviving
+// indexes can be checked.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { MongoMemoryServer } from "mongodb-memory-server";
+import { MongoClient } from "mongodb";
+
+import { planIndexDrop, classifyIndex, redact } from "../../scripts/organizations-name-index.mjs";
+
+let mongo;
+let client;
+let db;
+
+test.before(async () => {
+  mongo = await MongoMemoryServer.create();
+  client = new MongoClient(mongo.getUri());
+  await client.connect();
+  db = client.db("index-selection-test");
+});
+
+test.after(async () => {
+  await client?.close();
+  await mongo?.stop();
+});
+
+// Each case gets its own collection, so nothing leaks between them.
+async function seed(name, build) {
+  const collection = db.collection(name);
+  await collection.insertOne({ name: "seed org" });
+  await build(collection);
+  return collection;
+}
+
+const names = (indexes) => indexes.map((i) => i.name).sort();
+
+test("drops a UNIQUE {name:1}, and leaves _id_ and everything else alone", async () => {
+  const collection = await seed("case-unique", async (c) => {
+    await c.createIndex({ name: 1 }, { unique: true, name: "name_1" });
+    await c.createIndex({ email: 1 }, { name: "email_1" });
+  });
+
+  const plan = planIndexDrop(await collection.listIndexes().toArray());
+  assert.equal(plan.ok, true);
+  assert.deepEqual(
+    plan.targets.map((i) => i.name),
+    ["name_1"],
+  );
+
+  await collection.dropIndex(plan.targets[0].name);
+  assert.deepEqual(names(await collection.listIndexes().toArray()), ["_id_", "email_1"]);
+});
+
+test("does NOT drop a NON-unique {name:1}", async () => {
+  const collection = await seed("case-plain", async (c) => {
+    await c.createIndex({ name: 1 }, { name: "name_1" });
+  });
+
+  const indexes = await collection.listIndexes().toArray();
+  const plan = planIndexDrop(indexes);
+  assert.equal(plan.ok, false);
+  assert.deepEqual(plan.targets, []);
+  assert.match(plan.reason, /nothing to drop/i);
+  assert.equal(classifyIndex(indexes.find((i) => i.name === "name_1")), "known-name-plain");
+});
+
+test("never selects _id_, even when it is the only index there is", async () => {
+  const collection = await seed("case-id-only", async () => {});
+
+  const indexes = await collection.listIndexes().toArray();
+  assert.deepEqual(names(indexes), ["_id_"]);
+  assert.equal(classifyIndex(indexes[0]), "protected");
+  assert.equal(planIndexDrop(indexes).ok, false);
+});
+
+test("refuses on an unrecognised compound index involving name", async () => {
+  const collection = await seed("case-compound", async (c) => {
+    await c.createIndex({ name: 1 }, { unique: true, name: "name_1" });
+    await c.createIndex({ name: 1, org: 1 }, { unique: true, name: "name_1_org_1" });
+  });
+
+  const plan = planIndexDrop(await collection.listIndexes().toArray());
+  assert.equal(plan.ok, false);
+  assert.deepEqual(plan.targets, []);
+  assert.deepEqual(
+    plan.unrecognised.map((i) => i.name),
+    ["name_1_org_1"],
+  );
+  assert.match(plan.reason, /does not recognise/i);
+
+  // and refusing means refusing: the collection is untouched.
+  assert.deepEqual(names(await collection.listIndexes().toArray()), [
+    "_id_",
+    "name_1",
+    "name_1_org_1",
+  ]);
+});
+
+test("the repo's own name indexes are recognised, so a real database is not refused", async () => {
+  const collection = await seed("case-repo-shape", async (c) => {
+    await c.createIndex({ name: 1, description: 1, status: 1, email: 1 });
+    await c.createIndex({ name: "text", description: "text" });
+    await c.createIndex({ name: 1 }, { unique: true, name: "name_1" });
+  });
+
+  const plan = planIndexDrop(await collection.listIndexes().toArray());
+  assert.equal(plan.ok, true);
+  assert.deepEqual(
+    plan.targets.map((i) => i.name),
+    ["name_1"],
+  );
+});
+
+test("the connection string never survives into an error message", () => {
+  const uri = "mongodb+srv://user:secret@cluster0.example.mongodb.net/iservice365";
+  const message = redact(`connect ECONNREFUSED for ${uri} after 30000ms`, uri);
+  assert.doesNotMatch(message, /secret|cluster0|mongodb\+srv/);
+  assert.match(message, /<connection string hidden>/);
+});

package/test/guard-invite-schema.test.mjs

@@ -0,0 +1,173 @@
+/**
+ * The guard app's invite screens, validated against the schema they will
+ * actually be answered by.
+ *
+ * `POST /api/visitor-transactions/invite/:inviterId` is the RESIDENT app's
+ * "invite to my unit" flow. It derives site, org, block, level and unit from
+ * the inviter's `site.people` row, and `schemaInviteVisitor` declares no
+ * `site`, `org`, `nric` or `members[].visitorPass` — so Joi's default rejects
+ * all four and every request the guard app builds answers 400.
+ *
+ * Deleting the rejected keys would be worse than the 400: a guard holds no
+ * `site.people` row, so the invitation would be written with no site and no
+ * org — an orphan attributed to nobody.
+ *
+ * So the guard case gets its OWN schema, and the resident one is left exactly
+ * as it is. The bodies below are copied from the two screens on
+ * `iservice365-mobile-app-security` PR #203 (`pages/visitors/invite/
+ * visitor.vue:394` and `contractor.vue:532`), field for field, because those
+ * payloads are what exposed the defect.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { schemaInviteVisitor } from "./.build/models/visitor-invite.model.mjs";
+import { schemaGuardInviteVisitor } from "./.build/models/guard-invite.model.mjs";
+
+const SITE = "6923d6664150ca6a69b9f2b2";
+const ORG = "69bb9dbff572cf9d260d7ce3";
+
+/** `pages/visitors/invite/visitor.vue:394`, byte for byte. */
+function guardGuestBody() {
+  return {
+    type: "guest",
+    expectedCheckIn: "2026-09-10T00:00:00.000Z",
+    arrivalTime: "14:30",
+    duration: "",
+    name: "Harris Tan",
+    contact: "91234567",
+    email: "",
+    isOvernightParking: false,
+    numberOfPassengers: 0,
+    purpose: "Delivery",
+    site: SITE,
+    org: ORG,
+  };
+}
+
+/** `pages/visitors/invite/contractor.vue:532`, byte for byte. */
+function guardContractorBody() {
+  return {
+    type: "contractor",
+    expectedCheckIn: "2026-09-10T00:00:00.000Z",
+    contractorType: "home-contractor",
+    name: "Acme Aircon",
+    nric: "S1234567D",
+    email: "",
+    contact: "98765432",
+    company: "Acme Pte Ltd",
+    plateNumber: "SGX1234A",
+    members: [{ name: "Lee", nric: "S7654321B", contact: "90001111", visitorPass: "" }],
+    purpose: "Aircon servicing",
+    site: SITE,
+    org: ORG,
+  };
+}
+
+test("the guard GUEST payload is rejected by the resident schema — the reported 400", () => {
+  const { error } = schemaInviteVisitor.validate(
+    { inviterUserId: "6a7c0a4c850a58d1a7e9ae1b", ...guardGuestBody() },
+    { abortEarly: false },
+  );
+
+  assert.ok(error, "schemaInviteVisitor must keep refusing site/org");
+  assert.match(error.message, /"site" is not allowed/);
+  assert.match(error.message, /"org" is not allowed/);
+});
+
+test("the guard CONTRACTOR payload is rejected by the resident schema — the reported 400", () => {
+  const { error } = schemaInviteVisitor.validate(
+    { inviterUserId: "6a7c0a4c850a58d1a7e9ae1b", ...guardContractorBody() },
+    { abortEarly: false },
+  );
+
+  assert.ok(error);
+  for (const key of ['"site"', '"org"', '"nric"', '"members[0].visitorPass"']) {
+    assert.ok(error.message.includes(`${key} is not allowed`), `expected ${key} to be refused`);
+  }
+});
+
+test("the guard GUEST payload validates against the guard schema", () => {
+  const { error, value } = schemaGuardInviteVisitor.validate(guardGuestBody(), {
+    abortEarly: false,
+  });
+
+  assert.equal(error, undefined, error && error.message);
+  assert.equal(value.site, SITE);
+  assert.equal(value.type, "guest");
+});
+
+test("the guard CONTRACTOR payload validates against the guard schema", () => {
+  const { error, value } = schemaGuardInviteVisitor.validate(guardContractorBody(), {
+    abortEarly: false,
+  });
+
+  assert.equal(error, undefined, error && error.message);
+  assert.equal(value.nric, "S1234567D");
+  // `emptyMember()` seeds `visitorPass: ""` and never binds it to an input, so
+  // the empty string is DROPPED rather than written into a field the rest of
+  // the platform reads as an array of key references.
+  assert.equal(value.members[0].visitorPass, undefined);
+});
+
+test("a real gate pass is accepted, in the shape the platform already stores", () => {
+  const body = guardContractorBody();
+  body.members[0].visitorPass = [{ keyId: "6923d6664150ca6a69b9f2b4" }];
+
+  const { error, value } = schemaGuardInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.equal(error, undefined, error && error.message);
+  assert.equal(value.members[0].visitorPass[0].keyId, "6923d6664150ca6a69b9f2b4");
+});
+
+test("a pass that is not a key reference is refused, not stored as text", () => {
+  const body = guardContractorBody();
+  body.members[0].visitorPass = "P-014";
+
+  const { error } = schemaGuardInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.ok(error, "free text must not reach an array-of-key-references field");
+});
+
+test("the guard schema REQUIRES a site — there is no orphan write to fall into", () => {
+  const { site, ...noSite } = guardGuestBody();
+  const { error } = schemaGuardInviteVisitor.validate(noSite, { abortEarly: false });
+
+  assert.ok(error);
+  assert.match(error.message, /"site" is required/);
+});
+
+test("the guard schema refuses a site that is not an id", () => {
+  const body = { ...guardGuestBody(), site: "not-an-id" };
+  const { error } = schemaGuardInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.ok(error);
+  assert.match(error.message, /site/);
+});
+
+test("the guard schema takes NO inviterUserId — the author comes from the session", () => {
+  const body = { ...guardGuestBody(), inviterUserId: "6a7c0a4c850a58d1a7e9ae1b" };
+  const { error } = schemaGuardInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.ok(error, "an inviter id in the body must not be honoured");
+  assert.match(error.message, /"inviterUserId" is not allowed/);
+});
+
+test("the guard schema declines block/level/unit — a guard invite has no unit", () => {
+  for (const key of ["block", "level", "unit"]) {
+    const { error } = schemaGuardInviteVisitor.validate(
+      { ...guardGuestBody(), [key]: "6923d6664150ca6a69b9f2b3" },
+      { abortEarly: false },
+    );
+    assert.ok(error, `${key} must not be accepted`);
+    assert.match(error.message, new RegExp(`"${key}" is not allowed`));
+  }
+});
+
+test("contractorType stays required for a contractor, as on the resident schema", () => {
+  const { contractorType, ...body } = guardContractorBody();
+  const { error } = schemaGuardInviteVisitor.validate(body, { abortEarly: false });
+
+  assert.ok(error);
+  assert.match(error.message, /"contractorType" is required/);
+});

package/test/guard-invite-wiring.test.mjs

@@ -0,0 +1,161 @@
+/**
+ * The guard invite path, asserted at the seams that would silently rot.
+ *
+ * `test/e2e/guard-invite-scope.e2e.test.mjs` proves the behaviour over real
+ * HTTP against a real database, and asserts the STORED document. What is
+ * pinned here is the wiring — the four properties that make the guard path
+ * safe, each of which a later edit could remove without any test going red:
+ *
+ *   1. the site is taken from the REQUEST and checked with `requireSiteReach`
+ *      before anything is written;
+ *   2. the org is read off the RESOLVED site, never off the body — the body's
+ *      `org` is accepted (so an installed build does not 400) and ignored;
+ *   3. the author is the SESSION's caller, not a path segment or a body field;
+ *   4. the resident path still derives everything from `_getByUserId`, and
+ *      `schemaInviteVisitor` is still the schema it validates against.
+ *
+ * Nothing here opens a socket or a database. Every assertion reads a file.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const read = (rel) =>
+  readFileSync(fileURLToPath(new URL(`../src/${rel}`, import.meta.url)), "utf8");
+
+const controller = read("controllers/visitor-transaction.controller.ts");
+const service = read("services/visitor-transaction.service.ts");
+
+/** One `async function name(...)` body out of a source file. */
+function fn(text, name) {
+  const start = text.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `${name} is no longer defined`);
+  const rest = text.slice(start);
+  const next = rest.slice(1).search(/\n {0,4}async function [a-zA-Z0-9_]+ ?\(/);
+  return next === -1 ? rest : rest.slice(0, next + 1);
+}
+
+test("the guard handler checks site reach BEFORE it calls the service", () => {
+  const handler = fn(controller, "inviteVisitorAsGuard");
+
+  const reach = handler.indexOf("requireSiteReach(");
+  const write = handler.indexOf("_inviteVisitorAsGuard(");
+
+  assert.notEqual(reach, -1, "inviteVisitorAsGuard must ask requireSiteReach");
+  assert.notEqual(write, -1, "inviteVisitorAsGuard must call the guard service");
+  assert.ok(reach < write, "the site check must run before the write");
+});
+
+test("the guard handler validates with the GUARD schema, not the resident one", () => {
+  const handler = fn(controller, "inviteVisitorAsGuard");
+
+  assert.ok(handler.includes("schemaGuardInviteVisitor.validate("));
+  assert.ok(
+    !handler.includes("schemaInviteVisitor.validate("),
+    "the guard handler must not reuse the resident schema",
+  );
+});
+
+test("the guard handler takes its author from the session, not from the URL", () => {
+  const handler = fn(controller, "inviteVisitorAsGuard");
+
+  assert.ok(
+    handler.includes("callerId(req)"),
+    "the author must be resolved from the session",
+  );
+  assert.ok(
+    !handler.includes("req.params.inviterId"),
+    "a client-supplied inviter id must not reach the guard write",
+  );
+});
+
+test("the guard service resolves the site, and reads org off the RESOLVED site", () => {
+  const guard = fn(service, "inviteVisitorAsGuard");
+
+  assert.ok(guard.includes("_getSiteById("), "the site must be loaded, not trusted");
+  assert.ok(
+    /site\?\.orgId|site\?\.org/.test(guard),
+    "org must come off the resolved site document",
+  );
+  assert.ok(
+    !/value\.org|value\?\.org/.test(guard),
+    "org must never be read off the request body",
+  );
+});
+
+test("a guard invitation carries no block, level or unit", () => {
+  const guard = fn(service, "inviteVisitorAsGuard");
+
+  for (const key of ["block", "level", "unit", "unitName"]) {
+    assert.ok(
+      guard.includes(`${key}: null`),
+      `${key} must be written null on a guard invitation`,
+    );
+  }
+});
+
+test("the guard service never reads a people row — that is the resident path", () => {
+  const guard = fn(service, "inviteVisitorAsGuard");
+
+  assert.ok(
+    !guard.includes("_getByUserId("),
+    "a guard holds no site.people row; reading one is the orphan-write bug",
+  );
+});
+
+test("REGRESSION: the resident path still derives its estate from the people row", () => {
+  const resident = fn(service, "inviteVisitor");
+
+  assert.ok(resident.includes("_getByUserId("), "the resident inviter lookup is gone");
+  assert.ok(
+    !resident.includes("value.site") && !resident.includes("value.org"),
+    "the resident path must not start trusting a client-supplied site or org",
+  );
+});
+
+test("REGRESSION: the resident handler still validates with schemaInviteVisitor", () => {
+  const resident = fn(controller, "inviteVisitor");
+
+  assert.ok(resident.includes("schemaInviteVisitor.validate("));
+  assert.ok(
+    resident.includes("inviterUserId: req.params.inviterId"),
+    "the resident route still takes its inviter from the path segment",
+  );
+});
+
+test("REGRESSION: schemaInviteVisitor declares no site, org, nric or visitorPass", () => {
+  const model = read("models/visitor-invite.model.ts");
+  const body = model.slice(model.indexOf("export const schemaInviteVisitor"));
+
+  // `members[].nric` is legitimately declared on the resident schema and
+  // always has been. What must never appear is a TOP-LEVEL site, org or
+  // nric, or a member pass number — those are the guard-only fields.
+  const topLevel = body
+    .split(String.fromCharCode(10))
+    .filter((line) => /^ {2}[a-zA-Z]/.test(line))
+    .join(String.fromCharCode(10));
+
+  for (const key of ["site:", "org:", "nric:"]) {
+    assert.ok(
+      !topLevel.includes(key),
+      `${key} appeared on the resident schema — that is the orphan-write trap`,
+    );
+  }
+  assert.ok(
+    !body.includes("visitorPass:"),
+    "visitorPass appeared on the resident schema",
+  );
+  assert.ok(
+    !body.includes("unknown(true)") && !body.includes("allowUnknown"),
+    "the resident schema must keep refusing undeclared keys",
+  );
+});
+
+test("both invitation paths go through ONE write, so they cannot drift apart", () => {
+  const resident = fn(service, "inviteVisitor");
+  const guard = fn(service, "inviteVisitorAsGuard");
+
+  assert.ok(resident.includes("_writeInvitation("));
+  assert.ok(guard.includes("_writeInvitation("));
+});