@7365admin1/core 3.52.8 → 3.52.9

package/dist/index.mjs

@@ -13433,20 +13433,7 @@ async function resolveInviteActor(userId) {
       members.map((m) => m.role?.toString?.() ?? "").filter((r) => r && ObjectId25.isValid(r))
     )
   );
-  const orgLevelRoleIds = /* @__PURE__ */ new Set();
-  if (memberRoleIds.length) {
-    const memberRoles = await db2.collection("roles").find(
-      {
-        _id: { $in: memberRoleIds.map((r) => new ObjectId25(r)) },
-        ...LIVE_ROLE
-      },
-      { projection: { site: 1 } }
-    ).toArray();
-    for (const role of memberRoles) {
-      if (!role.site)
-        orgLevelRoleIds.add(role._id.toString());
-    }
-  }
+  const orgLevelRoleIds = await orgLevelRoles(db2, memberRoleIds);
   return {
     id,
     name: user?.name ?? adminMember?.name ?? "",
@@ -13490,6 +13477,25 @@ async function hasOrgInvitation(userId, orgId) {
   );
   return Boolean(invite);
 }
+async function orgLevelRoles(db2, roles) {
+  const ids2 = Array.from(
+    new Set(
+      roles.map((role) => role?.toString?.() ?? "").filter((role) => role && ObjectId25.isValid(role))
+    )
+  );
+  const orgLevel = /* @__PURE__ */ new Set();
+  if (!ids2.length)
+    return orgLevel;
+  const docs = await db2.collection("roles").find(
+    { _id: { $in: ids2.map((id) => new ObjectId25(id)) }, ...LIVE_ROLE },
+    { projection: { site: 1 } }
+  ).toArray();
+  for (const role of docs) {
+    if (!role.site)
+      orgLevel.add(role._id.toString());
+  }
+  return orgLevel;
+}
 
 // src/services/service-provider-invite.service.ts
 import {
@@ -23884,6 +23890,13 @@ function cameraGrant(params) {
     return atSite;
   const atOrg = org ? params.memberships.find(
     (membership) => !idOf(membership.siteId) && idOf(membership.org) === org
+  ) ?? // Owner rule, 2026-09-02, reconciled with the LIST half (`orgSiteScope`):
+  // an ORGANISATION-LEVEL role reaches every site of its own organisation
+  // even when its membership row also names a `siteId`. Asked SECOND so a
+  // site-less membership still grants first and nobody's granting row — and
+  // so nobody's permissions — changes.
+  params.memberships.find(
+    (membership) => membership.orgLevelRole === true && idOf(membership.org) === org
   ) : void 0;
   if (atOrg)
     return atOrg;
@@ -25351,11 +25364,22 @@ function useCameraViewService() {
         engagedOrgs.add(String(engagement.org));
       }
     }
+    const siteOrg = idText(params.site?.orgId ?? params.site?.org);
+    const widenable = memberships.filter(
+      (membership) => idText(membership.siteId) && idText(membership.siteId) !== String(params.siteObjectId) && siteOrg && idText(membership.org) === siteOrg
+    );
+    const orgLevel = widenable.length ? await orgLevelRoles(
+      params.db,
+      widenable.map((membership) => membership.role)
+    ) : /* @__PURE__ */ new Set();
     const grant = cameraGrant({
       cameraSite: params.siteObjectId,
       // `orgId` is the real field; `org` is kept as a fallback only.
       cameraOrg: params.site?.orgId ?? params.site?.org,
-      memberships,
+      memberships: orgLevel.size ? memberships.map((membership) => ({
+        ...membership,
+        orgLevelRole: orgLevel.has(idText(membership.role))
+      })) : memberships,
       engagedOrgs
     });
     return { memberships, grant };
@@ -25939,6 +25963,9 @@ function maxConcurrentGrabs() {
 }
 var inFlightGrabs = 0;
 var LAST_FRAME_TTL_SECONDS = 60 * 60;
+function idText(value) {
+  return value ? String(value) : "";
+}
 
 // src/utils/site-reach.util.ts
 async function requireSiteReach(req, site, permission) {
@@ -91869,6 +91896,7 @@ export {
   occasionForStatus,
   occurrence_book_namespace_collection,
   online_forms_namespace_collection,
+  orgLevelRoles,
   orgSchema,
   orgSiteScope,
   overnight_parking_requests_namespace_collection,