@7365admin1/core 3.52.8 → 3.52.9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.8",
+  "version": "3.52.9",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/camera-view.util.test.mjs

@@ -132,6 +132,7 @@ const SITE = "6923d6664150ca6a69b9f2b2";
 const OWNER_ORG = "6923d6664150ca6a69b9f000";
 const AGENCY_ORG = "6923d6664150ca6a69b9f111";
 const OTHER_ORG = "6923d6664150ca6a69b9f222";
+const OTHER_SITE = "6923d6664150ca6a69b9f333";
 
 test("an org-level member of an engaged organisation reaches the engaged site", () => {
   assert.equal(
@@ -1102,3 +1103,134 @@ test("orgSiteScope: an unresolved role fails closed — it does not widen", () =
     [SCOPE_SITE_A],
   );
 });
+
+/**
+ * The camera side of the site-scope rule, reconciled with the LIST side.
+ *
+ * `orgSiteScope` (below) was changed on 2026-09-02 to the owner's rule: an
+ * ORGANISATION-LEVEL role sees every site of its organisation even when its
+ * membership row also names a `siteId`. `cameraGrant` kept the older, stricter
+ * reading — `!siteId` only — so the switcher offered those people sites the
+ * camera view then refused. Both halves must say the same thing or the menu is
+ * lying.
+ *
+ * Site-level roles are NOT widened: a membership pinned to a site whose role
+ * belongs to that site reaches that site and no other. Widening those would be
+ * a cross-tenant leak, not a reconciliation.
+ */
+const ORG_LEVEL = { orgLevelRole: true };
+
+test("an org-level ROLE reaches the org's other sites even when its row names a site", () => {
+  // The ~8 users this change is for: `Org Owner`-shaped roles whose membership
+  // row carries a stray siteId. The list offers them every site; the camera
+  // path refused every site but one.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OWNER_ORG, siteId: OTHER_SITE, role: "org-role", ...ORG_LEVEL }],
+    })?.role,
+    "org-role",
+  );
+
+  // Shape 2 — the same role with NO siteId still passes, unchanged.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OWNER_ORG, role: "org-role", ...ORG_LEVEL }],
+    })?.role,
+    "org-role",
+  );
+});
+
+test("a SITE-level role pinned to another site is still refused — no cross-tenant widening", () => {
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OWNER_ORG, siteId: OTHER_SITE, role: "site-role" }],
+    }),
+    null,
+  );
+
+  // Absent/unresolvable is read as site-level — the narrowing side.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [
+        { org: OWNER_ORG, siteId: OTHER_SITE, role: "site-role", orgLevelRole: false },
+        { org: OWNER_ORG, siteId: OTHER_SITE, role: "unknown-role", orgLevelRole: undefined },
+      ],
+    }),
+    null,
+  );
+
+  // ...and it still reaches its OWN site.
+  assert.equal(
+    cameraGrant({
+      cameraSite: OTHER_SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OWNER_ORG, siteId: OTHER_SITE, role: "site-role" }],
+    })?.role,
+    "site-role",
+  );
+});
+
+test("an org-level role in ANOTHER organisation reaches nothing", () => {
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OTHER_ORG, siteId: OTHER_SITE, role: "org-role", ...ORG_LEVEL }],
+    }),
+    null,
+  );
+
+  // The engagement branch is NOT widened by this change: the owner's decision
+  // of 2026-08-10 stands — an agency's site-pinned staff reach their own site
+  // only, whatever their role's level. The list half does not widen here
+  // either, so the two still agree.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: AGENCY_ORG, siteId: OTHER_SITE, role: "org-role", ...ORG_LEVEL }],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    }),
+    null,
+  );
+});
+
+test("a site-less membership still wins, so nobody's permissions change", () => {
+  // Widening must not re-point the GRANTING membership: whoever passed before
+  // must pass on the same row, or their role — and so their permissions —
+  // silently change.
+  const memberships = [
+    { org: OWNER_ORG, siteId: OTHER_SITE, role: "pinned-org-role", ...ORG_LEVEL },
+    { org: OWNER_ORG, role: "site-less-role" },
+  ];
+  assert.equal(
+    cameraGrant({ cameraSite: SITE, cameraOrg: OWNER_ORG, memberships })?.role,
+    "site-less-role",
+  );
+  assert.equal(
+    cameraGrant({ cameraSite: SITE, cameraOrg: OWNER_ORG, memberships: [...memberships].reverse() })?.role,
+    "site-less-role",
+    "document order must not decide which membership grants",
+  );
+
+  // And a membership AT the site still beats the widened branch.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [
+        { org: OWNER_ORG, siteId: OTHER_SITE, role: "pinned-org-role", ...ORG_LEVEL },
+        { org: OTHER_ORG, siteId: SITE, role: "at-the-site" },
+      ],
+    })?.role,
+    "at-the-site",
+  );
+});