@7365admin1/core 3.52.9 → 3.52.10

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.52.9",
+  "version": "3.52.10",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/vehicle-site-scope.test.mjs

@@ -0,0 +1,128 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { entitledSiteScope } from "./.build/utils/camera-view.util.mjs";
+
+/**
+ * `GET /api/vehicles` and `GET /api/vehicles/blocklisted` take an OPTIONAL
+ * `site`, and a request that omitted it applied no site predicate at all:
+ * `if (site) await requireSiteReach(...)` in the controller and
+ * `...(site && { site })` in the repository. Measured read-only on staging,
+ * 2026-09-03: one such call from the MA app's vehicle screen came back with 148
+ * vehicles belonging to four unrelated clients.
+ *
+ * The DECISION is `entitledSiteScope` and is covered here directly. The WIRING
+ * — that the controller asks for the scope and the repository applies it — needs
+ * a live Atlas connection to run, so it is asserted on the source, exactly as
+ * `camera-entitlement-wiring.test.mjs` does for the camera paths.
+ */
+
+const ORG_A = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const ORG_B = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const SITE_A1 = "a1a1a1a1a1a1a1a1a1a1a1a1";
+const SITE_A2 = "a2a2a2a2a2a2a2a2a2a2a2a2";
+const SITE_B1 = "b1b1b1b1b1b1b1b1b1b1b1b1";
+
+const sitesByOrg = { [ORG_A]: [SITE_A1, SITE_A2], [ORG_B]: [SITE_B1] };
+
+test("a site-level role reaches only its own site", () => {
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: false }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual(scope, [SITE_A1]);
+  assert.ok(!scope.includes(SITE_A2), "must not reach a sibling site");
+  assert.ok(!scope.includes(SITE_B1), "must never reach another organisation");
+});
+
+test("an org-level role reaches its whole organisation and no other", () => {
+  // The row also NAMES a site — the case that was the defect in the first cut of
+  // the camera change (owner decision, 2026-09-02: org-level roles see all
+  // sites).
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: true }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual([...scope].sort(), [SITE_A1, SITE_A2].sort());
+  assert.ok(!scope.includes(SITE_B1), "must never reach another organisation");
+});
+
+test("a membership carrying no site is org-wide", () => {
+  const scope = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: "", orgLevelRole: false }],
+    sitesByOrg,
+    engagedSitesByOrg: {},
+  });
+
+  assert.deepEqual([...scope].sort(), [SITE_A1, SITE_A2].sort());
+});
+
+test("an engagement grants only through a membership with no site", () => {
+  const engagedSitesByOrg = { [ORG_A]: [SITE_B1] };
+
+  const orgWide = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: "", orgLevelRole: false }],
+    sitesByOrg,
+    engagedSitesByOrg,
+  });
+  assert.ok(orgWide.includes(SITE_B1), "an agency's org-level staff reach it");
+
+  // A membership PINNED to a site never grants a different site — the same rule
+  // `cameraGrant` applies (owner decision, 2026-08-10).
+  const pinned = entitledSiteScope({
+    memberships: [{ org: ORG_A, siteId: SITE_A1, orgLevelRole: false }],
+    sitesByOrg,
+    engagedSitesByOrg,
+  });
+  assert.deepEqual(pinned, [SITE_A1]);
+});
+
+test("no membership is an empty scope, not an unrestricted one", () => {
+  assert.deepEqual(
+    entitledSiteScope({ memberships: [], sitesByOrg, engagedSitesByOrg: {} }),
+    [],
+  );
+});
+
+const controller = readFileSync(
+  fileURLToPath(new URL("../src/controllers/vehicle.controller.ts", import.meta.url)),
+  "utf8",
+);
+const repo = readFileSync(
+  fileURLToPath(new URL("../src/repositories/vehicle.repo.ts", import.meta.url)),
+  "utf8",
+);
+
+test("both vehicle lists resolve a scope when no site is named", () => {
+  const asked = controller.match(/const siteScope = site \? null : await entitledSites\(req\);/g);
+  assert.equal(asked?.length, 2, "the list and the blocklist both ask");
+
+  // An explicitly supplied site is still authorised, and never trusted.
+  assert.equal(
+    controller.match(/if \(site\) await requireSiteReach\(req, site\);/g)?.length,
+    2,
+  );
+
+  assert.ok(
+    controller.includes("        siteScope,\n"),
+    "the scope must reach the repository, not be resolved and dropped",
+  );
+});
+
+test("the repository applies an empty scope rather than dropping it", () => {
+  const applied = repo.match(/\.\.\.\(siteScope\n/g);
+  assert.equal(applied?.length, 2, "both queries carry the predicate");
+
+  // `siteScope && siteScope.length` here would turn "reaches no site" back into
+  // "sees everything", which is the whole defect.
+  assert.ok(
+    !/siteScope\?\.length|siteScope && siteScope\.length/.test(repo),
+    "an empty array must not collapse into the no-restriction branch",
+  );
+});