@7365admin1/core 3.53.0 → 3.53.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.0",
+  "version": "3.53.1",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/role-site-scope.e2e.test.mjs

@@ -0,0 +1,204 @@
+// End-to-end proof that a role created on one SITE does not appear on another
+// site of the same client.
+//
+// The owner reported it in these words: "the roles and permission per site that
+// create on specific site it should stay on that specific site alone, not
+// connected to other clients or other sites."
+//
+// The client half was already closed -- `GET /api/roles?org=` runs through
+// `requireOrgReach`, and `org-scoping-roles-members.e2e.test.mjs` holds it. The
+// SITE half was not closed at all: every one of the seven site apps renders
+// `RolePermissionMain` with the site in the URL, the role is CREATED carrying
+// that site (`createRole` accepts `site`, `MRole` stores it), and then the list
+// query -- `{ status: "active", org }` -- never mentioned it. So Seventh
+// Condominium's roles-and-permissions screen listed every role of every estate
+// that client owns, with Edit and Delete on each.
+//
+// What must NOT change, and is asserted here as hard as the leak itself: a role
+// with no site is the organisation's own and stays visible on every site. Every
+// role stored before the `site` field existed is in that shape, so a filter
+// that dropped them would have hidden roles that are the only way to edit
+// themselves.
+//
+// Everything here is created and thrown away by the harness: an in-process
+// MongoDB replica set, a loopback Redis, a loopback mail sink. No staging or
+// production database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "SiteScope-Passw0rd!";
+const ADMIN = "site-scope-admin@e2e.example.com"; // an org member, reaches both sites
+
+describe("a site's roles list is scoped to that site", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+  let sid;
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- role site scoping: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const names = async (query) => {
+    const res = await h.api(`/roles?${query}`, { sid });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    return (res.body.items ?? []).map((r) => r.name).sort();
+  };
+
+  record("0. baseline — the admin signs in and sees all four roles", async () => {
+    sid = await h.login(ADMIN, PASSWORD);
+    assert.ok(sid);
+    assert.deepEqual(await names(`org=${id.org}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+      "Site B Guard",
+    ]);
+  });
+
+  record("1. site A's screen does not list site B's role", async () => {
+    const listed = await names(`org=${id.org}&site=${id.siteA}&limit=50`);
+    assert.ok(
+      !listed.includes("Site B Guard"),
+      `site B's role leaked onto site A: ${JSON.stringify(listed)}`,
+    );
+  });
+
+  record("2. and site B's screen does not list site A's role", async () => {
+    const listed = await names(`org=${id.org}&site=${id.siteB}&limit=50`);
+    assert.ok(
+      !listed.includes("Site A Guard"),
+      `site A's role leaked onto site B: ${JSON.stringify(listed)}`,
+    );
+  });
+
+  record("3. each site still sees its OWN role and the org-wide ones", async () => {
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteA}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+    ]);
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteB}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site B Guard",
+    ]);
+  });
+
+  record("4. a second site's answer is not the first one's, out of the cache", async () => {
+    // The list is cached in Redis for 15 minutes on a key built from the query.
+    // Asking twice in the opposite order is what catches a `site` that filters
+    // but is missing from the cache key -- the case where the fix works once and
+    // is decorative after that.
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteB}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site B Guard",
+    ]);
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteA}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+    ]);
+  });
+
+  record("5. asking without a site is unchanged — the whole client", async () => {
+    assert.deepEqual(await names(`org=${id.org}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+      "Site B Guard",
+    ]);
+  });
+
+  record("6. a role created through the API carries its site and stays there", async () => {
+    const res = await h.api("/roles", {
+      method: "POST",
+      sid,
+      body: {
+        name: "Site A Supervisor",
+        permissions: ["feedback:see-all-feedbacks"],
+        type: "property_management_agency",
+        org: id.org.toString(),
+        site: id.siteA.toString(),
+        platform: "website",
+      },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    assert.ok((await names(`org=${id.org}&site=${id.siteA}&limit=50`)).includes("Site A Supervisor"));
+    assert.ok(!(await names(`org=${id.org}&site=${id.siteB}&limit=50`)).includes("Site A Supervisor"));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const siteA = new ObjectId();
+  const siteB = new ObjectId();
+  const adminRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org,
+    name: "Site Scope Org",
+    email: "site-scope@e2e.example.com",
+    type: "org",
+    nature: "property_management_agency",
+    status: "active",
+    createdAt: now,
+  });
+
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "Site A", org, orgId: org, status: "active" },
+    { _id: siteB, name: "Site B", org, orgId: org, status: "active" },
+  ]);
+
+  await h.db.collection("roles").insertMany([
+    // the caller's own role, org-wide
+    { _id: adminRole, name: "Org Wide", org, site: "", permissions: ["*"], type: "property_management_agency", status: "active" },
+    // the shape every role stored before the `site` field existed has: no key
+    { name: "Org Wide Legacy", org, permissions: ["*"], type: "property_management_agency", status: "active" },
+    { name: "Site A Guard", org, site: siteA, permissions: [], type: "property_management_agency", status: "active" },
+    { name: "Site B Guard", org, site: siteB, permissions: [], type: "property_management_agency", status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: ADMIN, name: "site-scope-admin", status: "active", createdAt: now },
+  ]);
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: ADMIN }, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertOne({
+    user: users.insertedIds[0],
+    org,
+    type: "property_management_agency",
+    role: adminRole,
+    status: "active",
+  });
+
+  return { org, siteA, siteB };
+}