@7365admin1/core 3.53.0 → 3.53.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.0",
+  "version": "3.53.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/role-site-scope.e2e.test.mjs

@@ -0,0 +1,204 @@
+// End-to-end proof that a role created on one SITE does not appear on another
+// site of the same client.
+//
+// The owner reported it in these words: "the roles and permission per site that
+// create on specific site it should stay on that specific site alone, not
+// connected to other clients or other sites."
+//
+// The client half was already closed -- `GET /api/roles?org=` runs through
+// `requireOrgReach`, and `org-scoping-roles-members.e2e.test.mjs` holds it. The
+// SITE half was not closed at all: every one of the seven site apps renders
+// `RolePermissionMain` with the site in the URL, the role is CREATED carrying
+// that site (`createRole` accepts `site`, `MRole` stores it), and then the list
+// query -- `{ status: "active", org }` -- never mentioned it. So Seventh
+// Condominium's roles-and-permissions screen listed every role of every estate
+// that client owns, with Edit and Delete on each.
+//
+// What must NOT change, and is asserted here as hard as the leak itself: a role
+// with no site is the organisation's own and stays visible on every site. Every
+// role stored before the `site` field existed is in that shape, so a filter
+// that dropped them would have hidden roles that are the only way to edit
+// themselves.
+//
+// Everything here is created and thrown away by the harness: an in-process
+// MongoDB replica set, a loopback Redis, a loopback mail sink. No staging or
+// production database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "SiteScope-Passw0rd!";
+const ADMIN = "site-scope-admin@e2e.example.com"; // an org member, reaches both sites
+
+describe("a site's roles list is scoped to that site", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+  let sid;
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- role site scoping: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const names = async (query) => {
+    const res = await h.api(`/roles?${query}`, { sid });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    return (res.body.items ?? []).map((r) => r.name).sort();
+  };
+
+  record("0. baseline — the admin signs in and sees all four roles", async () => {
+    sid = await h.login(ADMIN, PASSWORD);
+    assert.ok(sid);
+    assert.deepEqual(await names(`org=${id.org}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+      "Site B Guard",
+    ]);
+  });
+
+  record("1. site A's screen does not list site B's role", async () => {
+    const listed = await names(`org=${id.org}&site=${id.siteA}&limit=50`);
+    assert.ok(
+      !listed.includes("Site B Guard"),
+      `site B's role leaked onto site A: ${JSON.stringify(listed)}`,
+    );
+  });
+
+  record("2. and site B's screen does not list site A's role", async () => {
+    const listed = await names(`org=${id.org}&site=${id.siteB}&limit=50`);
+    assert.ok(
+      !listed.includes("Site A Guard"),
+      `site A's role leaked onto site B: ${JSON.stringify(listed)}`,
+    );
+  });
+
+  record("3. each site still sees its OWN role and the org-wide ones", async () => {
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteA}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+    ]);
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteB}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site B Guard",
+    ]);
+  });
+
+  record("4. a second site's answer is not the first one's, out of the cache", async () => {
+    // The list is cached in Redis for 15 minutes on a key built from the query.
+    // Asking twice in the opposite order is what catches a `site` that filters
+    // but is missing from the cache key -- the case where the fix works once and
+    // is decorative after that.
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteB}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site B Guard",
+    ]);
+    assert.deepEqual(await names(`org=${id.org}&site=${id.siteA}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+    ]);
+  });
+
+  record("5. asking without a site is unchanged — the whole client", async () => {
+    assert.deepEqual(await names(`org=${id.org}&limit=50`), [
+      "Org Wide",
+      "Org Wide Legacy",
+      "Site A Guard",
+      "Site B Guard",
+    ]);
+  });
+
+  record("6. a role created through the API carries its site and stays there", async () => {
+    const res = await h.api("/roles", {
+      method: "POST",
+      sid,
+      body: {
+        name: "Site A Supervisor",
+        permissions: ["feedback:see-all-feedbacks"],
+        type: "property_management_agency",
+        org: id.org.toString(),
+        site: id.siteA.toString(),
+        platform: "website",
+      },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    assert.ok((await names(`org=${id.org}&site=${id.siteA}&limit=50`)).includes("Site A Supervisor"));
+    assert.ok(!(await names(`org=${id.org}&site=${id.siteB}&limit=50`)).includes("Site A Supervisor"));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const siteA = new ObjectId();
+  const siteB = new ObjectId();
+  const adminRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org,
+    name: "Site Scope Org",
+    email: "site-scope@e2e.example.com",
+    type: "org",
+    nature: "property_management_agency",
+    status: "active",
+    createdAt: now,
+  });
+
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "Site A", org, orgId: org, status: "active" },
+    { _id: siteB, name: "Site B", org, orgId: org, status: "active" },
+  ]);
+
+  await h.db.collection("roles").insertMany([
+    // the caller's own role, org-wide
+    { _id: adminRole, name: "Org Wide", org, site: "", permissions: ["*"], type: "property_management_agency", status: "active" },
+    // the shape every role stored before the `site` field existed has: no key
+    { name: "Org Wide Legacy", org, permissions: ["*"], type: "property_management_agency", status: "active" },
+    { name: "Site A Guard", org, site: siteA, permissions: [], type: "property_management_agency", status: "active" },
+    { name: "Site B Guard", org, site: siteB, permissions: [], type: "property_management_agency", status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: ADMIN, name: "site-scope-admin", status: "active", createdAt: now },
+  ]);
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: ADMIN }, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertOne({
+    user: users.insertedIds[0],
+    org,
+    type: "property_management_agency",
+    role: adminRole,
+    status: "active",
+  });
+
+  return { org, siteA, siteB };
+}

package/test/file-delete-scope.test.mjs

@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const { fileOwnerId, mayDeleteFile } = await import("./.build/utils/file-owner.util.mjs");
+
+const A = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const B = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const ORG_1 = "111111111111111111111111";
+const ORG_2 = "222222222222222222222222";
+
+test("a caller deletes their own new file", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: A, callerOrgIds: [ORG_1], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("a caller deletes another tenant's new file — refused", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerOrgIds: [ORG_2], ownerOrgIds: [ORG_1] }),
+    false,
+  );
+});
+
+test("a legacy row with no ownership behaves unchanged", () => {
+  assert.equal(mayDeleteFile({ ownerId: "", callerId: B, callerOrgIds: [ORG_2] }), true);
+  assert.equal(fileOwnerId({ name: "old.pdf" }), "");
+});
+
+test("same tenant, different person, is still allowed", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerOrgIds: [ORG_2, ORG_1], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("an anonymous caller cannot delete a stamped file", () => {
+  assert.equal(mayDeleteFile({ ownerId: A, callerId: "", callerOrgIds: [ORG_1] }), false);
+});
+
+test("super admin keeps its bypass", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerIsSuperAdmin: true, callerOrgIds: [], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("fileOwnerId reads an ObjectId-shaped stamp", () => {
+  assert.equal(fileOwnerId({ createdBy: { toString: () => A } }), A);
+  assert.equal(fileOwnerId(null), "");
+});
+
+test("the controller wires the gate on delete and stamps on upload", () => {
+  const src = readFileSync(new URL("../src/controllers/file.controller.ts", import.meta.url), "utf8");
+  assert.match(src, /mayDeleteFile/, "delete must consult the ownership gate");
+  assert.match(src, /callerId\(req\)/, "the stamp and the gate come from the session, never the body");
+  assert.doesNotMatch(src, /req\.body\.createdBy/, "the owner is never taken from the request body");
+});
+
+test("the model carries the optional stamp", () => {
+  const src = readFileSync(new URL("../src/models/file.model.ts", import.meta.url), "utf8");
+  assert.match(src, /createdBy\?:/, "createdBy is optional — no existing row is invalidated");
+});