@7365admin1/core 3.53.1 → 3.53.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.1",
+  "version": "3.53.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/file-delete-scope.test.mjs

@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const { fileOwnerId, mayDeleteFile } = await import("./.build/utils/file-owner.util.mjs");
+
+const A = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const B = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const ORG_1 = "111111111111111111111111";
+const ORG_2 = "222222222222222222222222";
+
+test("a caller deletes their own new file", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: A, callerOrgIds: [ORG_1], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("a caller deletes another tenant's new file — refused", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerOrgIds: [ORG_2], ownerOrgIds: [ORG_1] }),
+    false,
+  );
+});
+
+test("a legacy row with no ownership behaves unchanged", () => {
+  assert.equal(mayDeleteFile({ ownerId: "", callerId: B, callerOrgIds: [ORG_2] }), true);
+  assert.equal(fileOwnerId({ name: "old.pdf" }), "");
+});
+
+test("same tenant, different person, is still allowed", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerOrgIds: [ORG_2, ORG_1], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("an anonymous caller cannot delete a stamped file", () => {
+  assert.equal(mayDeleteFile({ ownerId: A, callerId: "", callerOrgIds: [ORG_1] }), false);
+});
+
+test("super admin keeps its bypass", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerIsSuperAdmin: true, callerOrgIds: [], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("fileOwnerId reads an ObjectId-shaped stamp", () => {
+  assert.equal(fileOwnerId({ createdBy: { toString: () => A } }), A);
+  assert.equal(fileOwnerId(null), "");
+});
+
+test("the controller wires the gate on delete and stamps on upload", () => {
+  const src = readFileSync(new URL("../src/controllers/file.controller.ts", import.meta.url), "utf8");
+  assert.match(src, /mayDeleteFile/, "delete must consult the ownership gate");
+  assert.match(src, /callerId\(req\)/, "the stamp and the gate come from the session, never the body");
+  assert.doesNotMatch(src, /req\.body\.createdBy/, "the owner is never taken from the request body");
+});
+
+test("the model carries the optional stamp", () => {
+  const src = readFileSync(new URL("../src/models/file.model.ts", import.meta.url), "utf8");
+  assert.match(src, /createdBy\?:/, "createdBy is optional — no existing row is invalidated");
+});