@7365admin1/core 3.53.1 → 3.53.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.1",
+  "version": "3.53.3",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/console-audit.test.mjs

@@ -298,10 +298,10 @@ test("suspending and reactivating a client both leave a record", () => {
   // The actor is the session the owner guard resolved, never the request body.
   assert.match(
     body,
-    /const (\w+) = await requirePlatformOwner\(req\)/,
+    /const (\w+) = await requirePlatformOwner\(req/,
     "updateStatus no longer takes the actor from the guard",
   );
-  const actorVar = body.match(/const (\w+) = await requirePlatformOwner\(req\)/)[1];
+  const actorVar = body.match(/const (\w+) = await requirePlatformOwner\(req/)[1];
   assert.match(
     body,
     new RegExp(`actor: ${actorVar}`),
@@ -335,7 +335,7 @@ test("a lost audit row cannot undo a suspension", () => {
 // ---------------------------------------------------------------- the read
 
 test("the read is staff-gated, paged, and filterable by client and by date", () => {
-  assert.match(CONTROLLER, /await requirePlatformStaff\(req\)/);
+  assert.match(CONTROLLER, /await requireConsolePermission\(req, "activity-history", "see-activity-history"\)/);
 
   for (const filter of ["org:", "action:", "from:", "to:", "page:", "limit:"]) {
     assert.match(CONTROLLER, new RegExp(filter), `no ${filter} filter`);
@@ -343,7 +343,7 @@ test("the read is staff-gated, paged, and filterable by client and by date", ()
 
   // The gate runs before the read, not after it.
   assert.ok(
-    CONTROLLER.indexOf("await requirePlatformStaff(req)") <
+    CONTROLLER.search(/await requireConsolePermission\(req/) <
       CONTROLLER.indexOf("await _list("),
     "the audit trail is read before the caller is judged",
   );

package/test/console-permission.test.mjs

@@ -0,0 +1,273 @@
+/**
+ * THE SERVER SIDE OF THE SEVEN365 STAFF CONSOLE GATE.
+ *
+ * Twelve controllers ask `requirePlatformStaff` before every console write, and
+ * until now it read ONE thing: is this session a staff membership. It never read
+ * which modules the staff role holds, so a role ticked for Promo Codes alone
+ * still reached subscriptions, platform Terms, the client list and every user on
+ * the platform. `web-app-org` #186 hides those screens from that role; hiding a
+ * screen is drawing, not securing.
+ *
+ * Two halves are proved here and both matter:
+ *
+ *  - the RULE (`console-permission.util.ts`), executed as the shipped module;
+ *  - the WIRING -- that all 45 gate call sites across the twelve controllers
+ *    actually name a module, and that the mapped strings are ones the console's
+ *    own catalogue can grant. A gate reading a string no role editor can tick is
+ *    the `visitor:create` defect, and it looks identical to a working gate in a
+ *    grep.
+ *
+ * The DECISION itself reads the `members` and `roles` collections and cannot run
+ * without a database; it is executed over real HTTP against a throwaway
+ * in-memory MongoDB in `test/e2e/console-permission.e2e.test.mjs`.
+ *
+ * Nothing here opens a socket or a database.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const {
+  CONSOLE_PERMISSIONS,
+  consoleRoleAllows,
+  consoleRoleAllowsAll,
+  consoleSpellings,
+} = await import("./.build/utils/console-permission.util.mjs");
+
+const read = (rel) =>
+  readFileSync(fileURLToPath(new URL(`../src/${rel}`, import.meta.url)), "utf8");
+
+// ---- the rule ------------------------------------------------------------
+
+test("an EMPTY permission list reaches everything - the zero-lockout rule", () => {
+  // `user.service.ts createDefaultUser()` seeds the platform-staff role with
+  // `permissions: []`. If this ever returns false, shipping the gate locks the
+  // Seven365 owner out of their own console.
+  assert.equal(consoleRoleAllowsAll([]), true);
+  for (const resource of Object.keys(CONSOLE_PERMISSIONS)) {
+    assert.equal(consoleRoleAllows([], resource), true, resource);
+    for (const action of CONSOLE_PERMISSIONS[resource]) {
+      assert.equal(
+        consoleRoleAllows([], resource, action),
+        true,
+        `${resource}:${action}`,
+      );
+    }
+  }
+});
+
+test("a missing or null list is treated as empty, not as a refusal", () => {
+  assert.equal(
+    consoleRoleAllows(undefined, "promo-codes", "create-promo-code"),
+    true,
+  );
+  assert.equal(consoleRoleAllows(null, "promo-codes", "create-promo-code"), true);
+});
+
+test("the wildcard reaches everything - the short-circuit staging relies on", () => {
+  // Staging's seeded Super Admin holds `["*"]`, not `[]`. Both must allow all,
+  // because production's own owner role cannot be read from here.
+  assert.equal(consoleRoleAllowsAll(["*"]), true);
+  assert.equal(
+    consoleRoleAllows(["*"], "activity-history", "see-activity-history"),
+    true,
+  );
+  assert.equal(consoleRoleAllows(["*"], "subscriptions"), true);
+});
+
+test("a one-module role reaches that module and nothing else", () => {
+  const held = ["promo-codes:create-promo-code"];
+  assert.equal(consoleRoleAllows(held, "promo-codes", "create-promo-code"), true);
+  assert.equal(consoleRoleAllows(held, "promo-codes", "delete-promo-code"), false);
+  assert.equal(consoleRoleAllows(held, "subscriptions", "manage-subscription"), false);
+  assert.equal(
+    consoleRoleAllows(held, "activity-history", "see-activity-history"),
+    false,
+  );
+});
+
+test("the resource-only question is ANY action on it, exactly as consoleCanSee", () => {
+  // Somebody granted only `delete-promo-code` still has to open Promo Codes.
+  const held = ["promo-codes:delete-promo-code"];
+  assert.equal(consoleRoleAllows(held, "promo-codes"), true);
+  assert.equal(consoleRoleAllows(held, "organizations"), false);
+});
+
+test("both shipped spellings of the roles family are accepted - widening, not swapping", () => {
+  // `-admin`'s role editor writes `roles-and-permissions:add-role`; eight apps
+  // write `roles:add-role`. Picking one would silently un-grant every role
+  // holding the other.
+  assert.equal(
+    consoleRoleAllows(["roles:add-role"], "roles-and-permissions", "add-role"),
+    true,
+  );
+  assert.equal(
+    consoleRoleAllows(
+      ["roles-and-permissions:add-role"],
+      "roles-and-permissions",
+      "add-role",
+    ),
+    true,
+  );
+  assert.deepEqual([...consoleSpellings("roles-and-permissions", "add-role")].sort(), [
+    "roles-and-permissions:add-role",
+    "roles:add-role",
+  ]);
+});
+
+test("CONTROL: an unknown resource is refused a governed role, never waved through", () => {
+  // If this passes, a typo in a controller silently disables its own gate.
+  assert.equal(consoleRoleAllows(["x:y"], "not-a-console-module", "anything"), false);
+  assert.equal(
+    consoleRoleAllows(["promo-codes:create-promo-code"], "promo-kodes"),
+    false,
+  );
+});
+
+test("CONTROL: an action outside the resource's catalogue is refused", () => {
+  assert.equal(
+    consoleRoleAllows(
+      ["organizations:delete-organization"],
+      "organizations",
+      "delete-organization",
+    ),
+    false,
+  );
+});
+
+test("CONTROL: holding the string for a DIFFERENT resource does not grant this one", () => {
+  assert.equal(consoleRoleAllows(["users:see-all-users"], "members", "view-members"), false);
+});
+
+// ---- the catalogue mirrors the console's own ------------------------------
+
+test("the catalogue is the eleven console resources, no more and no less", () => {
+  assert.deepEqual(Object.keys(CONSOLE_PERMISSIONS).sort(), [
+    "activity-history",
+    "invitations",
+    "marketplace-vendors",
+    "members",
+    "organizations",
+    "platform-terms",
+    "promo-codes",
+    "roles-and-permissions",
+    "sp-approvals",
+    "subscriptions",
+    "users",
+  ]);
+});
+
+// ---- the wiring -----------------------------------------------------------
+
+const CONTROLLERS = [
+  "console-audit",
+  "member",
+  "organization-v2",
+  "organization",
+  "platform-terms",
+  "promo-code",
+  "role-v2",
+  "role",
+  "subscription-plan",
+  "subscription",
+  "user-v2",
+  "user",
+];
+
+const GATE =
+  /require(?:ConsolePermission|PlatformStaff|PlatformOwner|SelfOrPlatformStaff|UserFieldWrite)\(req[^\n]*/g;
+
+function gateCalls() {
+  const calls = [];
+  for (const name of CONTROLLERS) {
+    const text = read(`controllers/${name}.controller.ts`);
+    for (const [call] of text.matchAll(GATE)) calls.push([name, call]);
+  }
+  return calls;
+}
+
+test("every console gate call site names a module - all 45 of them", () => {
+  const calls = gateCalls();
+  assert.equal(calls.length, 45, `gate call sites moved: ${calls.length}`);
+
+  const ungoverned = calls.filter(
+    ([, call]) =>
+      !/requireConsolePermission\(req, "/.test(call) && !/resource: "/.test(call),
+  );
+  assert.deepEqual(ungoverned, [], "a console gate still asks identity alone");
+});
+
+test("every module string a controller names is one the catalogue can grant", () => {
+  // The `visitor:create` defect: a server enforcing a string no role editor can
+  // tick is a gate nobody can ever satisfy except through `*` or an empty list.
+  const seen = new Set();
+  for (const [name, call] of gateCalls()) {
+    const direct = call.match(
+      /requireConsolePermission\(req, "([^"]+)"(?:, "([^"]+)")?/,
+    );
+    const object = call.match(/resource: "([^"]+)"(?:, action: "([^"]+)")?/);
+    const [, resource, action] = direct ?? object ?? [];
+    assert.ok(resource, `${name}: ${call}`);
+    assert.ok(CONSOLE_PERMISSIONS[resource], `${name}: unknown resource ${resource}`);
+    if (action) {
+      assert.ok(
+        CONSOLE_PERMISSIONS[resource].includes(action),
+        `${name}: ${resource} has no action ${action}`,
+      );
+    }
+    seen.add(resource);
+  }
+  // Only the resources the twelve controllers actually serve. `sp-approvals`,
+  // `marketplace-vendors` and `invitations` live outside this package.
+  assert.deepEqual([...seen].sort(), [
+    "activity-history",
+    "members",
+    "organizations",
+    "platform-terms",
+    "promo-codes",
+    "roles-and-permissions",
+    "subscriptions",
+    "users",
+  ]);
+});
+
+test("the SELF road is left alone - a person editing their own record needs no module", () => {
+  const authz = read("utils/console-authz.util.ts");
+  const self = authz.slice(
+    authz.indexOf("export async function requireSelfOrPlatformStaff("),
+  );
+  const selfBody = self.slice(0, self.indexOf("\n}\n"));
+  const returnSelf = selfBody.indexOf("return id;");
+  assert.ok(returnSelf > 0, "the self short-circuit is gone");
+  assert.ok(
+    !selfBody.slice(0, returnSelf).includes("consoleRoleAllows"),
+    "the self road must not consult the console catalogue",
+  );
+});
+
+test("the owner tier is still checked BEFORE any module, and cannot be widened by one", () => {
+  const authz = read("utils/console-authz.util.ts");
+  const owner = authz.slice(
+    authz.indexOf("export async function requirePlatformOwner("),
+  );
+  const body = owner.slice(0, owner.indexOf("\n}\n"));
+  assert.ok(
+    body.indexOf("isPlatformOwner") < body.indexOf("if (grant)"),
+    "owner check must come first",
+  );
+  assert.ok(body.includes("throw new UnauthorizedError"), "the owner refusal is gone");
+});
+
+test("staff identity is still required - the module check is layered, never a swap", () => {
+  const authz = read("utils/console-authz.util.ts");
+  const staff = authz.slice(
+    authz.indexOf("export async function requirePlatformStaff("),
+  );
+  const body = staff.slice(0, staff.indexOf("\n}\n"));
+  assert.ok(body.includes("resolveStaffRole"), "identity is no longer resolved");
+  assert.ok(
+    body.indexOf("if (!role)") < body.indexOf("consoleRoleAllows"),
+    "identity must be decided before the module",
+  );
+});

package/test/e2e/console-permission.e2e.test.mjs

@@ -0,0 +1,286 @@
+// End-to-end proof that a Seven365 staff role's MODULES are enforced by the
+// server, not only drawn by the console.
+//
+// `requirePlatformStaff` answered one question -- is this session a staff
+// membership -- and twelve controllers asked it before every console write. It
+// never read which modules the staff role holds. So a staff account onboarded
+// onto a role ticked for Promo Codes alone could still mint a subscription,
+// publish platform Terms, read the whole client list and enumerate every user
+// on the platform. `web-app-org` #186 hides those screens from that role;
+// hiding a screen is drawing, not securing, and none of these endpoints is
+// reached only through a screen.
+//
+// THE ZERO-LOCKOUT RULE IS THE THING THAT MAKES THIS SHIPPABLE, so it is
+// asserted first and hardest. `user.service.ts createDefaultUser()` seeds the
+// platform-staff role with `permissions: []`, while staging's seeded role holds
+// `["*"]`. Production's own owner role cannot be read from here, so the rule has
+// to be correct for BOTH: an empty list means everything, and `"*"` means
+// everything. Cases 1-4 are the owner walking the console with each of those two
+// lists and losing nothing.
+//
+// Everything runs through the real Express stack against the harness's
+// in-process MongoDB replica set. No staging or production database is touched
+// and every seeded value is obviously fake.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Console-Perm-Passw0rd!";
+const UNGOVERNED = "console-perm-empty@e2e.example.com";
+const WILDCARD = "console-perm-star@e2e.example.com";
+const PROMO_ONLY = "console-perm-promo@e2e.example.com";
+const ROLES_LEGACY = "console-perm-roles@e2e.example.com";
+const TENANT = "console-perm-tenant@e2e.example.com";
+
+describe("staff console modules are enforced server-side", { concurrency: 1 }, () => {
+  let h;
+  let id;
+  let ungovernedSid;
+  let wildcardSid;
+  let promoSid;
+  let rolesSid;
+  let tenantSid;
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    id = await seed(h);
+    ungovernedSid = await h.login(UNGOVERNED, PASSWORD);
+    wildcardSid = await h.login(WILDCARD, PASSWORD);
+    promoSid = await h.login(PROMO_ONLY, PASSWORD);
+    rolesSid = await h.login(ROLES_LEGACY, PASSWORD);
+    tenantSid = await h.login(TENANT, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- console permission: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  // `status` is required by the handler's Joi schema, which runs BEFORE the
+  // gate -- an invalid query answers 400 for everyone and would hide the 401.
+  const promoList = (sid) => h.api("/promo-codes/?status=active", { sid });
+  const userList = (sid) => h.api("/users/?status=active", { sid });
+  const subscriptionList = (sid) => h.api("/subscriptions/?status=active", { sid });
+  const orgList = (sid) => h.api("/organizations/v2/?page=1&limit=10", { sid });
+
+  const mintPromo = (sid, code) =>
+    h.api("/promo-codes/", {
+      method: "POST",
+      sid,
+      body: { code, type: "fixed", fixed_rate: 5, description: "e2e" },
+    });
+
+  const createPlatformRole = (sid, name) =>
+    h.api("/roles/", {
+      method: "POST",
+      sid,
+      body: { name, type: "admin", permissions: [] },
+    });
+
+  // ---- the zero-lockout rule ---------------------------------------------
+
+  record("1. EMPTY list: the seeded owner still reaches every console read", async () => {
+    // `createDefaultUser()` writes `permissions: []`. If this fails, shipping
+    // the gate locks the Seven365 owner out of their own console.
+    for (const [label, res] of [
+      ["promo codes", await promoList(ungovernedSid)],
+      ["users", await userList(ungovernedSid)],
+      ["subscriptions", await subscriptionList(ungovernedSid)],
+      ["organizations", await orgList(ungovernedSid)],
+    ]) {
+      assert.equal(res.status, 200, `${label}: ${JSON.stringify(res.body)}`);
+    }
+  });
+
+  record("2. EMPTY list: and every console write", async () => {
+    const minted = await mintPromo(ungovernedSid, "E2EEMPTY1");
+    assert.equal(minted.status, 201, JSON.stringify(minted.body));
+
+    const role = await createPlatformRole(ungovernedSid, "E2E Empty Staff Role");
+    assert.ok(role.status < 400, JSON.stringify(role.body));
+  });
+
+  record('3. "*" reaches everything too -- what staging\'s owner role holds', async () => {
+    for (const res of [
+      await promoList(wildcardSid),
+      await userList(wildcardSid),
+      await subscriptionList(wildcardSid),
+    ]) {
+      assert.equal(res.status, 200, JSON.stringify(res.body));
+    }
+    const minted = await mintPromo(wildcardSid, "E2ESTAR1");
+    assert.equal(minted.status, 201, JSON.stringify(minted.body));
+  });
+
+  // ---- a governed role is actually governed --------------------------------
+
+  record("4. a Promo-Codes-only staff role still mints a promo code", async () => {
+    // Proves the refusals below are the module gate, not a broken route.
+    const minted = await mintPromo(promoSid, "E2EPROMO1");
+    assert.equal(minted.status, 201, JSON.stringify(minted.body));
+  });
+
+  record("5. ...and is refused the platform-wide user list", async () => {
+    const res = await userList(promoSid);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("6. ...the platform-wide subscription list", async () => {
+    const res = await subscriptionList(promoSid);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("7. ...and the client list", async () => {
+    const res = await orgList(promoSid);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("8. a refusal discloses nothing about the records behind it", async () => {
+    const res = await userList(promoSid);
+    const text = JSON.stringify(res.body ?? {});
+    for (const secret of [TENANT, UNGOVERNED, id.tenantOrg.toString()]) {
+      assert.ok(!text.includes(secret), `the refusal leaked ${secret}`);
+    }
+  });
+
+  record("9. the module is per-ACTION, not per-screen", async () => {
+    // The role holds `create-promo-code` and nothing else on the resource. The
+    // LIST is the resource-only question (any action reaches the screen), so it
+    // is allowed; DELETE names an action the role does not hold.
+    const list = await promoList(promoSid);
+    assert.equal(list.status, 200, JSON.stringify(list.body));
+
+    const removed = await h.api(`/promo-codes/${id.promo.toString()}`, {
+      method: "DELETE",
+      sid: promoSid,
+    });
+    assert.equal(removed.status, 401, JSON.stringify(removed.body));
+  });
+
+  record("10. the owner's ungoverned account can still delete it", async () => {
+    // Case 9's control: the DELETE route works, so the 401 above is the module.
+    const removed = await h.api(`/promo-codes/${id.promo.toString()}`, {
+      method: "DELETE",
+      sid: ungovernedSid,
+    });
+    assert.ok(removed.status < 400, JSON.stringify(removed.body));
+  });
+
+  // ---- widening, not swapping ---------------------------------------------
+
+  record("11. the legacy roles spelling is accepted -- no role migration needed", async () => {
+    // This role holds `roles:add-role`. `-admin`'s editor writes
+    // `roles-and-permissions:add-role`. Picking one spelling would silently
+    // un-grant every role holding the other.
+    const role = await createPlatformRole(rolesSid, "E2E Legacy Spelling Role");
+    assert.ok(role.status < 400, JSON.stringify(role.body));
+  });
+
+  record("12. ...and that role reaches nothing else on the console", async () => {
+    const res = await promoList(rolesSid);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  // ---- staff identity is unchanged ----------------------------------------
+
+  record("13. a tenant admin is still refused the console entirely", async () => {
+    // The module check is layered ON TOP of the staff identity test, never in
+    // place of it. Nobody who was refused before is admitted now.
+    for (const res of [
+      await promoList(tenantSid),
+      await userList(tenantSid),
+      await subscriptionList(tenantSid),
+      await mintPromo(tenantSid, "E2ETENANT1"),
+    ]) {
+      assert.equal(res.status, 401, JSON.stringify(res.body));
+    }
+  });
+
+  record("14. no session at all is still refused", async () => {
+    const res = await promoList();
+    assert.equal(res.status, 401, JSON.stringify(res.status));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const hashed = await h.hashPassword(PASSWORD);
+
+  const tenantOrg = new ObjectId();
+  const tenantRole = new ObjectId();
+  const emptyRole = new ObjectId();
+  const starRole = new ObjectId();
+  const promoRole = new ObjectId();
+  const rolesRole = new ObjectId();
+  const promo = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: tenantOrg,
+    name: "Console Perm Tenant",
+    email: "console-perm-tenant-org@e2e.example.com",
+    type: "property-management",
+    status: "active",
+    createdAt: now,
+  });
+
+  await h.db.collection("roles").insertMany([
+    // Staff is a MEMBERSHIP of type "admin" whose role is ALSO type "admin".
+    // A role merely NAMED "Super Admin" is not staff -- see `super-admin.util.ts`.
+    { _id: emptyRole, name: "Super Admin", type: "admin", default: true, status: "active", permissions: [] },
+    { _id: starRole, name: "Staff Wildcard", type: "admin", status: "active", permissions: ["*"] },
+    { _id: promoRole, name: "Staff Promo Only", type: "admin", status: "active", permissions: ["promo-codes:create-promo-code"] },
+    // The MINORITY spelling. Eight apps write this; `-admin` writes
+    // `roles-and-permissions:add-role`. Both must pass.
+    { _id: rolesRole, name: "Staff Roles Legacy", type: "admin", status: "active", permissions: ["roles:add-role"] },
+    { _id: tenantRole, name: "Organisation Admin", org: tenantOrg, status: "active", permissions: ["*"] },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: UNGOVERNED, password: hashed, name: "Ungoverned Staff", status: "active", createdAt: now },
+    { email: WILDCARD, password: hashed, name: "Wildcard Staff", status: "active", createdAt: now },
+    { email: PROMO_ONLY, password: hashed, name: "Promo Staff", status: "active", createdAt: now },
+    { email: ROLES_LEGACY, password: hashed, name: "Roles Staff", status: "active", createdAt: now },
+    { email: TENANT, password: hashed, name: "Tenant Admin", status: "active", defaultOrg: tenantOrg.toString(), createdAt: now },
+  ]);
+
+  const [empty, star, promoUser, rolesUser, tenant] = [0, 1, 2, 3, 4].map(
+    (i) => users.insertedIds[i],
+  );
+
+  await h.db.collection("members").insertMany([
+    { user: empty, type: "admin", role: emptyRole, status: "active" },
+    { user: star, type: "admin", role: starRole, status: "active" },
+    { user: promoUser, type: "admin", role: promoRole, status: "active" },
+    { user: rolesUser, type: "admin", role: rolesRole, status: "active" },
+    { user: tenant, org: tenantOrg, role: tenantRole, type: "organization", status: "active" },
+  ]);
+
+  await h.db.collection("promo-codes").insertOne({
+    _id: promo,
+    code: "E2ESEEDED1",
+    type: "fixed",
+    fixed_rate: 5,
+    status: "active",
+    createdAt: now,
+  });
+
+  return { tenantOrg, promo };
+}

package/test/file-delete-scope.test.mjs

@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const { fileOwnerId, mayDeleteFile } = await import("./.build/utils/file-owner.util.mjs");
+
+const A = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const B = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const ORG_1 = "111111111111111111111111";
+const ORG_2 = "222222222222222222222222";
+
+test("a caller deletes their own new file", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: A, callerOrgIds: [ORG_1], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("a caller deletes another tenant's new file — refused", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerOrgIds: [ORG_2], ownerOrgIds: [ORG_1] }),
+    false,
+  );
+});
+
+test("a legacy row with no ownership behaves unchanged", () => {
+  assert.equal(mayDeleteFile({ ownerId: "", callerId: B, callerOrgIds: [ORG_2] }), true);
+  assert.equal(fileOwnerId({ name: "old.pdf" }), "");
+});
+
+test("same tenant, different person, is still allowed", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerOrgIds: [ORG_2, ORG_1], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("an anonymous caller cannot delete a stamped file", () => {
+  assert.equal(mayDeleteFile({ ownerId: A, callerId: "", callerOrgIds: [ORG_1] }), false);
+});
+
+test("super admin keeps its bypass", () => {
+  assert.equal(
+    mayDeleteFile({ ownerId: A, callerId: B, callerIsSuperAdmin: true, callerOrgIds: [], ownerOrgIds: [ORG_1] }),
+    true,
+  );
+});
+
+test("fileOwnerId reads an ObjectId-shaped stamp", () => {
+  assert.equal(fileOwnerId({ createdBy: { toString: () => A } }), A);
+  assert.equal(fileOwnerId(null), "");
+});
+
+test("the controller wires the gate on delete and stamps on upload", () => {
+  const src = readFileSync(new URL("../src/controllers/file.controller.ts", import.meta.url), "utf8");
+  assert.match(src, /mayDeleteFile/, "delete must consult the ownership gate");
+  assert.match(src, /callerId\(req\)/, "the stamp and the gate come from the session, never the body");
+  assert.doesNotMatch(src, /req\.body\.createdBy/, "the owner is never taken from the request body");
+});
+
+test("the model carries the optional stamp", () => {
+  const src = readFileSync(new URL("../src/models/file.model.ts", import.meta.url), "utf8");
+  assert.match(src, /createdBy\?:/, "createdBy is optional — no existing row is invalidated");
+});