@7365admin1/core 3.53.1 → 3.53.3

package/test/member-scope.test.mjs

@@ -47,7 +47,7 @@ test("the type=admin bypass is closed, and closed to staff only", () => {
 
   assert.match(
     body,
-    /if \(type === "admin"\)[\s\S]{0,120}await requirePlatformStaff\(req\)/,
+    /if \(type === "admin"\)[\s\S]{0,120}await requireConsolePermission\(req/,
     "type=admin must be staff-only, not merely allowed through",
   );
 });
@@ -68,14 +68,14 @@ test("asking about your own memberships stays open; about somebody else's does n
   const body = fn(controller, "getAll");
   assert.match(
     body,
-    /else if \(user && user !== callerId\(req\)\)[\s\S]{0,600}await requirePlatformStaff\(req\)/,
+    /else if \(user && user !== callerId\(req\)\)[\s\S]{0,600}await requireConsolePermission\(req/,
   );
 });
 
 test("the scope decision happens before the query runs", () => {
   const body = fn(controller, "getAll");
   const gate = Math.min(
-    ...["requirePlatformStaff", "requireOrgAccess"]
+    ...["requireConsolePermission", "requireOrgAccess"]
       .map((s) => body.indexOf(s))
       .filter((i) => i !== -1),
   );
@@ -107,6 +107,6 @@ test("a membership with no organisation is platform-staff only", () => {
   // read as protection while passing everyone — and it would pass them on
   // precisely the most privileged row in the collection.
   const helper = controller.slice(controller.indexOf("async function requireMemberOrg"));
-  assert.match(helper.slice(0, 500), /if \(!orgId\)[\s\S]{0,120}requirePlatformStaff\(req\)/);
+  assert.match(helper.slice(0, 500), /if \(!orgId\)[\s\S]{0,120}requireConsolePermission\(req/);
   assert.match(helper.slice(0, 500), /requireOrgAccess\(req, orgId\)/);
 });

package/test/org-suspension.test.mjs

@@ -162,8 +162,8 @@ test("suspending and reactivating a client is OWNER-only, not staff", () => {
   assert.ok(at !== -1, "organization.controller no longer defines updateStatus");
   const body = ORG_CONTROLLER.slice(at);
 
-  assert.match(body, /await requirePlatformOwner\(req\)/);
-  const guard = body.indexOf("await requirePlatformOwner(req)");
+  assert.match(body, /await requirePlatformOwner\(req/);
+  const guard = body.search(/await requirePlatformOwner\(req/);
   const write = body.indexOf("await _updateStatusById(");
   assert.ok(guard !== -1 && write !== -1 && guard < write);
 
@@ -181,11 +181,26 @@ test("suspending and reactivating a client is OWNER-only, not staff", () => {
 test("the owner is told apart from ordinary staff by a marker no caller can set", () => {
   assert.match(SUPER_ADMIN, /export async function isPlatformOwner\(/);
 
-  // The staff tier is unchanged: role type only.
+  // The staff tier is unchanged: role type only. Both tiers now read the SAME
+  // resolved role document (`resolveStaffRole`, added for the console module
+  // gate) instead of each running its own copy of the two queries — so the
+  // admin-type test is asserted where it now lives.
+  const resolver = fn(SUPER_ADMIN, "export async function resolveStaffRole(");
   const staff = fn(SUPER_ADMIN, "export async function isSuperAdmin(");
   const owner = fn(SUPER_ADMIN, "export async function isPlatformOwner(");
 
-  assert.match(staff, /return role\?\.type === "admin";/);
+  assert.match(resolver, /role\?\.type === "admin"/);
+  assert.match(resolver, /type: "admin"/, "the staff MEMBERSHIP test is gone");
+  // `default` appears in the resolver's RETURN TYPE — it hands the field to
+  // `isPlatformOwner`. What must never appear is a test ON it: the resolver
+  // returns every staff role, and only the owner tier reads the marker.
+  assert.doesNotMatch(
+    resolver,
+    /default === true|default: true/,
+    "the shared resolver must not have quietly become the owner gate",
+  );
+
+  assert.match(staff, /resolveStaffRole\(userId\)\) !== null/);
   assert.doesNotMatch(
     staff,
     /default/,
@@ -193,8 +208,8 @@ test("the owner is told apart from ordinary staff by a marker no caller can set"
   );
 
   // The owner tier requires BOTH: an admin-typed role AND roles.default.
-  assert.match(owner, /role\?\.type === "admin"/);
-  assert.match(owner, /role\?\.default === true/);
+  assert.match(owner, /resolveStaffRole\(userId\)/);
+  assert.match(owner, /\.default === true/);
 });
 
 test("roles.default cannot be set through the role API", () => {
@@ -210,7 +225,7 @@ test("roles.default cannot be set through the role API", () => {
 
 test("the owner guard is beside the staff guard, not a second mechanism", () => {
   assert.match(CONSOLE_AUTHZ, /export async function requirePlatformOwner\(/);
-  assert.match(CONSOLE_AUTHZ, /isPlatformOwner, isSuperAdmin/);
+  assert.match(CONSOLE_AUTHZ, /isPlatformOwner, resolveStaffRole/);
   // Same session-only resolution as the staff gate.
   assert.match(
     CONSOLE_AUTHZ,

package/test/resident-ownership-scope.test.mjs

@@ -46,7 +46,7 @@ test("the three 'my memberships' reads compare the URL id to the session", () =>
     const body = fn(member, name);
     assert.match(
       body,
-      new RegExp(`requireSelfOrPlatformStaff\\(req, ${param}\\)`),
+      new RegExp(`requireSelfOrPlatformStaff\\(req, ${param}[,)]`),
       `${name} no longer scopes the user id in the URL to the caller`,
     );
     // The guard has to run BEFORE the read, not after it.

package/test/role-member-org-scope.test.mjs

@@ -68,7 +68,7 @@ test("no org still means the org-less platform roles, not everybody's", () => {
   const body = fn(roleController, "getRoles");
   assert.doesNotMatch(
     body,
-    /if \(!org\)[\s\S]{0,80}requirePlatformStaff/,
+    /if \(!org\)[\s\S]{0,80}requireConsolePermission/,
     "an org-less role list must stay reachable",
   );
 });

package/test/role-scope.test.mjs

@@ -95,10 +95,10 @@ test("createRole refuses a platform role from a non-staff caller", () => {
   const body = fn(controller, "createRole");
   assert.match(
     body,
-    /if \(payload\.type === PLATFORM_STAFF_ROLE_TYPE\)[\s\S]{0,200}await requirePlatformStaff\(req\)/,
+    /if \(payload\.type === PLATFORM_STAFF_ROLE_TYPE\)[\s\S]{0,200}await requireConsolePermission\(req/,
   );
 
-  const gate = body.indexOf("requirePlatformStaff");
+  const gate = body.search(/requireConsolePermission\(/);
   const write = body.indexOf("_createRole(");
   assert.ok(gate !== -1 && write !== -1 && gate < write,
     "the caller is checked before the role is written");
@@ -108,7 +108,7 @@ test("/api/roles/v2 is gated too — the same hole with /v2 on the URL", () => {
   const body = fn(controllerV2, "createRole");
   assert.match(
     body,
-    /if \(value\.type === PLATFORM_STAFF_ROLE_TYPE\)[\s\S]{0,200}await requirePlatformStaff\(req\)/,
+    /if \(value\.type === PLATFORM_STAFF_ROLE_TYPE\)[\s\S]{0,200}await requireConsolePermission\(req/,
   );
 });
 
@@ -159,7 +159,7 @@ test("an org-less role is platform-staff only", () => {
   // "no organisation to check, therefore allowed", the gate would be worse than
   // none — it would read as protection while passing everyone.
   const helper = controller.slice(controller.indexOf("async function requireRoleOrg"));
-  assert.match(helper.slice(0, 500), /if \(!orgId\)[\s\S]{0,120}requirePlatformStaff\(req\)/);
+  assert.match(helper.slice(0, 500), /if \(!orgId\)[\s\S]{0,120}requireConsolePermission\(req/);
   assert.match(helper.slice(0, 500), /requireOrgAccess\(req, orgId\)/);
 });
 

package/test/staff-console-authz.test.mjs

@@ -93,7 +93,7 @@ function body(file, name) {
  */
 const GUARDED = [
   // [file, handler, guard, the call it protects]
-  ["organization.controller.ts", "add", "requirePlatformStaff", "_add("],
+  ["organization.controller.ts", "add", "requireConsolePermission", "_add("],
   // REACH, not membership. Step 1 of the client onboarding wizard is this
   // write and the owner has no `members` row yet - theirs is created at the
   // last step. `requireOrgAccess` here 401'd every new client on the first
@@ -108,14 +108,14 @@ const GUARDED = [
     "requirePlatformOwner",
     "_updateStatusById(",
   ],
-  ["organization-v2.controller.ts", "getAll", "requirePlatformStaff", "_getAll("],
+  ["organization-v2.controller.ts", "getAll", "requireConsolePermission", "_getAll("],
   [
     "organization-v2.controller.ts",
     "getOrganizationsWithSubscription",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_getOrganizationsWithSubscription(",
   ],
-  ["subscription.controller.ts", "add", "requirePlatformStaff", "_add("],
+  ["subscription.controller.ts", "add", "requireConsolePermission", "_add("],
   [
     "subscription.controller.ts",
     "updateSubscriptionSeats",
@@ -128,66 +128,66 @@ const GUARDED = [
   [
     "subscription.controller.ts",
     "createConsoleSubscription",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_add(",
   ],
   [
     "subscription.controller.ts",
     "updateConsoleSubscription",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_updateConsoleFieldsById(",
   ],
   [
     "subscription.controller.ts",
     "getConsoleSubscription",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_getByOrgId(",
   ],
-  ["subscription-plan.controller.ts", "add", "requirePlatformStaff", "_add("],
-  ["subscription-plan.controller.ts", "update", "requirePlatformStaff", "_update("],
+  ["subscription-plan.controller.ts", "add", "requireConsolePermission", "_add("],
+  ["subscription-plan.controller.ts", "update", "requireConsolePermission", "_update("],
   [
     "subscription-plan.controller.ts",
     "updateStatus",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_updateStatusById(",
   ],
-  ["promo-code.controller.ts", "add", "requirePlatformStaff", "_add("],
+  ["promo-code.controller.ts", "add", "requireConsolePermission", "_add("],
   // Editing, disabling and removing a code are the same power as minting one:
   // a discount is money off our own invoices whichever way it is written.
-  ["promo-code.controller.ts", "update", "requirePlatformStaff", "_updateById("],
+  ["promo-code.controller.ts", "update", "requireConsolePermission", "_updateById("],
   [
     "promo-code.controller.ts",
     "updateStatus",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_updateStatusById(",
   ],
   [
     "promo-code.controller.ts",
     "remove",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_softDeleteById(",
   ],
-  ["platform-terms.controller.ts", "add", "requirePlatformStaff", "_add("],
+  ["platform-terms.controller.ts", "add", "requireConsolePermission", "_add("],
   // The acceptance record as a list - every account on the platform and
   // whether it has consented. The fourth cross-tenant read, gated like the
   // others; the per-user `getStatus` below cannot answer it.
   [
     "platform-terms.controller.ts",
     "getAcceptance",
-    "requirePlatformStaff",
+    "requireConsolePermission",
     "_listAcceptance(",
   ],
   // The console's own history. A read, and gated like the two cross-tenant
   // reads above: it is every client's commercial history in one list.
-  ["console-audit.controller.ts", "getAll", "requirePlatformStaff", "_list("],
+  ["console-audit.controller.ts", "getAll", "requireConsolePermission", "_list("],
   // Every account on the platform in one list - not filtered by org or site,
   // so it spans every client's residents, guards and cleaners at once. The
   // third cross-tenant read, gated like the other two.
-  ["user.controller.ts", "getUsers", "requirePlatformStaff", "_getUsers("],
+  ["user.controller.ts", "getUsers", "requireConsolePermission", "_getUsers("],
   // /api/users/v2 is a separate mount onto a separate controller with its own
   // copy of the same unfiltered list. Gating only v1 leaves the gate
   // bypassable by adding /v2 to the URL.
-  ["user-v2.controller.ts", "getUsers", "requirePlatformStaff", "_getUsers("],
+  ["user-v2.controller.ts", "getUsers", "requireConsolePermission", "_getUsers("],
   // The user is named in the URL, so without a check any signed-in account
   // could read - or record - somebody else's acceptance by changing the id.
   [
@@ -310,7 +310,7 @@ test("platform Terms are signed by the session, never by the request body", () =
     "the author is back to being whatever the caller typed",
   );
 
-  const guard = b.indexOf("await requirePlatformStaff(req)");
+  const guard = b.search(/await requireConsolePermission\(req/);
   assert.ok(guard !== -1 && guard < b.indexOf("createdBy:"));
 });
 
@@ -327,7 +327,7 @@ test("a promo code is removed, never deleted", () => {
 test("the code a staff member removed is attributed to them, not to the body", () => {
   const b = body("promo-code.controller.ts", "remove");
 
-  assert.match(b, /const staffId = await requirePlatformStaff\(req\)/);
+  assert.match(b, /const staffId = await requireConsolePermission\(req, "promo-codes", "delete-promo-code"\)/);
   assert.match(b, /_softDeleteById\(req\.params\.id, staffId\)/);
 });
 
@@ -365,14 +365,14 @@ test("the customer checkout is NOT staff-gated", () => {
   // purpose; this test exists so nobody closes it by reflex in a later sweep.
   const b = body("subscription.controller.ts", "createOrgSubscription");
 
-  assert.doesNotMatch(b, /requirePlatformStaff/);
+  assert.doesNotMatch(b, /requirePlatformStaff|requireConsolePermission/);
   assert.doesNotMatch(b, /requireOrgAccess/);
 });
 
 test("self-signup can still create its organisation", () => {
   const b = body("organization.controller.ts", "addOnboardingOrg");
 
-  assert.doesNotMatch(b, /requirePlatformStaff/);
+  assert.doesNotMatch(b, /requirePlatformStaff|requireConsolePermission/);
   assert.doesNotMatch(b, /requireOrgAccess/);
 });
 
@@ -396,7 +396,7 @@ test("gating the platform-wide user list does not gate a person's own profile",
     for (const file of ALSO_READ) {
       assert.doesNotMatch(
         body(file, name),
-        /requirePlatformStaff|requirePlatformOwner/,
+        /requirePlatformStaff|requirePlatformOwner|requireConsolePermission/,
         `${file} ${name} is staff-gated — that locks users out of their own ` +
           `account. Only the platform-wide list is a staff read.`,
       );
@@ -414,7 +414,7 @@ test("no new endpoint arrives on this surface without a decision", () => {
       assert.ok(
         guarded.includes(name) || open.includes(name),
         `${file} ${name} is new and is in neither list — gate it with ` +
-          `requirePlatformStaff/requireOrgAccess, or add it to OPEN_BY_DESIGN ` +
+          `requireConsolePermission/requireOrgAccess, or add it to OPEN_BY_DESIGN ` +
           `with the reason it stays open`,
       );
     }

package/test/terms-acceptance-list.test.mjs

@@ -47,11 +47,11 @@ test("the acceptance list is staff-gated, from the session, before it reads", ()
 
   assert.match(
     handler,
-    /await requirePlatformStaff\(req\)/,
+    /await requireConsolePermission\(req, "platform-terms", "see-platform-terms"\)/,
     "the acceptance list is not behind the platform staff gate",
   );
 
-  const gate = handler.indexOf("requirePlatformStaff(req)");
+  const gate = handler.search(/requireConsolePermission\(req/);
   const reads = handler.indexOf("_listAcceptance(");
 
   assert.ok(reads !== -1, "getAcceptance no longer reads the list");