@7365admin1/core 3.53.3 → 3.53.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.3",
+  "version": "3.53.4",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/sp-approvals-console-gate.test.mjs

@@ -0,0 +1,117 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * SP Approvals — the console module, on the server.
+ *
+ * `service-provider-invite.service.ts assertSuperAdmin` answers "is this
+ * Seven365 staff" and nothing else, so a staff role ticked for Promo Codes
+ * alone could approve or reject any client's service-provider application. The
+ * four staff-only handlers now also ask which console module the role holds.
+ *
+ * The decision reads `members`/`roles` and cannot run without Atlas, so what is
+ * asserted here is the WIRING, off the source: that each of the four asks, that
+ * it asks BEFORE it acts, that the strings it asks for exist in the catalogue,
+ * and — the part that matters later — that the SIX org-side handlers still ask
+ * nothing, because a property manager reaches those holding no console module.
+ */
+
+const controller = readFileSync(
+  fileURLToPath(
+    new URL(
+      "../src/controllers/service-provider-invite.controller.ts",
+      import.meta.url,
+    ),
+  ),
+  "utf8",
+);
+
+/** The body of one `async function <name>(` in the controller. */
+const handler = (name) => {
+  const start = controller.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `handler ${name} is gone — rename or removal`);
+  const next = controller.indexOf("\n  async function ", start + 1);
+  return controller.slice(start, next === -1 ? controller.length : next);
+};
+
+const GATED = {
+  approvals: ["sp-approvals", "see-all-sp-approvals"],
+  pendingApprovalCount: ["sp-approvals", "see-all-sp-approvals"],
+  approve: ["sp-approvals", "approve-sp"],
+  reject: ["sp-approvals", "reject-sp"],
+};
+
+// The org road. `assertOwnerOrSuperAdmin` lets a property manager act on their
+// own organisation's invitation, so a console module here would lock them out.
+const UNGATED = ["list", "cancel", "resend", "remove", "decline", "getOne"];
+
+test("the four staff-only handlers ask for their console module", () => {
+  for (const [name, [resource, action]] of Object.entries(GATED)) {
+    const body = handler(name);
+    assert.ok(
+      body.includes("requireConsolePermission"),
+      `${name} does not ask at all`,
+    );
+    assert.ok(body.includes(`"${resource}"`), `${name} misses ${resource}`);
+    assert.ok(body.includes(`"${action}"`), `${name} misses ${action}`);
+  }
+});
+
+test("it asks before it acts", () => {
+  for (const name of Object.keys(GATED)) {
+    const body = handler(name);
+    const asks = body.indexOf("requireConsolePermission");
+    const acts = body.indexOf("res.json(");
+    assert.ok(asks !== -1 && acts !== -1, `${name} lost a marker`);
+    assert.ok(asks < acts, `${name} acts before it asks`);
+  }
+});
+
+test("every string asked for is one the role editor can grant", async () => {
+  const { CONSOLE_PERMISSIONS, consoleRoleAllows } = await import(
+    "./.build/utils/console-permission.util.mjs"
+  );
+
+  for (const [resource, action] of Object.values(GATED)) {
+    assert.ok(
+      CONSOLE_PERMISSIONS[resource]?.includes(action),
+      `${resource}:${action} is not in the console catalogue — ungrantable`,
+    );
+    // A governed role holding the string passes; one holding a sibling module
+    // does not. This is the control: without it the test would pass on an
+    // always-true gate.
+    assert.equal(
+      consoleRoleAllows([`${resource}:${action}`], resource, action),
+      true,
+    );
+    assert.equal(
+      consoleRoleAllows(["promo-codes:create-promo-code"], resource, action),
+      false,
+    );
+    // The empty list and "*" still reach everything — no role document is
+    // written for this to ship.
+    assert.equal(consoleRoleAllows([], resource, action), true);
+    assert.equal(consoleRoleAllows(["*"], resource, action), true);
+  }
+});
+
+test("the org-side handlers stay open to a property manager", () => {
+  for (const name of UNGATED) {
+    assert.ok(
+      !handler(name).includes("requireConsolePermission"),
+      `${name} now demands a console module — that locks out property managers`,
+    );
+  }
+});
+
+test("the console gate is exported for API-core to reuse", () => {
+  const index = readFileSync(
+    fileURLToPath(new URL("../src/index.ts", import.meta.url)),
+    "utf8",
+  );
+  assert.ok(index.includes("requireConsolePermission,"));
+  assert.ok(index.includes('./utils/console-authz.util"'));
+  assert.ok(index.includes('export * from "./utils/console-permission.util";'));
+});