@7365admin1/core 3.53.3 → 3.53.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.3",
+  "version": "3.53.5",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/invite-org-scope.test.mjs

@@ -106,6 +106,12 @@ test("the two service-provider invites still resolve their caller themselves", (
   for (const source of [verificationService, verificationServiceV2]) {
     const body = fn(source, "createServiceProviderInvite");
     assert.match(body, /resolveInviteActor\(invitedBy\)/);
-    assert.match(body, /actor\.isSuperAdmin[\s\S]{0,80}actor\.orgIds\.includes\(orgId\)/);
+    assert.match(
+      body,
+      // Widened to the property this pinned — a staff clause resolved from the
+      // session, ahead of the caller's own orgs. The staff clause is now the
+      // cross-client grant (`staffMayBypass`), not identity alone.
+      /staffMayBypass\(actor\)[\s\S]{0,80}actor\.orgIds\.includes\(orgId\)/,
+    );
   }
 });

package/test/role-member-org-scope.test.mjs

@@ -103,7 +103,10 @@ test("the membership is authorised before it is written", () => {
 
 test("reach is staff, or membership, or an invitation — and nothing else", () => {
   const body = fn(authz, "requireOrgReach");
-  assert.match(body, /if \(actor\.isSuperAdmin\) return id;/);
+  // The staff road is now the cross-client GRANT, not identity alone
+  // (`staffMayBypass`) — still one road, asked one notch harder. Widened to the
+  // property this pinned, never weakened: a staff clause must still be first.
+  assert.match(body, /if \(staffMayBypass\(actor\)\) return id;/);
   assert.match(body, /actor\.orgIds\.includes\(org\)/);
   assert.match(body, /await hasOrgInvitation\(id, org\)/);
   assert.match(body, /throw new UnauthorizedError\("Not authorized\."\)/);

package/test/sp-approvals-console-gate.test.mjs

@@ -0,0 +1,117 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * SP Approvals — the console module, on the server.
+ *
+ * `service-provider-invite.service.ts assertSuperAdmin` answers "is this
+ * Seven365 staff" and nothing else, so a staff role ticked for Promo Codes
+ * alone could approve or reject any client's service-provider application. The
+ * four staff-only handlers now also ask which console module the role holds.
+ *
+ * The decision reads `members`/`roles` and cannot run without Atlas, so what is
+ * asserted here is the WIRING, off the source: that each of the four asks, that
+ * it asks BEFORE it acts, that the strings it asks for exist in the catalogue,
+ * and — the part that matters later — that the SIX org-side handlers still ask
+ * nothing, because a property manager reaches those holding no console module.
+ */
+
+const controller = readFileSync(
+  fileURLToPath(
+    new URL(
+      "../src/controllers/service-provider-invite.controller.ts",
+      import.meta.url,
+    ),
+  ),
+  "utf8",
+);
+
+/** The body of one `async function <name>(` in the controller. */
+const handler = (name) => {
+  const start = controller.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `handler ${name} is gone — rename or removal`);
+  const next = controller.indexOf("\n  async function ", start + 1);
+  return controller.slice(start, next === -1 ? controller.length : next);
+};
+
+const GATED = {
+  approvals: ["sp-approvals", "see-all-sp-approvals"],
+  pendingApprovalCount: ["sp-approvals", "see-all-sp-approvals"],
+  approve: ["sp-approvals", "approve-sp"],
+  reject: ["sp-approvals", "reject-sp"],
+};
+
+// The org road. `assertOwnerOrSuperAdmin` lets a property manager act on their
+// own organisation's invitation, so a console module here would lock them out.
+const UNGATED = ["list", "cancel", "resend", "remove", "decline", "getOne"];
+
+test("the four staff-only handlers ask for their console module", () => {
+  for (const [name, [resource, action]] of Object.entries(GATED)) {
+    const body = handler(name);
+    assert.ok(
+      body.includes("requireConsolePermission"),
+      `${name} does not ask at all`,
+    );
+    assert.ok(body.includes(`"${resource}"`), `${name} misses ${resource}`);
+    assert.ok(body.includes(`"${action}"`), `${name} misses ${action}`);
+  }
+});
+
+test("it asks before it acts", () => {
+  for (const name of Object.keys(GATED)) {
+    const body = handler(name);
+    const asks = body.indexOf("requireConsolePermission");
+    const acts = body.indexOf("res.json(");
+    assert.ok(asks !== -1 && acts !== -1, `${name} lost a marker`);
+    assert.ok(asks < acts, `${name} acts before it asks`);
+  }
+});
+
+test("every string asked for is one the role editor can grant", async () => {
+  const { CONSOLE_PERMISSIONS, consoleRoleAllows } = await import(
+    "./.build/utils/console-permission.util.mjs"
+  );
+
+  for (const [resource, action] of Object.values(GATED)) {
+    assert.ok(
+      CONSOLE_PERMISSIONS[resource]?.includes(action),
+      `${resource}:${action} is not in the console catalogue — ungrantable`,
+    );
+    // A governed role holding the string passes; one holding a sibling module
+    // does not. This is the control: without it the test would pass on an
+    // always-true gate.
+    assert.equal(
+      consoleRoleAllows([`${resource}:${action}`], resource, action),
+      true,
+    );
+    assert.equal(
+      consoleRoleAllows(["promo-codes:create-promo-code"], resource, action),
+      false,
+    );
+    // The empty list and "*" still reach everything — no role document is
+    // written for this to ship.
+    assert.equal(consoleRoleAllows([], resource, action), true);
+    assert.equal(consoleRoleAllows(["*"], resource, action), true);
+  }
+});
+
+test("the org-side handlers stay open to a property manager", () => {
+  for (const name of UNGATED) {
+    assert.ok(
+      !handler(name).includes("requireConsolePermission"),
+      `${name} now demands a console module — that locks out property managers`,
+    );
+  }
+});
+
+test("the console gate is exported for API-core to reuse", () => {
+  const index = readFileSync(
+    fileURLToPath(new URL("../src/index.ts", import.meta.url)),
+    "utf8",
+  );
+  assert.ok(index.includes("requireConsolePermission,"));
+  assert.ok(index.includes('./utils/console-authz.util"'));
+  assert.ok(index.includes('export * from "./utils/console-permission.util";'));
+});

package/test/staff-bypass-tenant-scope.test.mjs

@@ -0,0 +1,38 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { CROSS_CLIENT_GRANT, staffMayBypass } = await import(
+  "./.build/utils/console-permission.util.mjs"
+);
+
+/**
+ * The bypass is what let platform identity alone skip tenant scoping. These
+ * pin the ZERO-LOCKOUT property: every spelling a real staff role carries today
+ * still bypasses, so nobody loses access on deploy.
+ */
+const staff = (permissions) => ({ isSuperAdmin: true, staffPermissions: permissions });
+
+test("the two spellings a live staff role carries today still bypass", () => {
+  // `createDefaultUser` seeds `permissions: []`; the live staff account holds ["*"].
+  assert.equal(staffMayBypass(staff([])), true, "empty list must mean everything");
+  assert.equal(staffMayBypass(staff(["*"])), true, "wildcard must mean everything");
+});
+
+test("a partial staff role is governed, and the grant is a real catalogue string", () => {
+  assert.equal(staffMayBypass(staff(["promo-codes:create-promo-code"])), false);
+  assert.equal(staffMayBypass(staff(["organizations:see-all-organizations"])), true);
+  assert.equal(staffMayBypass(staff(["organizations:see-organization-details"])), true);
+});
+
+test("a non-staff caller never bypasses, however their list reads", () => {
+  assert.equal(staffMayBypass({ isSuperAdmin: false, staffPermissions: [] }), false);
+  assert.equal(staffMayBypass({ isSuperAdmin: false, staffPermissions: ["*"] }), false);
+  assert.equal(staffMayBypass({ isSuperAdmin: false }), false);
+});
+
+test("the grant is the organizations module — the control must not pass", () => {
+  assert.equal(CROSS_CLIENT_GRANT.resource, "organizations");
+  // Control: a resource that is NOT the grant must be refused for a partial
+  // role, or this test would pass against any implementation.
+  assert.equal(staffMayBypass(staff(["users:see-all-users"])), false);
+});