@7365admin1/core 3.53.4 → 3.53.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.4",
+  "version": "3.53.5",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/invite-org-scope.test.mjs

@@ -106,6 +106,12 @@ test("the two service-provider invites still resolve their caller themselves", (
   for (const source of [verificationService, verificationServiceV2]) {
     const body = fn(source, "createServiceProviderInvite");
     assert.match(body, /resolveInviteActor\(invitedBy\)/);
-    assert.match(body, /actor\.isSuperAdmin[\s\S]{0,80}actor\.orgIds\.includes\(orgId\)/);
+    assert.match(
+      body,
+      // Widened to the property this pinned — a staff clause resolved from the
+      // session, ahead of the caller's own orgs. The staff clause is now the
+      // cross-client grant (`staffMayBypass`), not identity alone.
+      /staffMayBypass\(actor\)[\s\S]{0,80}actor\.orgIds\.includes\(orgId\)/,
+    );
   }
 });

package/test/role-member-org-scope.test.mjs

@@ -103,7 +103,10 @@ test("the membership is authorised before it is written", () => {
 
 test("reach is staff, or membership, or an invitation — and nothing else", () => {
   const body = fn(authz, "requireOrgReach");
-  assert.match(body, /if \(actor\.isSuperAdmin\) return id;/);
+  // The staff road is now the cross-client GRANT, not identity alone
+  // (`staffMayBypass`) — still one road, asked one notch harder. Widened to the
+  // property this pinned, never weakened: a staff clause must still be first.
+  assert.match(body, /if \(staffMayBypass\(actor\)\) return id;/);
   assert.match(body, /actor\.orgIds\.includes\(org\)/);
   assert.match(body, /await hasOrgInvitation\(id, org\)/);
   assert.match(body, /throw new UnauthorizedError\("Not authorized\."\)/);

package/test/staff-bypass-tenant-scope.test.mjs

@@ -0,0 +1,38 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { CROSS_CLIENT_GRANT, staffMayBypass } = await import(
+  "./.build/utils/console-permission.util.mjs"
+);
+
+/**
+ * The bypass is what let platform identity alone skip tenant scoping. These
+ * pin the ZERO-LOCKOUT property: every spelling a real staff role carries today
+ * still bypasses, so nobody loses access on deploy.
+ */
+const staff = (permissions) => ({ isSuperAdmin: true, staffPermissions: permissions });
+
+test("the two spellings a live staff role carries today still bypass", () => {
+  // `createDefaultUser` seeds `permissions: []`; the live staff account holds ["*"].
+  assert.equal(staffMayBypass(staff([])), true, "empty list must mean everything");
+  assert.equal(staffMayBypass(staff(["*"])), true, "wildcard must mean everything");
+});
+
+test("a partial staff role is governed, and the grant is a real catalogue string", () => {
+  assert.equal(staffMayBypass(staff(["promo-codes:create-promo-code"])), false);
+  assert.equal(staffMayBypass(staff(["organizations:see-all-organizations"])), true);
+  assert.equal(staffMayBypass(staff(["organizations:see-organization-details"])), true);
+});
+
+test("a non-staff caller never bypasses, however their list reads", () => {
+  assert.equal(staffMayBypass({ isSuperAdmin: false, staffPermissions: [] }), false);
+  assert.equal(staffMayBypass({ isSuperAdmin: false, staffPermissions: ["*"] }), false);
+  assert.equal(staffMayBypass({ isSuperAdmin: false }), false);
+});
+
+test("the grant is the organizations module — the control must not pass", () => {
+  assert.equal(CROSS_CLIENT_GRANT.resource, "organizations");
+  // Control: a resource that is NOT the grant must be refused for a partial
+  // role, or this test would pass against any implementation.
+  assert.equal(staffMayBypass(staff(["users:see-all-users"])), false);
+});