@7365admin1/core 3.53.5 → 3.53.7

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.5",
+  "version": "3.53.7",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/invite-org-scope.test.mjs

@@ -62,7 +62,7 @@ test("every invite handler asks requireInviteReach, and asks first", () => {
 
     assert.match(
       body,
-      new RegExp(`await requireInviteReach\\(req, ${org}, app\\)`),
+      new RegExp(`await requireInviteReach\\(req, ${org}, app, role\\)`),
       `${handler} must check the organisation it was handed`,
     );
 

package/test/invite-role-scope.test.mjs

@@ -0,0 +1,236 @@
+/**
+ * The role an invitation hands out must belong to the organisation it invites
+ * into — and must never be a Seven365 console role.
+ *
+ * Both arms were measured against staging's **942** role-carrying invitations
+ * before being written (`_analysis/_invite-role-scope.js`, read-only). The
+ * counts in the case names below are that measurement, and they are what makes
+ * this shippable: 52 refused, all 52 mis-scoped, 890 untouched.
+ *
+ * The CONTROL for every refusal case is the pre-fix behaviour: before this
+ * change `role` was validated by `Joi.string().hex()` and nothing else, so
+ * every input here was accepted. `roleInvitable` not existing at all is what
+ * that control looks like, which the wiring assertions at the bottom pin.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { roleInvitable } from "./.build/utils/invite-role-scope.util.mjs";
+
+const CLIENT_A = "68f063160c11062938dadadd";
+const CLIENT_B = "690053d194b3f2e7d74be49b";
+const SITE_A = "6925212188a3a9a52eb53d37";
+
+// ---------------------------------------------------------------------------
+// REFUSED — the two shapes that are the defect
+// ---------------------------------------------------------------------------
+
+test("a role owned by another organisation is refused (51 live rows)", () => {
+  // "BC Property Group" Org Admin invited into "ABC Property Group".
+  const refusal = roleInvitable(
+    { type: "organization", org: CLIENT_A },
+    CLIENT_B,
+    ["organization"],
+  );
+
+  assert.equal(refusal, "That role belongs to a different organisation.");
+});
+
+test("a Seven365 console role is refused on a client invitation (1 live row)", () => {
+  // CapitaLand Super Admin, type "admin", on a property-management invite.
+  for (const org of ["", null, CLIENT_A]) {
+    const refusal = roleInvitable({ type: "admin", org }, org, [
+      "property_management_agency",
+    ]);
+
+    assert.equal(
+      refusal,
+      "That role belongs to the Seven365 console and cannot be given to this invitation.",
+      `an org-less staff role must not ride an ordinary invitation (org=${org})`,
+    );
+  }
+});
+
+test("a console role is refused even for the organisation that owns it", () => {
+  // The organisation arm would say yes to this; the staff arm is what refuses
+  // it, and it is checked FIRST for exactly that reason.
+  assert.equal(
+    roleInvitable({ type: "admin", org: CLIENT_A }, CLIENT_A, ["organization"]),
+    "That role belongs to the Seven365 console and cannot be given to this invitation.",
+  );
+});
+
+test("an ObjectId-shaped org is compared by value, not by identity", () => {
+  const asObjectId = { toString: () => CLIENT_A };
+
+  assert.equal(
+    roleInvitable({ type: "organization", org: asObjectId }, CLIENT_A, []),
+    null,
+  );
+  assert.equal(
+    roleInvitable({ type: "organization", org: asObjectId }, CLIENT_B, []),
+    "That role belongs to a different organisation.",
+  );
+});
+
+// ---------------------------------------------------------------------------
+// ALLOWED — the zero-lockout proof. Every legitimate shape that reaches the
+// invitation endpoints today, and still must.
+// ---------------------------------------------------------------------------
+
+const LEGITIMATE = [
+  [
+    "super-admin invites a client with a TEMPLATE role (org-less, ~340 live rows)",
+    { type: "organization", org: "" },
+    CLIENT_A,
+    ["property_management_agency"],
+  ],
+  [
+    "the same template role when the role org is absent entirely",
+    { type: "organization" },
+    CLIENT_A,
+    ["security_agency"],
+  ],
+  [
+    "org admin invites a member with the organisation OWN role (the majority)",
+    { type: "organization", org: CLIENT_A },
+    CLIENT_A,
+    ["organization"],
+  ],
+  [
+    "a vertical app invites into a site with that org role",
+    { type: "cleaning_services", org: CLIENT_A },
+    CLIENT_A,
+    ["cleaning_services"],
+  ],
+  [
+    "an ORG-WIDE role, site empty, on a site-scoped invitation",
+    { type: "property_management_agency", org: CLIENT_A, site: "" },
+    CLIENT_A,
+    ["property_management_agency"],
+  ],
+  [
+    "a SITE-PINNED role invited into another site of the SAME org (36 live rows)",
+    { type: "property_management_agency", org: CLIENT_A, site: SITE_A },
+    CLIENT_A,
+    ["property_management_agency"],
+  ],
+  [
+    "an invitation that names no organisation at all (2 live rows)",
+    { type: "property_management_agency", org: CLIENT_A },
+    "",
+    ["Organization"],
+  ],
+  [
+    "and one whose org is null",
+    { type: "organization", org: CLIENT_A },
+    null,
+    ["organization"],
+  ],
+  [
+    "a staff invitation carrying a staff role — the console own flow",
+    { type: "admin", org: "" },
+    "",
+    ["admin"],
+  ],
+  [
+    "a multi-app invitation whose app list includes the staff type",
+    { type: "admin", org: "" },
+    "",
+    ["organization", "admin"],
+  ],
+  [
+    "a role id that resolves to nothing writes no permissions, so it is left alone",
+    null,
+    CLIENT_A,
+    ["organization"],
+  ],
+  [
+    "no app named at all, ordinary client role",
+    { type: "organization", org: CLIENT_A },
+    CLIENT_A,
+    null,
+  ],
+];
+
+for (const [name, role, org, apps] of LEGITIMATE) {
+  test(`ALLOWED: ${name}`, () => {
+    assert.equal(
+      roleInvitable(role, org, apps),
+      null,
+      "this invitation works today and must keep working",
+    );
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Wiring — the control. If any of this is removed the decision above is dead
+// code and every refusal case silently reverts to the pre-fix behaviour.
+// ---------------------------------------------------------------------------
+
+const read = (rel) =>
+  readFileSync(fileURLToPath(new URL(`../src/${rel}`, import.meta.url)), "utf8");
+
+test("requireInviteReach runs the role check, and runs it last", () => {
+  const authz = read("utils/console-authz.util.ts");
+
+  assert.match(
+    authz,
+    /const refusal = roleInvitable\(stored, org, apps\);\n\s*if \(refusal\) throw new BadRequestError\(refusal\);/,
+    "the refusal must be raised as a 4xx, not swallowed",
+  );
+
+  const gate = authz.indexOf("export async function requireInviteReach(");
+  const body = authz.slice(gate);
+
+  assert.match(
+    body,
+    /await requireRoleInvitable\(role, org, apps\);/,
+    "requireInviteReach must run the role check",
+  );
+
+  assert.ok(
+    body.indexOf("await requireOrgReach(req, org)") <
+      body.indexOf("await requireRoleInvitable("),
+    "the role read must come after the organisation gate, so no existing caller pays for it",
+  );
+});
+
+test("the role is only ever read from the STORED role, never from the request", () => {
+  const authz = read("utils/console-authz.util.ts");
+  const start = authz.indexOf("async function requireRoleInvitable(");
+  const body = authz.slice(
+    start,
+    authz.indexOf("export async function requireInviteReach("),
+  );
+
+  assert.match(body, /collection\("roles"\)/);
+  assert.match(body, /projection: \{ org: 1, type: 1 \}/);
+  assert.doesNotMatch(
+    body,
+    /req\.body|req\.query/,
+    "nothing the caller sends may take part in this decision",
+  );
+});
+
+test("every invite handler hands its role to the gate", () => {
+  const sources = [
+    read("controllers/verification.controller.ts"),
+    read("controllers/verification-v2.controller.ts"),
+  ].join("\n");
+
+  const calls =
+    sources.match(/requireInviteReach\(req, [a-zA-Z]+, app[^)]*\)/g) ?? [];
+
+  assert.equal(calls.length, 6, "there are six invite handlers");
+
+  for (const call of calls) {
+    assert.match(
+      call,
+      /, role\)$/,
+      `${call} must pass the role it is about to write`,
+    );
+  }
+});

package/test/member-staff-gate.test.mjs

@@ -121,7 +121,7 @@ test("createUserInvite refuses a staff invitation from a non-staff caller", () =
   // yourself as staff, then accept your own invitation.
   const body = fn(verificationController, "createUserInvite");
 
-  assert.match(body, /await requireInviteReach\(req, org, app\)/);
+  assert.match(body, /await requireInviteReach\(req, org, app, role\)/);
 
   const gate = body.indexOf("requireInviteReach");
   const write = body.indexOf("_createUserInvite(");

package/test/verification-scope.test.mjs

@@ -0,0 +1,96 @@
+/**
+ * Listing and cancelling invitations both ask who is calling.
+ *
+ * `GET /api/verifications` took `orgId` as an OPTIONAL query filter with
+ * `requireAuth` in front and nothing else, so omitting it read every client's
+ * pending invitations. `PUT /api/verifications/:id/cancel` took the id off the
+ * URL with no authorization identifier in the handler at all, so any signed-in
+ * account could cancel any other client's invitations.
+ *
+ * What is pinned here is the wiring — the part that silently rots when somebody
+ * adds a filter, or copies one of these handlers to make a v3 — plus the two
+ * rules inside the gates themselves, because the rules are what make the fix
+ * lockout-free rather than merely closed.
+ *
+ * Nothing here opens a socket or a database. Every assertion reads a file.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const read = (rel) =>
+  readFileSync(fileURLToPath(new URL(`../src/${rel}`, import.meta.url)), "utf8");
+
+const v1 = read("controllers/verification.controller.ts");
+const v2 = read("controllers/verification-v2.controller.ts");
+const consoleAuthz = read("utils/console-authz.util.ts");
+
+/** One `async function name(...)` body out of a source file. */
+function fn(text, name) {
+  const start = text.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `${name} is no longer defined`);
+  const rest = text.slice(start);
+  const next = rest.slice(1).search(/\n *async function [a-zA-Z0-9_]+ ?\(/);
+  return next === -1 ? rest : rest.slice(0, next + 1);
+}
+
+/** [source, label, handler, the gate it must call, the call it guards] */
+const GUARDED = [
+  [v1, "v1", "getVerifications", "requireVerificationListReach(", "_getVerifications("],
+  [v2, "v2", "getVerifications", "requireVerificationListReach(", "_getVerifications("],
+  [v1, "v1", "cancelUserInvitation", "requireVerificationReach(", "_cancelUserInvitation("],
+  [v2, "v2", "cancelUserInvitation", "requireVerificationReach(", "_cancelUserInvitation("],
+];
+
+test("both list and both cancel handlers ask, and ask BEFORE the read or write", () => {
+  for (const [source, label, handler, gate, guarded] of GUARDED) {
+    const body = fn(source, handler);
+
+    assert.ok(
+      body.includes(gate),
+      `${label} ${handler} no longer calls ${gate}`
+    );
+    assert.ok(
+      body.indexOf(gate) < body.indexOf(guarded),
+      `${label} ${handler} calls ${guarded} before it is authorized`
+    );
+  }
+});
+
+test("the cancel gate reads the STORED verification, never the request", () => {
+  for (const [source, label] of [[v1, "v1"], [v2, "v2"]]) {
+    const body = fn(source, "cancelUserInvitation");
+    assert.match(
+      body,
+      /requireVerificationReach\(\s*req,\s*await _getVerificationById\(otpId\)/,
+      `${label} cancel must authorize against the stored record`
+    );
+  }
+});
+
+test("the v1 list gate is handed the caller's own orgId, not a literal", () => {
+  const body = fn(v1, "getVerifications");
+  assert.match(body, /requireVerificationListReach\(req, orgId\)/);
+});
+
+test("an omitted organisation costs Seven365 staff identity", () => {
+  const gate = fn(consoleAuthz, "requireVerificationListReach");
+  assert.ok(gate.includes("requireOrgReach(req, orgId)"), "the org branch is gone");
+  assert.ok(gate.includes("requirePlatformStaff(req)"), "the estate-wide branch is gone");
+  // The org branch must return, or a reaching member would then be asked for
+  // staff identity as well and every web app's invitations screen would 401.
+  assert.match(gate, /requireOrgReach\(req, orgId\);\s*\n\s*return;/);
+});
+
+test("a verification that names no organisation behaves exactly as before", () => {
+  const gate = fn(consoleAuthz, "requireVerificationReach");
+  // `createUserInvite` writes rows with an empty organisation and they are
+  // cancelled from the staff console. Refusing them would break a working
+  // screen; this early return is the zero-lockout half of the fix.
+  assert.match(gate, /if \(!org\) return;/);
+  assert.ok(
+    gate.indexOf("if (!org) return;") < gate.indexOf("requireOrgReach"),
+    "the org-less carve-out must come before the refusal"
+  );
+});