@7365admin1/core 3.53.6 → 3.53.7

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.6",
+  "version": "3.53.7",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/verification-scope.test.mjs

@@ -0,0 +1,96 @@
+/**
+ * Listing and cancelling invitations both ask who is calling.
+ *
+ * `GET /api/verifications` took `orgId` as an OPTIONAL query filter with
+ * `requireAuth` in front and nothing else, so omitting it read every client's
+ * pending invitations. `PUT /api/verifications/:id/cancel` took the id off the
+ * URL with no authorization identifier in the handler at all, so any signed-in
+ * account could cancel any other client's invitations.
+ *
+ * What is pinned here is the wiring — the part that silently rots when somebody
+ * adds a filter, or copies one of these handlers to make a v3 — plus the two
+ * rules inside the gates themselves, because the rules are what make the fix
+ * lockout-free rather than merely closed.
+ *
+ * Nothing here opens a socket or a database. Every assertion reads a file.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const read = (rel) =>
+  readFileSync(fileURLToPath(new URL(`../src/${rel}`, import.meta.url)), "utf8");
+
+const v1 = read("controllers/verification.controller.ts");
+const v2 = read("controllers/verification-v2.controller.ts");
+const consoleAuthz = read("utils/console-authz.util.ts");
+
+/** One `async function name(...)` body out of a source file. */
+function fn(text, name) {
+  const start = text.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `${name} is no longer defined`);
+  const rest = text.slice(start);
+  const next = rest.slice(1).search(/\n *async function [a-zA-Z0-9_]+ ?\(/);
+  return next === -1 ? rest : rest.slice(0, next + 1);
+}
+
+/** [source, label, handler, the gate it must call, the call it guards] */
+const GUARDED = [
+  [v1, "v1", "getVerifications", "requireVerificationListReach(", "_getVerifications("],
+  [v2, "v2", "getVerifications", "requireVerificationListReach(", "_getVerifications("],
+  [v1, "v1", "cancelUserInvitation", "requireVerificationReach(", "_cancelUserInvitation("],
+  [v2, "v2", "cancelUserInvitation", "requireVerificationReach(", "_cancelUserInvitation("],
+];
+
+test("both list and both cancel handlers ask, and ask BEFORE the read or write", () => {
+  for (const [source, label, handler, gate, guarded] of GUARDED) {
+    const body = fn(source, handler);
+
+    assert.ok(
+      body.includes(gate),
+      `${label} ${handler} no longer calls ${gate}`
+    );
+    assert.ok(
+      body.indexOf(gate) < body.indexOf(guarded),
+      `${label} ${handler} calls ${guarded} before it is authorized`
+    );
+  }
+});
+
+test("the cancel gate reads the STORED verification, never the request", () => {
+  for (const [source, label] of [[v1, "v1"], [v2, "v2"]]) {
+    const body = fn(source, "cancelUserInvitation");
+    assert.match(
+      body,
+      /requireVerificationReach\(\s*req,\s*await _getVerificationById\(otpId\)/,
+      `${label} cancel must authorize against the stored record`
+    );
+  }
+});
+
+test("the v1 list gate is handed the caller's own orgId, not a literal", () => {
+  const body = fn(v1, "getVerifications");
+  assert.match(body, /requireVerificationListReach\(req, orgId\)/);
+});
+
+test("an omitted organisation costs Seven365 staff identity", () => {
+  const gate = fn(consoleAuthz, "requireVerificationListReach");
+  assert.ok(gate.includes("requireOrgReach(req, orgId)"), "the org branch is gone");
+  assert.ok(gate.includes("requirePlatformStaff(req)"), "the estate-wide branch is gone");
+  // The org branch must return, or a reaching member would then be asked for
+  // staff identity as well and every web app's invitations screen would 401.
+  assert.match(gate, /requireOrgReach\(req, orgId\);\s*\n\s*return;/);
+});
+
+test("a verification that names no organisation behaves exactly as before", () => {
+  const gate = fn(consoleAuthz, "requireVerificationReach");
+  // `createUserInvite` writes rows with an empty organisation and they are
+  // cancelled from the staff console. Refusing them would break a working
+  // screen; this early return is the zero-lockout half of the fix.
+  assert.match(gate, /if \(!org\) return;/);
+  assert.ok(
+    gate.indexOf("if (!org) return;") < gate.indexOf("requireOrgReach"),
+    "the org-less carve-out must come before the refusal"
+  );
+});