@7365admin1/core 3.53.8 → 3.53.9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.8",
+  "version": "3.53.9",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/camera-view.util.test.mjs

@@ -13,7 +13,6 @@ import {
   hasAnyPermission,
   isCameraEntitled,
   cameraGrant,
-  orgSiteScope,
   parseDeviceTime,
   parseSoftwareVersion,
   ptzEndpoint,
@@ -938,93 +937,10 @@ test("a write is scoped to the caller's own sites, not just to any signed-in use
 });
 
 /*
- * `orgSiteScope` — which sites of ONE organisation a caller may be OFFERED.
- *
- * The listing half of `cameraGrant`. `GET /api/customer-sites?org=` authorised
- * at organisation level and then returned the organisation's whole estate, so a
- * user invited to a single site saw every site in the client in the switcher.
+ * The OFFER half of `cameraGrant` is `entitledSiteScope`, and it now answers
+ * `GET /api/customer-sites?org=` directly (`entitledSites`). Its own tests are
+ * `picker-site-scope.test.mjs` and `building-estate-site-scope.test.mjs`.
  */
-const SCOPE_ORG = "aaaaaaaaaaaaaaaaaaaaaaaa";
-const SCOPE_OTHER_ORG = "bbbbbbbbbbbbbbbbbbbbbbbb";
-const SCOPE_SITE_A = "cccccccccccccccccccccccc";
-const SCOPE_SITE_B = "dddddddddddddddddddddddd";
-
-test("orgSiteScope: an org-wide membership keeps the whole list", () => {
-  // The half a careless narrowing breaks. An org owner/admin holds a membership
-  // with no site, and must still see every site in their organisation.
-  assert.equal(
-    orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: "" }], org: SCOPE_ORG }),
-    null,
-  );
-  assert.equal(
-    orgSiteScope({ memberships: [{ org: SCOPE_ORG }], org: SCOPE_ORG }),
-    null,
-  );
-  // One org-wide membership wins even alongside pinned ones.
-  assert.equal(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-        { org: SCOPE_ORG, siteId: "" },
-      ],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-});
-
-test("orgSiteScope: a site-pinned membership is offered that site alone", () => {
-  assert.deepEqual(
-    orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }], org: SCOPE_ORG }),
-    [SCOPE_SITE_A],
-  );
-  // Two pins in the same organisation are both offered, de-duplicated.
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_B },
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A, SCOPE_SITE_B],
-  );
-});
-
-test("orgSiteScope: another organisation's memberships do not widen this one", () => {
-  // The reported defect in one line: pinned to one site here, org-wide
-  // somewhere else. The org-wide row must not unlock this organisation.
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-        { org: SCOPE_OTHER_ORG, siteId: "" },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-  // No membership in this organisation at all: fail closed, not "show all".
-  assert.deepEqual(
-    orgSiteScope({ memberships: [{ org: SCOPE_OTHER_ORG, siteId: "" }], org: SCOPE_ORG }),
-    [],
-  );
-});
-
-test("orgSiteScope: ObjectId and hex-string ids are the same id", () => {
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [{ org: { toString: () => SCOPE_ORG }, siteId: { toString: () => SCOPE_SITE_A } }],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
-test("orgSiteScope: no organisation asked about means no restriction", () => {
-  assert.equal(orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }] }), null);
-});
 
 /**
  * The owner's rule of 2026-09-02: "Org-level roles see all sites."
@@ -1034,80 +950,10 @@ test("orgSiteScope: no organisation asked about means no restriction", () => {
  * (`Org Owner` in most cases) but whose membership row also happens to name a
  * site. These three tests are the three shapes the rule has to get right.
  */
-test("orgSiteScope: a site-LEVEL role pinned to a site sees only that site", () => {
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
-test("orgSiteScope: an ORG-level role carrying a siteId still sees every site", () => {
-  assert.equal(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: true },
-      ],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-
-  // and it widens the whole organisation, not just its own row
-  assert.equal(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_B, orgLevelRole: true },
-      ],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-});
-
-test("orgSiteScope: an ORG-level role with no siteId sees every site", () => {
-  assert.equal(
-    orgSiteScope({
-      memberships: [{ org: SCOPE_ORG, siteId: "", orgLevelRole: true }],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-});
-
-test("orgSiteScope: an org-level role in ANOTHER organisation does not widen this one", () => {
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
-        { org: SCOPE_OTHER_ORG, siteId: "", orgLevelRole: true },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
-test("orgSiteScope: an unresolved role fails closed — it does not widen", () => {
-  // `orgLevelRole` absent is how a missing or soft-deleted role arrives.
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
 /**
  * The camera side of the site-scope rule, reconciled with the LIST side.
  *
- * `orgSiteScope` (below) was changed on 2026-09-02 to the owner's rule: an
+ * The site LIST was changed on 2026-09-02 to the owner's rule: an
  * ORGANISATION-LEVEL role sees every site of its organisation even when its
  * membership row also names a `siteId`. `cameraGrant` kept the older, stricter
  * reading — `!siteId` only — so the switcher offered those people sites the

package/test/picker-site-scope.test.mjs

@@ -0,0 +1,181 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  cameraGrant,
+  entitledSiteScope,
+} from "./.build/utils/camera-view.util.mjs";
+
+/**
+ * The site PICKER must offer exactly the sites the camera check will serve.
+ *
+ * `GET /api/customer-sites?org=<agency>` fills the site switcher in the guard
+ * app, the MA apps and the seven vertical web apps. Every screen then calls with
+ * the chosen site id — `getAnprCameras` -> `GET /api/site-cameras` -> core's
+ * `entitleSite`. When the two disagree, the switcher is a menu of things that do
+ * not work: the user picks a site and reads "Site not found.".
+ *
+ * Owner's ruling, 2026-09-06: **a guard reaches only the sites they are
+ * personally assigned to, not every site their agency is engaged at.** So the
+ * PICKER is the half that was wrong, and the entitlement rule is unchanged.
+ *
+ * The controller therefore now asks the SAME helper the camera check asks:
+ * `entitledSites` -> `entitledSiteScope`, which is `cameraGrant`'s three
+ * branches expressed as a list. These tests pin that agreement, in both
+ * directions, and pin that an ORG-level role is not narrowed with the guards.
+ *
+ * Measured read-only on staging 2026-09-06: 384 offered pairs -> 342; the 42
+ * removed are exactly the 42 `entitleSite` already refuses; 26 of 189 users see
+ * a shorter list; ZERO users gain a site.
+ */
+
+const AGENCY = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const CLIENT = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const SITE_A = "cccccccccccccccccccccccc";
+const SITE_B = "dddddddddddddddddddddddd";
+
+/** The engagement rows `?org=AGENCY` returns: the agency serves both sites. */
+const ENGAGED = { [AGENCY]: [SITE_A, SITE_B] };
+/** Both sites belong to the CLIENT, not to the agency. */
+const OWNED = { [CLIENT]: [SITE_A, SITE_B] };
+
+/**
+ * The rule the controller used BEFORE this change (`orgSiteScope`), transcribed
+ * so the defect is reproducible from the test file alone rather than only from
+ * the staging measurement. It is the control every test below is measured
+ * against: each `notDeepEqual`/`ok` pair here fails if the two rules are made to
+ * agree by accident, and each assertion on `entitledSiteScope` is one the
+ * pre-fix rule does not satisfy.
+ */
+function preFixOrgSiteScope({ memberships, org }) {
+  if (!org) return null;
+  const inOrg = memberships.filter((m) => String(m.org ?? "") === org);
+  if (inOrg.some((m) => !String(m.siteId ?? "") || m.orgLevelRole === true)) {
+    return null; // "no restriction" — the whole engagement list
+  }
+  return inOrg.map((m) => String(m.siteId ?? "")).filter(Boolean);
+}
+
+/** What the picker offers for `?org=AGENCY` under a given scope list. */
+function offered(scope) {
+  return scope === null
+    ? ENGAGED[AGENCY]
+    : ENGAGED[AGENCY].filter((site) => scope.includes(site));
+}
+
+/** Does the camera check serve this site to this caller? */
+function grants(site, memberships) {
+  return Boolean(
+    cameraGrant({
+      cameraSite: site,
+      cameraOrg: CLIENT,
+      memberships,
+      engagedOrgs: new Set(
+        Object.entries(ENGAGED)
+          .filter(([, sites]) => sites.includes(site))
+          .map(([org]) => org),
+      ),
+    }),
+  );
+}
+
+test("a guard assigned to one site is offered that site, and its cameras load", () => {
+  // The shape the owner ruled on: an ORG-LEVEL role at the agency whose
+  // membership row names site A. 26 of 189 staging users are this shape.
+  const memberships = [
+    { org: AGENCY, siteId: SITE_A, role: "guard-role", orgLevelRole: true },
+  ];
+
+  const scope = entitledSiteScope({
+    memberships,
+    sitesByOrg: OWNED,
+    engagedSitesByOrg: ENGAGED,
+  });
+
+  assert.deepEqual(offered(scope), [SITE_A]);
+  assert.equal(grants(SITE_A, memberships), true);
+});
+
+test("an agency site the guard is NOT assigned to is neither offered nor reachable", () => {
+  const memberships = [
+    { org: AGENCY, siteId: SITE_A, role: "guard-role", orgLevelRole: true },
+  ];
+
+  const scope = entitledSiteScope({
+    memberships,
+    sitesByOrg: OWNED,
+    engagedSitesByOrg: ENGAGED,
+  });
+
+  assert.equal(offered(scope).includes(SITE_B), false);
+  assert.equal(grants(SITE_B, memberships), false);
+
+  // CONTROL — this is exactly what the pre-fix rule did, and why site B showed
+  // up in the switcher and then answered "Site not found.".
+  const before = offered(preFixOrgSiteScope({ memberships, org: AGENCY }));
+  assert.equal(before.includes(SITE_B), true);
+  assert.equal(grants(SITE_B, memberships), false);
+});
+
+test("the offer and the camera check agree on every site, both ways", () => {
+  // The property the whole change exists for: offered == granted, with no
+  // site offered that is refused and no site refused that is offered.
+  const shapes = [
+    // a guard pinned to a site, org-level role — the defect's shape
+    [{ org: AGENCY, siteId: SITE_A, role: "r", orgLevelRole: true }],
+    // a guard pinned to a site, site-level role
+    [{ org: AGENCY, siteId: SITE_A, role: "r" }],
+    // agency staff with NO site — org-wide, reaches every engaged site
+    [{ org: AGENCY, siteId: "", role: "r" }],
+    // a member of nothing relevant
+    [{ org: CLIENT, siteId: SITE_A, role: "r" }],
+  ];
+
+  for (const memberships of shapes) {
+    const scope = entitledSiteScope({
+      memberships,
+      sitesByOrg: OWNED,
+      engagedSitesByOrg: ENGAGED,
+    });
+    for (const site of ENGAGED[AGENCY]) {
+      assert.equal(
+        offered(scope).includes(site),
+        grants(site, memberships),
+        `offer and camera check disagree on ${site} for ${JSON.stringify(memberships)}`,
+      );
+    }
+  }
+
+  // CONTROL — the pre-fix rule disagrees on the first shape. If this ever
+  // stops failing, the transcription above has drifted and the test is void.
+  const [defect] = shapes;
+  const before = offered(preFixOrgSiteScope({ memberships: defect, org: AGENCY }));
+  assert.ok(
+    ENGAGED[AGENCY].some(
+      (site) => before.includes(site) !== grants(site, defect),
+    ),
+    "the pre-fix rule must disagree — otherwise there was nothing to fix",
+  );
+});
+
+test("an ORG-level role at the site's OWNER still reaches its whole estate", () => {
+  // Do not narrow admins while narrowing guards. An organisation-level role at
+  // the CLIENT keeps every site the client owns, pinned row or not.
+  const memberships = [
+    { org: CLIENT, siteId: SITE_A, role: "org-owner", orgLevelRole: true },
+  ];
+
+  const scope = entitledSiteScope({
+    memberships,
+    sitesByOrg: OWNED,
+    engagedSitesByOrg: ENGAGED,
+  });
+
+  assert.deepEqual([...scope].sort(), [SITE_A, SITE_B].sort());
+  assert.equal(grants(SITE_A, memberships), true);
+  assert.equal(grants(SITE_B, memberships), true);
+
+  // ...and a site-less membership at the owner is the same answer.
+  const siteless = [{ org: CLIENT, siteId: "", role: "org-owner" }];
+  assert.equal(grants(SITE_B, siteless), true);
+});