@7365admin1/core 3.53.8 → 3.54.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.8",
+  "version": "3.54.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/camera-view.util.test.mjs

@@ -13,7 +13,6 @@ import {
   hasAnyPermission,
   isCameraEntitled,
   cameraGrant,
-  orgSiteScope,
   parseDeviceTime,
   parseSoftwareVersion,
   ptzEndpoint,
@@ -938,93 +937,10 @@ test("a write is scoped to the caller's own sites, not just to any signed-in use
 });
 
 /*
- * `orgSiteScope` — which sites of ONE organisation a caller may be OFFERED.
- *
- * The listing half of `cameraGrant`. `GET /api/customer-sites?org=` authorised
- * at organisation level and then returned the organisation's whole estate, so a
- * user invited to a single site saw every site in the client in the switcher.
+ * The OFFER half of `cameraGrant` is `entitledSiteScope`, and it now answers
+ * `GET /api/customer-sites?org=` directly (`entitledSites`). Its own tests are
+ * `picker-site-scope.test.mjs` and `building-estate-site-scope.test.mjs`.
  */
-const SCOPE_ORG = "aaaaaaaaaaaaaaaaaaaaaaaa";
-const SCOPE_OTHER_ORG = "bbbbbbbbbbbbbbbbbbbbbbbb";
-const SCOPE_SITE_A = "cccccccccccccccccccccccc";
-const SCOPE_SITE_B = "dddddddddddddddddddddddd";
-
-test("orgSiteScope: an org-wide membership keeps the whole list", () => {
-  // The half a careless narrowing breaks. An org owner/admin holds a membership
-  // with no site, and must still see every site in their organisation.
-  assert.equal(
-    orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: "" }], org: SCOPE_ORG }),
-    null,
-  );
-  assert.equal(
-    orgSiteScope({ memberships: [{ org: SCOPE_ORG }], org: SCOPE_ORG }),
-    null,
-  );
-  // One org-wide membership wins even alongside pinned ones.
-  assert.equal(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-        { org: SCOPE_ORG, siteId: "" },
-      ],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-});
-
-test("orgSiteScope: a site-pinned membership is offered that site alone", () => {
-  assert.deepEqual(
-    orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }], org: SCOPE_ORG }),
-    [SCOPE_SITE_A],
-  );
-  // Two pins in the same organisation are both offered, de-duplicated.
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_B },
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A, SCOPE_SITE_B],
-  );
-});
-
-test("orgSiteScope: another organisation's memberships do not widen this one", () => {
-  // The reported defect in one line: pinned to one site here, org-wide
-  // somewhere else. The org-wide row must not unlock this organisation.
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A },
-        { org: SCOPE_OTHER_ORG, siteId: "" },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-  // No membership in this organisation at all: fail closed, not "show all".
-  assert.deepEqual(
-    orgSiteScope({ memberships: [{ org: SCOPE_OTHER_ORG, siteId: "" }], org: SCOPE_ORG }),
-    [],
-  );
-});
-
-test("orgSiteScope: ObjectId and hex-string ids are the same id", () => {
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [{ org: { toString: () => SCOPE_ORG }, siteId: { toString: () => SCOPE_SITE_A } }],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
-test("orgSiteScope: no organisation asked about means no restriction", () => {
-  assert.equal(orgSiteScope({ memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }] }), null);
-});
 
 /**
  * The owner's rule of 2026-09-02: "Org-level roles see all sites."
@@ -1034,80 +950,10 @@ test("orgSiteScope: no organisation asked about means no restriction", () => {
  * (`Org Owner` in most cases) but whose membership row also happens to name a
  * site. These three tests are the three shapes the rule has to get right.
  */
-test("orgSiteScope: a site-LEVEL role pinned to a site sees only that site", () => {
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
-test("orgSiteScope: an ORG-level role carrying a siteId still sees every site", () => {
-  assert.equal(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: true },
-      ],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-
-  // and it widens the whole organisation, not just its own row
-  assert.equal(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_B, orgLevelRole: true },
-      ],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-});
-
-test("orgSiteScope: an ORG-level role with no siteId sees every site", () => {
-  assert.equal(
-    orgSiteScope({
-      memberships: [{ org: SCOPE_ORG, siteId: "", orgLevelRole: true }],
-      org: SCOPE_ORG,
-    }),
-    null,
-  );
-});
-
-test("orgSiteScope: an org-level role in ANOTHER organisation does not widen this one", () => {
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [
-        { org: SCOPE_ORG, siteId: SCOPE_SITE_A, orgLevelRole: false },
-        { org: SCOPE_OTHER_ORG, siteId: "", orgLevelRole: true },
-      ],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
-test("orgSiteScope: an unresolved role fails closed — it does not widen", () => {
-  // `orgLevelRole` absent is how a missing or soft-deleted role arrives.
-  assert.deepEqual(
-    orgSiteScope({
-      memberships: [{ org: SCOPE_ORG, siteId: SCOPE_SITE_A }],
-      org: SCOPE_ORG,
-    }),
-    [SCOPE_SITE_A],
-  );
-});
-
 /**
  * The camera side of the site-scope rule, reconciled with the LIST side.
  *
- * `orgSiteScope` (below) was changed on 2026-09-02 to the owner's rule: an
+ * The site LIST was changed on 2026-09-02 to the owner's rule: an
  * ORGANISATION-LEVEL role sees every site of its organisation even when its
  * membership row also names a `siteId`. `cameraGrant` kept the older, stricter
  * reading — `!siteId` only — so the switcher offered those people sites the

package/test/e2e/harness.mjs

@@ -706,6 +706,14 @@ function buildApp(nsu, core) {
     notificationPreferences.put("/", requireAuth, update);
   }
 
+  // mirrors iservice365-API-core/src/routes/personal-emergency-chain.route.ts
+  const personalEmergencyContacts = express.Router();
+  {
+    const { get, update } = core.usePersonalEmergencyChainController();
+    personalEmergencyContacts.get("/:userId", requireAuth, get);
+    personalEmergencyContacts.put("/:userId", requireAuth, update);
+  }
+
 
   // mirrors iservice365-API-core/src/routes/vehicle.route.ts
   const vehicles = express.Router();
@@ -1527,6 +1535,7 @@ function buildApp(nsu, core) {
   app.use("/api/bulletin-videos", bulletinVideos);
   app.use("/api/notifications", notifications);
   app.use("/api/notification-preferences", notificationPreferences);
+  app.use("/api/personal-emergency-contacts", personalEmergencyContacts);
   app.use("/api/subscriptions", subscriptions);
   app.use("/api/invoices", invoices);
   app.use("/api/post-preloved", postPreloved);

package/test/e2e/personal-emergency-chain-scope.e2e.test.mjs

@@ -0,0 +1,373 @@
+// End-to-end proof, over real HTTP, that a person's OWN emergency contacts are
+// theirs — readable and writable by them and by Seven365 staff, and by nobody
+// else — and that the ordering of the chain cannot be corrupted.
+//
+// This is a NEW collection (`personal-emergency-contacts`). It does not touch
+// the site's published directory (`emergency-contacts`, in
+// `iservice365-API-core`), which is a different list with a different owner and
+// a different gate. The cases below prove that separation is real: a site's own
+// administrator, with a wildcard role over that site, still cannot read a
+// resident's family numbers.
+//
+// The two rules under test:
+//
+//   1. WHO. `requireSelfOrPlatformStaff` — the same helper `/api/users` and
+//      `/api/users/v2` already use. The owner's decision: the person, plus
+//      Seven365 platform staff. NOT the site admin, NOT the org admin.
+//   2. ORDER. Two contacts cannot hold the same position, and a reorder either
+//      applies completely or leaves the stored chain exactly as it was. There
+//      is no half-applied order for a later read to find.
+//
+// Every case has its positive control beside its negative one: a refusal that
+// is never contrasted with a success would also pass against an endpoint that
+// refuses everybody, and would prove nothing.
+//
+// Everything it talks to is created and thrown away by the harness: an
+// in-process MongoDB replica set, a loopback Redis, a loopback mail sink. No
+// staging or production database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "PersonalChain-Passw0rd!";
+const OWNER = "pec-owner@e2e.example.com"; // the resident whose chain it is
+const STRANGER = "pec-stranger@e2e.example.com"; // another org entirely
+const SITE_ADMIN = "pec-siteadmin@e2e.example.com"; // wildcard role AT the owner's org
+const STAFF = "pec-sevenadmin@e2e.example.com"; // Seven365 platform staff
+
+const CHAIN = "/personal-emergency-contacts";
+
+const wife = { name: "Wife", phone: "+6591234567", relationship: "Spouse", order: 1, active: true };
+const son = { name: "Son", phone: "+6598765432", relationship: "Son", order: 2, active: true };
+const doctor = { name: "Dr Tan", phone: "+6567001122", relationship: "Doctor", order: 3, active: true };
+
+describe("a person's own emergency chain", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- personal emergency chain: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let ownerSid;
+  let strangerSid;
+  let siteAdminSid;
+  let staffSid;
+
+  const stored = async (user) =>
+    await h.db.collection("personal-emergency-contacts").findOne({ user });
+
+  record("0. baseline — four sessions, and no chain stored for anybody", async () => {
+    ownerSid = await h.login(OWNER, PASSWORD);
+    strangerSid = await h.login(STRANGER, PASSWORD);
+    siteAdminSid = await h.login(SITE_ADMIN, PASSWORD);
+    staffSid = await h.login(STAFF, PASSWORD);
+
+    assert.equal(await stored(id.owner), null);
+    assert.equal(
+      await h.db.collection("personal-emergency-contacts").countDocuments({}),
+      0,
+    );
+  });
+
+  // ---- reading and writing your own ---------------------------------------
+
+  record("1. an empty chain reads as empty, not as an error, before anything is saved", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: ownerSid });
+
+    assert.equal(res.status, 200);
+    assert.deepEqual(res.body?.data?.contacts, []);
+    assert.equal(res.body?.data?.ringSeconds, 20);
+    assert.equal(res.body?.data?.siteDirectoryFallback, true);
+    // Reading must not have written a row.
+    assert.equal(await stored(id.owner), null);
+  });
+
+  record("2. he saves his own chain — the positive control the refusals are measured against", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [wife, son, doctor], ringSeconds: 25, siteDirectoryFallback: false },
+    });
+
+    assert.equal(res.status, 200);
+    assert.equal(res.body?.data?.contacts?.length, 3);
+
+    const row = await stored(id.owner);
+    assert.notEqual(row, null, "nothing was written");
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+    assert.equal(row.ringSeconds, 25);
+    assert.equal(row.siteDirectoryFallback, false);
+  });
+
+  record("3. he reads back exactly what he saved", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: ownerSid });
+
+    assert.equal(res.status, 200);
+    assert.deepEqual(res.body.data.contacts.map((c) => c.phone), [
+      wife.phone,
+      son.phone,
+      doctor.phone,
+    ]);
+  });
+
+  // ---- somebody else's ----------------------------------------------------
+
+  record("4. a stranger cannot READ his chain", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: strangerSid });
+
+    assert.equal(res.status, 401);
+    assert.equal(res.body?.contacts, undefined);
+  });
+
+  record("5. a stranger cannot WRITE his chain", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: strangerSid,
+      body: { contacts: [{ ...wife, name: "Planted", phone: "+6500000000" }] },
+    });
+
+    assert.equal(res.status, 401);
+    const row = await stored(id.owner);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+  });
+
+  record("6. the SITE ADMIN of his own organisation cannot read it either", async () => {
+    // This is the case that separates a personal chain from the site's
+    // published directory. The same person holds a wildcard role over this
+    // organisation and can administer the site's own emergency numbers.
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: siteAdminSid });
+
+    assert.equal(res.status, 401);
+  });
+
+  record("7. the SITE ADMIN cannot write it either", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: siteAdminSid,
+      body: { contacts: [{ ...wife, name: "Planted by admin" }] },
+    });
+
+    assert.equal(res.status, 401);
+    const row = await stored(id.owner);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+  });
+
+  record("8. the site admin CAN still keep his own chain — he is not locked out of the feature", async () => {
+    const res = await h.api(`${CHAIN}/${id.siteAdmin}`, {
+      method: "PUT",
+      sid: siteAdminSid,
+      body: { contacts: [{ ...wife, name: "Admin's wife" }] },
+    });
+
+    assert.equal(res.status, 200);
+    assert.equal((await stored(id.siteAdmin))?.contacts?.length, 1);
+  });
+
+  // ---- Seven365 staff -----------------------------------------------------
+
+  record("9. Seven365 staff CAN read it — the precedent a user record already sets", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: staffSid });
+
+    assert.equal(res.status, 200);
+    assert.equal(res.body?.data?.contacts?.length, 3);
+  });
+
+  record("10. Seven365 staff CAN write it", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: staffSid,
+      body: { contacts: [wife, son, doctor], ringSeconds: 30, siteDirectoryFallback: true },
+    });
+
+    assert.equal(res.status, 200);
+    assert.equal((await stored(id.owner))?.ringSeconds, 30);
+  });
+
+  // ---- ordering integrity -------------------------------------------------
+
+  record("11. two contacts cannot hold the same position", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [{ ...wife, order: 1 }, { ...son, order: 1 }] },
+    });
+
+    assert.equal(res.status, 400);
+    assert.match(String(res.body?.message ?? res.body), /same position/i);
+  });
+
+  record("12. the refused reorder wrote NOTHING — the stored chain is untouched", async () => {
+    const row = await stored(id.owner);
+
+    assert.equal(row.contacts.length, 3, "a rejected write changed the chain");
+    assert.deepEqual(row.contacts.map((c) => c.order), [1, 2, 3]);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+    assert.equal(row.ringSeconds, 30, "settings moved on a rejected write");
+  });
+
+  record("13. a valid reorder applies completely, in one write", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: {
+        contacts: [
+          { ...doctor, order: 1 },
+          { ...wife, order: 2 },
+          { ...son, order: 3 },
+        ],
+      },
+    });
+
+    assert.equal(res.status, 200);
+    const row = await stored(id.owner);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Dr Tan", "Wife", "Son"]);
+    assert.deepEqual(row.contacts.map((c) => c.order), [1, 2, 3]);
+  });
+
+  record("14. concurrent reorders leave ONE chain in ONE of the two orders, never a mixture", async () => {
+    const a = [
+      { ...wife, order: 1 },
+      { ...son, order: 2 },
+      { ...doctor, order: 3 },
+    ];
+    const b = [
+      { ...doctor, order: 1 },
+      { ...son, order: 2 },
+      { ...wife, order: 3 },
+    ];
+
+    await Promise.all([
+      h.api(`${CHAIN}/${id.owner}`, { method: "PUT", sid: ownerSid, body: { contacts: a } }),
+      h.api(`${CHAIN}/${id.owner}`, { method: "PUT", sid: ownerSid, body: { contacts: b } }),
+    ]);
+
+    assert.equal(
+      await h.db.collection("personal-emergency-contacts").countDocuments({ user: id.owner }),
+      1,
+      "a second row was created for the same person",
+    );
+
+    const names = (await stored(id.owner)).contacts.map((c) => c.name);
+    const options = [a, b].map((set) => set.map((c) => c.name));
+    assert.ok(
+      options.some((option) => option.join() === names.join()),
+      `chain is a mixture of both writes: ${names.join()}`,
+    );
+  });
+
+  // ---- validation at the trust boundary -----------------------------------
+
+  record("15. a number that is not dialable internationally is refused", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [{ ...wife, phone: "91234567" }] },
+    });
+
+    assert.equal(res.status, 400);
+    assert.match(String(res.body?.message ?? res.body), /international format/i);
+  });
+
+  record("16. a user id in the BODY cannot redirect the write", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [wife], user: id.stranger.toString() },
+    });
+
+    // The schema does not accept it at all, so there is nothing to strip and
+    // nothing to get wrong later.
+    assert.equal(res.status, 400);
+    assert.equal(await stored(id.stranger), null);
+  });
+
+  record("17. an unauthenticated caller reaches nothing", async () => {
+    assert.equal((await h.api(`${CHAIN}/${id.owner}`)).status, 401);
+    assert.equal(
+      (await h.api(`${CHAIN}/${id.owner}`, { method: "PUT", body: { contacts: [] } })).status,
+      401,
+    );
+  });
+
+  // ---- the site's own directory is a different list ------------------------
+
+  record("18. nothing here touched the site's published emergency directory", async () => {
+    assert.equal(
+      await h.db.collection("emergency-contacts").countDocuments({}),
+      0,
+      "the site directory collection was written to",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const orgA = new ObjectId();
+  const orgB = new ObjectId();
+  const siteA = new ObjectId();
+  const staffRole = new ObjectId();
+  const roleA = new ObjectId();
+  const roleB = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: orgA, name: "PEC Org A", email: "pec-a@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgB, name: "PEC Org B", email: "pec-b@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("sites").insertOne({
+    _id: siteA, name: "PEC Site A", orgId: orgA, status: "active", createdAt: now,
+  });
+
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    // A wildcard role at the OWNER's own organisation: this is the strongest
+    // tenant role there is, and case 6 proves even it does not reach a
+    // resident's personal chain.
+    { _id: roleA, name: "Site Admin A", org: orgA, type: "organization", permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Admin B", org: orgB, type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const emails = [OWNER, STRANGER, SITE_ADMIN, STAFF];
+  const users = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+
+  const [owner, stranger, siteAdmin, staff] = [0, 1, 2, 3].map((i) => users.insertedIds[i]);
+
+  await h.db.collection("members").insertMany([
+    { user: owner, org: orgA, siteId: siteA, type: "organization", role: roleA, status: "active" },
+    { user: stranger, org: orgB, type: "organization", role: roleB, status: "active" },
+    { user: siteAdmin, org: orgA, siteId: siteA, type: "organization", role: roleA, status: "active" },
+    { user: staff, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  return { orgA, orgB, siteA, owner, stranger, siteAdmin, staff };
+}

package/test/notification-category.util.test.mjs

@@ -180,7 +180,7 @@ describe("notification categories", () => {
   // -------------------------------------------------------------------------
   // What the September 2026 audit fixed. Both of these FAIL against the
   // catalogue as it stood before it: `serviceProviderInvite` declared
-  // `email: true` and `emergencyContact` declared `rendered: true`.
+  // `email: true`, and `emergencyContact` was offered with no sender at all.
   // -------------------------------------------------------------------------
 
   it("no category offers a switchable Email row, because no sender reads one", () => {
@@ -199,22 +199,37 @@ describe("notification categories", () => {
     }
   });
 
-  it("emergency contacts are not offered, because nothing calls their sender", () => {
-    // The sender exists in `notification.service.ts`, but emergency contacts
-    // are written in `iservice365-API-core` and the caller there was never
-    // merged. A switch over a message that cannot arrive is the defect this
-    // whole catalogue exists to prevent.
+  it("emergency contacts ARE offered now that a caller exists", () => {
+    // `iservice365-API-core`'s `emergency.service.ts` calls
+    // `NotificationService.emergencyContactChanged` on each of its three
+    // writes, and reads this flag before it sends. So the switch governs a
+    // message that really arrives — which is what this catalogue exists to
+    // guarantee, and the reason the flag was false until the caller was written.
     const category = notificationCategory("emergencyContact");
-    assert.equal(category.rendered, false);
+    assert.equal(category.rendered, true);
 
-    for (const permissions of [["emergency-contact:update"], ["*"]]) {
+    // The gate is the `emergency-contact` RESOURCE, so any action on it counts.
+    for (const permissions of [
+      ["emergency-contact:update-emergency-contact"],
+      ["emergency-contact:see-all"],
+      ["*"],
+    ]) {
       assert.ok(
-        !keys(categoriesForPermissions({ permissions, isResident: true })).includes(
+        keys(categoriesForPermissions({ permissions, isResident: true })).includes(
           "emergencyContact",
         ),
-        `offered to ${permissions.join()}`,
+        `not offered to ${permissions.join()}`,
       );
     }
+
+    // Negative control: holding an unrelated resource must NOT offer it, or the
+    // assertion above would pass for everybody and prove nothing.
+    assert.ok(
+      !keys(
+        categoriesForPermissions({ permissions: ["bulletin-board:see-all"] }),
+      ).includes("emergencyContact"),
+      "offered to a role that holds no emergency-contact permission",
+    );
   });
 
   it("category keys are unique", () => {
@@ -371,6 +386,9 @@ const BEFORE = {
     "prelovedMarketplace",
     "serviceProviderInvite",
     "incidentReport",
+    // Added by the emergency-contact re-land: the sender in API-core exists
+    // again, so the switch is rendered again. See `rendered` on the category.
+    "emergencyContact",
     "virtualPatrol",
     "cameraFault",
   ],
@@ -378,7 +396,7 @@ const BEFORE = {
     "bulletin-board": ["bulletinBoard"],
     "bulletin-board-mgmt": ["bulletinBoard"],
     "bulletin-videos-mgmt": ["bulletinBoard"],
-    "emergency-contact": [],
+    "emergency-contact": ["emergencyContact"],
     "event-mgmt": ["event"],
     "facility-booking-mgmt": ["facilityBooking"],
     "facility-mgmt": ["facilityBooking"],