@7365admin1/core 3.53.8 → 3.54.0

package/test/personal-emergency-chain.test.mjs

@@ -0,0 +1,261 @@
+/**
+ * The ordering rules of a person's own emergency chain, run as the shipped
+ * module -- not a description of it.
+ *
+ * Two things decide whether "ring my wife, then my son, then my doctor" works
+ * at all, and both are enforced here rather than in a screen:
+ *
+ *  1. no two contacts may claim the same position -- otherwise "who is second"
+ *     has two answers and the dialer picks one at random;
+ *  2. a chain that breaks rule 1 is refused BEFORE anything is written, which is
+ *     what makes a reorder atomic. There is no partial order to clean up,
+ *     because a rejected reorder never reaches the database at all.
+ *
+ * The E.164 rule is checked here too: a number that is not dialable from
+ * outside the country it was typed in is not an emergency contact.
+ *
+ * Nothing here opens a socket or a database.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { ObjectId } from "mongodb";
+
+import {
+  MAX_PERSONAL_EMERGENCY_CONTACTS,
+  DEFAULT_RING_SECONDS,
+  MPersonalEmergencyChain,
+  emptyPersonalEmergencyChain,
+  schemaUpdatePersonalEmergencyChain,
+} from "./.build/models/personal-emergency-chain.model.mjs";
+
+const USER = new ObjectId().toString();
+
+const contact = (over = {}) => ({
+  name: "Wife",
+  phone: "+6591234567",
+  relationship: "Spouse",
+  order: 1,
+  active: true,
+  ...over,
+});
+
+const validate = (body) =>
+  schemaUpdatePersonalEmergencyChain.validate(body, { convert: true });
+
+const chain = (contacts) => ({
+  user: USER,
+  contacts,
+  ringSeconds: DEFAULT_RING_SECONDS,
+  siteDirectoryFallback: true,
+});
+
+// ---------------------------------------------------------------- positions
+
+test("a chain with distinct positions is accepted -- the positive control", () => {
+  const { error, value } = validate({
+    contacts: [
+      contact({ name: "Wife", order: 1 }),
+      contact({ name: "Son", phone: "+6598765432", order: 2 }),
+      contact({ name: "Dr Tan", phone: "+6567001122", order: 3 }),
+    ],
+  });
+
+  assert.equal(error, undefined);
+  // A positive control that returned nothing would prove nothing.
+  assert.equal(value.contacts.length, 3);
+  assert.deepEqual(
+    value.contacts.map((c) => c.order),
+    [1, 2, 3],
+  );
+});
+
+test("two contacts cannot share a position", () => {
+  const { error } = validate({
+    contacts: [contact({ order: 2 }), contact({ name: "Son", order: 2 })],
+  });
+
+  assert.notEqual(error, undefined);
+  assert.match(error.message, /same position/i);
+});
+
+test("the model refuses a duplicate position even if validation is bypassed", () => {
+  // The repository calls the model, so this is the last gate before the write.
+  assert.throws(
+    () =>
+      MPersonalEmergencyChain(
+        chain([contact({ order: 1 }), contact({ name: "Son", order: 1 })]),
+      ),
+    /same position/i,
+  );
+});
+
+test("a stored chain comes back in dialling order, whatever order it was sent in", () => {
+  const doc = MPersonalEmergencyChain(
+    chain([
+      contact({ name: "Dr Tan", phone: "+6567001122", order: 3 }),
+      contact({ name: "Wife", order: 1 }),
+      contact({ name: "Son", phone: "+6598765432", order: 2 }),
+    ]),
+  );
+
+  assert.deepEqual(
+    doc.contacts.map((c) => c.name),
+    ["Wife", "Son", "Dr Tan"],
+  );
+  assert.deepEqual(
+    doc.contacts.map((c) => c.order),
+    [1, 2, 3],
+  );
+});
+
+test("a reorder is a whole new chain, and an invalid one changes nothing", () => {
+  const wife = contact({ name: "Wife", order: 1 });
+  const son = contact({ name: "Son", phone: "+6598765432", order: 2 });
+
+  const before = MPersonalEmergencyChain(chain([wife, son]));
+  assert.deepEqual(
+    before.contacts.map((c) => c.name),
+    ["Wife", "Son"],
+  );
+
+  // Swapping them is valid and lands complete.
+  const after = MPersonalEmergencyChain(
+    chain([
+      contact({ name: "Wife", order: 2 }),
+      contact({ name: "Son", phone: "+6598765432", order: 1 }),
+    ]),
+  );
+  assert.deepEqual(
+    after.contacts.map((c) => c.name),
+    ["Son", "Wife"],
+  );
+
+  // A half-typed reorder -- both at position 1 -- is refused outright, so the
+  // caller still holds the chain it had.
+  assert.throws(
+    () =>
+      MPersonalEmergencyChain(
+        chain([
+          contact({ name: "Wife", order: 1 }),
+          contact({ name: "Son", phone: "+6598765432", order: 1 }),
+        ]),
+      ),
+    /same position/i,
+  );
+  assert.deepEqual(
+    before.contacts.map((c) => c.name),
+    ["Wife", "Son"],
+  );
+});
+
+// -------------------------------------------------------------------- phone
+
+test("a phone number must be dialable from anywhere", () => {
+  for (const phone of [
+    "91234567",
+    "+0591234567",
+    "6591234567",
+    "+65 9123 4567",
+    "",
+    "+",
+  ]) {
+    const { error } = validate({ contacts: [contact({ phone })] });
+    assert.notEqual(error, undefined, JSON.stringify(phone) + " was accepted");
+  }
+
+  // Positive control across three countries, so the rule is not "Singapore only".
+  for (const phone of ["+6591234567", "+442071234567", "+14155550123"]) {
+    const { error } = validate({ contacts: [contact({ phone })] });
+    assert.equal(error, undefined, phone + " was refused");
+  }
+});
+
+// ----------------------------------------------------------------- settings
+
+test("chain settings have working defaults and real bounds", () => {
+  const { error, value } = validate({ contacts: [] });
+
+  assert.equal(error, undefined);
+  assert.equal(value.ringSeconds, DEFAULT_RING_SECONDS);
+  assert.equal(value.siteDirectoryFallback, true);
+
+  assert.notEqual(validate({ contacts: [], ringSeconds: 1 }).error, undefined);
+  assert.notEqual(validate({ contacts: [], ringSeconds: 600 }).error, undefined);
+  assert.equal(validate({ contacts: [], ringSeconds: 45 }).error, undefined);
+
+  assert.equal(
+    validate({ contacts: [], siteDirectoryFallback: false }).value
+      .siteDirectoryFallback,
+    false,
+  );
+});
+
+test("the chain is bounded, so a body cannot be padded into an expensive write", () => {
+  const many = Array.from(
+    { length: MAX_PERSONAL_EMERGENCY_CONTACTS + 1 },
+    (_, i) => contact({ order: i + 1 }),
+  );
+
+  assert.notEqual(validate({ contacts: many }).error, undefined);
+  assert.equal(
+    validate({ contacts: many.slice(0, MAX_PERSONAL_EMERGENCY_CONTACTS) }).error,
+    undefined,
+  );
+});
+
+test("a contact can be kept but taken out of the chain", () => {
+  const { error, value } = validate({
+    contacts: [contact({ order: 1, active: false })],
+  });
+
+  assert.equal(error, undefined);
+  assert.equal(value.contacts[0].active, false);
+});
+
+test("no user id is accepted from the body -- the URL and the gate decide that", () => {
+  const { error } = validate({ contacts: [], user: new ObjectId().toString() });
+
+  assert.notEqual(error, undefined, "a user id in the body was accepted");
+});
+
+// ------------------------------------------------------------------- absent
+
+test("somebody who has never saved a chain reads an empty one, not an error", () => {
+  const empty = emptyPersonalEmergencyChain(USER);
+
+  assert.deepEqual(empty.contacts, []);
+  assert.equal(empty.ringSeconds, DEFAULT_RING_SECONDS);
+  assert.equal(empty.siteDirectoryFallback, true);
+  assert.equal(empty.user, USER);
+});
+
+test("nothing in the model names a telephony vendor", () => {
+  // The chain has to outlive whatever places the call. If a provider name ever
+  // appears here, the data model has been tied to one dialer.
+  const text = readFileSync(
+    fileURLToPath(
+      new URL(
+        "../src/models/personal-emergency-chain.model.ts",
+        import.meta.url,
+      ),
+    ),
+    "utf8",
+  );
+
+  for (const vendor of [
+    "twilio",
+    "vonage",
+    "nexmo",
+    "asterisk",
+    "plivo",
+    "sinch",
+    "telnyx",
+  ]) {
+    assert.ok(
+      !new RegExp(vendor, "i").test(text),
+      vendor + " is named in the model",
+    );
+  }
+});

package/test/picker-site-scope.test.mjs

@@ -0,0 +1,181 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  cameraGrant,
+  entitledSiteScope,
+} from "./.build/utils/camera-view.util.mjs";
+
+/**
+ * The site PICKER must offer exactly the sites the camera check will serve.
+ *
+ * `GET /api/customer-sites?org=<agency>` fills the site switcher in the guard
+ * app, the MA apps and the seven vertical web apps. Every screen then calls with
+ * the chosen site id — `getAnprCameras` -> `GET /api/site-cameras` -> core's
+ * `entitleSite`. When the two disagree, the switcher is a menu of things that do
+ * not work: the user picks a site and reads "Site not found.".
+ *
+ * Owner's ruling, 2026-09-06: **a guard reaches only the sites they are
+ * personally assigned to, not every site their agency is engaged at.** So the
+ * PICKER is the half that was wrong, and the entitlement rule is unchanged.
+ *
+ * The controller therefore now asks the SAME helper the camera check asks:
+ * `entitledSites` -> `entitledSiteScope`, which is `cameraGrant`'s three
+ * branches expressed as a list. These tests pin that agreement, in both
+ * directions, and pin that an ORG-level role is not narrowed with the guards.
+ *
+ * Measured read-only on staging 2026-09-06: 384 offered pairs -> 342; the 42
+ * removed are exactly the 42 `entitleSite` already refuses; 26 of 189 users see
+ * a shorter list; ZERO users gain a site.
+ */
+
+const AGENCY = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const CLIENT = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const SITE_A = "cccccccccccccccccccccccc";
+const SITE_B = "dddddddddddddddddddddddd";
+
+/** The engagement rows `?org=AGENCY` returns: the agency serves both sites. */
+const ENGAGED = { [AGENCY]: [SITE_A, SITE_B] };
+/** Both sites belong to the CLIENT, not to the agency. */
+const OWNED = { [CLIENT]: [SITE_A, SITE_B] };
+
+/**
+ * The rule the controller used BEFORE this change (`orgSiteScope`), transcribed
+ * so the defect is reproducible from the test file alone rather than only from
+ * the staging measurement. It is the control every test below is measured
+ * against: each `notDeepEqual`/`ok` pair here fails if the two rules are made to
+ * agree by accident, and each assertion on `entitledSiteScope` is one the
+ * pre-fix rule does not satisfy.
+ */
+function preFixOrgSiteScope({ memberships, org }) {
+  if (!org) return null;
+  const inOrg = memberships.filter((m) => String(m.org ?? "") === org);
+  if (inOrg.some((m) => !String(m.siteId ?? "") || m.orgLevelRole === true)) {
+    return null; // "no restriction" — the whole engagement list
+  }
+  return inOrg.map((m) => String(m.siteId ?? "")).filter(Boolean);
+}
+
+/** What the picker offers for `?org=AGENCY` under a given scope list. */
+function offered(scope) {
+  return scope === null
+    ? ENGAGED[AGENCY]
+    : ENGAGED[AGENCY].filter((site) => scope.includes(site));
+}
+
+/** Does the camera check serve this site to this caller? */
+function grants(site, memberships) {
+  return Boolean(
+    cameraGrant({
+      cameraSite: site,
+      cameraOrg: CLIENT,
+      memberships,
+      engagedOrgs: new Set(
+        Object.entries(ENGAGED)
+          .filter(([, sites]) => sites.includes(site))
+          .map(([org]) => org),
+      ),
+    }),
+  );
+}
+
+test("a guard assigned to one site is offered that site, and its cameras load", () => {
+  // The shape the owner ruled on: an ORG-LEVEL role at the agency whose
+  // membership row names site A. 26 of 189 staging users are this shape.
+  const memberships = [
+    { org: AGENCY, siteId: SITE_A, role: "guard-role", orgLevelRole: true },
+  ];
+
+  const scope = entitledSiteScope({
+    memberships,
+    sitesByOrg: OWNED,
+    engagedSitesByOrg: ENGAGED,
+  });
+
+  assert.deepEqual(offered(scope), [SITE_A]);
+  assert.equal(grants(SITE_A, memberships), true);
+});
+
+test("an agency site the guard is NOT assigned to is neither offered nor reachable", () => {
+  const memberships = [
+    { org: AGENCY, siteId: SITE_A, role: "guard-role", orgLevelRole: true },
+  ];
+
+  const scope = entitledSiteScope({
+    memberships,
+    sitesByOrg: OWNED,
+    engagedSitesByOrg: ENGAGED,
+  });
+
+  assert.equal(offered(scope).includes(SITE_B), false);
+  assert.equal(grants(SITE_B, memberships), false);
+
+  // CONTROL — this is exactly what the pre-fix rule did, and why site B showed
+  // up in the switcher and then answered "Site not found.".
+  const before = offered(preFixOrgSiteScope({ memberships, org: AGENCY }));
+  assert.equal(before.includes(SITE_B), true);
+  assert.equal(grants(SITE_B, memberships), false);
+});
+
+test("the offer and the camera check agree on every site, both ways", () => {
+  // The property the whole change exists for: offered == granted, with no
+  // site offered that is refused and no site refused that is offered.
+  const shapes = [
+    // a guard pinned to a site, org-level role — the defect's shape
+    [{ org: AGENCY, siteId: SITE_A, role: "r", orgLevelRole: true }],
+    // a guard pinned to a site, site-level role
+    [{ org: AGENCY, siteId: SITE_A, role: "r" }],
+    // agency staff with NO site — org-wide, reaches every engaged site
+    [{ org: AGENCY, siteId: "", role: "r" }],
+    // a member of nothing relevant
+    [{ org: CLIENT, siteId: SITE_A, role: "r" }],
+  ];
+
+  for (const memberships of shapes) {
+    const scope = entitledSiteScope({
+      memberships,
+      sitesByOrg: OWNED,
+      engagedSitesByOrg: ENGAGED,
+    });
+    for (const site of ENGAGED[AGENCY]) {
+      assert.equal(
+        offered(scope).includes(site),
+        grants(site, memberships),
+        `offer and camera check disagree on ${site} for ${JSON.stringify(memberships)}`,
+      );
+    }
+  }
+
+  // CONTROL — the pre-fix rule disagrees on the first shape. If this ever
+  // stops failing, the transcription above has drifted and the test is void.
+  const [defect] = shapes;
+  const before = offered(preFixOrgSiteScope({ memberships: defect, org: AGENCY }));
+  assert.ok(
+    ENGAGED[AGENCY].some(
+      (site) => before.includes(site) !== grants(site, defect),
+    ),
+    "the pre-fix rule must disagree — otherwise there was nothing to fix",
+  );
+});
+
+test("an ORG-level role at the site's OWNER still reaches its whole estate", () => {
+  // Do not narrow admins while narrowing guards. An organisation-level role at
+  // the CLIENT keeps every site the client owns, pinned row or not.
+  const memberships = [
+    { org: CLIENT, siteId: SITE_A, role: "org-owner", orgLevelRole: true },
+  ];
+
+  const scope = entitledSiteScope({
+    memberships,
+    sitesByOrg: OWNED,
+    engagedSitesByOrg: ENGAGED,
+  });
+
+  assert.deepEqual([...scope].sort(), [SITE_A, SITE_B].sort());
+  assert.equal(grants(SITE_A, memberships), true);
+  assert.equal(grants(SITE_B, memberships), true);
+
+  // ...and a site-less membership at the owner is the same answer.
+  const siteless = [{ org: CLIENT, siteId: "", role: "org-owner" }];
+  assert.equal(grants(SITE_B, siteless), true);
+});