@7365admin1/core 3.53.9 → 3.55.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.53.9",
+  "version": "3.55.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/harness.mjs

@@ -706,6 +706,14 @@ function buildApp(nsu, core) {
     notificationPreferences.put("/", requireAuth, update);
   }
 
+  // mirrors iservice365-API-core/src/routes/personal-emergency-chain.route.ts
+  const personalEmergencyContacts = express.Router();
+  {
+    const { get, update } = core.usePersonalEmergencyChainController();
+    personalEmergencyContacts.get("/:userId", requireAuth, get);
+    personalEmergencyContacts.put("/:userId", requireAuth, update);
+  }
+
 
   // mirrors iservice365-API-core/src/routes/vehicle.route.ts
   const vehicles = express.Router();
@@ -1527,6 +1535,7 @@ function buildApp(nsu, core) {
   app.use("/api/bulletin-videos", bulletinVideos);
   app.use("/api/notifications", notifications);
   app.use("/api/notification-preferences", notificationPreferences);
+  app.use("/api/personal-emergency-contacts", personalEmergencyContacts);
   app.use("/api/subscriptions", subscriptions);
   app.use("/api/invoices", invoices);
   app.use("/api/post-preloved", postPreloved);

package/test/e2e/notification-matrix.e2e.test.mjs

@@ -0,0 +1,420 @@
+// The whole Notification Settings matrix, measured rather than reasoned about.
+//
+// The owner's complaint is not "is the guard called" — it is "does moving a
+// switch change what I actually receive". So every category this package can
+// send is driven through its REAL sender, against a real MongoDB, with the
+// preference written and re-read over REAL HTTP through the real `requireAuth`,
+// and the delivery counted on both sides: a row in the `notifications`
+// collection, and a payload handed to the push sender.
+//
+// Four measurements per category, and the FIRST one is a positive control:
+//
+//   ON     both channels must deliver — a zero here means the test is broken,
+//          not that the feature works
+//   inApp  off  -> nothing in the app, the phone still buzzes
+//   push   off  -> the phone is quiet, the message is still in the app
+//   both   off  -> nothing at all
+//
+// then the switches go back on and delivery must return. Every write is made
+// with `PUT /notification-preferences` and every read with a fresh
+// `GET /notification-preferences`, so "it saved" and "it is obeyed" are two
+// separate proofs rather than one.
+//
+// The six categories whose senders live in `iservice365-API-core` are measured
+// the same way, in that repository's own `test/e2e/notification-matrix`.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Matrix-Passw0rd!";
+const STAFF = "matrix-staff@e2e.example.com";
+
+const RESIDENT_SLUG = "iservice365-resident-mobile-app";
+const MA_SLUG = "iservice365-ma-mobile-app";
+
+/** every core sender, one per category it governs */
+function senders(h, id) {
+  const to = () => id.user.toString();
+  const site = () => id.site;
+
+  return [
+    {
+      key: "bulletinBoard",
+      label: "Notice Board",
+      trigger: () =>
+        h.core.NotificationService.bulletinBoardCreated({
+          to: to(),
+          bulletinId: new ObjectId(),
+          subject: "Lift maintenance",
+          status: "published",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "event",
+      label: "Events",
+      trigger: () =>
+        h.core.NotificationService.eventCreatedForMA({
+          to: to(),
+          eventId: new ObjectId(),
+          status: "published",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "visitors",
+      label: "Visitors",
+      trigger: () =>
+        h.core.NotificationService.invitedVisitorCheckOutForMa({
+          to: to(),
+          name: "Sam Visitor",
+          _id: new ObjectId(),
+          siteId: site(),
+        }),
+    },
+    {
+      key: "onlineForm",
+      label: "Online Forms",
+      trigger: () =>
+        h.core.NotificationService.onlineFormRequestStatusUpdated({
+          to: to(),
+          onlineFormId: new ObjectId(),
+          status: "approved",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "prelovedMarketplace",
+      label: "Marketplace",
+      trigger: () =>
+        h.core.NotificationService.prelovedMarketplacePostCreation({
+          to: to(),
+          prelovedId: new ObjectId(),
+          subject: "Bookshelf",
+          status: "published",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "serviceProviderInvite",
+      label: "Service Provider Invitations",
+      trigger: () =>
+        h.core.NotificationService.serviceProviderInvited({
+          to: to(),
+          invitationId: new ObjectId(),
+          title: "You have been invited",
+          orgName: "Northwind",
+          siteName: "Aurora Residences",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "incidentReport",
+      label: "Incident Reports",
+      trigger: () =>
+        h.core.NotificationService.incidentReported({
+          siteId: site(),
+          incidentId: new ObjectId(),
+          reportId: "IR-1",
+          siteName: "Aurora Residences",
+        }),
+    },
+    {
+      key: "emergencyContact",
+      label: "Emergency Contacts",
+      trigger: () =>
+        h.core.NotificationService.emergencyContactChanged({
+          siteId: site(),
+          contactId: new ObjectId(),
+          contactTitle: "Fire station",
+          action: "updated",
+        }),
+    },
+    {
+      key: "virtualPatrol",
+      label: "Guard Patrols",
+      trigger: () =>
+        h.core.NotificationService.patrolException({
+          siteId: site(),
+          patrolLogId: new ObjectId(),
+          routeName: "Basement",
+          problem: "A patrol finished late",
+        }),
+    },
+    {
+      key: "cameraFault",
+      label: "Camera Faults",
+      trigger: () =>
+        h.core.NotificationService.cameraFault({
+          siteId: site(),
+          cameraId: new ObjectId(),
+          message: "Camera 3 is not answering.",
+        }),
+    },
+  ];
+}
+
+describe("notification settings: the measured matrix", { concurrency: 1 }, () => {
+  let h;
+  let sid;
+  const id = {};
+  const matrix = [];
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    sid = await h.login(STAFF, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- observed matrix: core senders ---");
+    console.log(
+      "category".padEnd(26) +
+        "ON inApp/push".padEnd(16) +
+        "inApp OFF".padEnd(12) +
+        "push OFF".padEnd(12) +
+        "both OFF".padEnd(12) +
+        "restored".padEnd(12) +
+        "email",
+    );
+    for (const row of matrix) console.log(row);
+  });
+
+  const getPrefs = () => h.api("/notification-preferences", { sid });
+  const putPrefs = (off) =>
+    h.api("/notification-preferences", { method: "PUT", sid, body: { off } });
+
+  /** run one sender and report what actually landed */
+  async function measure(trigger) {
+    const where = { userId: new ObjectId(id.user.toString()) };
+    const before = await h.db.collection("notifications").countDocuments(where);
+    const pushBefore = h.pushes.length;
+
+    await trigger();
+
+    return {
+      inApp: (await h.db.collection("notifications").countDocuments(where)) - before,
+      push: h.pushes.length - pushBefore,
+    };
+  }
+
+  /** what a FRESH request says the screen shows for this category */
+  async function screenFor(key) {
+    const res = await getPrefs();
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const category = res.body.data.categories.find((c) => c.key === key);
+    assert.ok(category, `${key} is not on this person's screen`);
+    return Object.fromEntries(
+      category.channels.map((c) => [c.key, { enabled: c.enabled, supported: c.supported }]),
+    );
+  }
+
+  it("every rendered category is on this one person's screen", async () => {
+    const shown = (await getPrefs()).body.data.categories.map((c) => c.key);
+    const rendered = h.core.NOTIFICATION_CATEGORIES.filter((c) => c.rendered).map((c) => c.key);
+    assert.deepEqual(
+      rendered.filter((k) => !shown.includes(k)),
+      [],
+      "the seeded person must see every switch, or the matrix has holes",
+    );
+  });
+
+  for (const sender of senders(null, null).map((s) => s.key)) {
+    it(`${sender}: a switch turned off actually stops it`, async () => {
+      const spec = senders(h, id).find((s) => s.key === sender);
+
+      // ---------------------------------------------------------------- ON
+      await putPrefs([]);
+      const screenOn = await screenFor(spec.key);
+      assert.equal(screenOn.inApp.enabled, true, "in-app reads as on");
+      assert.equal(screenOn.push.enabled, true, "phone alerts read as on");
+
+      const on = await measure(spec.trigger);
+      assert.ok(on.inApp > 0, `POSITIVE CONTROL FAILED: ${spec.key} delivered nothing in the app while switched ON — the test is wrong, not the feature`);
+      assert.ok(on.push > 0, `POSITIVE CONTROL FAILED: ${spec.key} sent no push while switched ON — the test is wrong, not the feature`);
+
+      // ------------------------------------------------------ in-app OFF
+      await putPrefs([{ category: spec.key, channel: "inApp" }]);
+      const savedInApp = await screenFor(spec.key);
+      assert.equal(savedInApp.inApp.enabled, false, "the OFF choice survived a fresh read");
+      assert.equal(savedInApp.push.enabled, true, "and it did not move the other switch");
+
+      const inAppOff = await measure(spec.trigger);
+      assert.equal(inAppOff.inApp, 0, `${spec.key} still wrote to the app feed with in-app switched off`);
+      assert.ok(inAppOff.push > 0, `${spec.key} lost its push when only in-app was switched off`);
+
+      // -------------------------------------------------------- push OFF
+      await putPrefs([{ category: spec.key, channel: "push" }]);
+      const savedPush = await screenFor(spec.key);
+      assert.equal(savedPush.push.enabled, false);
+      assert.equal(savedPush.inApp.enabled, true);
+
+      const pushOff = await measure(spec.trigger);
+      assert.equal(pushOff.push, 0, `${spec.key} still sent a push with phone alerts switched off`);
+      assert.ok(pushOff.inApp > 0, `${spec.key} vanished from the app feed when only the phone was switched off`);
+
+      // -------------------------------------------------------- both OFF
+      await putPrefs([
+        { category: spec.key, channel: "inApp" },
+        { category: spec.key, channel: "push" },
+      ]);
+      const bothOff = await measure(spec.trigger);
+      assert.deepEqual(bothOff, { inApp: 0, push: 0 }, `${spec.key} still delivered with everything switched off`);
+
+      // -------------------------------------------------------- restored
+      await putPrefs([]);
+      const restoredScreen = await screenFor(spec.key);
+      assert.equal(restoredScreen.inApp.enabled, true);
+      assert.equal(restoredScreen.push.enabled, true);
+      const restored = await measure(spec.trigger);
+      assert.ok(restored.inApp > 0 && restored.push > 0, `${spec.key} did not come back when switched on again`);
+
+      // ----------------------------------------------------------- email
+      // An absent key IS the answer now: the server sends only the channels a
+      // category can really deliver on, so email is missing rather than
+      // present-and-dimmed.
+      const email = restoredScreen.email;
+      assert.equal(email, undefined, `${spec.key} still offers an email switch nothing reads`);
+
+      matrix.push(
+        spec.key.padEnd(26) +
+          `${on.inApp}/${on.push}`.padEnd(16) +
+          `${inAppOff.inApp}/${inAppOff.push}`.padEnd(12) +
+          `${pushOff.inApp}/${pushOff.push}`.padEnd(12) +
+          `${bothOff.inApp}/${bothOff.push}`.padEnd(12) +
+          `${restored.inApp}/${restored.push}`.padEnd(12) +
+          (email ? "OFFERED (bug)" : "not offered"),
+      );
+    });
+  }
+
+  it("no category in the catalogue can deliver email", async () => {
+    const withEmail = h.core.NOTIFICATION_CATEGORIES.filter((c) => c.channels.email).map((c) => c.key);
+    assert.deepEqual(
+      withEmail,
+      [],
+      "a category claims an email channel — then a sender must call filterRecipients with \"email\", and none does",
+    );
+  });
+
+  it("a category that cannot use a channel keeps nobody on it", async () => {
+    const { filterRecipients } = h.core.useNotificationPreferenceRepo();
+    assert.deepEqual(
+      await filterRecipients([id.user.toString()], "bulletinBoard", "email"),
+      [],
+      "an email send would reach nobody, which is why no switch is offered",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+
+  const org = new ObjectId();
+  const site = new ObjectId();
+  const role = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org,
+    name: "Matrix Property Management",
+    email: "matrix-org@e2e.example.com",
+    type: "property-management",
+    status: "active",
+    // so the vendor-only switch is on this one screen too
+    isMarketplaceVendor: true,
+    createdAt: now,
+  });
+
+  await h.db.collection("sites").insertOne({
+    _id: site,
+    name: "Aurora Residences",
+    org: org.toString(),
+    status: "active",
+    createdAt: now,
+  });
+
+  // One role holding every module behind a rendered category, so a single
+  // person is offered the whole screen and no category is measured against a
+  // different account.
+  await h.db.collection("roles").insertOne({
+    _id: role,
+    name: "Everything",
+    org,
+    status: "active",
+    permissions: [
+      "feedbacks:see-all-feedback",
+      "workOrder:see-all-work-orders",
+      "bulletin-board:see-all",
+      "event-mgmt:see-all",
+      "facility-booking-mgmt:see-all",
+      "visitorManagement:see-all",
+      "online-form-configuration:see-all",
+      "service-provider-mgmt:see-all",
+      "incident-reports:see-all",
+      "emergency-contact:see-all",
+      "virtual-patrol:see-all",
+      "site-settings:see-all",
+    ],
+  });
+
+  const user = (
+    await h.db.collection("users").insertOne({
+      email: STAFF,
+      password: await h.hashPassword(PASSWORD),
+      name: "Max Matrix",
+      status: "active",
+      defaultOrg: org.toString(),
+      createdAt: now,
+    })
+  ).insertedId;
+
+  // `type: "resident"` as well as the role, so the resident-default categories
+  // are on the same screen. The safety senders resolve their own recipients
+  // from `siteId` + the role's permissions, so the membership must name the
+  // site or four categories would measure zero for the wrong reason.
+  await h.db.collection("members").insertOne({
+    user,
+    org,
+    siteId: site,
+    role,
+    type: "resident",
+    status: "active",
+  });
+
+  // A device per app slug the senders address, plus one with no slug at all
+  // (the service-provider invite sends without one). A missing token would read
+  // exactly like a suppressed push.
+  await h.db.collection("push_tokens").insertMany([
+    {
+      userId: user.toString(),
+      token: "ExponentPushToken[matrix-resident]",
+      platform: "ios",
+      appSlug: RESIDENT_SLUG,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
+    {
+      userId: user.toString(),
+      token: "ExponentPushToken[matrix-ma]",
+      platform: "android",
+      appSlug: MA_SLUG,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
+    {
+      userId: user.toString(),
+      token: "ExponentPushToken[matrix-noslug]",
+      platform: "ios",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
+  ]);
+
+  return { org, site, role, user };
+}

package/test/e2e/notification-preference.e2e.test.mjs

@@ -297,18 +297,31 @@ describe("notification preferences, end to end", { concurrency: 1 }, () => {
   );
 
   record(
-    "12. a channel that cannot deliver is shown, dimmed, with a reason — and never on",
+    "12. a channel that cannot deliver is not offered at all",
     async () => {
+      // It used to be drawn, dimmed, and apologised for. A control that cannot
+      // move is not a setting: it tells a person they have been asked
+      // something they have not, and it made the summary line claim "on
+      // everywhere" for a category with no email at all.
       const res = await getPrefs(managerSid);
       const workOrder = res.body.data.categories.find(
         (c) => c.key === "workOrder",
       );
-      const email = workOrder.channels.find((c) => c.key === "email");
 
-      assert.equal(email.supported, false);
-      assert.equal(email.enabled, false);
-      assert.ok(email.note && email.note.length > 20, "a plain reason is given");
-      assert.doesNotMatch(email.note, /_|[a-z][A-Z]/, "no internal names in the reason");
+      assert.deepEqual(
+        workOrder.channels.map((c) => c.key),
+        ["inApp", "push"],
+        "only the channels this category can really deliver on are sent",
+      );
+      assert.ok(
+        workOrder.channels.every((c) => c.supported),
+        "everything sent is switchable",
+      );
+      assert.equal(
+        res.body.data.channels.find((c) => c.key === "email"),
+        undefined,
+        "and the channel dictionary does not advertise one either",
+      );
     },
   );
 
@@ -502,8 +515,8 @@ describe("notification preferences, end to end", { concurrency: 1 }, () => {
 
       assert.deepEqual(
         emailCapable,
-        ["serviceProviderInvite"],
-        "only one category can govern email at all",
+        [],
+        "no category governs email at all — nothing in the estate sends a notification by email",
       );
 
       // and the catalogue holds no category for a one-time code, a password