@7365admin1/core 3.53.9 → 3.55.0

package/test/e2e/personal-emergency-chain-scope.e2e.test.mjs

@@ -0,0 +1,373 @@
+// End-to-end proof, over real HTTP, that a person's OWN emergency contacts are
+// theirs — readable and writable by them and by Seven365 staff, and by nobody
+// else — and that the ordering of the chain cannot be corrupted.
+//
+// This is a NEW collection (`personal-emergency-contacts`). It does not touch
+// the site's published directory (`emergency-contacts`, in
+// `iservice365-API-core`), which is a different list with a different owner and
+// a different gate. The cases below prove that separation is real: a site's own
+// administrator, with a wildcard role over that site, still cannot read a
+// resident's family numbers.
+//
+// The two rules under test:
+//
+//   1. WHO. `requireSelfOrPlatformStaff` — the same helper `/api/users` and
+//      `/api/users/v2` already use. The owner's decision: the person, plus
+//      Seven365 platform staff. NOT the site admin, NOT the org admin.
+//   2. ORDER. Two contacts cannot hold the same position, and a reorder either
+//      applies completely or leaves the stored chain exactly as it was. There
+//      is no half-applied order for a later read to find.
+//
+// Every case has its positive control beside its negative one: a refusal that
+// is never contrasted with a success would also pass against an endpoint that
+// refuses everybody, and would prove nothing.
+//
+// Everything it talks to is created and thrown away by the harness: an
+// in-process MongoDB replica set, a loopback Redis, a loopback mail sink. No
+// staging or production database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "PersonalChain-Passw0rd!";
+const OWNER = "pec-owner@e2e.example.com"; // the resident whose chain it is
+const STRANGER = "pec-stranger@e2e.example.com"; // another org entirely
+const SITE_ADMIN = "pec-siteadmin@e2e.example.com"; // wildcard role AT the owner's org
+const STAFF = "pec-sevenadmin@e2e.example.com"; // Seven365 platform staff
+
+const CHAIN = "/personal-emergency-contacts";
+
+const wife = { name: "Wife", phone: "+6591234567", relationship: "Spouse", order: 1, active: true };
+const son = { name: "Son", phone: "+6598765432", relationship: "Son", order: 2, active: true };
+const doctor = { name: "Dr Tan", phone: "+6567001122", relationship: "Doctor", order: 3, active: true };
+
+describe("a person's own emergency chain", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- personal emergency chain: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  let ownerSid;
+  let strangerSid;
+  let siteAdminSid;
+  let staffSid;
+
+  const stored = async (user) =>
+    await h.db.collection("personal-emergency-contacts").findOne({ user });
+
+  record("0. baseline — four sessions, and no chain stored for anybody", async () => {
+    ownerSid = await h.login(OWNER, PASSWORD);
+    strangerSid = await h.login(STRANGER, PASSWORD);
+    siteAdminSid = await h.login(SITE_ADMIN, PASSWORD);
+    staffSid = await h.login(STAFF, PASSWORD);
+
+    assert.equal(await stored(id.owner), null);
+    assert.equal(
+      await h.db.collection("personal-emergency-contacts").countDocuments({}),
+      0,
+    );
+  });
+
+  // ---- reading and writing your own ---------------------------------------
+
+  record("1. an empty chain reads as empty, not as an error, before anything is saved", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: ownerSid });
+
+    assert.equal(res.status, 200);
+    assert.deepEqual(res.body?.data?.contacts, []);
+    assert.equal(res.body?.data?.ringSeconds, 20);
+    assert.equal(res.body?.data?.siteDirectoryFallback, true);
+    // Reading must not have written a row.
+    assert.equal(await stored(id.owner), null);
+  });
+
+  record("2. he saves his own chain — the positive control the refusals are measured against", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [wife, son, doctor], ringSeconds: 25, siteDirectoryFallback: false },
+    });
+
+    assert.equal(res.status, 200);
+    assert.equal(res.body?.data?.contacts?.length, 3);
+
+    const row = await stored(id.owner);
+    assert.notEqual(row, null, "nothing was written");
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+    assert.equal(row.ringSeconds, 25);
+    assert.equal(row.siteDirectoryFallback, false);
+  });
+
+  record("3. he reads back exactly what he saved", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: ownerSid });
+
+    assert.equal(res.status, 200);
+    assert.deepEqual(res.body.data.contacts.map((c) => c.phone), [
+      wife.phone,
+      son.phone,
+      doctor.phone,
+    ]);
+  });
+
+  // ---- somebody else's ----------------------------------------------------
+
+  record("4. a stranger cannot READ his chain", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: strangerSid });
+
+    assert.equal(res.status, 401);
+    assert.equal(res.body?.contacts, undefined);
+  });
+
+  record("5. a stranger cannot WRITE his chain", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: strangerSid,
+      body: { contacts: [{ ...wife, name: "Planted", phone: "+6500000000" }] },
+    });
+
+    assert.equal(res.status, 401);
+    const row = await stored(id.owner);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+  });
+
+  record("6. the SITE ADMIN of his own organisation cannot read it either", async () => {
+    // This is the case that separates a personal chain from the site's
+    // published directory. The same person holds a wildcard role over this
+    // organisation and can administer the site's own emergency numbers.
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: siteAdminSid });
+
+    assert.equal(res.status, 401);
+  });
+
+  record("7. the SITE ADMIN cannot write it either", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: siteAdminSid,
+      body: { contacts: [{ ...wife, name: "Planted by admin" }] },
+    });
+
+    assert.equal(res.status, 401);
+    const row = await stored(id.owner);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+  });
+
+  record("8. the site admin CAN still keep his own chain — he is not locked out of the feature", async () => {
+    const res = await h.api(`${CHAIN}/${id.siteAdmin}`, {
+      method: "PUT",
+      sid: siteAdminSid,
+      body: { contacts: [{ ...wife, name: "Admin's wife" }] },
+    });
+
+    assert.equal(res.status, 200);
+    assert.equal((await stored(id.siteAdmin))?.contacts?.length, 1);
+  });
+
+  // ---- Seven365 staff -----------------------------------------------------
+
+  record("9. Seven365 staff CAN read it — the precedent a user record already sets", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, { sid: staffSid });
+
+    assert.equal(res.status, 200);
+    assert.equal(res.body?.data?.contacts?.length, 3);
+  });
+
+  record("10. Seven365 staff CAN write it", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: staffSid,
+      body: { contacts: [wife, son, doctor], ringSeconds: 30, siteDirectoryFallback: true },
+    });
+
+    assert.equal(res.status, 200);
+    assert.equal((await stored(id.owner))?.ringSeconds, 30);
+  });
+
+  // ---- ordering integrity -------------------------------------------------
+
+  record("11. two contacts cannot hold the same position", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [{ ...wife, order: 1 }, { ...son, order: 1 }] },
+    });
+
+    assert.equal(res.status, 400);
+    assert.match(String(res.body?.message ?? res.body), /same position/i);
+  });
+
+  record("12. the refused reorder wrote NOTHING — the stored chain is untouched", async () => {
+    const row = await stored(id.owner);
+
+    assert.equal(row.contacts.length, 3, "a rejected write changed the chain");
+    assert.deepEqual(row.contacts.map((c) => c.order), [1, 2, 3]);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Wife", "Son", "Dr Tan"]);
+    assert.equal(row.ringSeconds, 30, "settings moved on a rejected write");
+  });
+
+  record("13. a valid reorder applies completely, in one write", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: {
+        contacts: [
+          { ...doctor, order: 1 },
+          { ...wife, order: 2 },
+          { ...son, order: 3 },
+        ],
+      },
+    });
+
+    assert.equal(res.status, 200);
+    const row = await stored(id.owner);
+    assert.deepEqual(row.contacts.map((c) => c.name), ["Dr Tan", "Wife", "Son"]);
+    assert.deepEqual(row.contacts.map((c) => c.order), [1, 2, 3]);
+  });
+
+  record("14. concurrent reorders leave ONE chain in ONE of the two orders, never a mixture", async () => {
+    const a = [
+      { ...wife, order: 1 },
+      { ...son, order: 2 },
+      { ...doctor, order: 3 },
+    ];
+    const b = [
+      { ...doctor, order: 1 },
+      { ...son, order: 2 },
+      { ...wife, order: 3 },
+    ];
+
+    await Promise.all([
+      h.api(`${CHAIN}/${id.owner}`, { method: "PUT", sid: ownerSid, body: { contacts: a } }),
+      h.api(`${CHAIN}/${id.owner}`, { method: "PUT", sid: ownerSid, body: { contacts: b } }),
+    ]);
+
+    assert.equal(
+      await h.db.collection("personal-emergency-contacts").countDocuments({ user: id.owner }),
+      1,
+      "a second row was created for the same person",
+    );
+
+    const names = (await stored(id.owner)).contacts.map((c) => c.name);
+    const options = [a, b].map((set) => set.map((c) => c.name));
+    assert.ok(
+      options.some((option) => option.join() === names.join()),
+      `chain is a mixture of both writes: ${names.join()}`,
+    );
+  });
+
+  // ---- validation at the trust boundary -----------------------------------
+
+  record("15. a number that is not dialable internationally is refused", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [{ ...wife, phone: "91234567" }] },
+    });
+
+    assert.equal(res.status, 400);
+    assert.match(String(res.body?.message ?? res.body), /international format/i);
+  });
+
+  record("16. a user id in the BODY cannot redirect the write", async () => {
+    const res = await h.api(`${CHAIN}/${id.owner}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: { contacts: [wife], user: id.stranger.toString() },
+    });
+
+    // The schema does not accept it at all, so there is nothing to strip and
+    // nothing to get wrong later.
+    assert.equal(res.status, 400);
+    assert.equal(await stored(id.stranger), null);
+  });
+
+  record("17. an unauthenticated caller reaches nothing", async () => {
+    assert.equal((await h.api(`${CHAIN}/${id.owner}`)).status, 401);
+    assert.equal(
+      (await h.api(`${CHAIN}/${id.owner}`, { method: "PUT", body: { contacts: [] } })).status,
+      401,
+    );
+  });
+
+  // ---- the site's own directory is a different list ------------------------
+
+  record("18. nothing here touched the site's published emergency directory", async () => {
+    assert.equal(
+      await h.db.collection("emergency-contacts").countDocuments({}),
+      0,
+      "the site directory collection was written to",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const orgA = new ObjectId();
+  const orgB = new ObjectId();
+  const siteA = new ObjectId();
+  const staffRole = new ObjectId();
+  const roleA = new ObjectId();
+  const roleB = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: orgA, name: "PEC Org A", email: "pec-a@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgB, name: "PEC Org B", email: "pec-b@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("sites").insertOne({
+    _id: siteA, name: "PEC Site A", orgId: orgA, status: "active", createdAt: now,
+  });
+
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    // A wildcard role at the OWNER's own organisation: this is the strongest
+    // tenant role there is, and case 6 proves even it does not reach a
+    // resident's personal chain.
+    { _id: roleA, name: "Site Admin A", org: orgA, type: "organization", permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Admin B", org: orgB, type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const emails = [OWNER, STRANGER, SITE_ADMIN, STAFF];
+  const users = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+
+  const [owner, stranger, siteAdmin, staff] = [0, 1, 2, 3].map((i) => users.insertedIds[i]);
+
+  await h.db.collection("members").insertMany([
+    { user: owner, org: orgA, siteId: siteA, type: "organization", role: roleA, status: "active" },
+    { user: stranger, org: orgB, type: "organization", role: roleB, status: "active" },
+    { user: siteAdmin, org: orgA, siteId: siteA, type: "organization", role: roleA, status: "active" },
+    { user: staff, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  return { orgA, orgB, siteA, owner, stranger, siteAdmin, staff };
+}

package/test/e2e/safety-notification.e2e.test.mjs

@@ -407,7 +407,7 @@ describe("safety alerts, end to end", { concurrency: 1 }, () => {
         assert.equal(categorySupportsChannel(category, "email"), false, category);
         assert.ok(
           notificationCategory(category).channelNote?.email,
-          `${category} must explain the dimmed email switch`,
+          `${category} must record why it offers no email switch`,
         );
       }
     },

package/test/notification-category.util.test.mjs

@@ -180,7 +180,7 @@ describe("notification categories", () => {
   // -------------------------------------------------------------------------
   // What the September 2026 audit fixed. Both of these FAIL against the
   // catalogue as it stood before it: `serviceProviderInvite` declared
-  // `email: true` and `emergencyContact` declared `rendered: true`.
+  // `email: true`, and `emergencyContact` was offered with no sender at all.
   // -------------------------------------------------------------------------
 
   it("no category offers a switchable Email row, because no sender reads one", () => {
@@ -199,22 +199,37 @@ describe("notification categories", () => {
     }
   });
 
-  it("emergency contacts are not offered, because nothing calls their sender", () => {
-    // The sender exists in `notification.service.ts`, but emergency contacts
-    // are written in `iservice365-API-core` and the caller there was never
-    // merged. A switch over a message that cannot arrive is the defect this
-    // whole catalogue exists to prevent.
+  it("emergency contacts ARE offered now that a caller exists", () => {
+    // `iservice365-API-core`'s `emergency.service.ts` calls
+    // `NotificationService.emergencyContactChanged` on each of its three
+    // writes, and reads this flag before it sends. So the switch governs a
+    // message that really arrives — which is what this catalogue exists to
+    // guarantee, and the reason the flag was false until the caller was written.
     const category = notificationCategory("emergencyContact");
-    assert.equal(category.rendered, false);
+    assert.equal(category.rendered, true);
 
-    for (const permissions of [["emergency-contact:update"], ["*"]]) {
+    // The gate is the `emergency-contact` RESOURCE, so any action on it counts.
+    for (const permissions of [
+      ["emergency-contact:update-emergency-contact"],
+      ["emergency-contact:see-all"],
+      ["*"],
+    ]) {
       assert.ok(
-        !keys(categoriesForPermissions({ permissions, isResident: true })).includes(
+        keys(categoriesForPermissions({ permissions, isResident: true })).includes(
           "emergencyContact",
         ),
-        `offered to ${permissions.join()}`,
+        `not offered to ${permissions.join()}`,
       );
     }
+
+    // Negative control: holding an unrelated resource must NOT offer it, or the
+    // assertion above would pass for everybody and prove nothing.
+    assert.ok(
+      !keys(
+        categoriesForPermissions({ permissions: ["bulletin-board:see-all"] }),
+      ).includes("emergencyContact"),
+      "offered to a role that holds no emergency-contact permission",
+    );
   });
 
   it("category keys are unique", () => {
@@ -371,6 +386,9 @@ const BEFORE = {
     "prelovedMarketplace",
     "serviceProviderInvite",
     "incidentReport",
+    // Added by the emergency-contact re-land: the sender in API-core exists
+    // again, so the switch is rendered again. See `rendered` on the category.
+    "emergencyContact",
     "virtualPatrol",
     "cameraFault",
   ],
@@ -378,7 +396,7 @@ const BEFORE = {
     "bulletin-board": ["bulletinBoard"],
     "bulletin-board-mgmt": ["bulletinBoard"],
     "bulletin-videos-mgmt": ["bulletinBoard"],
-    "emergency-contact": [],
+    "emergency-contact": ["emergencyContact"],
     "event-mgmt": ["event"],
     "facility-booking-mgmt": ["facilityBooking"],
     "facility-mgmt": ["facilityBooking"],