@7365admin1/core 3.54.0 → 3.56.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.54.0",
+  "version": "3.56.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/notification-matrix.e2e.test.mjs

@@ -0,0 +1,420 @@
+// The whole Notification Settings matrix, measured rather than reasoned about.
+//
+// The owner's complaint is not "is the guard called" — it is "does moving a
+// switch change what I actually receive". So every category this package can
+// send is driven through its REAL sender, against a real MongoDB, with the
+// preference written and re-read over REAL HTTP through the real `requireAuth`,
+// and the delivery counted on both sides: a row in the `notifications`
+// collection, and a payload handed to the push sender.
+//
+// Four measurements per category, and the FIRST one is a positive control:
+//
+//   ON     both channels must deliver — a zero here means the test is broken,
+//          not that the feature works
+//   inApp  off  -> nothing in the app, the phone still buzzes
+//   push   off  -> the phone is quiet, the message is still in the app
+//   both   off  -> nothing at all
+//
+// then the switches go back on and delivery must return. Every write is made
+// with `PUT /notification-preferences` and every read with a fresh
+// `GET /notification-preferences`, so "it saved" and "it is obeyed" are two
+// separate proofs rather than one.
+//
+// The six categories whose senders live in `iservice365-API-core` are measured
+// the same way, in that repository's own `test/e2e/notification-matrix`.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Matrix-Passw0rd!";
+const STAFF = "matrix-staff@e2e.example.com";
+
+const RESIDENT_SLUG = "iservice365-resident-mobile-app";
+const MA_SLUG = "iservice365-ma-mobile-app";
+
+/** every core sender, one per category it governs */
+function senders(h, id) {
+  const to = () => id.user.toString();
+  const site = () => id.site;
+
+  return [
+    {
+      key: "bulletinBoard",
+      label: "Notice Board",
+      trigger: () =>
+        h.core.NotificationService.bulletinBoardCreated({
+          to: to(),
+          bulletinId: new ObjectId(),
+          subject: "Lift maintenance",
+          status: "published",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "event",
+      label: "Events",
+      trigger: () =>
+        h.core.NotificationService.eventCreatedForMA({
+          to: to(),
+          eventId: new ObjectId(),
+          status: "published",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "visitors",
+      label: "Visitors",
+      trigger: () =>
+        h.core.NotificationService.invitedVisitorCheckOutForMa({
+          to: to(),
+          name: "Sam Visitor",
+          _id: new ObjectId(),
+          siteId: site(),
+        }),
+    },
+    {
+      key: "onlineForm",
+      label: "Online Forms",
+      trigger: () =>
+        h.core.NotificationService.onlineFormRequestStatusUpdated({
+          to: to(),
+          onlineFormId: new ObjectId(),
+          status: "approved",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "prelovedMarketplace",
+      label: "Marketplace",
+      trigger: () =>
+        h.core.NotificationService.prelovedMarketplacePostCreation({
+          to: to(),
+          prelovedId: new ObjectId(),
+          subject: "Bookshelf",
+          status: "published",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "serviceProviderInvite",
+      label: "Service Provider Invitations",
+      trigger: () =>
+        h.core.NotificationService.serviceProviderInvited({
+          to: to(),
+          invitationId: new ObjectId(),
+          title: "You have been invited",
+          orgName: "Northwind",
+          siteName: "Aurora Residences",
+          siteId: site(),
+        }),
+    },
+    {
+      key: "incidentReport",
+      label: "Incident Reports",
+      trigger: () =>
+        h.core.NotificationService.incidentReported({
+          siteId: site(),
+          incidentId: new ObjectId(),
+          reportId: "IR-1",
+          siteName: "Aurora Residences",
+        }),
+    },
+    {
+      key: "emergencyContact",
+      label: "Emergency Contacts",
+      trigger: () =>
+        h.core.NotificationService.emergencyContactChanged({
+          siteId: site(),
+          contactId: new ObjectId(),
+          contactTitle: "Fire station",
+          action: "updated",
+        }),
+    },
+    {
+      key: "virtualPatrol",
+      label: "Guard Patrols",
+      trigger: () =>
+        h.core.NotificationService.patrolException({
+          siteId: site(),
+          patrolLogId: new ObjectId(),
+          routeName: "Basement",
+          problem: "A patrol finished late",
+        }),
+    },
+    {
+      key: "cameraFault",
+      label: "Camera Faults",
+      trigger: () =>
+        h.core.NotificationService.cameraFault({
+          siteId: site(),
+          cameraId: new ObjectId(),
+          message: "Camera 3 is not answering.",
+        }),
+    },
+  ];
+}
+
+describe("notification settings: the measured matrix", { concurrency: 1 }, () => {
+  let h;
+  let sid;
+  const id = {};
+  const matrix = [];
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    sid = await h.login(STAFF, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- observed matrix: core senders ---");
+    console.log(
+      "category".padEnd(26) +
+        "ON inApp/push".padEnd(16) +
+        "inApp OFF".padEnd(12) +
+        "push OFF".padEnd(12) +
+        "both OFF".padEnd(12) +
+        "restored".padEnd(12) +
+        "email",
+    );
+    for (const row of matrix) console.log(row);
+  });
+
+  const getPrefs = () => h.api("/notification-preferences", { sid });
+  const putPrefs = (off) =>
+    h.api("/notification-preferences", { method: "PUT", sid, body: { off } });
+
+  /** run one sender and report what actually landed */
+  async function measure(trigger) {
+    const where = { userId: new ObjectId(id.user.toString()) };
+    const before = await h.db.collection("notifications").countDocuments(where);
+    const pushBefore = h.pushes.length;
+
+    await trigger();
+
+    return {
+      inApp: (await h.db.collection("notifications").countDocuments(where)) - before,
+      push: h.pushes.length - pushBefore,
+    };
+  }
+
+  /** what a FRESH request says the screen shows for this category */
+  async function screenFor(key) {
+    const res = await getPrefs();
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    const category = res.body.data.categories.find((c) => c.key === key);
+    assert.ok(category, `${key} is not on this person's screen`);
+    return Object.fromEntries(
+      category.channels.map((c) => [c.key, { enabled: c.enabled, supported: c.supported }]),
+    );
+  }
+
+  it("every rendered category is on this one person's screen", async () => {
+    const shown = (await getPrefs()).body.data.categories.map((c) => c.key);
+    const rendered = h.core.NOTIFICATION_CATEGORIES.filter((c) => c.rendered).map((c) => c.key);
+    assert.deepEqual(
+      rendered.filter((k) => !shown.includes(k)),
+      [],
+      "the seeded person must see every switch, or the matrix has holes",
+    );
+  });
+
+  for (const sender of senders(null, null).map((s) => s.key)) {
+    it(`${sender}: a switch turned off actually stops it`, async () => {
+      const spec = senders(h, id).find((s) => s.key === sender);
+
+      // ---------------------------------------------------------------- ON
+      await putPrefs([]);
+      const screenOn = await screenFor(spec.key);
+      assert.equal(screenOn.inApp.enabled, true, "in-app reads as on");
+      assert.equal(screenOn.push.enabled, true, "phone alerts read as on");
+
+      const on = await measure(spec.trigger);
+      assert.ok(on.inApp > 0, `POSITIVE CONTROL FAILED: ${spec.key} delivered nothing in the app while switched ON — the test is wrong, not the feature`);
+      assert.ok(on.push > 0, `POSITIVE CONTROL FAILED: ${spec.key} sent no push while switched ON — the test is wrong, not the feature`);
+
+      // ------------------------------------------------------ in-app OFF
+      await putPrefs([{ category: spec.key, channel: "inApp" }]);
+      const savedInApp = await screenFor(spec.key);
+      assert.equal(savedInApp.inApp.enabled, false, "the OFF choice survived a fresh read");
+      assert.equal(savedInApp.push.enabled, true, "and it did not move the other switch");
+
+      const inAppOff = await measure(spec.trigger);
+      assert.equal(inAppOff.inApp, 0, `${spec.key} still wrote to the app feed with in-app switched off`);
+      assert.ok(inAppOff.push > 0, `${spec.key} lost its push when only in-app was switched off`);
+
+      // -------------------------------------------------------- push OFF
+      await putPrefs([{ category: spec.key, channel: "push" }]);
+      const savedPush = await screenFor(spec.key);
+      assert.equal(savedPush.push.enabled, false);
+      assert.equal(savedPush.inApp.enabled, true);
+
+      const pushOff = await measure(spec.trigger);
+      assert.equal(pushOff.push, 0, `${spec.key} still sent a push with phone alerts switched off`);
+      assert.ok(pushOff.inApp > 0, `${spec.key} vanished from the app feed when only the phone was switched off`);
+
+      // -------------------------------------------------------- both OFF
+      await putPrefs([
+        { category: spec.key, channel: "inApp" },
+        { category: spec.key, channel: "push" },
+      ]);
+      const bothOff = await measure(spec.trigger);
+      assert.deepEqual(bothOff, { inApp: 0, push: 0 }, `${spec.key} still delivered with everything switched off`);
+
+      // -------------------------------------------------------- restored
+      await putPrefs([]);
+      const restoredScreen = await screenFor(spec.key);
+      assert.equal(restoredScreen.inApp.enabled, true);
+      assert.equal(restoredScreen.push.enabled, true);
+      const restored = await measure(spec.trigger);
+      assert.ok(restored.inApp > 0 && restored.push > 0, `${spec.key} did not come back when switched on again`);
+
+      // ----------------------------------------------------------- email
+      // An absent key IS the answer now: the server sends only the channels a
+      // category can really deliver on, so email is missing rather than
+      // present-and-dimmed.
+      const email = restoredScreen.email;
+      assert.equal(email, undefined, `${spec.key} still offers an email switch nothing reads`);
+
+      matrix.push(
+        spec.key.padEnd(26) +
+          `${on.inApp}/${on.push}`.padEnd(16) +
+          `${inAppOff.inApp}/${inAppOff.push}`.padEnd(12) +
+          `${pushOff.inApp}/${pushOff.push}`.padEnd(12) +
+          `${bothOff.inApp}/${bothOff.push}`.padEnd(12) +
+          `${restored.inApp}/${restored.push}`.padEnd(12) +
+          (email ? "OFFERED (bug)" : "not offered"),
+      );
+    });
+  }
+
+  it("no category in the catalogue can deliver email", async () => {
+    const withEmail = h.core.NOTIFICATION_CATEGORIES.filter((c) => c.channels.email).map((c) => c.key);
+    assert.deepEqual(
+      withEmail,
+      [],
+      "a category claims an email channel — then a sender must call filterRecipients with \"email\", and none does",
+    );
+  });
+
+  it("a category that cannot use a channel keeps nobody on it", async () => {
+    const { filterRecipients } = h.core.useNotificationPreferenceRepo();
+    assert.deepEqual(
+      await filterRecipients([id.user.toString()], "bulletinBoard", "email"),
+      [],
+      "an email send would reach nobody, which is why no switch is offered",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+
+  const org = new ObjectId();
+  const site = new ObjectId();
+  const role = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org,
+    name: "Matrix Property Management",
+    email: "matrix-org@e2e.example.com",
+    type: "property-management",
+    status: "active",
+    // so the vendor-only switch is on this one screen too
+    isMarketplaceVendor: true,
+    createdAt: now,
+  });
+
+  await h.db.collection("sites").insertOne({
+    _id: site,
+    name: "Aurora Residences",
+    org: org.toString(),
+    status: "active",
+    createdAt: now,
+  });
+
+  // One role holding every module behind a rendered category, so a single
+  // person is offered the whole screen and no category is measured against a
+  // different account.
+  await h.db.collection("roles").insertOne({
+    _id: role,
+    name: "Everything",
+    org,
+    status: "active",
+    permissions: [
+      "feedbacks:see-all-feedback",
+      "workOrder:see-all-work-orders",
+      "bulletin-board:see-all",
+      "event-mgmt:see-all",
+      "facility-booking-mgmt:see-all",
+      "visitorManagement:see-all",
+      "online-form-configuration:see-all",
+      "service-provider-mgmt:see-all",
+      "incident-reports:see-all",
+      "emergency-contact:see-all",
+      "virtual-patrol:see-all",
+      "site-settings:see-all",
+    ],
+  });
+
+  const user = (
+    await h.db.collection("users").insertOne({
+      email: STAFF,
+      password: await h.hashPassword(PASSWORD),
+      name: "Max Matrix",
+      status: "active",
+      defaultOrg: org.toString(),
+      createdAt: now,
+    })
+  ).insertedId;
+
+  // `type: "resident"` as well as the role, so the resident-default categories
+  // are on the same screen. The safety senders resolve their own recipients
+  // from `siteId` + the role's permissions, so the membership must name the
+  // site or four categories would measure zero for the wrong reason.
+  await h.db.collection("members").insertOne({
+    user,
+    org,
+    siteId: site,
+    role,
+    type: "resident",
+    status: "active",
+  });
+
+  // A device per app slug the senders address, plus one with no slug at all
+  // (the service-provider invite sends without one). A missing token would read
+  // exactly like a suppressed push.
+  await h.db.collection("push_tokens").insertMany([
+    {
+      userId: user.toString(),
+      token: "ExponentPushToken[matrix-resident]",
+      platform: "ios",
+      appSlug: RESIDENT_SLUG,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
+    {
+      userId: user.toString(),
+      token: "ExponentPushToken[matrix-ma]",
+      platform: "android",
+      appSlug: MA_SLUG,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
+    {
+      userId: user.toString(),
+      token: "ExponentPushToken[matrix-noslug]",
+      platform: "ios",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
+  ]);
+
+  return { org, site, role, user };
+}

package/test/e2e/notification-preference.e2e.test.mjs

@@ -297,18 +297,31 @@ describe("notification preferences, end to end", { concurrency: 1 }, () => {
   );
 
   record(
-    "12. a channel that cannot deliver is shown, dimmed, with a reason — and never on",
+    "12. a channel that cannot deliver is not offered at all",
     async () => {
+      // It used to be drawn, dimmed, and apologised for. A control that cannot
+      // move is not a setting: it tells a person they have been asked
+      // something they have not, and it made the summary line claim "on
+      // everywhere" for a category with no email at all.
       const res = await getPrefs(managerSid);
       const workOrder = res.body.data.categories.find(
         (c) => c.key === "workOrder",
       );
-      const email = workOrder.channels.find((c) => c.key === "email");
 
-      assert.equal(email.supported, false);
-      assert.equal(email.enabled, false);
-      assert.ok(email.note && email.note.length > 20, "a plain reason is given");
-      assert.doesNotMatch(email.note, /_|[a-z][A-Z]/, "no internal names in the reason");
+      assert.deepEqual(
+        workOrder.channels.map((c) => c.key),
+        ["inApp", "push"],
+        "only the channels this category can really deliver on are sent",
+      );
+      assert.ok(
+        workOrder.channels.every((c) => c.supported),
+        "everything sent is switchable",
+      );
+      assert.equal(
+        res.body.data.channels.find((c) => c.key === "email"),
+        undefined,
+        "and the channel dictionary does not advertise one either",
+      );
     },
   );
 
@@ -502,8 +515,8 @@ describe("notification preferences, end to end", { concurrency: 1 }, () => {
 
       assert.deepEqual(
         emailCapable,
-        ["serviceProviderInvite"],
-        "only one category can govern email at all",
+        [],
+        "no category governs email at all — nothing in the estate sends a notification by email",
       );
 
       // and the catalogue holds no category for a one-time code, a password

package/test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs

@@ -97,9 +97,11 @@ describe("onboarding step 1 says what is wrong when the save is refused", { conc
     ownerSid = await h.login(OWNER, PASSWORD);
 
     assert.equal(
-      await h.db.collection("members").countDocuments({ user: id.owner }),
+      await h.db
+        .collection("members")
+        .countDocuments({ user: id.owner, org: id.ownOrg }),
       0,
-      "the owner must hold no membership — reach is by `createdBy` (DV-0248)",
+      "the owner must hold no membership of THIS organisation — reach is by `createdBy` (DV-0248)",
     );
     assert.equal((await ownOrg()).name, "Ben Org");
   });
@@ -160,6 +162,49 @@ describe("onboarding step 1 says what is wrong when the save is refused", { conc
     assert.equal(saved.contact, "+63 9569346664");
   });
 
+  // ---- the second control: the legacy document shape is NOT the cause -------
+
+  record("5. control — the legacy production document shape saves unchanged", async () => {
+    // The 16 rows a lead read out of the production `organizations` collection
+    // carry the LEGACY `organization-api` field set — `contactNumber`, `sites`,
+    // `logo`, `createdBySpId` — and `createdAt`, `updatedAt` and `createdBy`
+    // are EMPTY STRINGS, not dates and not ObjectIds. The obvious suspicion is
+    // that saving over a row like that throws on a type: `createdAt: ""` where
+    // a Date is expected, `createdBy: ""` where an ObjectId is.
+    //
+    // It cannot. This repository talks to the raw `mongodb` driver — there is
+    // no Mongoose, no model layer and no cast step between `update()` and the
+    // server. `$set` names `name`, `email`, `contact` and `updatedAt` and
+    // nothing else, and MongoDB replaces a field wholesale whatever BSON type
+    // it held before. The legacy fields are never read, never re-validated and
+    // never rewritten.
+    //
+    // This case is the proof: same modal body, same route, a row in exactly
+    // that shape, no unique index on it — 200, and the legacy fields survive
+    // untouched.
+    const res = await h.api(`/organizations/${id.legacyOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody("Legacy Shaped Org Renamed"),
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const saved = await h.db
+      .collection("organizations")
+      .findOne({ _id: id.legacyOrg });
+
+    assert.equal(saved.name, "Legacy Shaped Org Renamed");
+    assert.equal(saved.contact, "+63 9569346664");
+    assert.ok(saved.updatedAt instanceof Date, "updatedAt is replaced by a Date");
+    // untouched, still exactly as the legacy service left them
+    assert.equal(saved.createdAt, "");
+    assert.equal(saved.createdBy, "");
+    assert.equal(saved.contactNumber, "+65 61234567");
+    assert.deepEqual(saved.sites, []);
+    assert.equal(saved.createdBySpId, "");
+  });
+
   record("4. and the guard is unchanged — no session is still refused", async () => {
     const res = await h.api(`/organizations/${id.ownOrg}`, {
       method: "PUT",
@@ -175,6 +220,7 @@ async function seed(h) {
   const now = new Date().toISOString();
   const otherOrg = new ObjectId();
   const ownOrg = new ObjectId();
+  const legacyOrg = new ObjectId();
 
   const orgs = h.db.collection("organizations");
 
@@ -202,6 +248,24 @@ async function seed(h) {
       contact: "+65 00000000",
       createdAt: now,
     },
+    // A row in the exact shape a lead read out of production: the legacy
+    // `organization-api` field set, with the three timestamps/ids as EMPTY
+    // STRINGS. Deliberately NOT covered by the unique index above — its name is
+    // its own — so case 5 measures the document shape and nothing else.
+    {
+      _id: legacyOrg,
+      name: "Legacy Shaped Org",
+      email: "os-legacy@e2e.example.com",
+      contactNumber: "+65 61234567",
+      description: "",
+      sites: [],
+      status: "active",
+      logo: [],
+      createdBySpId: "",
+      createdAt: "",
+      updatedAt: "",
+      createdBy: "",
+    },
   ]);
 
   const users = await h.db.collection("users").insertMany([
@@ -216,5 +280,14 @@ async function seed(h) {
   // holds at step 1.
   await orgs.updateOne({ _id: ownOrg }, { $set: { createdBy: owner } });
 
-  return { owner, ownOrg, otherOrg };
+  // The legacy row's `createdBy` is "" — that road cannot reach it, so the
+  // owner reaches it the ordinary way, by membership.
+  await h.db.collection("members").insertOne({
+    user: owner,
+    org: legacyOrg,
+    type: "organization",
+    status: "active",
+  });
+
+  return { owner, ownOrg, otherOrg, legacyOrg };
 }

package/test/e2e/safety-notification.e2e.test.mjs

@@ -407,7 +407,7 @@ describe("safety alerts, end to end", { concurrency: 1 }, () => {
         assert.equal(categorySupportsChannel(category, "email"), false, category);
         assert.ok(
           notificationCategory(category).channelNote?.email,
-          `${category} must explain the dimmed email switch`,
+          `${category} must record why it offers no email switch`,
         );
       }
     },