@7365admin1/core 3.55.0 → 3.56.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.55.0",
+  "version": "3.56.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs

@@ -97,9 +97,11 @@ describe("onboarding step 1 says what is wrong when the save is refused", { conc
     ownerSid = await h.login(OWNER, PASSWORD);
 
     assert.equal(
-      await h.db.collection("members").countDocuments({ user: id.owner }),
+      await h.db
+        .collection("members")
+        .countDocuments({ user: id.owner, org: id.ownOrg }),
       0,
-      "the owner must hold no membership — reach is by `createdBy` (DV-0248)",
+      "the owner must hold no membership of THIS organisation — reach is by `createdBy` (DV-0248)",
     );
     assert.equal((await ownOrg()).name, "Ben Org");
   });
@@ -160,6 +162,49 @@ describe("onboarding step 1 says what is wrong when the save is refused", { conc
     assert.equal(saved.contact, "+63 9569346664");
   });
 
+  // ---- the second control: the legacy document shape is NOT the cause -------
+
+  record("5. control — the legacy production document shape saves unchanged", async () => {
+    // The 16 rows a lead read out of the production `organizations` collection
+    // carry the LEGACY `organization-api` field set — `contactNumber`, `sites`,
+    // `logo`, `createdBySpId` — and `createdAt`, `updatedAt` and `createdBy`
+    // are EMPTY STRINGS, not dates and not ObjectIds. The obvious suspicion is
+    // that saving over a row like that throws on a type: `createdAt: ""` where
+    // a Date is expected, `createdBy: ""` where an ObjectId is.
+    //
+    // It cannot. This repository talks to the raw `mongodb` driver — there is
+    // no Mongoose, no model layer and no cast step between `update()` and the
+    // server. `$set` names `name`, `email`, `contact` and `updatedAt` and
+    // nothing else, and MongoDB replaces a field wholesale whatever BSON type
+    // it held before. The legacy fields are never read, never re-validated and
+    // never rewritten.
+    //
+    // This case is the proof: same modal body, same route, a row in exactly
+    // that shape, no unique index on it — 200, and the legacy fields survive
+    // untouched.
+    const res = await h.api(`/organizations/${id.legacyOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody("Legacy Shaped Org Renamed"),
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const saved = await h.db
+      .collection("organizations")
+      .findOne({ _id: id.legacyOrg });
+
+    assert.equal(saved.name, "Legacy Shaped Org Renamed");
+    assert.equal(saved.contact, "+63 9569346664");
+    assert.ok(saved.updatedAt instanceof Date, "updatedAt is replaced by a Date");
+    // untouched, still exactly as the legacy service left them
+    assert.equal(saved.createdAt, "");
+    assert.equal(saved.createdBy, "");
+    assert.equal(saved.contactNumber, "+65 61234567");
+    assert.deepEqual(saved.sites, []);
+    assert.equal(saved.createdBySpId, "");
+  });
+
   record("4. and the guard is unchanged — no session is still refused", async () => {
     const res = await h.api(`/organizations/${id.ownOrg}`, {
       method: "PUT",
@@ -175,6 +220,7 @@ async function seed(h) {
   const now = new Date().toISOString();
   const otherOrg = new ObjectId();
   const ownOrg = new ObjectId();
+  const legacyOrg = new ObjectId();
 
   const orgs = h.db.collection("organizations");
 
@@ -202,6 +248,24 @@ async function seed(h) {
       contact: "+65 00000000",
       createdAt: now,
     },
+    // A row in the exact shape a lead read out of production: the legacy
+    // `organization-api` field set, with the three timestamps/ids as EMPTY
+    // STRINGS. Deliberately NOT covered by the unique index above — its name is
+    // its own — so case 5 measures the document shape and nothing else.
+    {
+      _id: legacyOrg,
+      name: "Legacy Shaped Org",
+      email: "os-legacy@e2e.example.com",
+      contactNumber: "+65 61234567",
+      description: "",
+      sites: [],
+      status: "active",
+      logo: [],
+      createdBySpId: "",
+      createdAt: "",
+      updatedAt: "",
+      createdBy: "",
+    },
   ]);
 
   const users = await h.db.collection("users").insertMany([
@@ -216,5 +280,14 @@ async function seed(h) {
   // holds at step 1.
   await orgs.updateOne({ _id: ownOrg }, { $set: { createdBy: owner } });
 
-  return { owner, ownOrg, otherOrg };
+  // The legacy row's `createdBy` is "" — that road cannot reach it, so the
+  // owner reaches it the ordinary way, by membership.
+  await h.db.collection("members").insertOne({
+    user: owner,
+    org: legacyOrg,
+    type: "organization",
+    status: "active",
+  });
+
+  return { owner, ownOrg, otherOrg, legacyOrg };
 }

package/test/role-scope-separation.test.mjs

@@ -0,0 +1,195 @@
+import { strict as assert } from "node:assert";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+
+import {
+  PLATFORM_ONLY_PERMISSIONS,
+  platformPermissionsAdded,
+  refuseSharedClientTemplate,
+  requireNoPlatformGrant,
+  roleScope,
+} from "./.build/utils/role-scope.util.mjs";
+
+/*
+ * The 2026-09-07 outage, reproduced as data.
+ *
+ * "Org Owner": `type: "organization"`, `org: ""`, 117 live members, 321
+ * invitations. The console editor pre-ticks its own catalogue for a
+ * `default: true` role and saves it -- 34 platform strings, no client module.
+ */
+const ORG_OWNER = { type: "organization", org: "", permissions: ["*"] };
+
+/** Exactly what `useAdminPermission` expands to: 24 + members 5 + roles 5. */
+const CONSOLE_SAVE = [
+  "organizations:see-all-organizations",
+  "organizations:see-organization-details",
+  "promo-codes:create-promo-code",
+  "promo-codes:see-promo-code-details",
+  "promo-codes:edit-promo-code-details",
+  "promo-codes:change-promo-code-status",
+  "promo-codes:delete-promo-code",
+  "users:see-all-users",
+  "users:see-user-details",
+  "invitations:create-invitation",
+  "invitations:view-invitations",
+  "invitations:cancel-invitation",
+  "subscriptions:see-all-subscriptions",
+  "subscriptions:see-subscription-details",
+  "subscriptions:manage-subscription",
+  "sp-approvals:see-all-sp-approvals",
+  "sp-approvals:approve-sp",
+  "sp-approvals:reject-sp",
+  "sp-approvals:delete-sp-approval",
+  "marketplace-vendors:see-all-marketplace-vendors",
+  "marketplace-vendors:see-marketplace-vendor-details",
+  "platform-terms:see-platform-terms",
+  "platform-terms:edit-platform-terms",
+  "activity-history:see-activity-history",
+  "members:view-members",
+  "members:assign-member-role",
+  "members:suspend-member",
+  "members:activate-member",
+  "members:delete-member",
+  "roles-and-permissions:add-role",
+  "roles-and-permissions:see-all-roles",
+  "roles-and-permissions:see-role-details",
+  "roles-and-permissions:update-role",
+  "roles-and-permissions:delete-role",
+];
+
+test("the save that caused the outage is 34 strings", () => {
+  assert.equal(CONSOLE_SAVE.length, 34);
+});
+
+test("a role's scope is read off type and org, and nothing else", () => {
+  assert.equal(roleScope({ type: "admin", org: "" }), "platform");
+  assert.equal(roleScope({ type: "admin", org: "6512ab" }), "platform");
+  assert.equal(roleScope(ORG_OWNER), "client-template");
+  assert.equal(roleScope({ type: "security_agency", org: "" }), "client-template");
+  assert.equal(roleScope({ type: "organization", org: "6512ab" }), "client");
+  assert.equal(roleScope({ type: "", org: "6512ab" }), "client");
+  // ObjectId, not a string
+  assert.equal(
+    roleScope({ type: "organization", org: { toString: () => "6512ab" } }),
+    "client",
+  );
+});
+
+test("THE OUTAGE: a console save cannot strip a shared template", () => {
+  assert.throws(
+    () => refuseSharedClientTemplate(ORG_OWNER),
+    /shared by every client/,
+  );
+});
+
+test("POSITIVE CONTROL: the writes that must still work are not refused", () => {
+  // a real platform staff role -- the console's own
+  assert.doesNotThrow(() =>
+    refuseSharedClientTemplate({ type: "admin", org: "", permissions: [] }),
+  );
+  // a client's own role, in its own org
+  assert.doesNotThrow(() =>
+    refuseSharedClientTemplate({ type: "organization", org: "6512ab" }),
+  );
+  assert.doesNotThrow(() =>
+    refuseSharedClientTemplate({ type: "security_agency", org: "6512ab" }),
+  );
+});
+
+test("a client editor cannot grant a platform resource", () => {
+  assert.throws(
+    () =>
+      requireNoPlatformGrant({ type: "organization", org: "6512ab", permissions: [] }, [
+        "members:view-members",
+        "organizations:see-all-organizations",
+      ]),
+    /Seven365 console permissions/,
+  );
+});
+
+test("the console CAN still grant them on a platform role", () => {
+  assert.doesNotThrow(() =>
+    requireNoPlatformGrant({ type: "admin", org: "", permissions: [] }, CONSOLE_SAVE),
+  );
+});
+
+test("NEVER refuses a save that works today: held strings pass through", () => {
+  // 114 org-owned roles hold a `subscriptions:*` string. Re-saving one is not
+  // an addition, so it is allowed even though the resource name collides.
+  const held = ["subscriptions:see-all-subscriptions", "members:view-members"];
+  assert.doesNotThrow(() =>
+    requireNoPlatformGrant({ type: "organization", org: "6512ab", permissions: held }, held),
+  );
+  assert.deepEqual(platformPermissionsAdded(held, held), []);
+});
+
+test("the ORG spelling of subscriptions is not a platform grant", () => {
+  // `useOrgPermission` spells them differently. Refusing the bare resource
+  // would have locked 114 roles out of their own editor.
+  const org = [
+    "subscriptions:management-subscription",
+    "subscriptions:view-subscription-details",
+  ];
+  assert.deepEqual(platformPermissionsAdded(org, []), []);
+  assert.doesNotThrow(() =>
+    requireNoPlatformGrant({ type: "organization", org: "6512ab", permissions: [] }, org),
+  );
+});
+
+test("the four shared resource names are deliberately NOT refused", () => {
+  for (const permission of [
+    "users:see-all-users",
+    "invitations:view-invitations",
+    "members:view-members",
+    "roles-and-permissions:add-role",
+    "roles:add-role",
+  ]) {
+    assert.equal(
+      PLATFORM_ONLY_PERMISSIONS.has(permission),
+      false,
+      permission + " must stay grantable on a client role",
+    );
+  }
+});
+
+test("POSITIVE CONTROL: the refusal set is not empty and does bite", () => {
+  // 19, not the console catalogue's 34: `users` (2), `invitations` (3),
+  // `members` (5) and `roles-and-permissions` (5) are shared resource names and
+  // are deliberately left grantable on a client role.
+  assert.equal(PLATFORM_ONLY_PERMISSIONS.size, 19);
+  const added = platformPermissionsAdded(CONSOLE_SAVE, []);
+  assert.equal(added.length, 19);
+});
+
+test("an empty or absent permission list is never a platform grant", () => {
+  assert.doesNotThrow(() =>
+    requireNoPlatformGrant({ type: "organization", org: "6512ab" }, []),
+  );
+  assert.doesNotThrow(() =>
+    requireNoPlatformGrant({ type: "organization", org: "6512ab" }, null),
+  );
+  assert.doesNotThrow(() =>
+    requireNoPlatformGrant({ type: "organization", org: "6512ab" }, ["*"]),
+  );
+});
+
+test("the lockout check's copy of the platform list cannot drift", () => {
+  /*
+   * `tools/role-scope-lockout-check/check.js` is plain CommonJS run against a
+   * live database, so it cannot import the TypeScript guard. It reads a JSON
+   * copy instead. Two copies of a permission catalogue is what drifted last
+   * time (`useAdminPermission` was 107 lines apart between two apps), so the
+   * copy is asserted here rather than trusted.
+   */
+  const onDisk = JSON.parse(
+    readFileSync(
+      new URL(
+        "../tools/role-scope-lockout-check/platform-only-permissions.json",
+        import.meta.url,
+      ),
+      "utf8",
+    ),
+  );
+
+  assert.deepEqual(onDisk, [...PLATFORM_ONLY_PERMISSIONS].sort());
+});

package/test/role-scope.test.mjs

@@ -112,6 +112,21 @@ test("/api/roles/v2 is gated too — the same hole with /v2 on the URL", () => {
   );
 });
 
+/**
+ * The four true WRITES now go through `requireRoleWrite`, which is
+ * `requireRoleOrg` plus one refusal: a role with no `org` and a non-admin type
+ * is a template every client shares, and the console must not rewrite it. That
+ * is the 2026-09-07 outage. `getDeletionPreview` is a read and deliberately
+ * stays on `requireRoleOrg` — see `role-scope-separation.test.mjs`.
+ */
+const WRITE_GATE = {
+  updateRole: /await requireRoleWrite\(req, existing/,
+  updatePermissionsById: /await requireRoleWrite\(req, existing/,
+  deleteRole: /await requireRoleWrite\(req, existing/,
+  deleteWithReassignments: /await requireRoleWrite\(req, existing/,
+  getDeletionPreview: /await requireRoleOrg\(req, existing\.org\)/,
+};
+
 test("every role write scopes on the STORED role's organisation", () => {
   for (const name of MUST_SCOPE) {
     const body = fn(controller, name);
@@ -123,14 +138,14 @@ test("every role write scopes on the STORED role's organisation", () => {
     );
     assert.match(
       body,
-      /await requireRoleOrg\(req, existing\.org\)/,
+      WRITE_GATE[name],
       `${name} must scope on the stored role's org`,
     );
 
     // and it must not take the organisation from the caller instead
     assert.doesNotMatch(
       body,
-      /requireRoleOrg\(req, (req\.body|req\.query|req\.params)/,
+      /requireRole(Org|Write)\(req, (req\.body|req\.query|req\.params)/,
       `${name} must not scope on an org the caller supplied`,
     );
   }
@@ -147,7 +162,7 @@ test("the gate runs before the write, not after it", () => {
 
   for (const [name, call] of Object.entries(writes)) {
     const body = fn(controller, name);
-    const gate = body.indexOf("requireRoleOrg");
+    const gate = body.search(/requireRole(Org|Write)\(req/);
     const write = body.indexOf(call);
     assert.ok(gate !== -1 && write !== -1 && gate < write,
       `${name}: the gate must run before ${call}`);
@@ -163,6 +178,43 @@ test("an org-less role is platform-staff only", () => {
   assert.match(helper.slice(0, 500), /requireOrgAccess\(req, orgId\)/);
 });
 
+test("the write gate refuses a shared client template before anything else", () => {
+  // The whole of the 2026-09-07 fix. `requireRoleWrite` must refuse a template
+  // FIRST; if it fell through to `requireRoleOrg` an org-less role would reach
+  // the staff console gate again, which is what let the console rewrite it.
+  const helper = controller.slice(
+    controller.indexOf("async function requireRoleWrite"),
+  );
+  const body = helper.slice(0, 500);
+
+  const refuse = body.indexOf("refuseSharedClientTemplate(role)");
+  const fallthrough = body.indexOf("requireRoleOrg(req");
+
+  assert.ok(refuse !== -1, "requireRoleWrite must refuse shared templates");
+  assert.ok(fallthrough !== -1, "and must still apply the org rule to the rest");
+  assert.ok(refuse < fallthrough, "the refusal must come first");
+});
+
+test("the permission-writing paths refuse a platform grant", () => {
+  for (const name of ["createRole", "updateRole", "updatePermissionsById"]) {
+    assert.match(
+      fn(controller, name),
+      /requireNoPlatformGrant\(/,
+      `${name} must refuse console permissions on a client role`,
+    );
+  }
+});
+
+test("READS are NOT routed through the write gate", () => {
+  // 117 live members read the org-less "Org Owner" on every session. Refusing
+  // them is the same outage from the other direction.
+  const helper = controller.slice(
+    controller.indexOf("async function requireRoleRead"),
+  );
+  assert.doesNotMatch(helper.slice(0, 400), /requireRoleWrite|refuseSharedClientTemplate/);
+  assert.match(helper.slice(0, 400), /holdsRole\(callerId\(req\), roleId\)/);
+});
+
 test("no new handler arrives on this controller without a decision", () => {
   const known = new Set([...MUST_SCOPE, ...OPEN_BY_DESIGN]);
   const unknown = exported(controller).filter((name) => !known.has(name));