@7365admin1/core 3.55.0 → 3.57.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.55.0",
+  "version": "3.57.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/harness.mjs

@@ -651,6 +651,7 @@ function buildApp(nsu, core) {
   {
     const {
       getAll,
+      add,
       addOnboardingOrg,
       getOrgsByUserId,
       getByName,
@@ -660,6 +661,7 @@ function buildApp(nsu, core) {
       update,
     } = core.useOrgController();
 
+    organizations.post("/", requireAuth, add);
     organizations.get("/", requireAuth, getAll);
     organizations.post("/onboarding", requireAuth, addOnboardingOrg);
     organizations.get("/user/:user", requireAuth, getOrgsByUserId);

package/test/e2e/onboarding-org-save-diagnosis.e2e.test.mjs

@@ -97,9 +97,11 @@ describe("onboarding step 1 says what is wrong when the save is refused", { conc
     ownerSid = await h.login(OWNER, PASSWORD);
 
     assert.equal(
-      await h.db.collection("members").countDocuments({ user: id.owner }),
+      await h.db
+        .collection("members")
+        .countDocuments({ user: id.owner, org: id.ownOrg }),
       0,
-      "the owner must hold no membership — reach is by `createdBy` (DV-0248)",
+      "the owner must hold no membership of THIS organisation — reach is by `createdBy` (DV-0248)",
     );
     assert.equal((await ownOrg()).name, "Ben Org");
   });
@@ -160,6 +162,49 @@ describe("onboarding step 1 says what is wrong when the save is refused", { conc
     assert.equal(saved.contact, "+63 9569346664");
   });
 
+  // ---- the second control: the legacy document shape is NOT the cause -------
+
+  record("5. control — the legacy production document shape saves unchanged", async () => {
+    // The 16 rows a lead read out of the production `organizations` collection
+    // carry the LEGACY `organization-api` field set — `contactNumber`, `sites`,
+    // `logo`, `createdBySpId` — and `createdAt`, `updatedAt` and `createdBy`
+    // are EMPTY STRINGS, not dates and not ObjectIds. The obvious suspicion is
+    // that saving over a row like that throws on a type: `createdAt: ""` where
+    // a Date is expected, `createdBy: ""` where an ObjectId is.
+    //
+    // It cannot. This repository talks to the raw `mongodb` driver — there is
+    // no Mongoose, no model layer and no cast step between `update()` and the
+    // server. `$set` names `name`, `email`, `contact` and `updatedAt` and
+    // nothing else, and MongoDB replaces a field wholesale whatever BSON type
+    // it held before. The legacy fields are never read, never re-validated and
+    // never rewritten.
+    //
+    // This case is the proof: same modal body, same route, a row in exactly
+    // that shape, no unique index on it — 200, and the legacy fields survive
+    // untouched.
+    const res = await h.api(`/organizations/${id.legacyOrg}`, {
+      method: "PUT",
+      sid: ownerSid,
+      body: modalBody("Legacy Shaped Org Renamed"),
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+
+    const saved = await h.db
+      .collection("organizations")
+      .findOne({ _id: id.legacyOrg });
+
+    assert.equal(saved.name, "Legacy Shaped Org Renamed");
+    assert.equal(saved.contact, "+63 9569346664");
+    assert.ok(saved.updatedAt instanceof Date, "updatedAt is replaced by a Date");
+    // untouched, still exactly as the legacy service left them
+    assert.equal(saved.createdAt, "");
+    assert.equal(saved.createdBy, "");
+    assert.equal(saved.contactNumber, "+65 61234567");
+    assert.deepEqual(saved.sites, []);
+    assert.equal(saved.createdBySpId, "");
+  });
+
   record("4. and the guard is unchanged — no session is still refused", async () => {
     const res = await h.api(`/organizations/${id.ownOrg}`, {
       method: "PUT",
@@ -175,6 +220,7 @@ async function seed(h) {
   const now = new Date().toISOString();
   const otherOrg = new ObjectId();
   const ownOrg = new ObjectId();
+  const legacyOrg = new ObjectId();
 
   const orgs = h.db.collection("organizations");
 
@@ -202,6 +248,24 @@ async function seed(h) {
       contact: "+65 00000000",
       createdAt: now,
     },
+    // A row in the exact shape a lead read out of production: the legacy
+    // `organization-api` field set, with the three timestamps/ids as EMPTY
+    // STRINGS. Deliberately NOT covered by the unique index above — its name is
+    // its own — so case 5 measures the document shape and nothing else.
+    {
+      _id: legacyOrg,
+      name: "Legacy Shaped Org",
+      email: "os-legacy@e2e.example.com",
+      contactNumber: "+65 61234567",
+      description: "",
+      sites: [],
+      status: "active",
+      logo: [],
+      createdBySpId: "",
+      createdAt: "",
+      updatedAt: "",
+      createdBy: "",
+    },
   ]);
 
   const users = await h.db.collection("users").insertMany([
@@ -216,5 +280,14 @@ async function seed(h) {
   // holds at step 1.
   await orgs.updateOne({ _id: ownOrg }, { $set: { createdBy: owner } });
 
-  return { owner, ownOrg, otherOrg };
+  // The legacy row's `createdBy` is "" — that road cannot reach it, so the
+  // owner reaches it the ordinary way, by membership.
+  await h.db.collection("members").insertOne({
+    user: owner,
+    org: legacyOrg,
+    type: "organization",
+    status: "active",
+  });
+
+  return { owner, ownOrg, otherOrg, legacyOrg };
 }

package/test/e2e/org-default-roles.e2e.test.mjs

@@ -0,0 +1,320 @@
+/**
+ * A NEW client organisation gets its own owner roles, and NO existing
+ * organisation is touched.
+ *
+ * ## What this is proving
+ *
+ * Measured on staging 2026-09-07: **74 of 195 live organisations hold not one
+ * role**, and not one of those 74 has a subscription. The paid signup path
+ * (`subscription.service.ts:145-165`) has always seeded two `owner` roles with
+ * `permissions: ["*"]`; the two paths that actually create clients today —
+ * `POST /organizations` from the Seven365 console and `POST
+ * /organizations/onboarding` from the client wizard — seeded nothing. An
+ * organisation with no role of its own has nothing to invite anybody with,
+ * which is why the console offers the ORG-LESS templates instead: the shared
+ * documents that one console save took every client's modules away with.
+ *
+ * The unit half (`test/org-default-roles.test.mjs`) proves the shape. This
+ * proves the rows land, over real HTTP, through the real controller, and — the
+ * assertion that matters most on the day after an outage — that an
+ * organisation that already existed comes out of the run byte-identical.
+ *
+ * Everything here is created and thrown away by the harness: an in-process
+ * MongoDB replica set, a loopback Redis, a loopback mail sink. No staging or
+ * production database, Redis, mailbox or endpoint is touched.
+ *
+ * Run with: yarn test:e2e
+ */
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OrgDefaultRoles-Passw0rd!";
+const STAFF = "odr-staff@e2e.example.com"; // Seven365 console, creates clients
+const WIZARD = "odr-wizard@e2e.example.com"; // a client walking the wizard
+
+const NATURE = "security_agency";
+
+describe("a new organisation is seeded with its own owner roles", { concurrency: 1 }, () => {
+  let h;
+  let id;
+  let staffSid;
+  let wizardSid;
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    id = await seed(h);
+    staffSid = await h.login(STAFF, PASSWORD);
+    wizardSid = await h.login(WIZARD, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- org default roles: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const rolesOf = (org) =>
+    h.db.collection("roles").find({ org: new ObjectId(org.toString()) }).toArray();
+
+  // ---- the console path ---------------------------------------------------
+
+  record("1. POST /organizations still answers 201 — client creation is not broken", async () => {
+    const res = await h.api("/organizations/", {
+      method: "POST",
+      sid: staffSid,
+      body: {
+        name: "ODR Console Client",
+        type: "org",
+        nature: NATURE,
+        email: "odr-console@e2e.example.com",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("2. that organisation now holds the two owner roles a paid signup gets", async () => {
+    const org = await h.db
+      .collection("organizations")
+      .findOne({ name: "ODR Console Client" });
+    assert.ok(org, "the organisation was created");
+
+    const roles = await rolesOf(org._id);
+
+    assert.equal(roles.length, 2, `expected two roles, got ${JSON.stringify(roles)}`);
+    assert.deepEqual(
+      roles.map((r) => r.type).sort(),
+      ["organization", NATURE],
+      "one organisation role and one typed by the organisation's nature",
+    );
+
+    for (const role of roles) {
+      assert.equal(role.name, "owner");
+      assert.deepEqual(role.permissions, ["*"], '["*"] means everything — nobody is locked out');
+      assert.equal(role.default, true);
+      assert.equal(role.status, "active");
+    }
+  });
+
+  record("3. every seeded role carries THIS organisation's id and no other", async () => {
+    // The 2026-09-07 outage was an `org`-less role of `type: "organization"` —
+    // one document shared by every client invited with it. If seeding could
+    // ever emit one, this fails.
+    const org = await h.db
+      .collection("organizations")
+      .findOne({ name: "ODR Console Client" });
+
+    for (const role of await rolesOf(org._id)) {
+      assert.ok(role.org, "the role has an org");
+      assert.equal(role.org.toString(), org._id.toString());
+    }
+
+    const orgless = await h.db
+      .collection("roles")
+      .find({ $or: [{ org: "" }, { org: null }, { org: { $exists: false } }] })
+      .toArray();
+
+    assert.equal(
+      orgless.filter((r) => r.name === "owner").length,
+      0,
+      "seeding created no org-less shared template",
+    );
+  });
+
+  // ---- the wizard path ----------------------------------------------------
+
+  record("4. POST /organizations/onboarding seeds the same two roles", async () => {
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: wizardSid,
+      body: {
+        name: "ODR Wizard Client",
+        type: "org",
+        nature: "cleaning_services",
+        email: "odr-wizard-org@e2e.example.com",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db
+      .collection("organizations")
+      .findOne({ name: "ODR Wizard Client" });
+    assert.ok(org, "the organisation was created");
+
+    const roles = await rolesOf(org._id);
+    assert.deepEqual(
+      roles.map((r) => r.type).sort(),
+      ["cleaning_services", "organization"],
+    );
+    for (const role of roles) {
+      assert.equal(role.name, "owner");
+      assert.deepEqual(role.permissions, ["*"]);
+      assert.equal(role.org.toString(), org._id.toString());
+    }
+  });
+
+  record("5. the wizard still gets its organisation back in the response body", async () => {
+    // The wizard reads `data._id` from this response to drive step 2. Seeding
+    // runs between the insert and that read, so a seeding failure must not be
+    // able to blank it.
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: wizardSid,
+      body: {
+        name: "ODR Wizard Client Two",
+        type: "org",
+        nature: "landscaping_services",
+        email: "odr-wizard-two@e2e.example.com",
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    assert.ok(res.body?.data?._id, `no organisation in the body: ${JSON.stringify(res.body)}`);
+  });
+
+  // ---- the part that matters most ----------------------------------------
+
+  record("6. the EXISTING organisation and its roles are byte-identical", async () => {
+    const org = await h.db.collection("organizations").findOne({ _id: id.existingOrg });
+    assert.deepEqual(
+      org,
+      id.existingOrgBefore,
+      "an organisation that already existed was modified",
+    );
+
+    const roles = await h.db
+      .collection("roles")
+      .find({ org: id.existingOrg })
+      .sort({ _id: 1 })
+      .toArray();
+
+    assert.deepEqual(
+      roles,
+      id.existingRolesBefore,
+      "an existing organisation's roles were modified",
+    );
+  });
+
+  record("7. no existing MEMBER was repointed and no role was deleted", async () => {
+    const members = await h.db
+      .collection("members")
+      .find({})
+      .sort({ _id: 1 })
+      .toArray();
+
+    assert.deepEqual(members, id.membersBefore, "a members row changed");
+
+    for (const roleId of id.allRoleIdsBefore) {
+      const still = await h.db.collection("roles").findOne({ _id: roleId });
+      assert.ok(still, `role ${roleId} disappeared`);
+    }
+  });
+
+  record("8. positive control: the run really did create roles", async () => {
+    // If cases 6 and 7 passed because nothing happened at all, they prove
+    // nothing. This is the count that makes them mean something.
+    const after = await h.db.collection("roles").countDocuments();
+
+    assert.ok(
+      after > id.roleCountBefore,
+      `roles went from ${id.roleCountBefore} to ${after} — seeding wrote nothing`,
+    );
+    assert.equal(
+      after - id.roleCountBefore,
+      6,
+      "three organisations were created, two roles each",
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const hashed = await h.hashPassword(PASSWORD);
+
+  const staffRole = new ObjectId();
+  const existingOrg = new ObjectId();
+  const existingRole = new ObjectId();
+  const wizardRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: existingOrg,
+    name: "ODR Existing Client",
+    email: "odr-existing@e2e.example.com",
+    type: "org",
+    nature: NATURE,
+    status: "active",
+    createdAt: now,
+  });
+
+  await h.db.collection("roles").insertMany([
+    // Seven365 staff: a members row of type "admin" whose role is ALSO type
+    // "admin". `["*"]` so the console gate passes and case 1 measures seeding,
+    // not authorization.
+    { _id: staffRole, name: "Staff Wildcard", type: "admin", status: "active", permissions: ["*"] },
+    // The existing client's own role, the one case 6 proves untouched.
+    {
+      _id: existingRole,
+      name: "Existing Org Admin",
+      org: existingOrg,
+      type: "organization",
+      status: "active",
+      permissions: ["members:view-member"],
+    },
+    { _id: wizardRole, name: "Wizard Owner", org: existingOrg, type: NATURE, status: "active", permissions: ["*"] },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: STAFF, password: hashed, name: "ODR Staff", status: "active", createdAt: now },
+    {
+      email: WIZARD,
+      password: hashed,
+      name: "ODR Wizard User",
+      status: "active",
+      defaultOrg: existingOrg.toString(),
+      createdAt: now,
+    },
+  ]);
+
+  await h.db.collection("members").insertMany([
+    { user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" },
+    {
+      user: users.insertedIds[1],
+      org: existingOrg,
+      type: "organization",
+      role: existingRole,
+      status: "active",
+    },
+  ]);
+
+  return {
+    existingOrg,
+    existingOrgBefore: await h.db.collection("organizations").findOne({ _id: existingOrg }),
+    existingRolesBefore: await h.db
+      .collection("roles")
+      .find({ org: existingOrg })
+      .sort({ _id: 1 })
+      .toArray(),
+    membersBefore: await h.db.collection("members").find({}).sort({ _id: 1 }).toArray(),
+    allRoleIdsBefore: (await h.db.collection("roles").find({}, { projection: { _id: 1 } }).toArray()).map(
+      (r) => r._id,
+    ),
+    roleCountBefore: await h.db.collection("roles").countDocuments(),
+  };
+}

package/test/org-default-roles.test.mjs

@@ -0,0 +1,218 @@
+/**
+ * The default roles a brand-new organisation gets.
+ *
+ * Three things are asserted, and each one is a way the 2026-09-07 outage could
+ * come back:
+ *
+ *   1. every seeded role carries the NEW organisation's id. An `org`-less role
+ *      of a non-admin type is a template shared by every client that was ever
+ *      invited with it — one of those is what took every client's modules away.
+ *      A helper that can emit one is the same bug waiting.
+ *   2. the permission list is `["*"]`, which means EVERYTHING. A new client is
+ *      never locked out of anything by its own default role, and no enumerated
+ *      catalogue is mirrored server-side to drift out of date.
+ *   3. the shape passes the separation guard shipped in 3.56.0
+ *      (`role-scope.util.ts`), so seeding cannot be refused by the very rule
+ *      that was added to stop this class of mistake.
+ *
+ * Nothing here opens a socket or a database. The end-to-end half — that the
+ * rows actually land, that an EXISTING organisation is untouched, and that
+ * client creation still answers 201 — is
+ * `test/e2e/org-default-roles.e2e.test.mjs`.
+ */
+
+import { strict as assert } from "node:assert";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+
+import {
+  defaultOwnerRoles,
+  seedDefaultOrgRoles,
+} from "./.build/utils/org-default-roles.util.mjs";
+import {
+  roleScope,
+  requireNoPlatformGrant,
+  refuseSharedClientTemplate,
+  PLATFORM_ONLY_PERMISSIONS,
+} from "./.build/utils/role-scope.util.mjs";
+
+const ORG = "68b0c1d2e3f4a5b6c7d8e9f0";
+
+test("a new organisation of an app nature gets the same two roles a paid signup gets", () => {
+  const roles = defaultOwnerRoles(ORG, "security_agency");
+
+  assert.equal(roles.length, 2, "two roles, exactly as subscription.service.ts writes");
+
+  for (const role of roles) {
+    assert.equal(role.name, "owner");
+    assert.deepEqual(role.permissions, ["*"]);
+    assert.equal(role.default, true);
+    assert.equal(role.org, ORG, "the role is scoped to the NEW organisation");
+  }
+
+  assert.deepEqual(
+    roles.map((r) => r.type).sort(),
+    ["organization", "security_agency"],
+    "one organisation role and one typed by the organisation's nature",
+  );
+});
+
+test("the shape matches what subscription.service.ts already writes", () => {
+  // The paid path is the only default-role story that has ever run in
+  // production. If somebody changes it, this fails rather than letting the two
+  // drift into two different definitions of "a new client's owner role".
+  const source = readFileSync(
+    new URL("../src/services/subscription.service.ts", import.meta.url),
+    "utf8",
+  );
+
+  const seeding = source.slice(
+    source.indexOf("const role = await addRole("),
+    source.indexOf("await addMember("),
+  );
+
+  assert.ok(seeding.length > 0, "found the seeding block in subscription.service.ts");
+  assert.equal(
+    (seeding.match(/name: "owner"/g) ?? []).length,
+    2,
+    "the paid path still seeds two roles named owner",
+  );
+  assert.equal(
+    (seeding.match(/permissions: \["\*"\]/g) ?? []).length,
+    2,
+    'the paid path still seeds ["*"] on both',
+  );
+  assert.equal(
+    (seeding.match(/default: true/g) ?? []).length,
+    2,
+    "the paid path still seeds both as default",
+  );
+  assert.ok(
+    seeding.includes('type: "organization"'),
+    "the paid path still seeds an organisation-typed role",
+  );
+  assert.ok(
+    seeding.includes("type: value.organization.nature"),
+    "the paid path still seeds a nature-typed role",
+  );
+});
+
+test("a nature that is not an app seeds only the organisation role", () => {
+  // `customer.service.ts` writes nature "property_owner", which is on neither
+  // `allowedNatures` nor `MEMBER_TYPES`. A role typed with it is a row no app
+  // can ever ask for.
+  const roles = defaultOwnerRoles(ORG, "property_owner");
+
+  assert.equal(roles.length, 1);
+  assert.equal(roles[0].type, "organization");
+  assert.equal(roles[0].org, ORG);
+});
+
+test("it can never produce an org-less shared template", () => {
+  // The single most important assertion in this file. `org: ""` on a
+  // `type: "organization"` role is the exact shape of "Org Owner", the document
+  // 119 members across every client shared on 2026-09-07.
+  for (const missing of [undefined, null, ""]) {
+    assert.deepEqual(
+      defaultOwnerRoles(missing, "security_agency"),
+      [],
+      `no roles for org=${JSON.stringify(missing)}`,
+    );
+  }
+});
+
+test("an ObjectId-like org is accepted and kept", () => {
+  const oid = { toString: () => ORG };
+  const roles = defaultOwnerRoles(oid, "cleaning_services");
+
+  assert.equal(roles.length, 2);
+  for (const role of roles) assert.equal(role.org, oid);
+});
+
+test("every seeded role passes the 3.56.0 separation guard", () => {
+  for (const nature of [
+    "real_estate_developer",
+    "property_management_agency",
+    "security_agency",
+    "cleaning_services",
+    "mechanical_electrical_services",
+    "landscaping_services",
+    "pest_control_services",
+    "pool_maintenance_services",
+    "property_owner",
+  ]) {
+    const roles = defaultOwnerRoles(ORG, nature);
+    assert.ok(roles.length >= 1, `${nature} seeds at least one role`);
+
+    for (const role of roles) {
+      assert.equal(
+        roleScope(role),
+        "client",
+        `${nature}/${role.type}: scoped to a client, not a template and not platform`,
+      );
+
+      // The write gate on `role.controller.ts` calls both of these. Neither may
+      // refuse a role we seed, or the role becomes unsavable the moment a
+      // client opens it in their own editor.
+      assert.doesNotThrow(() => refuseSharedClientTemplate(role));
+      assert.doesNotThrow(() => requireNoPlatformGrant(role, role.permissions));
+      // and re-saving it unchanged, which is what an editor does
+      assert.doesNotThrow(() => requireNoPlatformGrant(role, ["*"]));
+    }
+  }
+});
+
+test("seeding writes both roles through the repository it is handed", async () => {
+  const written = [];
+  await seedDefaultOrgRoles(async (role) => written.push(role), ORG, "security_agency");
+
+  assert.equal(written.length, 2);
+  assert.deepEqual(written.map((r) => r.type).sort(), ["organization", "security_agency"]);
+});
+
+test("a seeding failure never fails the request that created the organisation", async () => {
+  // The whole reason this is not inside a transaction. If a role insert throws,
+  // the organisation is already committed and the caller must still get its
+  // 201 — otherwise a seeding bug becomes a client-creation outage.
+  let attempts = 0;
+
+  await assert.doesNotReject(
+    seedDefaultOrgRoles(
+      async () => {
+        attempts += 1;
+        throw new Error("simulated insert failure");
+      },
+      ORG,
+      "security_agency",
+    ),
+  );
+
+  assert.equal(attempts, 1, "positive control: the failing insert was actually attempted");
+});
+
+test("positive control: the guard DOES refuse the shapes this seeding avoids", () => {
+  // If this test ever passes because the guard refuses nothing, the assertions
+  // above are worthless. So prove the guard still bites.
+  assert.ok(
+    PLATFORM_ONLY_PERMISSIONS.size > 0,
+    "the platform-only set is not empty",
+  );
+
+  const platformString = [...PLATFORM_ONLY_PERMISSIONS][0];
+
+  assert.throws(
+    () => refuseSharedClientTemplate({ type: "organization", org: "" }),
+    /shared by every client/,
+    "an org-less client template is still refused",
+  );
+
+  assert.throws(
+    () =>
+      requireNoPlatformGrant(
+        { type: "organization", org: ORG, permissions: [] },
+        [platformString],
+      ),
+    /Seven365 console permissions/,
+    "a platform grant on a client role is still refused",
+  );
+});