@7365admin1/core 3.56.0 → 3.58.0

package/test/e2e/role-template-restore.e2e.test.mjs

@@ -0,0 +1,369 @@
+/**
+ * A platform admin can put a shared client template BACK to allow-all, and can
+ * still do nothing else to it.
+ *
+ * ## What this is proving
+ *
+ * The guard shipped in core 3.56.0 refuses every write to an org-less
+ * `type: "organization"` role — the shared CLIENT TEMPLATES that every client
+ * invited with them depends on. It stopped the 2026-09-07 outage recurring and
+ * it also stopped it being repaired: production "Org Owner"
+ * (`69df7c8034293c971075ab97`) still holds the 34 platform permission strings,
+ * 119 members are still locked out, and the guard is what refuses the one write
+ * that gives them their modules back.
+ *
+ * The unit half (`test/role-scope-separation.test.mjs`) proves the predicate.
+ * This proves it over real HTTP, through the real routes and the real
+ * controller, and — the assertion that matters most — that what LANDS IN THE
+ * DATABASE after the restore is `["*"]` and not something else.
+ *
+ * The template here is seeded holding exactly the 34 strings production holds,
+ * so case 2 is today's outage attempted against today's code.
+ *
+ * Everything is created and thrown away by the harness: an in-process MongoDB
+ * replica set, a loopback Redis, a loopback mail sink. No staging or production
+ * database, Redis, mailbox or endpoint is touched.
+ *
+ * Run with: yarn test:e2e
+ */
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "RoleTemplateRestore-Passw0rd!";
+const STAFF = "rtr-staff@e2e.example.com"; // Seven365 console
+const CLIENT = "rtr-client@e2e.example.com"; // an ordinary tenant member
+
+/** Verbatim `useAdminPermission`: the list the console save wrote. */
+const CONSOLE_SAVE = [
+  "organizations:see-all-organizations",
+  "organizations:see-organization-details",
+  "promo-codes:create-promo-code",
+  "promo-codes:see-promo-code-details",
+  "promo-codes:edit-promo-code-details",
+  "promo-codes:change-promo-code-status",
+  "promo-codes:delete-promo-code",
+  "users:see-all-users",
+  "users:see-user-details",
+  "invitations:create-invitation",
+  "invitations:view-invitations",
+  "invitations:cancel-invitation",
+  "subscriptions:see-all-subscriptions",
+  "subscriptions:see-subscription-details",
+  "subscriptions:manage-subscription",
+  "sp-approvals:see-all-sp-approvals",
+  "sp-approvals:approve-sp",
+  "sp-approvals:reject-sp",
+  "sp-approvals:delete-sp-approval",
+  "marketplace-vendors:see-all-marketplace-vendors",
+  "marketplace-vendors:see-marketplace-vendor-details",
+  "platform-terms:see-platform-terms",
+  "platform-terms:edit-platform-terms",
+  "activity-history:see-activity-history",
+  "members:view-members",
+  "members:assign-member-role",
+  "members:suspend-member",
+  "members:activate-member",
+  "members:delete-member",
+  "roles-and-permissions:add-role",
+  "roles-and-permissions:see-all-roles",
+  "roles-and-permissions:see-role-details",
+  "roles-and-permissions:update-role",
+  "roles-and-permissions:delete-role",
+];
+
+const REFUSAL = /shared by every client/;
+
+describe("a shared client template can be restored and nothing else", { concurrency: 1 }, () => {
+  let h;
+  let id;
+  let staffSid;
+  let clientSid;
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    id = await seed(h);
+    staffSid = await h.login(STAFF, PASSWORD);
+    clientSid = await h.login(CLIENT, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- role template restore: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const permissionsOf = async (roleId) =>
+    (await h.db.collection("roles").findOne({ _id: roleId }))?.permissions;
+
+  const patchPermissions = (roleId, permissions, sid) =>
+    h.api("/roles/permissions/id/" + roleId.toString(), {
+      method: "PATCH",
+      sid,
+      body: { permissions },
+    });
+
+  // ---- the outage, attempted -----------------------------------------------
+
+  record("1. the template starts in production's broken state — 34 strings", async () => {
+    assert.deepEqual(await permissionsOf(id.template), CONSOLE_SAVE);
+  });
+
+  record("2. THE OUTAGE: a console save of the 34 strings is still refused", async () => {
+    const res = await patchPermissions(id.template, CONSOLE_SAVE, staffSid);
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", REFUSAL);
+    assert.deepEqual(
+      await permissionsOf(id.template),
+      CONSOLE_SAVE,
+      "the refused write must not have touched the row",
+    );
+  });
+
+  record("3. NARROWING: a strict subset of what it holds is refused", async () => {
+    const res = await patchPermissions(id.template, CONSOLE_SAVE.slice(0, 10), staffSid);
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", REFUSAL);
+    assert.deepEqual(await permissionsOf(id.template), CONSOLE_SAVE);
+  });
+
+  record("4. a hand-built superset is refused too — nothing authors a template", async () => {
+    const res = await patchPermissions(
+      id.template,
+      [...CONSOLE_SAVE, "members:view-members-extra"],
+      staffSid,
+    );
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.deepEqual(await permissionsOf(id.template), CONSOLE_SAVE);
+  });
+
+  // ---- the repair ----------------------------------------------------------
+
+  record("5. THE REPAIR: a platform admin sets it to allow-all and it STORES it", async () => {
+    const res = await patchPermissions(id.template, ["*"], staffSid);
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(
+      await permissionsOf(id.template),
+      ["*"],
+      "the whole point: the row must now read allow-all",
+    );
+  });
+
+  record("6. an EMPTY list is not refused by the template guard — a different rule stops it", async () => {
+    /*
+     * MEASURED, and it is the reason the repair instruction says `["*"]`.
+     *
+     * `PATCH /roles/permissions/id/:id` refuses an empty list in the repository
+     * (`role.repo.ts:481` — "Permissions cannot be empty."), and has since long
+     * before any of this. It is a 400, not the 401 the template guard raises,
+     * so the guard did let it through; the storage layer is what says no.
+     *
+     * Deliberately NOT changed. Loosening it would let an empty list — which
+     * the permission model reads as EVERYTHING — be saved on any role by any
+     * client's own editor. That is a widening with a blast radius far past this
+     * repair, and `["*"]` restores the same thing.
+     */
+    const res = await patchPermissions(id.secondTemplate, [], staffSid);
+
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", /Permissions cannot be empty/);
+    assert.doesNotMatch(
+      res.body?.message ?? "",
+      REFUSAL,
+      "the template guard must NOT be what refused an empty list",
+    );
+    assert.deepEqual(await permissionsOf(id.secondTemplate), CONSOLE_SAVE);
+  });
+
+  record("6b. and where an empty list IS accepted, the guard permits it", async () => {
+    // `PATCH /roles/id/:id` stores it (`role.repo.ts:427` keeps a `[]`), so the
+    // guard's empty-list arm is exercised end to end and not merely asserted.
+    const res = await h.api("/roles/id/" + id.secondTemplate.toString(), {
+      method: "PATCH",
+      sid: staffSid,
+      body: { name: "Org Manager", permissions: [] },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(await permissionsOf(id.secondTemplate), []);
+  });
+
+  record("7. PATCH /id/:id — the other write endpoint behaves identically", async () => {
+    const refused = await h.api("/roles/id/" + id.thirdTemplate.toString(), {
+      method: "PATCH",
+      sid: staffSid,
+      body: { name: "Renamed Template", permissions: CONSOLE_SAVE },
+    });
+    assert.equal(refused.status, 401, JSON.stringify(refused.body));
+    assert.match(refused.body?.message ?? "", REFUSAL);
+
+    const restored = await h.api("/roles/id/" + id.thirdTemplate.toString(), {
+      method: "PATCH",
+      sid: staffSid,
+      body: { name: "Renamed Template", permissions: ["*"] },
+    });
+    assert.equal(restored.status, 200, JSON.stringify(restored.body));
+    assert.deepEqual(await permissionsOf(id.thirdTemplate), ["*"]);
+  });
+
+  // ---- what the exception must NOT have opened -----------------------------
+
+  record("8. a client member cannot use the restore path on a shared template", async () => {
+    // Reaching the restore still means passing the console gate. A tenant
+    // member holds no staff membership, so this must not be a way in.
+    const res = await patchPermissions(id.fourthTemplate, ["*"], clientSid);
+
+    assert.notEqual(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(
+      await permissionsOf(id.fourthTemplate),
+      ["members:view-members"],
+      "a non-staff caller must not have restored anything",
+    );
+  });
+
+  record("9. an ORG-SCOPED role is unaffected — it still narrows normally", async () => {
+    const res = await patchPermissions(id.clientRole, ["members:view-members"], staffSid);
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(await permissionsOf(id.clientRole), ["members:view-members"]);
+  });
+
+  record("10. a client editor still cannot grant a platform resource", async () => {
+    const res = await patchPermissions(
+      id.clientRole,
+      ["members:view-members", "organizations:see-all-organizations"],
+      staffSid,
+    );
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", /Seven365 console permissions/);
+    assert.deepEqual(await permissionsOf(id.clientRole), ["members:view-members"]);
+  });
+
+  record("11. POSITIVE CONTROL: the run really did write, and really did refuse", async () => {
+    // If every case above 401'd, cases 5-7 and 9 would be vacuous; if every
+    // case 200'd, cases 2-4 and 8 would be. Count both.
+    const verdicts = result.map(([v]) => v);
+    assert.equal(verdicts.includes("FAIL"), false, JSON.stringify(result));
+
+    for (const roleId of [id.template, id.thirdTemplate]) {
+      assert.deepEqual(await permissionsOf(roleId), ["*"], roleId.toString());
+    }
+    assert.deepEqual(await permissionsOf(id.secondTemplate), []);
+    // and one template that nothing was allowed to move
+    assert.deepEqual(await permissionsOf(id.fourthTemplate), ["members:view-members"]);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const hashed = await h.hashPassword(PASSWORD);
+
+  const staffRole = new ObjectId();
+  const clientOrg = new ObjectId();
+  const clientRole = new ObjectId();
+  const template = new ObjectId();
+  const secondTemplate = new ObjectId();
+  const thirdTemplate = new ObjectId();
+  const fourthTemplate = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: clientOrg,
+    name: "RTR Client",
+    email: "rtr-org@e2e.example.com",
+    type: "org",
+    nature: "organization",
+    status: "active",
+    createdAt: now,
+  });
+
+  await h.db.collection("roles").insertMany([
+    // Seven365 staff: `type: "admin"` with `["*"]`, so the console gate passes
+    // and the cases measure the TEMPLATE rule, not authorization.
+    { _id: staffRole, name: "Staff Wildcard", type: "admin", status: "active", permissions: ["*"] },
+    // The client's own role — org-scoped, so the template rule never applies.
+    {
+      _id: clientRole,
+      name: "RTR Client Admin",
+      org: clientOrg,
+      type: "organization",
+      status: "active",
+      permissions: ["*"],
+    },
+    // Four shared templates: org-less, no `org` field at all. The first three
+    // hold production's broken list verbatim.
+    {
+      _id: template,
+      name: "Org Owner",
+      type: "organization",
+      status: "active",
+      default: true,
+      permissions: CONSOLE_SAVE,
+    },
+    {
+      _id: secondTemplate,
+      name: "Org Manager",
+      type: "organization",
+      status: "active",
+      permissions: CONSOLE_SAVE,
+    },
+    {
+      _id: thirdTemplate,
+      name: "Agency Owner",
+      type: "security_agency",
+      status: "active",
+      permissions: CONSOLE_SAVE,
+    },
+    {
+      _id: fourthTemplate,
+      name: "Org Supervisor",
+      type: "organization",
+      status: "active",
+      permissions: ["members:view-members"],
+    },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: STAFF, password: hashed, name: "RTR Staff", status: "active", createdAt: now },
+    {
+      email: CLIENT,
+      password: hashed,
+      name: "RTR Client User",
+      status: "active",
+      defaultOrg: clientOrg.toString(),
+      createdAt: now,
+    },
+  ]);
+
+  await h.db.collection("members").insertMany([
+    { user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" },
+    {
+      user: users.insertedIds[1],
+      org: clientOrg,
+      type: "organization",
+      role: clientRole,
+      status: "active",
+    },
+  ]);
+
+  return { clientOrg, clientRole, template, secondTemplate, thirdTemplate, fourthTemplate };
+}

package/test/org-default-roles.test.mjs

@@ -0,0 +1,218 @@
+/**
+ * The default roles a brand-new organisation gets.
+ *
+ * Three things are asserted, and each one is a way the 2026-09-07 outage could
+ * come back:
+ *
+ *   1. every seeded role carries the NEW organisation's id. An `org`-less role
+ *      of a non-admin type is a template shared by every client that was ever
+ *      invited with it — one of those is what took every client's modules away.
+ *      A helper that can emit one is the same bug waiting.
+ *   2. the permission list is `["*"]`, which means EVERYTHING. A new client is
+ *      never locked out of anything by its own default role, and no enumerated
+ *      catalogue is mirrored server-side to drift out of date.
+ *   3. the shape passes the separation guard shipped in 3.56.0
+ *      (`role-scope.util.ts`), so seeding cannot be refused by the very rule
+ *      that was added to stop this class of mistake.
+ *
+ * Nothing here opens a socket or a database. The end-to-end half — that the
+ * rows actually land, that an EXISTING organisation is untouched, and that
+ * client creation still answers 201 — is
+ * `test/e2e/org-default-roles.e2e.test.mjs`.
+ */
+
+import { strict as assert } from "node:assert";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+
+import {
+  defaultOwnerRoles,
+  seedDefaultOrgRoles,
+} from "./.build/utils/org-default-roles.util.mjs";
+import {
+  roleScope,
+  requireNoPlatformGrant,
+  refuseSharedClientTemplate,
+  PLATFORM_ONLY_PERMISSIONS,
+} from "./.build/utils/role-scope.util.mjs";
+
+const ORG = "68b0c1d2e3f4a5b6c7d8e9f0";
+
+test("a new organisation of an app nature gets the same two roles a paid signup gets", () => {
+  const roles = defaultOwnerRoles(ORG, "security_agency");
+
+  assert.equal(roles.length, 2, "two roles, exactly as subscription.service.ts writes");
+
+  for (const role of roles) {
+    assert.equal(role.name, "owner");
+    assert.deepEqual(role.permissions, ["*"]);
+    assert.equal(role.default, true);
+    assert.equal(role.org, ORG, "the role is scoped to the NEW organisation");
+  }
+
+  assert.deepEqual(
+    roles.map((r) => r.type).sort(),
+    ["organization", "security_agency"],
+    "one organisation role and one typed by the organisation's nature",
+  );
+});
+
+test("the shape matches what subscription.service.ts already writes", () => {
+  // The paid path is the only default-role story that has ever run in
+  // production. If somebody changes it, this fails rather than letting the two
+  // drift into two different definitions of "a new client's owner role".
+  const source = readFileSync(
+    new URL("../src/services/subscription.service.ts", import.meta.url),
+    "utf8",
+  );
+
+  const seeding = source.slice(
+    source.indexOf("const role = await addRole("),
+    source.indexOf("await addMember("),
+  );
+
+  assert.ok(seeding.length > 0, "found the seeding block in subscription.service.ts");
+  assert.equal(
+    (seeding.match(/name: "owner"/g) ?? []).length,
+    2,
+    "the paid path still seeds two roles named owner",
+  );
+  assert.equal(
+    (seeding.match(/permissions: \["\*"\]/g) ?? []).length,
+    2,
+    'the paid path still seeds ["*"] on both',
+  );
+  assert.equal(
+    (seeding.match(/default: true/g) ?? []).length,
+    2,
+    "the paid path still seeds both as default",
+  );
+  assert.ok(
+    seeding.includes('type: "organization"'),
+    "the paid path still seeds an organisation-typed role",
+  );
+  assert.ok(
+    seeding.includes("type: value.organization.nature"),
+    "the paid path still seeds a nature-typed role",
+  );
+});
+
+test("a nature that is not an app seeds only the organisation role", () => {
+  // `customer.service.ts` writes nature "property_owner", which is on neither
+  // `allowedNatures` nor `MEMBER_TYPES`. A role typed with it is a row no app
+  // can ever ask for.
+  const roles = defaultOwnerRoles(ORG, "property_owner");
+
+  assert.equal(roles.length, 1);
+  assert.equal(roles[0].type, "organization");
+  assert.equal(roles[0].org, ORG);
+});
+
+test("it can never produce an org-less shared template", () => {
+  // The single most important assertion in this file. `org: ""` on a
+  // `type: "organization"` role is the exact shape of "Org Owner", the document
+  // 119 members across every client shared on 2026-09-07.
+  for (const missing of [undefined, null, ""]) {
+    assert.deepEqual(
+      defaultOwnerRoles(missing, "security_agency"),
+      [],
+      `no roles for org=${JSON.stringify(missing)}`,
+    );
+  }
+});
+
+test("an ObjectId-like org is accepted and kept", () => {
+  const oid = { toString: () => ORG };
+  const roles = defaultOwnerRoles(oid, "cleaning_services");
+
+  assert.equal(roles.length, 2);
+  for (const role of roles) assert.equal(role.org, oid);
+});
+
+test("every seeded role passes the 3.56.0 separation guard", () => {
+  for (const nature of [
+    "real_estate_developer",
+    "property_management_agency",
+    "security_agency",
+    "cleaning_services",
+    "mechanical_electrical_services",
+    "landscaping_services",
+    "pest_control_services",
+    "pool_maintenance_services",
+    "property_owner",
+  ]) {
+    const roles = defaultOwnerRoles(ORG, nature);
+    assert.ok(roles.length >= 1, `${nature} seeds at least one role`);
+
+    for (const role of roles) {
+      assert.equal(
+        roleScope(role),
+        "client",
+        `${nature}/${role.type}: scoped to a client, not a template and not platform`,
+      );
+
+      // The write gate on `role.controller.ts` calls both of these. Neither may
+      // refuse a role we seed, or the role becomes unsavable the moment a
+      // client opens it in their own editor.
+      assert.doesNotThrow(() => refuseSharedClientTemplate(role));
+      assert.doesNotThrow(() => requireNoPlatformGrant(role, role.permissions));
+      // and re-saving it unchanged, which is what an editor does
+      assert.doesNotThrow(() => requireNoPlatformGrant(role, ["*"]));
+    }
+  }
+});
+
+test("seeding writes both roles through the repository it is handed", async () => {
+  const written = [];
+  await seedDefaultOrgRoles(async (role) => written.push(role), ORG, "security_agency");
+
+  assert.equal(written.length, 2);
+  assert.deepEqual(written.map((r) => r.type).sort(), ["organization", "security_agency"]);
+});
+
+test("a seeding failure never fails the request that created the organisation", async () => {
+  // The whole reason this is not inside a transaction. If a role insert throws,
+  // the organisation is already committed and the caller must still get its
+  // 201 — otherwise a seeding bug becomes a client-creation outage.
+  let attempts = 0;
+
+  await assert.doesNotReject(
+    seedDefaultOrgRoles(
+      async () => {
+        attempts += 1;
+        throw new Error("simulated insert failure");
+      },
+      ORG,
+      "security_agency",
+    ),
+  );
+
+  assert.equal(attempts, 1, "positive control: the failing insert was actually attempted");
+});
+
+test("positive control: the guard DOES refuse the shapes this seeding avoids", () => {
+  // If this test ever passes because the guard refuses nothing, the assertions
+  // above are worthless. So prove the guard still bites.
+  assert.ok(
+    PLATFORM_ONLY_PERMISSIONS.size > 0,
+    "the platform-only set is not empty",
+  );
+
+  const platformString = [...PLATFORM_ONLY_PERMISSIONS][0];
+
+  assert.throws(
+    () => refuseSharedClientTemplate({ type: "organization", org: "" }),
+    /shared by every client/,
+    "an org-less client template is still refused",
+  );
+
+  assert.throws(
+    () =>
+      requireNoPlatformGrant(
+        { type: "organization", org: ORG, permissions: [] },
+        [platformString],
+      ),
+    /Seven365 console permissions/,
+    "a platform grant on a client role is still refused",
+  );
+});