@7365admin1/core 3.56.0 → 3.58.0

package/test/role-scope-separation.test.mjs

@@ -5,6 +5,7 @@ import { readFileSync } from "node:fs";
 import {
   PLATFORM_ONLY_PERMISSIONS,
   platformPermissionsAdded,
+  permissionsMeanEverything,
   refuseSharedClientTemplate,
   requireNoPlatformGrant,
   roleScope,
@@ -193,3 +194,151 @@ test("the lockout check's copy of the platform list cannot drift", () => {
 
   assert.deepEqual(onDisk, [...PLATFORM_ONLY_PERMISSIONS].sort());
 });
+
+
+/*
+ * ---------------------------------------------------------------------------
+ * THE RESTORE PATH
+ *
+ * 3.56.0 refused every write to a shared template, including the one that
+ * repairs the outage. Production "Org Owner" still holds the 34 strings and 119
+ * members are still locked out, so a platform admin needs a way BACK to
+ * allow-all — and no way to anything else.
+ *
+ * `BROKEN` is the live production state: the same template, after the save.
+ * ---------------------------------------------------------------------------
+ */
+
+const BROKEN = { type: "organization", org: "", permissions: CONSOLE_SAVE };
+
+test("RESTORE: a platform admin may set a shared template to [\"*\"]", () => {
+  assert.doesNotThrow(() => refuseSharedClientTemplate(BROKEN, ["*"]));
+  assert.equal(
+    refuseSharedClientTemplate(BROKEN, ["*"]),
+    true,
+    "must report the restore so the controller can record it",
+  );
+});
+
+test("RESTORE: an empty list is the same restore and is also permitted", () => {
+  // `[]` and `["*"]` are the two live spellings of everything.
+  assert.equal(refuseSharedClientTemplate(BROKEN, []), true);
+  assert.equal(permissionsMeanEverything([]), true);
+  assert.equal(permissionsMeanEverything(["*"]), true);
+  assert.equal(permissionsMeanEverything(["*", "members:view-members"]), true);
+  assert.equal(permissionsMeanEverything(["members:view-members"]), false);
+});
+
+test("THE OUTAGE STAYS IMPOSSIBLE: the 34 console strings are still refused", () => {
+  /*
+   * The one case a literal "superset-or-equal" rule would have let through.
+   * Production holds exactly this list TODAY, so an equal-set write is the
+   * outage being re-saved, not a widening. Refused from both states.
+   */
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, CONSOLE_SAVE),
+    /shared by every client/,
+  );
+  assert.throws(
+    () => refuseSharedClientTemplate(ORG_OWNER, CONSOLE_SAVE),
+    /shared by every client/,
+  );
+});
+
+test("NARROWING: a strict subset of what the template holds is refused", () => {
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, CONSOLE_SAVE.slice(0, 10)),
+    /shared by every client/,
+  );
+  // and a single-string list, the narrowest write there is
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, ["members:view-members"]),
+    /shared by every client/,
+  );
+});
+
+test("a strict SUPERSET is refused too — nothing may author a template's list", () => {
+  // Deliberately tighter than "superset-or-equal": no editor draws the client
+  // catalogue for an org-less role, so a hand-built list is a guess.
+  assert.throws(
+    () =>
+      refuseSharedClientTemplate(BROKEN, [
+        ...CONSOLE_SAVE,
+        "members:view-members",
+      ]),
+    /shared by every client/,
+  );
+});
+
+test("a DELETE presents no list, so the refusal is unchanged", () => {
+  // `deleteRole`/`deleteWithReassignments` call the gate with two arguments.
+  assert.throws(() => refuseSharedClientTemplate(BROKEN), /shared by every client/);
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, null),
+    /shared by every client/,
+  );
+});
+
+test("POSITIVE CONTROL: an org-scoped role is untouched in BOTH directions", () => {
+  const client = {
+    type: "organization",
+    org: "6512ab",
+    permissions: ["members:view-members", "roles-and-permissions:add-role"],
+  };
+
+  // widening
+  assert.equal(refuseSharedClientTemplate(client, ["*"]), false);
+  assert.equal(refuseSharedClientTemplate(client, []), false);
+  // narrowing — a client's own editor takes modules away every day
+  assert.equal(refuseSharedClientTemplate(client, ["members:view-members"]), false);
+  assert.equal(refuseSharedClientTemplate(client, []), false);
+  // and a delete
+  assert.equal(refuseSharedClientTemplate(client), false);
+
+  // the platform's own role, same both ways
+  const platform = { type: "admin", org: "", permissions: CONSOLE_SAVE };
+  assert.equal(refuseSharedClientTemplate(platform, ["*"]), false);
+  assert.equal(refuseSharedClientTemplate(platform, CONSOLE_SAVE.slice(0, 3)), false);
+});
+
+test("POSITIVE CONTROL: the refusal still bites — the exception is not a hole", () => {
+  /*
+   * If the restore arm were reachable for any list, every assertion above would
+   * pass vacuously. Count what is actually refused out of a realistic spread.
+   */
+  const writes = [
+    CONSOLE_SAVE,
+    CONSOLE_SAVE.slice(0, 10),
+    ["members:view-members"],
+    [...CONSOLE_SAVE, "members:view-members"],
+    ["organizations:see-all-organizations"],
+    undefined,
+  ];
+
+  let refused = 0;
+  for (const next of writes) {
+    try {
+      refuseSharedClientTemplate(BROKEN, next);
+    } catch {
+      refused += 1;
+    }
+  }
+
+  assert.equal(refused, 6, "every non-restore write must still be refused");
+  assert.equal(refuseSharedClientTemplate(BROKEN, ["*"]), true);
+});
+
+test("a client editor STILL cannot grant a platform resource after all this", () => {
+  // The other half of the guard is untouched by the restore path.
+  assert.throws(
+    () =>
+      requireNoPlatformGrant(
+        { type: "organization", org: "6512ab", permissions: [] },
+        ["organizations:see-all-organizations"],
+      ),
+    /Seven365 console permissions/,
+  );
+  // and the restore itself carries no platform string, so it passes this gate
+  assert.doesNotThrow(() => requireNoPlatformGrant(BROKEN, ["*"]));
+  assert.doesNotThrow(() => requireNoPlatformGrant(BROKEN, []));
+});

package/test/role-scope.test.mjs

@@ -185,14 +185,26 @@ test("the write gate refuses a shared client template before anything else", ()
   const helper = controller.slice(
     controller.indexOf("async function requireRoleWrite"),
   );
-  const body = helper.slice(0, 500);
-
-  const refuse = body.indexOf("refuseSharedClientTemplate(role)");
+  // 900, not 500: the gate carries a comment explaining why the restore is
+  // reported only after the console check.
+  const body = helper.slice(0, 900);
+
+  // Matched without the closing paren on purpose: the gate now hands the
+  // proposed permission list in as a second argument (the restore path), and
+  // the property this test exists to hold is the ORDER, not the arity.
+  const refuse = body.indexOf("refuseSharedClientTemplate(role");
   const fallthrough = body.indexOf("requireRoleOrg(req");
 
   assert.ok(refuse !== -1, "requireRoleWrite must refuse shared templates");
   assert.ok(fallthrough !== -1, "and must still apply the org rule to the rest");
   assert.ok(refuse < fallthrough, "the refusal must come first");
+
+  // The restore is only reachable AFTER the console gate has run, so a
+  // non-staff caller can never take it.
+  assert.ok(
+    body.indexOf("return isTemplateRestore") > fallthrough,
+    "a restore must not be reported before the authorization check",
+  );
 });
 
 test("the permission-writing paths refuse a platform grant", () => {