@7365admin1/core 3.57.0 → 3.58.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.57.0",
+  "version": "3.58.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/role-template-restore.e2e.test.mjs

@@ -0,0 +1,369 @@
+/**
+ * A platform admin can put a shared client template BACK to allow-all, and can
+ * still do nothing else to it.
+ *
+ * ## What this is proving
+ *
+ * The guard shipped in core 3.56.0 refuses every write to an org-less
+ * `type: "organization"` role — the shared CLIENT TEMPLATES that every client
+ * invited with them depends on. It stopped the 2026-09-07 outage recurring and
+ * it also stopped it being repaired: production "Org Owner"
+ * (`69df7c8034293c971075ab97`) still holds the 34 platform permission strings,
+ * 119 members are still locked out, and the guard is what refuses the one write
+ * that gives them their modules back.
+ *
+ * The unit half (`test/role-scope-separation.test.mjs`) proves the predicate.
+ * This proves it over real HTTP, through the real routes and the real
+ * controller, and — the assertion that matters most — that what LANDS IN THE
+ * DATABASE after the restore is `["*"]` and not something else.
+ *
+ * The template here is seeded holding exactly the 34 strings production holds,
+ * so case 2 is today's outage attempted against today's code.
+ *
+ * Everything is created and thrown away by the harness: an in-process MongoDB
+ * replica set, a loopback Redis, a loopback mail sink. No staging or production
+ * database, Redis, mailbox or endpoint is touched.
+ *
+ * Run with: yarn test:e2e
+ */
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "RoleTemplateRestore-Passw0rd!";
+const STAFF = "rtr-staff@e2e.example.com"; // Seven365 console
+const CLIENT = "rtr-client@e2e.example.com"; // an ordinary tenant member
+
+/** Verbatim `useAdminPermission`: the list the console save wrote. */
+const CONSOLE_SAVE = [
+  "organizations:see-all-organizations",
+  "organizations:see-organization-details",
+  "promo-codes:create-promo-code",
+  "promo-codes:see-promo-code-details",
+  "promo-codes:edit-promo-code-details",
+  "promo-codes:change-promo-code-status",
+  "promo-codes:delete-promo-code",
+  "users:see-all-users",
+  "users:see-user-details",
+  "invitations:create-invitation",
+  "invitations:view-invitations",
+  "invitations:cancel-invitation",
+  "subscriptions:see-all-subscriptions",
+  "subscriptions:see-subscription-details",
+  "subscriptions:manage-subscription",
+  "sp-approvals:see-all-sp-approvals",
+  "sp-approvals:approve-sp",
+  "sp-approvals:reject-sp",
+  "sp-approvals:delete-sp-approval",
+  "marketplace-vendors:see-all-marketplace-vendors",
+  "marketplace-vendors:see-marketplace-vendor-details",
+  "platform-terms:see-platform-terms",
+  "platform-terms:edit-platform-terms",
+  "activity-history:see-activity-history",
+  "members:view-members",
+  "members:assign-member-role",
+  "members:suspend-member",
+  "members:activate-member",
+  "members:delete-member",
+  "roles-and-permissions:add-role",
+  "roles-and-permissions:see-all-roles",
+  "roles-and-permissions:see-role-details",
+  "roles-and-permissions:update-role",
+  "roles-and-permissions:delete-role",
+];
+
+const REFUSAL = /shared by every client/;
+
+describe("a shared client template can be restored and nothing else", { concurrency: 1 }, () => {
+  let h;
+  let id;
+  let staffSid;
+  let clientSid;
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    id = await seed(h);
+    staffSid = await h.login(STAFF, PASSWORD);
+    clientSid = await h.login(CLIENT, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- role template restore: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const permissionsOf = async (roleId) =>
+    (await h.db.collection("roles").findOne({ _id: roleId }))?.permissions;
+
+  const patchPermissions = (roleId, permissions, sid) =>
+    h.api("/roles/permissions/id/" + roleId.toString(), {
+      method: "PATCH",
+      sid,
+      body: { permissions },
+    });
+
+  // ---- the outage, attempted -----------------------------------------------
+
+  record("1. the template starts in production's broken state — 34 strings", async () => {
+    assert.deepEqual(await permissionsOf(id.template), CONSOLE_SAVE);
+  });
+
+  record("2. THE OUTAGE: a console save of the 34 strings is still refused", async () => {
+    const res = await patchPermissions(id.template, CONSOLE_SAVE, staffSid);
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", REFUSAL);
+    assert.deepEqual(
+      await permissionsOf(id.template),
+      CONSOLE_SAVE,
+      "the refused write must not have touched the row",
+    );
+  });
+
+  record("3. NARROWING: a strict subset of what it holds is refused", async () => {
+    const res = await patchPermissions(id.template, CONSOLE_SAVE.slice(0, 10), staffSid);
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", REFUSAL);
+    assert.deepEqual(await permissionsOf(id.template), CONSOLE_SAVE);
+  });
+
+  record("4. a hand-built superset is refused too — nothing authors a template", async () => {
+    const res = await patchPermissions(
+      id.template,
+      [...CONSOLE_SAVE, "members:view-members-extra"],
+      staffSid,
+    );
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.deepEqual(await permissionsOf(id.template), CONSOLE_SAVE);
+  });
+
+  // ---- the repair ----------------------------------------------------------
+
+  record("5. THE REPAIR: a platform admin sets it to allow-all and it STORES it", async () => {
+    const res = await patchPermissions(id.template, ["*"], staffSid);
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(
+      await permissionsOf(id.template),
+      ["*"],
+      "the whole point: the row must now read allow-all",
+    );
+  });
+
+  record("6. an EMPTY list is not refused by the template guard — a different rule stops it", async () => {
+    /*
+     * MEASURED, and it is the reason the repair instruction says `["*"]`.
+     *
+     * `PATCH /roles/permissions/id/:id` refuses an empty list in the repository
+     * (`role.repo.ts:481` — "Permissions cannot be empty."), and has since long
+     * before any of this. It is a 400, not the 401 the template guard raises,
+     * so the guard did let it through; the storage layer is what says no.
+     *
+     * Deliberately NOT changed. Loosening it would let an empty list — which
+     * the permission model reads as EVERYTHING — be saved on any role by any
+     * client's own editor. That is a widening with a blast radius far past this
+     * repair, and `["*"]` restores the same thing.
+     */
+    const res = await patchPermissions(id.secondTemplate, [], staffSid);
+
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", /Permissions cannot be empty/);
+    assert.doesNotMatch(
+      res.body?.message ?? "",
+      REFUSAL,
+      "the template guard must NOT be what refused an empty list",
+    );
+    assert.deepEqual(await permissionsOf(id.secondTemplate), CONSOLE_SAVE);
+  });
+
+  record("6b. and where an empty list IS accepted, the guard permits it", async () => {
+    // `PATCH /roles/id/:id` stores it (`role.repo.ts:427` keeps a `[]`), so the
+    // guard's empty-list arm is exercised end to end and not merely asserted.
+    const res = await h.api("/roles/id/" + id.secondTemplate.toString(), {
+      method: "PATCH",
+      sid: staffSid,
+      body: { name: "Org Manager", permissions: [] },
+    });
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(await permissionsOf(id.secondTemplate), []);
+  });
+
+  record("7. PATCH /id/:id — the other write endpoint behaves identically", async () => {
+    const refused = await h.api("/roles/id/" + id.thirdTemplate.toString(), {
+      method: "PATCH",
+      sid: staffSid,
+      body: { name: "Renamed Template", permissions: CONSOLE_SAVE },
+    });
+    assert.equal(refused.status, 401, JSON.stringify(refused.body));
+    assert.match(refused.body?.message ?? "", REFUSAL);
+
+    const restored = await h.api("/roles/id/" + id.thirdTemplate.toString(), {
+      method: "PATCH",
+      sid: staffSid,
+      body: { name: "Renamed Template", permissions: ["*"] },
+    });
+    assert.equal(restored.status, 200, JSON.stringify(restored.body));
+    assert.deepEqual(await permissionsOf(id.thirdTemplate), ["*"]);
+  });
+
+  // ---- what the exception must NOT have opened -----------------------------
+
+  record("8. a client member cannot use the restore path on a shared template", async () => {
+    // Reaching the restore still means passing the console gate. A tenant
+    // member holds no staff membership, so this must not be a way in.
+    const res = await patchPermissions(id.fourthTemplate, ["*"], clientSid);
+
+    assert.notEqual(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(
+      await permissionsOf(id.fourthTemplate),
+      ["members:view-members"],
+      "a non-staff caller must not have restored anything",
+    );
+  });
+
+  record("9. an ORG-SCOPED role is unaffected — it still narrows normally", async () => {
+    const res = await patchPermissions(id.clientRole, ["members:view-members"], staffSid);
+
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(await permissionsOf(id.clientRole), ["members:view-members"]);
+  });
+
+  record("10. a client editor still cannot grant a platform resource", async () => {
+    const res = await patchPermissions(
+      id.clientRole,
+      ["members:view-members", "organizations:see-all-organizations"],
+      staffSid,
+    );
+
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.match(res.body?.message ?? "", /Seven365 console permissions/);
+    assert.deepEqual(await permissionsOf(id.clientRole), ["members:view-members"]);
+  });
+
+  record("11. POSITIVE CONTROL: the run really did write, and really did refuse", async () => {
+    // If every case above 401'd, cases 5-7 and 9 would be vacuous; if every
+    // case 200'd, cases 2-4 and 8 would be. Count both.
+    const verdicts = result.map(([v]) => v);
+    assert.equal(verdicts.includes("FAIL"), false, JSON.stringify(result));
+
+    for (const roleId of [id.template, id.thirdTemplate]) {
+      assert.deepEqual(await permissionsOf(roleId), ["*"], roleId.toString());
+    }
+    assert.deepEqual(await permissionsOf(id.secondTemplate), []);
+    // and one template that nothing was allowed to move
+    assert.deepEqual(await permissionsOf(id.fourthTemplate), ["members:view-members"]);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const hashed = await h.hashPassword(PASSWORD);
+
+  const staffRole = new ObjectId();
+  const clientOrg = new ObjectId();
+  const clientRole = new ObjectId();
+  const template = new ObjectId();
+  const secondTemplate = new ObjectId();
+  const thirdTemplate = new ObjectId();
+  const fourthTemplate = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: clientOrg,
+    name: "RTR Client",
+    email: "rtr-org@e2e.example.com",
+    type: "org",
+    nature: "organization",
+    status: "active",
+    createdAt: now,
+  });
+
+  await h.db.collection("roles").insertMany([
+    // Seven365 staff: `type: "admin"` with `["*"]`, so the console gate passes
+    // and the cases measure the TEMPLATE rule, not authorization.
+    { _id: staffRole, name: "Staff Wildcard", type: "admin", status: "active", permissions: ["*"] },
+    // The client's own role — org-scoped, so the template rule never applies.
+    {
+      _id: clientRole,
+      name: "RTR Client Admin",
+      org: clientOrg,
+      type: "organization",
+      status: "active",
+      permissions: ["*"],
+    },
+    // Four shared templates: org-less, no `org` field at all. The first three
+    // hold production's broken list verbatim.
+    {
+      _id: template,
+      name: "Org Owner",
+      type: "organization",
+      status: "active",
+      default: true,
+      permissions: CONSOLE_SAVE,
+    },
+    {
+      _id: secondTemplate,
+      name: "Org Manager",
+      type: "organization",
+      status: "active",
+      permissions: CONSOLE_SAVE,
+    },
+    {
+      _id: thirdTemplate,
+      name: "Agency Owner",
+      type: "security_agency",
+      status: "active",
+      permissions: CONSOLE_SAVE,
+    },
+    {
+      _id: fourthTemplate,
+      name: "Org Supervisor",
+      type: "organization",
+      status: "active",
+      permissions: ["members:view-members"],
+    },
+  ]);
+
+  const users = await h.db.collection("users").insertMany([
+    { email: STAFF, password: hashed, name: "RTR Staff", status: "active", createdAt: now },
+    {
+      email: CLIENT,
+      password: hashed,
+      name: "RTR Client User",
+      status: "active",
+      defaultOrg: clientOrg.toString(),
+      createdAt: now,
+    },
+  ]);
+
+  await h.db.collection("members").insertMany([
+    { user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" },
+    {
+      user: users.insertedIds[1],
+      org: clientOrg,
+      type: "organization",
+      role: clientRole,
+      status: "active",
+    },
+  ]);
+
+  return { clientOrg, clientRole, template, secondTemplate, thirdTemplate, fourthTemplate };
+}

package/test/role-scope-separation.test.mjs

@@ -5,6 +5,7 @@ import { readFileSync } from "node:fs";
 import {
   PLATFORM_ONLY_PERMISSIONS,
   platformPermissionsAdded,
+  permissionsMeanEverything,
   refuseSharedClientTemplate,
   requireNoPlatformGrant,
   roleScope,
@@ -193,3 +194,151 @@ test("the lockout check's copy of the platform list cannot drift", () => {
 
   assert.deepEqual(onDisk, [...PLATFORM_ONLY_PERMISSIONS].sort());
 });
+
+
+/*
+ * ---------------------------------------------------------------------------
+ * THE RESTORE PATH
+ *
+ * 3.56.0 refused every write to a shared template, including the one that
+ * repairs the outage. Production "Org Owner" still holds the 34 strings and 119
+ * members are still locked out, so a platform admin needs a way BACK to
+ * allow-all — and no way to anything else.
+ *
+ * `BROKEN` is the live production state: the same template, after the save.
+ * ---------------------------------------------------------------------------
+ */
+
+const BROKEN = { type: "organization", org: "", permissions: CONSOLE_SAVE };
+
+test("RESTORE: a platform admin may set a shared template to [\"*\"]", () => {
+  assert.doesNotThrow(() => refuseSharedClientTemplate(BROKEN, ["*"]));
+  assert.equal(
+    refuseSharedClientTemplate(BROKEN, ["*"]),
+    true,
+    "must report the restore so the controller can record it",
+  );
+});
+
+test("RESTORE: an empty list is the same restore and is also permitted", () => {
+  // `[]` and `["*"]` are the two live spellings of everything.
+  assert.equal(refuseSharedClientTemplate(BROKEN, []), true);
+  assert.equal(permissionsMeanEverything([]), true);
+  assert.equal(permissionsMeanEverything(["*"]), true);
+  assert.equal(permissionsMeanEverything(["*", "members:view-members"]), true);
+  assert.equal(permissionsMeanEverything(["members:view-members"]), false);
+});
+
+test("THE OUTAGE STAYS IMPOSSIBLE: the 34 console strings are still refused", () => {
+  /*
+   * The one case a literal "superset-or-equal" rule would have let through.
+   * Production holds exactly this list TODAY, so an equal-set write is the
+   * outage being re-saved, not a widening. Refused from both states.
+   */
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, CONSOLE_SAVE),
+    /shared by every client/,
+  );
+  assert.throws(
+    () => refuseSharedClientTemplate(ORG_OWNER, CONSOLE_SAVE),
+    /shared by every client/,
+  );
+});
+
+test("NARROWING: a strict subset of what the template holds is refused", () => {
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, CONSOLE_SAVE.slice(0, 10)),
+    /shared by every client/,
+  );
+  // and a single-string list, the narrowest write there is
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, ["members:view-members"]),
+    /shared by every client/,
+  );
+});
+
+test("a strict SUPERSET is refused too — nothing may author a template's list", () => {
+  // Deliberately tighter than "superset-or-equal": no editor draws the client
+  // catalogue for an org-less role, so a hand-built list is a guess.
+  assert.throws(
+    () =>
+      refuseSharedClientTemplate(BROKEN, [
+        ...CONSOLE_SAVE,
+        "members:view-members",
+      ]),
+    /shared by every client/,
+  );
+});
+
+test("a DELETE presents no list, so the refusal is unchanged", () => {
+  // `deleteRole`/`deleteWithReassignments` call the gate with two arguments.
+  assert.throws(() => refuseSharedClientTemplate(BROKEN), /shared by every client/);
+  assert.throws(
+    () => refuseSharedClientTemplate(BROKEN, null),
+    /shared by every client/,
+  );
+});
+
+test("POSITIVE CONTROL: an org-scoped role is untouched in BOTH directions", () => {
+  const client = {
+    type: "organization",
+    org: "6512ab",
+    permissions: ["members:view-members", "roles-and-permissions:add-role"],
+  };
+
+  // widening
+  assert.equal(refuseSharedClientTemplate(client, ["*"]), false);
+  assert.equal(refuseSharedClientTemplate(client, []), false);
+  // narrowing — a client's own editor takes modules away every day
+  assert.equal(refuseSharedClientTemplate(client, ["members:view-members"]), false);
+  assert.equal(refuseSharedClientTemplate(client, []), false);
+  // and a delete
+  assert.equal(refuseSharedClientTemplate(client), false);
+
+  // the platform's own role, same both ways
+  const platform = { type: "admin", org: "", permissions: CONSOLE_SAVE };
+  assert.equal(refuseSharedClientTemplate(platform, ["*"]), false);
+  assert.equal(refuseSharedClientTemplate(platform, CONSOLE_SAVE.slice(0, 3)), false);
+});
+
+test("POSITIVE CONTROL: the refusal still bites — the exception is not a hole", () => {
+  /*
+   * If the restore arm were reachable for any list, every assertion above would
+   * pass vacuously. Count what is actually refused out of a realistic spread.
+   */
+  const writes = [
+    CONSOLE_SAVE,
+    CONSOLE_SAVE.slice(0, 10),
+    ["members:view-members"],
+    [...CONSOLE_SAVE, "members:view-members"],
+    ["organizations:see-all-organizations"],
+    undefined,
+  ];
+
+  let refused = 0;
+  for (const next of writes) {
+    try {
+      refuseSharedClientTemplate(BROKEN, next);
+    } catch {
+      refused += 1;
+    }
+  }
+
+  assert.equal(refused, 6, "every non-restore write must still be refused");
+  assert.equal(refuseSharedClientTemplate(BROKEN, ["*"]), true);
+});
+
+test("a client editor STILL cannot grant a platform resource after all this", () => {
+  // The other half of the guard is untouched by the restore path.
+  assert.throws(
+    () =>
+      requireNoPlatformGrant(
+        { type: "organization", org: "6512ab", permissions: [] },
+        ["organizations:see-all-organizations"],
+      ),
+    /Seven365 console permissions/,
+  );
+  // and the restore itself carries no platform string, so it passes this gate
+  assert.doesNotThrow(() => requireNoPlatformGrant(BROKEN, ["*"]));
+  assert.doesNotThrow(() => requireNoPlatformGrant(BROKEN, []));
+});

package/test/role-scope.test.mjs

@@ -185,14 +185,26 @@ test("the write gate refuses a shared client template before anything else", ()
   const helper = controller.slice(
     controller.indexOf("async function requireRoleWrite"),
   );
-  const body = helper.slice(0, 500);
-
-  const refuse = body.indexOf("refuseSharedClientTemplate(role)");
+  // 900, not 500: the gate carries a comment explaining why the restore is
+  // reported only after the console check.
+  const body = helper.slice(0, 900);
+
+  // Matched without the closing paren on purpose: the gate now hands the
+  // proposed permission list in as a second argument (the restore path), and
+  // the property this test exists to hold is the ORDER, not the arity.
+  const refuse = body.indexOf("refuseSharedClientTemplate(role");
   const fallthrough = body.indexOf("requireRoleOrg(req");
 
   assert.ok(refuse !== -1, "requireRoleWrite must refuse shared templates");
   assert.ok(fallthrough !== -1, "and must still apply the org rule to the rest");
   assert.ok(refuse < fallthrough, "the refusal must come first");
+
+  // The restore is only reachable AFTER the console gate has run, so a
+  // non-staff caller can never take it.
+  assert.ok(
+    body.indexOf("return isTemplateRestore") > fallthrough,
+    "a restore must not be reported before the authorization check",
+  );
 });
 
 test("the permission-writing paths refuse a platform grant", () => {