@7365admin1/core 3.59.0 → 3.59.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.59.0",
+  "version": "3.59.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/resident-self-signup-pinning.e2e.test.mjs

@@ -309,6 +309,71 @@ describe("pre-login resident sign-up cannot manufacture access", { concurrency:
     assert.equal(person?.status, "active");
     assert.equal(person?.remarks, "e2e staff may set this");
   });
+
+  // ---- a document that never uploaded is dropped, AND reported -------------
+
+  record("13. a sign-up whose document upload failed still completes", async () => {
+    // Exactly what the wizard sends after a failed upload: the file is named
+    // and listed, and has no `id` because the upload never returned one.
+    const email = "pin-unsent@e2e.example.com";
+    const res = await h.api("/people/resident/create", {
+      method: "POST",
+      body: {
+        ...genuine(id, email),
+        files: [{ name: "tenancy-agreement.pdf", mimeType: "application/pdf" }],
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.status));
+
+    const person = await stored(email);
+    assert.ok(person, "the applicant must not be lost over an attachment we never received");
+    assert.deepEqual(person.files, []);
+    // ...and the reviewer can now tell this apart from "attached nothing".
+    assert.deepEqual(person.filesNotUploaded, ["tenancy-agreement.pdf"]);
+  });
+
+  record("14. a sign-up whose uploads all landed carries no report at all", async () => {
+    const email = "pin-uploaded@e2e.example.com";
+    const fileId = new ObjectId();
+    await h.db.collection("files").insertOne({
+      _id: fileId,
+      name: "tenancy-agreement.pdf",
+      status: "draft",
+    });
+
+    const res = await h.api("/people/resident/create", {
+      method: "POST",
+      body: {
+        ...genuine(id, email),
+        files: [{ id: fileId.toString(), name: "tenancy-agreement.pdf", mimeType: "application/pdf" }],
+      },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.status));
+
+    const person = await stored(email);
+    assert.equal(person.files?.length, 1);
+    assert.equal(person.files[0].id?.toString(), fileId.toString());
+    // Absent, not empty: a normal registration is written exactly as before.
+    assert.equal("filesNotUploaded" in person, false);
+    // And the document was linked - its status flipped out of draft.
+    const file = await h.db.collection("files").findOne({ _id: fileId });
+    assert.equal(file.status, "active");
+  });
+
+  record("15. the caller cannot plant the report itself", async () => {
+    const email = "pin-planted@e2e.example.com";
+    const res = await h.api("/people/resident/create", {
+      method: "POST",
+      body: { ...genuine(id, email), filesNotUploaded: ["planted-by-the-caller.pdf"] },
+    });
+
+    assert.equal(res.status, 201, JSON.stringify(res.status));
+
+    const person = await stored(email);
+    assert.equal("filesNotUploaded" in person, false);
+  });
 });
 
 async function seed(h) {

package/test/self-signup-files.test.mjs

@@ -0,0 +1,276 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import {
+  dropUnsentFiles,
+  unsentFileNames,
+  MAX_UNSENT_FILE_NAMES,
+  MAX_UNSENT_FILE_NAME_LENGTH,
+} from "./.build/utils/self-signup-files.util.mjs";
+import { schemaResidentSelfSignUp, schemaPerson, MPerson } from "./.build/models/person.model.mjs";
+
+/**
+ * Resident sign-up outage, 2026-09-08.
+ *
+ * A document whose upload failed stays in the app's list with no `id`
+ * (`UserDocumentStep.tsx:83-85` swallows the error), the wizard sends it, and
+ * `schemaFiles.id.required()` 400s the WHOLE registration with
+ * `"files[0].id" is required`. Measured against production: a body with no
+ * `files` reached the write, the same body with one id-less entry died at Joi.
+ * The resident sees nothing, because `createUser.tsx:458` only logs it.
+ *
+ * These pin the fix and, just as importantly, pin that it is STRICTLY WIDENING:
+ * everything that validated before still validates, identically.
+ */
+
+// A body that is otherwise a perfectly good registration.
+const base = () => ({
+  name: "Resident Test",
+  email: "resident@example.com",
+  password: "not-a-real-password",
+  type: "resident",
+  isOwner: true,
+  site: "0123456789abcdef01234567",
+  unit: "0123456789abcdef01234568",
+});
+
+const validFile = { id: "0123456789abcdef01234569", name: "ic-front.jpg", mimeType: "image/jpeg" };
+// What the app sends after a failed upload: named, listed, and never uploaded.
+const unsentFile = { name: "SEVEN365_Company_Profile_2026.pdf", mimeType: "application/pdf" };
+
+const selfSignUp = (body) => schemaResidentSelfSignUp.validate(body, { abortEarly: false, stripUnknown: true });
+
+test("the outage: a registration whose ONLY defect is an id-less file now goes through", () => {
+  const broken = { ...base(), files: [unsentFile] };
+
+  // Exactly the failure the owner's residents hit, before the fix.
+  const before = selfSignUp(broken);
+  assert.match(before.error?.message ?? "", /"files\[0\]\.id" is required/);
+
+  const after = selfSignUp(dropUnsentFiles(broken));
+  assert.equal(after.error, undefined);
+  // The applicant is kept, the attachment we never received is not.
+  assert.deepEqual(after.value.files, []);
+  assert.equal(after.value.email, "resident@example.com");
+});
+
+test("a valid file id is still linked, byte for byte, in the same order", () => {
+  const second = { id: "0123456789abcdef0123456a", name: "ic-back.jpg", mimeType: "image/jpeg" };
+  const body = { ...base(), files: [validFile, second] };
+
+  const { error, value } = selfSignUp(dropUnsentFiles(body));
+
+  assert.equal(error, undefined);
+  assert.deepEqual(value.files, [validFile, second]);
+  // Nothing was reordered or rewritten - this is what the status-flip loop reads.
+  assert.equal(value.files[0].id, validFile.id);
+  assert.equal(value.files[1].id, second.id);
+});
+
+test("a mixed list keeps every real upload and drops only the failed one", () => {
+  const body = { ...base(), files: [validFile, unsentFile] };
+
+  const { error, value } = selfSignUp(dropUnsentFiles(body));
+
+  assert.equal(error, undefined);
+  assert.deepEqual(value.files, [validFile]);
+});
+
+test("a body with no files key is returned completely unchanged", () => {
+  const body = base();
+  const out = dropUnsentFiles(body);
+
+  assert.deepEqual(out, body);
+  // Not `files: undefined` - the key must not appear at all, or a later
+  // `"files" in body` check silently changes meaning.
+  assert.equal("files" in out, false);
+  assert.equal(selfSignUp(out).error, undefined);
+});
+
+test("a files value that is not an array is handed to the schema untouched", () => {
+  // `null` is explicitly allowed by the schema and must stay allowed; a string
+  // is not, and must still be refused by Joi rather than quietly swallowed here.
+  assert.equal(dropUnsentFiles({ ...base(), files: null }).files, null);
+  assert.equal(selfSignUp(dropUnsentFiles({ ...base(), files: null })).error, undefined);
+
+  assert.equal(dropUnsentFiles({ ...base(), files: "nonsense" }).files, "nonsense");
+  assert.match(selfSignUp(dropUnsentFiles({ ...base(), files: "nonsense" })).error?.message ?? "", /files/);
+});
+
+test("an empty files array stays an empty files array", () => {
+  const { error, value } = selfSignUp(dropUnsentFiles({ ...base(), files: [] }));
+  assert.equal(error, undefined);
+  assert.deepEqual(value.files, []);
+});
+
+test("the input body is not mutated", () => {
+  const body = { ...base(), files: [unsentFile] };
+  dropUnsentFiles(body);
+  assert.deepEqual(body.files, [unsentFile]);
+});
+
+test("the authenticated staff path is untouched - schemaPerson still refuses an id-less file", () => {
+  const staffBody = {
+    name: "Added By Staff",
+    email: "staff-added@example.com",
+    type: "resident",
+    site: "0123456789abcdef01234567",
+    files: [unsentFile],
+  };
+
+  // schemaPerson is what `add()` uses when there IS a caller. A staff client
+  // sending a file with no id is a bug in that client, and stays a 400.
+  assert.match(schemaPerson.validate(staffBody, { abortEarly: false }).error?.message ?? "", /"files\[0\]\.id" is required/);
+  // And it is refused for the same reason with the util applied, proving the
+  // util is not reachable from that path by accident.
+  assert.equal(schemaPerson.validate(staffBody, { abortEarly: false }).error !== undefined, true);
+});
+
+/**
+ * The decision above is pure. What it cannot show is the WIRING: constructing
+ * the controller opens a live Mongo handle, so the only way to prove the filter
+ * runs on the self-signup path - and ONLY there - is to assert the source.
+ */
+const controller = readFileSync(
+  fileURLToPath(new URL("../src/controllers/person.controller.ts", import.meta.url)),
+  "utf8",
+);
+
+test("the filter runs on the self-signup path, before validation, and nowhere else", () => {
+  const selfSignUpFn = controller.slice(
+    controller.indexOf("async function addResidentSelfSignUp"),
+    controller.indexOf("async function add("),
+  );
+  assert.ok(selfSignUpFn.length > 0, "addResidentSelfSignUp was renamed or moved");
+
+  const dropAt = selfSignUpFn.indexOf("dropUnsentFiles(req.body)");
+  const validateAt = selfSignUpFn.indexOf("schemaResidentSelfSignUp.validate(");
+  assert.ok(dropAt > -1, "self-signup no longer drops unsent files");
+  assert.ok(validateAt > dropAt, "unsent files must be dropped BEFORE validation, or the 400 is unchanged");
+  assert.match(selfSignUpFn, /schemaResidentSelfSignUp\.validate\(\s*body\s*,/);
+
+  // Exactly one call site in the whole controller. If it ever appears on the
+  // authenticated `add`/`updateById` paths, staff stop being told about a
+  // client that is silently losing their attachments.
+  assert.equal(controller.match(/dropUnsentFiles\(/g)?.length, 1);
+  // Both helpers come from that one module, whatever shape the import takes.
+  const importBlock = controller.match(/import \{[\s\S]*?\} from "\.\.\/utils\/self-signup-files\.util";/);
+  assert.ok(importBlock, "self-signup-files.util is no longer imported by the controller");
+  assert.ok(importBlock[0].includes("dropUnsentFiles"));
+  assert.ok(importBlock[0].includes("unsentFileNames"));
+});
+
+/**
+ * 2026-09-08, second report. The fix above kept the applicant, and then hid the
+ * problem: `Files:` renders empty whether the resident attached nothing or
+ * attached something we never received. The owner's own registration was
+ * APPROVED in that state, without its tenancy agreement. So the entries we drop
+ * are now recorded on the person as `filesNotUploaded`, and the console has
+ * something to show.
+ */
+
+test("what was dropped is reported, by name, in order", () => {
+  const second = { name: "vehicle-registration.pdf", mimeType: "application/pdf" };
+  const body = { ...base(), files: [validFile, unsentFile, second] };
+
+  assert.deepEqual(unsentFileNames(body), [unsentFile.name, second.name]);
+  // And the two halves agree: what is kept plus what is reported is the input.
+  assert.deepEqual(dropUnsentFiles(body).files, [validFile]);
+});
+
+test("a registration where every upload landed reports nothing", () => {
+  assert.deepEqual(unsentFileNames({ ...base(), files: [validFile] }), []);
+  assert.deepEqual(unsentFileNames({ ...base(), files: [] }), []);
+  assert.deepEqual(unsentFileNames(base()), []);
+  assert.deepEqual(unsentFileNames({ ...base(), files: null }), []);
+  assert.deepEqual(unsentFileNames({ ...base(), files: "nonsense" }), []);
+  assert.deepEqual(unsentFileNames(undefined), []);
+});
+
+test("an unnamed dropped entry still reports something a reviewer can read", () => {
+  assert.deepEqual(unsentFileNames({ files: [{ mimeType: "application/pdf" }] }), ["Unnamed document"]);
+  assert.deepEqual(unsentFileNames({ files: [{ name: "   " }] }), ["Unnamed document"]);
+  assert.deepEqual(unsentFileNames({ files: [{ name: 42 }] }), ["Unnamed document"]);
+  // A null entry is not an unsent file, it is nonsense - and must not crash.
+  assert.deepEqual(unsentFileNames({ files: [null, undefined] }), []);
+});
+
+test("the caller cannot use it as free storage: bounded in count and in length", () => {
+  const many = Array.from({ length: MAX_UNSENT_FILE_NAMES + 5 }, (_, i) => ({ name: `doc-${i}.pdf` }));
+  assert.equal(unsentFileNames({ files: many }).length, MAX_UNSENT_FILE_NAMES);
+
+  const long = unsentFileNames({ files: [{ name: "x".repeat(5000) }] });
+  assert.equal(long[0].length, MAX_UNSENT_FILE_NAME_LENGTH);
+});
+
+test("the report is display text only - it is not accepted from the caller", () => {
+  // stripUnknown means a caller who sends `filesNotUploaded` has it dropped,
+  // exactly like `status` and `platform`. Only the controller sets it.
+  const { error, value } = selfSignUp({ ...base(), filesNotUploaded: ["planted.pdf"] });
+  assert.equal(error, undefined);
+  assert.equal("filesNotUploaded" in value, false);
+
+  // But the finished payload the controller builds must survive MPerson, which
+  // runs schemaPerson over it and refuses unknown keys.
+  const finished = { ...base(), isOwner: true, status: "pending", platform: "mobile", filesNotUploaded: ["a.pdf"] };
+  assert.equal(schemaPerson.validate(finished, { abortEarly: false }).error, undefined);
+});
+
+test("the controller records the dropped names from the ORIGINAL body, and only when there are some", () => {
+  const selfSignUpFn = controller.slice(
+    controller.indexOf("async function addResidentSelfSignUp"),
+    controller.indexOf("async function add("),
+  );
+
+  assert.match(selfSignUpFn, /unsentFileNames\(req\.body\)/);
+  // Read from req.body, not from the already-filtered `body` - which would
+  // always be empty and make the whole thing a silent no-op.
+  assert.equal(selfSignUpFn.includes("unsentFileNames(body)"), false);
+  assert.match(selfSignUpFn, /filesNotUploaded: notUploaded/);
+  assert.match(selfSignUpFn, /notUploaded\.length > 0 \?/);
+
+  // Self-signup only. The authenticated staff path must not start writing it.
+  assert.equal(controller.match(/unsentFileNames\(/g)?.length, 1);
+});
+
+/**
+ * `MPerson` does not return the object it was given: it returns an explicit
+ * whitelist, and anything not named there is dropped on the way to the
+ * database. Every unit test above passed with `filesNotUploaded` never reaching
+ * Mongo at all - only the end-to-end run caught it. Pin it here so the next
+ * field added to the payload is not lost the same way.
+ */
+test("MPerson carries the report through to the document it writes", () => {
+  const person = {
+    name: "Resident Test",
+    email: "resident@example.com",
+    isOwner: true,
+    site: "0123456789abcdef01234567",
+    status: "pending",
+    platform: "mobile",
+    files: [],
+    filesNotUploaded: ["tenancy-agreement.pdf"],
+  };
+
+  assert.deepEqual(MPerson(person).filesNotUploaded, ["tenancy-agreement.pdf"]);
+});
+
+test("a person with nothing to report gets no key at all, not an undefined one", () => {
+  // A fresh object each time: MPerson rewrites `site` into an ObjectId in
+  // place, so a second call on the same literal fails on "site must be a string".
+  const person = (extra) => ({
+    name: "Resident Test",
+    email: "resident@example.com",
+    isOwner: true,
+    site: "0123456789abcdef01234567",
+    files: [],
+    ...extra,
+  });
+
+  // `filesNotUploaded: undefined` would be written into every person document
+  // ever created, on every path, which is exactly what the conditional avoids.
+  assert.equal("filesNotUploaded" in MPerson(person()), false);
+  assert.equal("filesNotUploaded" in MPerson(person({ filesNotUploaded: [] })), false);
+});