@7365admin1/core 3.61.0 → 3.62.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.61.0",
+  "version": "3.62.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/backfill-org-owner-roles.test.mjs

@@ -58,16 +58,29 @@ test("an organisation with >= 1 role is skipped, with no exceptions", () => {
 
 // ── 3. creates exactly two, and exactly the paid path's shape ───────────────
 
-test("a role-less organisation gets exactly the two roles defaultOwnerRoles writes", () => {
+test("a role-less organisation gets exactly the roles defaultOwnerRoles writes", () => {
   for (const nature of APP_SERVICE_TYPES) {
     const { payloads } = planForOrg(org({ nature }), 0);
     const expected = defaultOwnerRoles(ORG, nature);
 
-    assert.equal(payloads.length, 2, `${nature} must plan two roles`);
-    assert.equal(expected.length, 2, `${nature}: defaultOwnerRoles must write two`);
+    // Four now, not two. The tool duplicates the permission list so it runs
+    // with no build step, and THIS is the assertion that stops the copy
+    // drifting from `ADMINISTRATOR_PERMISSIONS`: it compares string for string.
+    assert.equal(payloads.length, 4, `${nature} must plan four roles`);
+    assert.equal(expected.length, 4, `${nature}: defaultOwnerRoles must write four`);
     assert.deepEqual(payloads.map(apiShape), expected.map(apiShape), nature);
-    assert.deepEqual(payloads.map((p) => p.type), ["organization", nature]);
-    assert.deepEqual(payloads.map((p) => p.permissions), [["*"], ["*"]]);
+    assert.deepEqual(
+      payloads.map((p) => p.type),
+      ["organization", "organization", nature, nature],
+    );
+    assert.deepEqual(payloads.map((p) => p.name), [
+      "owner", "Administrator", "owner", "Administrator",
+    ]);
+    // The owner roles stay `["*"]`. That is what makes an incomplete
+    // Administrator enumeration harmless: a role granting everything is still
+    // there, so nobody can be locked out of anything by this.
+    assert.deepEqual(payloads[0].permissions, ["*"]);
+    assert.deepEqual(payloads[2].permissions, ["*"]);
   }
 
   // POSITIVE CONTROL: a wrong shape must be caught. `["*"]` is the whole point
@@ -80,11 +93,12 @@ test("a role-less organisation gets exactly the two roles defaultOwnerRoles writ
   );
 });
 
-test("a nature no app serves gets only the organization-typed role", () => {
+test("a nature no app serves gets only the organization-typed roles", () => {
   for (const nature of ["property_owner", "", null, undefined, "SECURITY_AGENCY"]) {
     const { payloads } = planForOrg(org({ nature }), 0);
     assert.deepEqual(payloads.map(apiShape), defaultOwnerRoles(ORG, nature).map(apiShape), String(nature));
-    assert.equal(payloads.length, 1);
+    assert.equal(payloads.length, 2);
+    assert.deepEqual(payloads.map((p) => p.type), ["organization", "organization"]);
   }
 });
 
@@ -123,7 +137,7 @@ test("never emits a role without a 24-hex organisation", () => {
   // ever. Prove a GOOD id still plans, and that every payload it plans really
   // does carry the org.
   const { payloads } = planForOrg(org(), 0);
-  assert.equal(payloads.length, 2);
+  assert.equal(payloads.length, 4);
   assert.ok(payloads.every((p) => p.org === ORG));
 });
 
@@ -135,18 +149,18 @@ test("a second run over the same organisations plans nothing", () => {
   // Run 1: nothing exists, so everything is planned.
   const first = orgs.map((o) => planForOrg(o, 0));
   const writtenPerOrg = first.map((p) => p.payloads.length);
-  assert.ok(writtenPerOrg.every((n) => n === 2));
+  assert.ok(writtenPerOrg.every((n) => n === 4));
 
   // Run 2: each organisation now holds what run 1 wrote.
   const second = orgs.map((o, i) => planForOrg(o, writtenPerOrg[i]));
   assert.ok(second.every((p) => p.payloads === undefined), "run 2 must plan nothing");
 
-  // A run that died mid-pair leaves ONE role. The skip rule protects it -- it
+  // A run that died mid-set leaves fewer than four. The skip rule protects it -- it
   // is not silently completed, it is reported for a human. Assert that, so the
   // behaviour is a decision and not an accident.
   assert.equal(planForOrg(org(), 1).payloads, undefined);
 
   // POSITIVE CONTROL: run 2 is only meaningfully empty because run 1 was not.
-  assert.equal(first.reduce((n, p) => n + p.payloads.length, 0), APP_SERVICE_TYPES.length * 2);
+  assert.equal(first.reduce((n, p) => n + p.payloads.length, 0), APP_SERVICE_TYPES.length * 4);
   assert.equal(second.reduce((n, p) => n + (p.payloads?.length ?? 0), 0), 0);
 });

package/test/console-permission.test.mjs

@@ -182,14 +182,39 @@ function gateCalls() {
   const calls = [];
   for (const name of CONTROLLERS) {
     const text = read(`controllers/${name}.controller.ts`);
-    for (const [call] of text.matchAll(GATE)) calls.push([name, call]);
+    for (const match of text.matchAll(GATE)) {
+      let call = match[0];
+
+      /*
+       * `GATE` stops at the newline, which is right for the one-line form and
+       * loses everything for the other one. A gate whose grant object is long
+       * enough for prettier to break it is written as
+       * `requirePlatformOwner(req, {` and then three more lines - and the
+       * captured text is just `requirePlatformOwner(req, {`, which names no
+       * module. So the check below reported as UNGOVERNED the very call that is
+       * governed most tightly.
+       *
+       * Widening `GATE` itself to run to the first `);` is not the fix: it
+       * merges adjacent single-line calls and the site count drops from 45 to
+       * 41. Only a call left OPEN at the end of its line is continued, and only
+       * as far as the `);` that closes it.
+       */
+      if (/[({,]\s*$/.test(call)) {
+        const rest = text.slice(match.index + call.length);
+        const end = rest.indexOf(");");
+        if (end !== -1) call += rest.slice(0, end + 2);
+      }
+
+      calls.push([name, call]);
+    }
   }
   return calls;
 }
 
-test("every console gate call site names a module - all 45 of them", () => {
+test("every console gate call site names a module - all 46 of them", () => {
   const calls = gateCalls();
-  assert.equal(calls.length, 45, `gate call sites moved: ${calls.length}`);
+  // 46 since `organization.controller.ts updateModules` was added.
+  assert.equal(calls.length, 46, `gate call sites moved: ${calls.length}`);
 
   const ungoverned = calls.filter(
     ([, call]) =>
@@ -206,8 +231,15 @@ test("every module string a controller names is one the catalogue can grant", ()
     const direct = call.match(
       /requireConsolePermission\(req, "([^"]+)"(?:, "([^"]+)")?/,
     );
-    const object = call.match(/resource: "([^"]+)"(?:, action: "([^"]+)")?/);
-    const [, resource, action] = direct ?? object ?? [];
+    // The object form is written across lines by prettier when the strings are
+    // long (`platform-terms` / `edit-platform-terms`), so this must not assume
+    // `resource` and `action` sit on one line with a comma between them.
+    const object = [
+      call.match(/resource: "([^"]+)"/)?.[1],
+      call.match(/action: "([^"]+)"/)?.[1],
+    ];
+    const objectMatch = object[0] ? [null, object[0], object[1]] : null;
+    const [, resource, action] = direct ?? objectMatch ?? [];
     assert.ok(resource, `${name}: ${call}`);
     assert.ok(CONSOLE_PERMISSIONS[resource], `${name}: unknown resource ${resource}`);
     if (action) {

package/test/org-default-roles.test.mjs

@@ -38,62 +38,97 @@ import {
 
 const ORG = "68b0c1d2e3f4a5b6c7d8e9f0";
 
-test("a new organisation of an app nature gets the same two roles a paid signup gets", () => {
+test("a new organisation gets the paid signup's owner pair AND an Administrator pair", () => {
   const roles = defaultOwnerRoles(ORG, "security_agency");
 
-  assert.equal(roles.length, 2, "two roles, exactly as subscription.service.ts writes");
+  assert.equal(roles.length, 4, "the two owner roles, plus an Administrator of each type");
 
   for (const role of roles) {
-    assert.equal(role.name, "owner");
-    assert.deepEqual(role.permissions, ["*"]);
-    assert.equal(role.default, true);
+    assert.equal(role.default, true, "seeded rows must not tick the onboarding checklist");
     assert.equal(role.org, ORG, "the role is scoped to the NEW organisation");
   }
 
+  const owners = roles.filter((r) => r.name === "owner");
+  const admins = roles.filter((r) => r.name === "Administrator");
+
+  assert.equal(owners.length, 2, "the owner pair subscription.service.ts writes is unchanged");
+  assert.equal(admins.length, 2);
+
+  for (const role of owners) assert.deepEqual(role.permissions, ["*"]);
+
   assert.deepEqual(
-    roles.map((r) => r.type).sort(),
+    owners.map((r) => r.type).sort(),
     ["organization", "security_agency"],
     "one organisation role and one typed by the organisation's nature",
   );
+  assert.deepEqual(
+    admins.map((r) => r.type).sort(),
+    ["organization", "security_agency"],
+    "the Administrator has to exist in BOTH type namespaces or it is invisible " +
+      "on the vertical app's member screen, which asks type=<membership type>",
+  );
+
+  for (const role of admins) {
+    assert.equal(role.permissions.length, 13);
+    // The cluster 73-82% of live client roles already carry: run your own
+    // people. Canonical spellings, so each renders as a ticked box.
+    assert.ok(role.permissions.includes("members:view-members"));
+    assert.ok(role.permissions.includes("invitations:create-invitation"));
+    assert.ok(role.permissions.includes("roles:see-all-roles"));
+    // Never an operational module -- those differ per service and the server
+    // has no vertical catalogue to enumerate them from.
+    assert.ok(!role.permissions.some((perm) => perm.startsWith("visitor")));
+    assert.ok(!role.permissions.includes("*"), "an Administrator is not an owner");
+  }
 });
 
-test("the shape matches what subscription.service.ts already writes", () => {
-  // The paid path is the only default-role story that has ever run in
-  // production. If somebody changes it, this fails rather than letting the two
-  // drift into two different definitions of "a new client's owner role".
+test("the paid signup path uses this helper rather than a copy of it", () => {
+  /*
+   * This test used to compare the helper against a hand-written block inside
+   * `createOrgSubscription`, counting `name: "owner"` and `permissions: ["*"]`
+   * in the source text. It was there because the paid path was the only
+   * default-role story that had ever run in production, and the two had to
+   * agree.
+   *
+   * Text-matching two definitions is the weaker half of that idea, and it broke
+   * the moment a THIRD role was added: the copy would have kept seeding two.
+   * The paid path now calls `defaultOwnerRoles`, so they cannot disagree at
+   * all, and this asserts the thing that actually guarantees it.
+   */
   const source = readFileSync(
     new URL("../src/services/subscription.service.ts", import.meta.url),
     "utf8",
   );
 
-  const seeding = source.slice(
-    source.indexOf("const role = await addRole("),
-    source.indexOf("await addMember("),
+  assert.ok(
+    source.includes('import { defaultOwnerRoles } from "../utils/org-default-roles.util"'),
+    "the paid path must import the shared helper",
+  );
+  assert.ok(
+    source.includes("defaultOwnerRoles(org, value.organization.nature)"),
+    "the paid path must ASK the helper for the roles, not describe its own",
   );
 
-  assert.ok(seeding.length > 0, "found the seeding block in subscription.service.ts");
+  // The membership written straight after is pointed at the FIRST role seeded,
+  // so the helper's order is part of the contract, not an incidental detail.
   assert.equal(
-    (seeding.match(/name: "owner"/g) ?? []).length,
-    2,
-    "the paid path still seeds two roles named owner",
+    defaultOwnerRoles(ORG, "security_agency")[0].type,
+    "organization",
+    "the first seeded role must be the organisation-typed owner",
   );
-  assert.equal(
-    (seeding.match(/permissions: \["\*"\]/g) ?? []).length,
-    2,
-    'the paid path still seeds ["*"] on both',
+  assert.equal(defaultOwnerRoles(ORG, "security_agency")[0].name, "owner");
+
+  // POSITIVE CONTROL: the old inline shape must really be gone, or this test
+  // would pass while a second definition quietly survived next to the call.
+  const paidBlock = source.slice(
+    source.indexOf("const seeded = defaultOwnerRoles("),
+    source.indexOf("await addMember("),
   );
+  assert.ok(paidBlock.length > 0, "found the seeding block");
   assert.equal(
-    (seeding.match(/default: true/g) ?? []).length,
-    2,
-    "the paid path still seeds both as default",
-  );
-  assert.ok(
-    seeding.includes('type: "organization"'),
-    "the paid path still seeds an organisation-typed role",
-  );
-  assert.ok(
-    seeding.includes("type: value.organization.nature"),
-    "the paid path still seeds a nature-typed role",
+    (paidBlock.match(/name: "owner"/g) ?? []).length,
+    0,
+    "no hand-written role literal may remain beside the helper call",
   );
 });
 
@@ -103,9 +138,12 @@ test("a nature that is not an app seeds only the organisation role", () => {
   // can ever ask for.
   const roles = defaultOwnerRoles(ORG, "property_owner");
 
-  assert.equal(roles.length, 1);
-  assert.equal(roles[0].type, "organization");
-  assert.equal(roles[0].org, ORG);
+  assert.equal(roles.length, 2, "the organisation-typed owner and Administrator, and no more");
+  for (const role of roles) {
+    assert.equal(role.type, "organization");
+    assert.equal(role.org, ORG);
+  }
+  assert.deepEqual(roles.map((r) => r.name), ["owner", "Administrator"]);
 });
 
 test("it can never produce an org-less shared template", () => {
@@ -125,7 +163,7 @@ test("an ObjectId-like org is accepted and kept", () => {
   const oid = { toString: () => ORG };
   const roles = defaultOwnerRoles(oid, "cleaning_services");
 
-  assert.equal(roles.length, 2);
+  assert.equal(roles.length, 4);
   for (const role of roles) assert.equal(role.org, oid);
 });
 
@@ -162,12 +200,17 @@ test("every seeded role passes the 3.56.0 separation guard", () => {
   }
 });
 
-test("seeding writes both roles through the repository it is handed", async () => {
+test("seeding writes every role through the repository it is handed", async () => {
   const written = [];
   await seedDefaultOrgRoles(async (role) => written.push(role), ORG, "security_agency");
 
-  assert.equal(written.length, 2);
-  assert.deepEqual(written.map((r) => r.type).sort(), ["organization", "security_agency"]);
+  assert.equal(written.length, 4);
+  assert.deepEqual(written.map((r) => r.type).sort(), [
+    "organization", "organization", "security_agency", "security_agency",
+  ]);
+  assert.deepEqual(written.map((r) => r.name), [
+    "owner", "Administrator", "owner", "Administrator",
+  ]);
 });
 
 test("a seeding failure never fails the request that created the organisation", async () => {

package/test/org-modules.test.mjs

@@ -0,0 +1,162 @@
+/*
+ * WHICH MODULES SEVEN365 HAS GIVEN A CLIENT.
+ *
+ * Owner brief 2026-09-09: "Seven365 will give the modules that they only need
+ * on the application/services that they want." Nothing expressed that - a plan
+ * is a name and a price, and which modules a client reaches is decided by which
+ * app somebody logs into. So every client's role editor offers the same
+ * 127-entry catalogue whether they bought one service or seven.
+ *
+ * The whole risk in this feature is the DEFAULT. Every one of the 168 live
+ * organisations has no `modules` field, so a reading of "absent means nothing"
+ * empties the role catalogue for all of them on deploy. Most of what follows is
+ * about absent, empty, and every other way this could fail closed when it must
+ * fail open.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+import {
+  normaliseModules,
+  orgAllowsModule,
+  catalogueForOrg,
+  MODULE_KEY,
+} from "./.build/utils/org-modules.util.mjs";
+
+const CATALOGUE = {
+  "visitor-mgmt": { "see-all-visitor": {}, "add-visitor": {} },
+  "facility-mgmt": { "add-facility": {} },
+  "nfc-patrol": { "see-all-patrols": {} },
+  workOrder: { "create-work-order": {} },
+};
+
+/* ── absent and empty mean EVERYTHING ─────────────────────────────────── */
+
+test("absent, empty, null and a non-array all mean EVERYTHING", () => {
+  // If any one of these meant "nothing", deploying this would empty the role
+  // catalogue for all 168 live organisations at once.
+  for (const modules of [undefined, null, [], "visitor-mgmt", 0, {}, NaN]) {
+    assert.equal(orgAllowsModule(modules, "visitor-mgmt"), true, String(modules));
+    assert.equal(
+      catalogueForOrg(CATALOGUE, modules),
+      CATALOGUE,
+      "the catalogue must come back UNCHANGED, not a rebuilt copy",
+    );
+  }
+});
+
+test("a list that matches nothing shows the WHOLE catalogue, not an empty one", () => {
+  /*
+   * A blank role editor is indistinguishable from a broken screen, and the
+   * likeliest cause of matching nothing is a console typo or a catalogue whose
+   * resource keys were renamed. Neither should take the editor away.
+   */
+  const narrowed = catalogueForOrg(CATALOGUE, ["not-a-real-module", "also-not"]);
+  assert.deepEqual(Object.keys(narrowed).sort(), Object.keys(CATALOGUE).sort());
+});
+
+test("an unreadable resource key is shown, never hidden", () => {
+  for (const resource of [undefined, null, "", "   ", 42]) {
+    assert.equal(orgAllowsModule(["visitor-mgmt"], resource), true, String(resource));
+  }
+});
+
+/* ── what it actually narrows ─────────────────────────────────────────── */
+
+test("a real list narrows the catalogue to exactly those modules", () => {
+  const narrowed = catalogueForOrg(CATALOGUE, ["visitor-mgmt", "workOrder"]);
+
+  assert.deepEqual(Object.keys(narrowed).sort(), ["visitor-mgmt", "workOrder"]);
+  // The actions inside a kept module are untouched, not rebuilt.
+  assert.equal(narrowed["visitor-mgmt"], CATALOGUE["visitor-mgmt"]);
+  // CONTROL: the assertion can fail - the dropped ones really were in there.
+  assert.ok(CATALOGUE["facility-mgmt"]);
+  assert.equal(narrowed["facility-mgmt"], undefined);
+});
+
+test("matching is exact, so a prefix cannot pull in a sibling module", () => {
+  // `visitor-mgmt` must not admit `visitor-mgmt-extra`, and `nfc` must not
+  // admit `nfc-patrol`. A loose match here quietly widens what Seven365 sold.
+  assert.equal(orgAllowsModule(["visitor-mgmt"], "visitor-mgmt-extra"), false);
+  assert.equal(orgAllowsModule(["nfc"], "nfc-patrol"), false);
+  assert.equal(orgAllowsModule(["nfc-patrol"], "nfc-patrol"), true);
+});
+
+/* ── the shape it accepts ─────────────────────────────────────────────── */
+
+test("normalise trims, de-duplicates and keeps order", () => {
+  assert.deepEqual(
+    normaliseModules([" visitor-mgmt ", "workOrder", "visitor-mgmt", "workOrder"]),
+    ["visitor-mgmt", "workOrder"],
+  );
+});
+
+test("normalise drops anything that is not a module key", () => {
+  assert.deepEqual(
+    normaliseModules(["visitor-mgmt", "", "   ", null, 7, {}, "has space", "-leading"]),
+    ["visitor-mgmt"],
+  );
+  assert.deepEqual(normaliseModules(null), []);
+  assert.deepEqual(normaliseModules("visitor-mgmt"), []);
+});
+
+test("the key shape accepts every spelling the real catalogues use", () => {
+  // Taken from the shipped catalogues: kebab, camel and snake all occur.
+  for (const key of [
+    "visitor-mgmt", "workOrder", "work_orders", "access-card-mgmt",
+    "nfc-patrol", "blocklist", "SOA-mgmt", "roles", "members",
+  ]) {
+    assert.ok(MODULE_KEY.test(key), key);
+  }
+  for (const bad of ["", " ", "-starts-with-dash", "has space", "a".repeat(65)]) {
+    assert.ok(!MODULE_KEY.test(bad), bad);
+  }
+});
+
+/* ── the endpoint, and the one it must NOT be part of ─────────────────── */
+
+const CONTROLLER = readFileSync(
+  new URL("../src/controllers/organization.controller.ts", import.meta.url),
+  "utf8",
+);
+
+function handler(name) {
+  const start = CONTROLLER.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `handler ${name} is gone`);
+  const next = CONTROLLER.indexOf("\n  async function ", start + 1);
+  return CONTROLLER.slice(start, next === -1 ? undefined : next);
+}
+
+test("setting a client's modules takes the CONSOLE gate", () => {
+  const body = handler("updateModules");
+  assert.match(body, /await requireConsolePermission\(req, "organizations"\)/);
+  // The write must name only `modules`. Anything else and this becomes a second
+  // way to edit an organisation, with a different gate from the first.
+  assert.match(body, /_update\(orgId, \{ modules \}\)/);
+});
+
+test("the CLIENT-reachable update still cannot set modules", () => {
+  /*
+   * `update` is `requireOrgReach` on purpose - a new owner fills in their own
+   * organisation during onboarding before any membership exists. If `modules`
+   * were in ITS whitelist, a client could decide its own entitlements by
+   * editing its own organisation. This is the assertion that keeps the two
+   * endpoints apart.
+   */
+  const body = handler("update");
+  assert.match(body, /await requireOrgReach\(req, id\)/, "control: still the client path");
+  assert.ok(
+    !/modules/.test(body),
+    "the client-reachable update must not mention modules at all",
+  );
+});
+
+test("the change is recorded, with the list readable in the row", () => {
+  const body = handler("updateModules");
+  assert.match(body, /ConsoleAuditAction\.CLIENT_MODULES_CHANGED/);
+  // An ARRAY is dropped by `auditValue`, which would leave a row saying a change
+  // happened without saying what to. It is joined into a string on purpose.
+  assert.match(body, /modules: modules\.join\(", "\)/);
+  assert.match(body, /moduleCount: modules\.length/);
+});

package/test/org-role-selfheal.test.mjs

@@ -96,25 +96,30 @@ function fakeWorld({
   };
 }
 
-test("an organisation holding zero roles gets the same two roles a new one gets", async () => {
+test("an organisation holding zero roles gets the same set a new one gets", async () => {
   const world = fakeWorld();
 
   const seeded = await healOrgDefaultRoles(world.deps, ORG);
 
-  assert.equal(seeded, 2, "two roles, exactly as a paid signup writes");
-  assert.equal(world.written.length, 2);
+  assert.equal(seeded, 4, "the paid signup's owner pair, plus an Administrator of each type");
+  assert.equal(world.written.length, 4);
+  assert.deepEqual(world.written.map((r) => r.name), [
+    "owner", "Administrator", "owner", "Administrator",
+  ]);
 
-  for (const role of world.written) {
-    assert.equal(role.name, "owner");
+  for (const role of world.written.filter((r) => r.name === "owner")) {
     assert.deepEqual(role.permissions, ["*"]);
+  }
+
+  for (const role of world.written) {
     assert.equal(role.default, true, "the repository path writes `default: true`");
     assert.equal(role.org, ORG, "every seeded role carries the organisation");
   }
 
   assert.deepEqual(
     world.written.map((r) => r.type).sort(),
-    ["organization", "security_agency"],
-    "one organisation role and one typed by the organisation's nature",
+    ["organization", "organization", "security_agency", "security_agency"],
+    "an owner and an Administrator in each of the two type namespaces",
   );
 });
 
@@ -146,9 +151,9 @@ test("the count is re-read UNDER the claim, so a role created meanwhile still st
 test("a second load of the same organisation is a no-op", async () => {
   const world = fakeWorld();
 
-  assert.equal(await healOrgDefaultRoles(world.deps, ORG), 2);
+  assert.equal(await healOrgDefaultRoles(world.deps, ORG), 4);
   assert.equal(await healOrgDefaultRoles(world.deps, ORG), 0, "the claim is already held");
-  assert.equal(world.written.length, 2, "still two roles, not four");
+  assert.equal(world.written.length, 4, "still one set, not two");
 });
 
 test("two simultaneous loads of the same organisation do not create four roles", async () => {
@@ -162,10 +167,10 @@ test("two simultaneous loads of the same organisation do not create four roles",
 
   assert.deepEqual(
     results.sort(),
-    [0, 2],
+    [0, 4],
     "exactly one caller seeded; the other did nothing at all",
   );
-  assert.equal(world.written.length, 2, "two roles in total, not four");
+  assert.equal(world.written.length, 4, "one set in total, not two");
 });
 
 test("ten simultaneous loads still produce exactly one set", async () => {
@@ -180,7 +185,7 @@ test("ten simultaneous loads still produce exactly one set", async () => {
     1,
     "one winner out of ten",
   );
-  assert.equal(world.written.length, 2);
+  assert.equal(world.written.length, 4);
 });
 
 test("it never emits an org-less role", async () => {
@@ -193,12 +198,15 @@ test("it never emits an org-less role", async () => {
   }
 });
 
-test("a nature that is not an app produces the organisation role only, still org-scoped", async () => {
+test("a nature that is not an app produces organisation-typed roles only, still org-scoped", async () => {
   const world = fakeWorld({ nature: "property_owner" });
 
-  assert.equal(await healOrgDefaultRoles(world.deps, ORG), 1);
-  assert.equal(world.written[0].type, "organization");
-  assert.equal(world.written[0].org, ORG);
+  assert.equal(await healOrgDefaultRoles(world.deps, ORG), 2);
+  assert.deepEqual(world.written.map((r) => r.name), ["owner", "Administrator"]);
+  for (const role of world.written) {
+    assert.equal(role.type, "organization");
+    assert.equal(role.org, ORG);
+  }
 });
 
 test("an insert that fails does not break the read, and gives the claim back", async () => {