@7365admin1/core 3.61.0 → 3.62.0

package/test/repair-client-template-permissions.test.mjs

@@ -0,0 +1,331 @@
+/*
+ * The 2026-09-07 repair tool -- what it will and will not touch.
+ *
+ * "Org Owner" is org-less and `type: "organization"`, so every client invited
+ * with it shares the one document. A console save wrote the 34 PLATFORM
+ * permission strings onto it and not one client module. An empty list means
+ * everything, so it granted everything right up to that save and nothing
+ * afterwards -- 123 live members and 322 invitations, all at once.
+ *
+ * The cause is closed at both ends. The document was never put back. This tool
+ * puts it back, and these tests are the whole of its judgement: `planRepair` is
+ * pure, so what it decides is exactly what is asserted here.
+ *
+ * The danger in a repair tool is not that it fails; it is that it repairs
+ * something it should not have. Most of what follows is about what it REFUSES.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  planRepair,
+  isPlatformOnly,
+  PLATFORM_ONLY_RESOURCES,
+} from "../tools/repair-client-template-permissions/repair.mjs";
+
+// The multi-entry tsup build nests by source folder and emits `.mjs`, so this
+// path is `./.build/utils/…`, not `./.build/…`. Getting it wrong fails to
+// RESOLVE, which reads exactly like the assertion failing.
+import { PLATFORM_ONLY_PERMISSIONS } from "./.build/utils/role-scope.util.mjs";
+
+const ID = "69df7c8034293c971075ab97"; // the real "Org Owner" on staging
+
+/** The 34 strings the incident actually wrote, as measured on staging. */
+const PLATFORM_34 = [
+  "organizations:see-all-organizations",
+  "organizations:see-organization-details",
+  "promo-codes:create-promo-code",
+  "promo-codes:see-promo-code-details",
+  "promo-codes:edit-promo-code-details",
+  "promo-codes:change-promo-code-status",
+  "promo-codes:delete-promo-code",
+  "users:see-all-users",
+  "users:see-user-details",
+  "invitations:create-invitation",
+  "invitations:view-invitations",
+  "invitations:cancel-invitation",
+  "subscriptions:see-all-subscriptions",
+  "subscriptions:see-subscription-details",
+  "subscriptions:manage-subscription",
+  "sp-approvals:see-all-sp-approvals",
+  "sp-approvals:approve-sp",
+  "sp-approvals:reject-sp",
+  "sp-approvals:delete-sp-approval",
+  "marketplace-vendors:see-all-marketplace-vendors",
+  "marketplace-vendors:see-marketplace-vendor-details",
+  "platform-terms:see-platform-terms",
+  "platform-terms:edit-platform-terms",
+  "activity-history:see-activity-history",
+  "members:view-members",
+  "members:assign-member-role",
+  "members:suspend-member",
+  "members:activate-member",
+  "members:delete-member",
+  "roles-and-permissions:add-role",
+  "roles-and-permissions:see-all-roles",
+  "roles-and-permissions:see-role-details",
+  "roles-and-permissions:delete-role",
+  "roles-and-permissions:update-role",
+];
+
+/* ── the drift guard ──────────────────────────────────────────────────── */
+
+test("the tool's platform-only resources match role-scope.util.ts exactly", () => {
+  /*
+   * The tool duplicates the list so it runs with no build step. If the two ever
+   * disagree, the tool either misses a corrupt role or -- much worse -- judges
+   * an ordinary client role corrupt and rewrites it. This is the test that
+   * stops that, and it reads the SHIPPED source of truth, not a copy.
+   */
+  const fromSource = new Set(
+    [...PLATFORM_ONLY_PERMISSIONS].map((p) => String(p).split(":")[0]),
+  );
+  assert.deepEqual(
+    [...PLATFORM_ONLY_RESOURCES].sort(),
+    [...fromSource].sort(),
+    "the tool's resource list has drifted from role-scope.util.ts",
+  );
+});
+
+test("the four shared resource names are NOT treated as platform-only", () => {
+  // `users`, `invitations`, `members` and `roles-and-permissions` exist in BOTH
+  // catalogues. Treating them as platform-only would classify a perfectly
+  // ordinary client role as corrupt and rewrite it. This is the single most
+  // dangerous mistake this tool could make.
+  for (const shared of ["users", "invitations", "members", "roles-and-permissions"]) {
+    assert.equal(
+      isPlatformOnly(`${shared}:anything`),
+      false,
+      `${shared} must not count as platform-only`,
+    );
+  }
+});
+
+/* ── what it repairs ──────────────────────────────────────────────────── */
+
+test("the real Org Owner document is REPORTED, never repaired unasked", () => {
+  // 19 of its 34 strings are platform-only; the other 15 are on the four SHARED
+  // resource names. Either way it is not repaired without a person naming it.
+  const plan = planRepair({
+    _id: ID,
+    name: "Org Owner",
+    type: "organization",
+    org: "",
+    permissions: PLATFORM_34,
+  });
+
+  assert.equal(plan.payload, undefined, "a mixed list must never be rewritten silently");
+  assert.equal(plan.review, true, "it must be raised for a human");
+  assert.match(plan.skip, /19 platform string\(s\) of 34/);
+});
+
+test("even an ENTIRELY-platform list is not repaired on the tool's own judgement", () => {
+  /*
+   * This is the correction the staging dry run forced. The first version
+   * repaired this case automatically, and over the real 462 roles that rule
+   * wanted to hand "Sub Member" -- one platform string, no holders -- the run
+   * of the whole platform. Restoring to `["*"]` asserts the role granted
+   * everything BEFORE the save, and no document says that. A person asserts it.
+   */
+  const purePlatform = PLATFORM_34.filter((p) => isPlatformOnly(p));
+  assert.equal(purePlatform.length, 19, "control: the fixture must be non-trivial");
+
+  const plan = planRepair({
+    _id: ID, name: "Sub Member", type: "organization", org: "",
+    permissions: purePlatform,
+  });
+
+  assert.equal(plan.payload, undefined);
+  assert.equal(plan.review, true);
+});
+
+/* ── what it refuses ──────────────────────────────────────────────────── */
+
+test("it never touches a role that belongs to one organisation", () => {
+  const plan = planRepair({
+    _id: ID,
+    type: "organization",
+    org: "692132394150ca6a69b9f298",
+    permissions: PLATFORM_34.filter(isPlatformOnly),
+  });
+  assert.match(plan.skip, /belongs to one organisation/);
+});
+
+test("it never touches a Seven365 staff role - those SHOULD hold platform strings", () => {
+  const plan = planRepair({
+    _id: ID,
+    type: "admin",
+    org: "",
+    permissions: PLATFORM_34.filter(isPlatformOnly),
+  });
+  assert.match(plan.skip, /platform staff role/);
+});
+
+test("a role already granting everything is left alone, both spellings", () => {
+  const empty = planRepair({ _id: ID, type: "organization", org: "", permissions: [] });
+  assert.match(empty.skip, /empty list/);
+
+  const star = planRepair({ _id: ID, type: "organization", org: "", permissions: ["*"] });
+  assert.match(star.skip, /wildcard/);
+});
+
+test("an ordinary client template is left alone", () => {
+  const plan = planRepair({
+    _id: ID,
+    name: "Site Member",
+    type: "organization",
+    org: "",
+    permissions: ["visitor-mgmt:see-all-visitor", "work-order:see-all-work-orders"],
+  });
+  assert.match(plan.skip, /holds no platform strings/);
+});
+
+test("it fails closed on anything it cannot read", () => {
+  assert.match(planRepair(null).skip, /no usable id/);
+  assert.match(planRepair({ _id: "not-an-id" }).skip, /no usable id/);
+  assert.match(
+    planRepair({ _id: ID, type: "organization", org: "", permissions: null }).skip,
+    /unreadable/,
+  );
+});
+
+test("the repair is idempotent - a repaired role plans nothing on a second run", () => {
+  const role = {
+    _id: ID,
+    type: "organization",
+    org: "",
+    permissions: PLATFORM_34.filter(isPlatformOnly),
+  };
+  const first = planRepair(role, [ID]);
+  assert.ok(first.payload);
+
+  const after = { ...role, permissions: first.payload.permissions };
+  assert.equal(planRepair(after, [ID]).payload, undefined);
+  assert.match(planRepair(after, [ID]).skip, /wildcard/);
+});
+
+/* ── the human opt-in ─────────────────────────────────────────────────── */
+
+test("a role is repaired only when a human names that exact id", () => {
+  /*
+   * This is how the real "Org Owner" gets repaired. Nothing in the document
+   * proves what it held before the save, so the tool will not decide -- but a
+   * person who has read it can, and naming the id is that decision recorded on
+   * the command line rather than assumed in code.
+   */
+  const role = {
+    _id: ID,
+    name: "Org Owner",
+    type: "organization",
+    org: "",
+    permissions: PLATFORM_34,
+  };
+
+  assert.equal(planRepair(role).payload, undefined, "unnamed: refused");
+
+  const named = planRepair(role, [ID]);
+  assert.deepEqual(named.payload, { permissions: ["*"] });
+  assert.equal(named.named, true);
+  assert.equal(named.removing, 34);
+});
+
+test("naming an id does NOT unlock the refusals that protect other roles", () => {
+  // The opt-in must widen exactly one thing: "this role may be restored".
+  // Every other guard has to survive it, or "--repair-role" becomes a way to
+  // damage a role by typing its id.
+  const org = planRepair(
+    { _id: ID, type: "organization", org: "692132394150ca6a69b9f298", permissions: PLATFORM_34 },
+    [ID],
+  );
+  assert.match(org.skip, /belongs to one organisation/);
+
+  const staff = planRepair({ _id: ID, type: "admin", org: "", permissions: PLATFORM_34 }, [ID]);
+  assert.match(staff.skip, /platform staff role/);
+
+  const ordinary = planRepair(
+    { _id: ID, type: "organization", org: "", permissions: ["visitor-mgmt:see-all-visitor"] },
+    [ID],
+  );
+  assert.match(ordinary.skip, /holds no platform strings/);
+});
+
+test("naming a DIFFERENT role leaves this one refused", () => {
+  const other = "690000000000000000000001";
+  const plan = planRepair(
+    { _id: ID, type: "organization", org: "", permissions: PLATFORM_34 },
+    [other],
+  );
+  assert.equal(plan.payload, undefined);
+  assert.equal(plan.review, true);
+});
+
+/* ── the browser snippet must decide identically ──────────────────────── */
+
+/*
+ * `devtools-snippet.js` carries its own copy of the decision, because it runs
+ * pasted into a DevTools console with nothing to import. A copy that drifts
+ * from `planRepair` is the whole risk of having one, so the copy is lifted OUT
+ * of the shipped snippet here and run against the same fixtures.
+ */
+async function snippetPlanRepair() {
+  const { readFileSync, writeFileSync, mkdirSync } = await import("node:fs");
+  const { join } = await import("node:path");
+  const { pathToFileURL } = await import("node:url");
+
+  const src = readFileSync(
+    new URL("../tools/repair-client-template-permissions/devtools-snippet.js", import.meta.url),
+    "utf8",
+  );
+
+  const consts = src.match(/const PLATFORM_ONLY = \[[\s\S]*?\];/);
+  const isPlat = src.match(/const isPlatformOnly = [^\n]+\n/);
+  const hex = src.match(/const HEX24 = [^\n]+\n/);
+  const fn = src.match(/function planRepair\(role, named = \[\]\) \{[\s\S]*?\n  \}/);
+  assert.ok(consts && isPlat && hex && fn, "the snippet's decision block has moved");
+
+  const out = join(new URL("..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"), "test", ".build");
+  mkdirSync(out, { recursive: true });
+  const file = join(out, `snippet-plan-${Date.now()}.mjs`);
+  writeFileSync(
+    file,
+    [consts[0], isPlat[0], hex[0], fn[0], "export { planRepair, PLATFORM_ONLY };"].join("\n"),
+  );
+  return import(pathToFileURL(file).href);
+}
+
+test("the DevTools snippet's platform list matches the source of truth", async () => {
+  const snippet = await snippetPlanRepair();
+  const fromSource = new Set(
+    [...PLATFORM_ONLY_PERMISSIONS].map((p) => String(p).split(":")[0]),
+  );
+  assert.deepEqual([...snippet.PLATFORM_ONLY].sort(), [...fromSource].sort());
+});
+
+test("the DevTools snippet decides exactly as planRepair does", async () => {
+  const snippet = await snippetPlanRepair();
+
+  const cases = [
+    ["the real Org Owner, unnamed", { _id: ID, type: "organization", org: "", permissions: PLATFORM_34 }, []],
+    ["the real Org Owner, named", { _id: ID, type: "organization", org: "", permissions: PLATFORM_34 }, [ID]],
+    ["all-platform, unnamed", { _id: ID, type: "organization", org: "", permissions: PLATFORM_34.filter(isPlatformOnly) }, []],
+    ["a staff role", { _id: ID, type: "admin", org: "", permissions: PLATFORM_34 }, [ID]],
+    ["an org-scoped role", { _id: ID, type: "organization", org: "692132394150ca6a69b9f298", permissions: PLATFORM_34 }, [ID]],
+    ["an ordinary template", { _id: ID, type: "organization", org: "", permissions: ["visitor-mgmt:see-all-visitor"] }, [ID]],
+    ["already wildcard", { _id: ID, type: "organization", org: "", permissions: ["*"] }, [ID]],
+    ["already empty", { _id: ID, type: "organization", org: "", permissions: [] }, [ID]],
+    ["a bad id", { _id: "nope", type: "organization", org: "", permissions: PLATFORM_34 }, []],
+  ];
+
+  for (const [label, role, named] of cases) {
+    const mine = planRepair(role, named);
+    const theirs = snippet.planRepair(role, named);
+    assert.deepEqual(
+      { payload: theirs.payload, review: theirs.review ?? undefined },
+      { payload: mine.payload, review: mine.review ?? undefined },
+      `${label}: the snippet and the tool disagree`,
+    );
+  }
+
+  // CONTROL: the comparison can fail — one of these really does plan a write.
+  assert.ok(snippet.planRepair({ _id: ID, type: "organization", org: "", permissions: PLATFORM_34 }, [ID]).payload);
+});

package/test/staff-console-authz.test.mjs

@@ -108,6 +108,18 @@ const GUARDED = [
     "requirePlatformOwner",
     "_updateStatusById(",
   ],
+  // Setting a client's modules is the commercial decision Seven365 makes ABOUT
+  // a client, so it takes the STAFF gate plus the `organizations` module — not
+  // the client-reachable `update`, whose `requireOrgReach` would otherwise let
+  // a client decide its own entitlements by editing its own organisation.
+  // Owner decision 9 keeps the OWNER tier for suspend and Terms; choosing
+  // modules is "set up subscriptions" work, which is ordinary staff work.
+  [
+    "organization.controller.ts",
+    "updateModules",
+    "requireConsolePermission",
+    "_update(",
+  ],
   ["organization-v2.controller.ts", "getAll", "requireConsolePermission", "_getAll("],
   [
     "organization-v2.controller.ts",
@@ -167,7 +179,10 @@ const GUARDED = [
     "requireConsolePermission",
     "_softDeleteById(",
   ],
-  ["platform-terms.controller.ts", "add", "requireConsolePermission", "_add("],
+  // Owner decision 9 (2026-08-20): only the OWNER may publish the platform
+  // Terms and Privacy Policy. Staff identity is not enough here, and the
+  // empty-permission-list rule meant an unticked staff role could do it.
+  ["platform-terms.controller.ts", "add", "requirePlatformOwner", "_add("],
   // The acceptance record as a list - every account on the platform and
   // whether it has consented. The fourth cross-tenant read, gated like the
   // others; the per-user `getStatus` below cannot answer it.
@@ -310,8 +325,13 @@ test("platform Terms are signed by the session, never by the request body", () =
     "the author is back to being whatever the caller typed",
   );
 
-  const guard = b.search(/await requireConsolePermission\(req/);
+  // Owner decision 9: publishing platform Terms is OWNER-only, not staff, so
+  // the gate here is `requirePlatformOwner`. It still names the module as a
+  // second, narrowing condition -- the owner tier is checked first.
+  const guard = b.search(/await requirePlatformOwner\(req/);
   assert.ok(guard !== -1 && guard < b.indexOf("createdBy:"));
+  assert.match(b, /resource: "platform-terms"/);
+  assert.match(b, /action: "edit-platform-terms"/);
 });
 
 test("a promo code is removed, never deleted", () => {

package/tools/backfill-org-owner-roles/backfill.mjs

@@ -102,10 +102,40 @@ export function planForOrg(org, existingRoleCount) {
   // accept (see the test, which pins this delta on purpose).
   const owner = { org: id, name: "owner", permissions: ["*"] };
 
-  const payloads = [{ ...owner, type: "organization" }];
+  // Kept in step with `ADMINISTRATOR_PERMISSIONS` in
+  // `src/utils/org-default-roles.util.ts` -- duplicated so this tool needs no
+  // build step, and pinned by `test/backfill-org-owner-roles.test.mjs`, which
+  // compares these payloads against `defaultOwnerRoles` string for string.
+  const administrator = {
+    org: id,
+    name: "Administrator",
+    permissions: [
+      "members:view-members",
+      "members:assign-member-role",
+      "members:suspend-member",
+      "members:activate-member",
+      "members:delete-member",
+      "invitations:create-invitation",
+      "invitations:view-invitations",
+      "invitations:cancel-invitation",
+      "roles:see-all-roles",
+      "roles:see-role-details",
+      "roles:add-role",
+      "roles:update-role",
+      "roles:delete-role",
+    ],
+  };
+
+  const payloads = [
+    { ...owner, type: "organization" },
+    { ...administrator, type: "organization" },
+  ];
 
   const nature = org?.nature ?? "";
-  if (APP_SERVICE_TYPES.includes(nature)) payloads.push({ ...owner, type: nature });
+  if (APP_SERVICE_TYPES.includes(nature)) {
+    payloads.push({ ...owner, type: nature });
+    payloads.push({ ...administrator, type: nature });
+  }
 
   return { payloads };
 }

package/tools/repair-client-template-permissions/devtools-snippet.js

@@ -0,0 +1,163 @@
+/**
+ * THE 2026-09-07 REPAIR, RUN FROM A BROWSER — paste into the DevTools console of
+ * a SIGNED-IN Seven365 platform-staff session on https://org.app.iservice365.org
+ *
+ * This is the same decision as `repair.mjs` (`planRepair`, tested in
+ * `test/repair-client-template-permissions.test.mjs`), in the one place that
+ * already holds a production session. The node tool needs a `SEVEN365_SID`;
+ * your browser has one, so nobody has to move a credential anywhere to run this.
+ *
+ * It sends no Authorization header and puts no secret in a URL: the session
+ * rides as the `sid` cookie the app already set, and the app's own Nitro proxy
+ * forwards `/api/**` to API-core. That is exactly how the 2026-09-09
+ * owner-membership repair was run.
+ *
+ * ## READ THIS BEFORE THE SECOND STEP
+ *
+ * DRY RUN unless you set `APPLY` to true AND name the role ids in `REPAIR_IDS`.
+ * Two separate switches, on purpose:
+ *
+ *   - it repairs NOTHING on its own judgement. Restoring a role to `["*"]`
+ *     asserts it granted EVERYTHING before the save, and no stored document
+ *     says what it held before. Over the real 462 staging roles the earlier
+ *     "repair anything that is all-platform" rule wanted to hand "Sub Member" —
+ *     one platform string, no holders — the run of the whole platform.
+ *   - so a person reads the table, decides, and names the id. That decision is
+ *     the point, and it is what the 2026-09-07 incident did not have.
+ *
+ * Run it once with both switches untouched. Read the table. Only then come back.
+ */
+(async () => {
+  /* ─── the two switches ─────────────────────────────────────────────── */
+
+  const APPLY = false;
+
+  /**
+   * The role ids you have decided to restore, as 24-hex strings.
+   *
+   * "Org Owner" on staging is `69df7c8034293c971075ab97`. PRODUCTION WILL HAVE A
+   * DIFFERENT ID — take it from the table this prints, never from here.
+   */
+  const REPAIR_IDS = [];
+
+  /* ─── the decision, identical to planRepair ────────────────────────── */
+
+  // The same seven resources as `src/utils/role-scope.util.ts`. `users`,
+  // `invitations`, `members` and `roles-and-permissions` are deliberately NOT
+  // here: those four names exist in BOTH catalogues, so treating them as
+  // platform-only would call an ordinary client role corrupt and rewrite it.
+  const PLATFORM_ONLY = [
+    "organizations", "promo-codes", "subscriptions", "sp-approvals",
+    "marketplace-vendors", "platform-terms", "activity-history",
+  ];
+  const isPlatformOnly = (p) => PLATFORM_ONLY.includes(String(p ?? "").split(":")[0]);
+  const HEX24 = /^[0-9a-fA-F]{24}$/;
+
+  function planRepair(role, named = []) {
+    const id = String(role?._id ?? "");
+    if (!HEX24.test(id)) return { skip: "role has no usable id" };
+    if ((role?.type ?? "") === "admin") return { skip: "platform staff role" };
+    if (role?.org) return { skip: "role belongs to one organisation" };
+
+    const held = Array.isArray(role?.permissions) ? role.permissions : null;
+    if (held === null) return { skip: "permission list unreadable" };
+    if (held.length === 0) return { skip: "already grants everything (empty list)" };
+    if (held.includes("*")) return { skip: "already grants everything (wildcard)" };
+
+    const platform = held.filter(isPlatformOnly);
+    if (platform.length === 0) {
+      return { skip: "holds no platform strings - an ordinary client template" };
+    }
+    if (!named.includes(id)) {
+      return {
+        skip: `holds ${platform.length} platform string(s) of ${held.length} - needs a human to name it`,
+        review: true,
+      };
+    }
+    return { payload: { permissions: ["*"] }, removing: held.length };
+  }
+
+  /* ─── read ─────────────────────────────────────────────────────────── */
+
+  const call = async (path, init) => {
+    const res = await fetch(path, {
+      credentials: "include",
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      ...init,
+    });
+    const text = await res.text();
+    let body = null;
+    try { body = text ? JSON.parse(text) : null; } catch { body = text; }
+    return { ok: res.ok, status: res.status, body };
+  };
+
+  console.log(APPLY ? "MODE: APPLY (will write)" : "MODE: DRY RUN (writes nothing)");
+
+  // No `org` parameter, which is the ORG-LESS set — the shared client templates.
+  const listed = await call("/api/roles?limit=100");
+  if (!listed.ok) {
+    console.error(`GET /api/roles -> ${listed.status}. Are you signed in as Seven365 staff?`, listed.body);
+    return;
+  }
+
+  const roles = listed.body?.items ?? [];
+  const rows = roles.map((role) => {
+    const plan = planRepair(role, REPAIR_IDS);
+    return {
+      name: role.name,
+      id: String(role._id),
+      type: role.type,
+      permissions: Array.isArray(role.permissions) ? role.permissions.length : "?",
+      decision: plan.payload
+        ? `REPAIR -> ["*"] (removing ${plan.removing})`
+        : plan.review
+          ? `REVIEW: ${plan.skip}`
+          : `skip: ${plan.skip}`,
+    };
+  });
+
+  console.log(`org-less roles returned: ${roles.length}`);
+  console.table(rows.filter((r) => !r.decision.startsWith("skip")));
+  console.log(
+    `repairs planned: ${rows.filter((r) => r.decision.startsWith("REPAIR")).length}` +
+    ` | flagged for a human: ${rows.filter((r) => r.decision.startsWith("REVIEW")).length}` +
+    ` | untouched: ${rows.filter((r) => r.decision.startsWith("skip")).length}`,
+  );
+
+  // How many people are actually behind a flagged role — the number that decides
+  // whether this is urgent. Counted per role so nothing is inferred.
+  for (const row of rows.filter((r) => !r.decision.startsWith("skip"))) {
+    const members = await call(`/api/members?role=${row.id}&limit=1`);
+    const total = Number(String(members.body?.pageRange ?? "").split(" of ").pop());
+    console.log(`  ${row.name} (${row.id}) — live members: ${Number.isFinite(total) ? total : "unknown"}`);
+  }
+
+  if (!APPLY || !REPAIR_IDS.length) {
+    console.log(
+      "\nDRY RUN — nothing was written." +
+      "\nTo repair: copy the id of the role you have decided about into REPAIR_IDS," +
+      " set APPLY = true, and paste the whole snippet again.",
+    );
+    return;
+  }
+
+  /* ─── write ────────────────────────────────────────────────────────── */
+
+  for (const row of rows.filter((r) => r.decision.startsWith("REPAIR"))) {
+    // Re-read immediately before writing, so a role somebody repaired a second
+    // ago is skipped rather than overwritten.
+    const fresh = await call(`/api/roles/id/${row.id}`);
+    if (!fresh.ok) { console.log(`  SKIP ${row.name}: re-read ${fresh.status}`); continue; }
+
+    const recheck = planRepair(fresh.body, REPAIR_IDS);
+    if (!recheck.payload) { console.log(`  SKIP ${row.name}: ${recheck.skip} (changed since the listing)`); continue; }
+
+    const res = await call(`/api/roles/permissions/id/${row.id}`, {
+      method: "PATCH",
+      body: JSON.stringify({ permissions: ["*"] }),
+    });
+    console.log(res.ok ? `  OK   ${row.name} -> ["*"]` : `  FAIL ${row.name} -> ${res.status}`, res.ok ? "" : res.body);
+  }
+
+  console.log("\nDone. Re-run with APPLY = false to confirm the table is now clean.");
+})();