@7365admin1/core 3.64.0 → 3.64.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.64.0",
+  "version": "3.64.1",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/role-scope.test.mjs

@@ -112,6 +112,32 @@ test("/api/roles/v2 is gated too — the same hole with /v2 on the URL", () => {
   );
 });
 
+test("/api/roles/v2 cannot mint a role holding the CONSOLE's own resources", () => {
+  /*
+   * `role.controller createRole` has carried `requireNoPlatformGrant` for a
+   * while; this mount did not. It is a separate controller behind a separate
+   * route and takes any string at all, so the hole was reachable by adding
+   * `/v2` to the URL - the same shape as the two gates above it.
+   *
+   * MEASURED BEFORE ADDING, on production, read-only: NO site-scoped role holds
+   * a platform-only string (6 site-scoped roles read; the 11 roles that do hold
+   * one are org-scoped and already covered by the v1 gate). This mount REQUIRES
+   * a `site`, so the check refuses nothing that exists today.
+   */
+  const body = fn(controllerV2, "createRole");
+  assert.match(body, /requireNoPlatformGrant\(/);
+
+  // It must run BEFORE the write, or it decides nothing.
+  const guard = body.indexOf("requireNoPlatformGrant(");
+  const write = body.indexOf("_createRole(");
+  assert.ok(guard !== -1 && write !== -1);
+  assert.ok(guard < write, "the role is created before the platform check");
+
+  // CONTROL: v1 still has it, so the assertion above is a real comparison and
+  // not a rule that only exists on one side.
+  assert.match(fn(controller, "createRole"), /requireNoPlatformGrant\(/);
+});
+
 /**
  * The four true WRITES now go through `requireRoleWrite`, which is
  * `requireRoleOrg` plus one refusal: a role with no `org` and a non-admin type