@7365admin1/core 3.64.0 → 3.64.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.64.0",
+  "version": "3.64.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/customer-sites-one-row-per-site.test.mjs

@@ -0,0 +1,107 @@
+/*
+ * ONE ROW PER SITE, NAMED BY THE SITE.
+ *
+ * Owner report, 2026-09-10: a provider's site list showed FOUR entries for THREE
+ * sites, and the site switcher ticked two at once. "NCC" and "Seventh
+ * Condominium" were the same site.
+ *
+ * Two faults, compounding:
+ *
+ *  1. `getAll` grouped by `{ name, site }`. A `customer-sites` row is an
+ *     ENGAGEMENT and one site can carry more than one, so two rows for the same
+ *     site with different names both survived as "distinct".
+ *  2. `name` is a SNAPSHOT from when the engagement was created. Site
+ *     `6923d666…` is named "Seventh Condominium"; its NEWER engagement row still
+ *     says "NCC". Recency is no guide — the newer row held the staler name — so
+ *     only the site record is reliable.
+ *
+ * These assertions read the shipped pipeline rather than a copy, because the
+ * defect was in the pipeline's shape, not in a helper.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const REPO = readFileSync(
+  new URL("../src/repositories/customer-site.repo.ts", import.meta.url),
+  "utf8",
+);
+
+function getAllBody() {
+  const start = REPO.indexOf("async function getAll(");
+  assert.notEqual(start, -1, "getAll is gone");
+  const next = REPO.indexOf("\n  async function ", start + 1);
+  return REPO.slice(start, next === -1 ? undefined : next);
+}
+
+test("distinct means one row per SITE, not per name-and-site", () => {
+  const body = getAllBody();
+  assert.match(body, /\$group: \{ _id: "\$site", doc: \{ \$first: "\$\$ROOT" \} \}/);
+  assert.ok(
+    !/_id: \{ name: "\$name", site: "\$site" \}/.test(body),
+    "still grouping by name AND site — a stale name makes a phantom site",
+  );
+});
+
+test("the name comes from the SITE, with the snapshot as a fallback", () => {
+  const body = getAllBody();
+  assert.match(body, /from: "sites"/);
+  assert.match(body, /localField: "site"/);
+  assert.match(body, /\$set: \{ name: \{ \$ifNull: \["\$_liveSite\.name", "\$name"\] \} \}/);
+
+  // A site that cannot be read must degrade to the stored name, never to blank.
+  assert.match(body, /preserveNullAndEmptyArrays: true/);
+  // And the joined document must not leak into the response.
+  assert.match(body, /\$unset: "_liveSite"/);
+});
+
+test("the search runs AFTER the rename, so a site is found by its real name", () => {
+  /*
+   * Matching the snapshot would hide a site under the name it actually has —
+   * searching "Seventh Condominium" would miss a row whose snapshot says "NCC".
+   */
+  const body = getAllBody();
+  const rename = body.indexOf("$ifNull");
+  const searchMatch = body.indexOf("$regex: search");
+  assert.notEqual(searchMatch, -1, "the search stage is gone");
+  assert.ok(rename < searchMatch, "the search still runs before the rename");
+
+  // It must no longer be part of the pre-aggregation query.
+  assert.ok(
+    !/query\.\$or = \[\{ name: \{ \$regex: search/.test(body),
+    "the search is back on the stored snapshot",
+  );
+});
+
+test("the final sort runs after the rename too", () => {
+  const body = getAllBody();
+  const rename = body.indexOf("$ifNull");
+  const lastSort = body.lastIndexOf("$sort: sort");
+  assert.ok(lastSort > rename, "rows are ordered by the stale name");
+});
+
+test("the count is derived from the SAME pipeline", () => {
+  /*
+   * Counting differently from the way rows are produced is how a list says
+   * "1-4 of 4" while showing three — which is exactly what the owner saw.
+   */
+  const body = getAllBody();
+  assert.match(body, /aggregate\(\[\.\.\.distinctPipeline, \{ \$count: "total" \}\]/);
+  assert.ok(
+    !/\{ \$group: \{ _id: \{ name: "\$name", site: "\$site" \} \} \},\s*\{ \$count/.test(body),
+    "the count still groups by name and site",
+  );
+});
+
+test("CONTROL: the org, status and site-scope match still runs FIRST", () => {
+  /*
+   * The scoping is the security boundary — a site-scoped caller must never see
+   * the whole estate. It has to stay ahead of everything else in the pipeline.
+   */
+  const body = getAllBody();
+  const firstMatch = body.indexOf("{ $match: query }");
+  const group = body.indexOf('$group: { _id: "$site"');
+  assert.notEqual(firstMatch, -1, "the scoping match is gone");
+  assert.ok(firstMatch < group, "scoping no longer runs before grouping");
+  assert.match(body, /query\.site = \{ \$in: scoped\.map/);
+});

package/test/role-scope.test.mjs

@@ -112,6 +112,32 @@ test("/api/roles/v2 is gated too — the same hole with /v2 on the URL", () => {
   );
 });
 
+test("/api/roles/v2 cannot mint a role holding the CONSOLE's own resources", () => {
+  /*
+   * `role.controller createRole` has carried `requireNoPlatformGrant` for a
+   * while; this mount did not. It is a separate controller behind a separate
+   * route and takes any string at all, so the hole was reachable by adding
+   * `/v2` to the URL - the same shape as the two gates above it.
+   *
+   * MEASURED BEFORE ADDING, on production, read-only: NO site-scoped role holds
+   * a platform-only string (6 site-scoped roles read; the 11 roles that do hold
+   * one are org-scoped and already covered by the v1 gate). This mount REQUIRES
+   * a `site`, so the check refuses nothing that exists today.
+   */
+  const body = fn(controllerV2, "createRole");
+  assert.match(body, /requireNoPlatformGrant\(/);
+
+  // It must run BEFORE the write, or it decides nothing.
+  const guard = body.indexOf("requireNoPlatformGrant(");
+  const write = body.indexOf("_createRole(");
+  assert.ok(guard !== -1 && write !== -1);
+  assert.ok(guard < write, "the role is created before the platform check");
+
+  // CONTROL: v1 still has it, so the assertion above is a real comparison and
+  // not a rule that only exists on one side.
+  assert.match(fn(controller, "createRole"), /requireNoPlatformGrant\(/);
+});
+
 /**
  * The four true WRITES now go through `requireRoleWrite`, which is
  * `requireRoleOrg` plus one refusal: a role with no `org` and a non-admin type