@7365admin1/core 3.64.3-staging.287 → 3.64.3-staging.289

package/.changeset/member-lookup-honours-org.md

@@ -0,0 +1,17 @@
+---
+"@7365admin1/core": patch
+---
+
+Use the organisation the app asks for when loading a user's membership.
+
+Every mobile app loads its user's role through
+`GET /api/members/user/:id/app/:type?org=<org>`, and `getByUserIdType` ignored
+`org`, answering with the first membership of that app type it found. A person
+in more than one organisation could therefore be handed another organisation's
+membership in the app they were using.
+
+It now prefers a LIVE membership in the requested organisation. When there is
+none there (or only a removed one), or no valid `org` is sent, it answers exactly
+as before, so no caller that received a membership now receives "not found", and
+a removed membership never wins over a live one. Login and the other internal
+uses of the repository lookup are unchanged.

package/.changeset/module-gate-foundation.md

@@ -0,0 +1,20 @@
+---
+"@7365admin1/core": patch
+---
+
+Lay the groundwork for module lists becoming a gate, without narrowing anyone.
+
+- New `utils/module-gate.util.ts`: the list of modules a client's list can
+  govern (generated from layer-common 5a96f95), the spelling groups, the
+  always-included set, and pure functions that work out which modules a
+  caller's apps must hide (`deniedModules`) and who would lose what if a list
+  changed (`moduleImpact`). Nothing calls them yet.
+- The organisation and site module checks now treat every spelling of a module
+  as the same module (ticking `workOrder` also allows `work_orders`,
+  `work_order` and `work-orders`), and never refuse members, invitations, roles,
+  sites, customers, subscriptions, payment methods or site settings. This only
+  ever refuses less than before.
+- A Site Settings save (`PATCH /api/sites/id/:id`) now always keeps the site's
+  stored module list. Before this, the save replaced `metadata` wholesale and
+  could wipe or overwrite that list. `PATCH /api/sites/:id/modules` is the only
+  way to change it.

package/dist/index.js

@@ -11689,13 +11689,42 @@ function normaliseModules(modules) {
   }
   return out;
 }
+var ALWAYS_ALLOWED = Object.freeze([
+  "sites",
+  "subscriptions",
+  "customers",
+  "payment-methods",
+  "members",
+  "invitations",
+  "roles",
+  "roles-and-permissions",
+  "site-settings"
+]);
+var SPELLING_GROUPS = Object.freeze(
+  [
+    ["work_orders", "workOrder", "work_order", "work-orders"],
+    ["visitor-mgmt", "visitorManagement"],
+    ["bulletin-board", "bulletin-board-mgmt"],
+    ["facility-booking-mgmt", "facility-booking"],
+    ["feedbacks", "feedback"],
+    ["building-mgmt", "buildingManagement"],
+    ["roles", "roles-and-permissions"],
+    ["service-provider-mgmt", "service-provider"],
+    ["online-form-configuration", "online-forms"]
+  ].map((group) => Object.freeze(group))
+);
+function moduleSpellings(key) {
+  return SPELLING_GROUPS.find((group) => group.includes(key)) ?? [key];
+}
 function orgAllowsModule(modules, resource) {
   if (!Array.isArray(modules) || modules.length === 0)
     return true;
   const key = typeof resource === "string" ? resource.trim() : "";
   if (!key)
     return true;
-  return modules.includes(key);
+  if (ALWAYS_ALLOWED.includes(key))
+    return true;
+  return moduleSpellings(key).some((spelling) => modules.includes(spelling));
 }
 
 // src/models/site.model.ts
@@ -11722,7 +11751,15 @@ function rejectedSiteModules(orgModules, requested) {
   if (!narrows(orgModules))
     return [];
   const org = normaliseModules(orgModules);
-  return normaliseModules(requested).filter((key) => !org.includes(key));
+  return normaliseModules(requested).filter((key) => !orgAllowsModule(org, key));
+}
+function keepStoredSiteModules(metadata, stored) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return metadata;
+  }
+  const { modules: _sent, ...rest } = metadata;
+  const kept = stored && typeof stored === "object" && !Array.isArray(stored) ? stored.modules : void 0;
+  return kept === void 0 ? rest : { ...rest, modules: kept };
 }
 function rejectedSiteModulesMessage(rejected) {
   return `This organisation has not been given ${rejected.join(", ")}, so a site cannot offer it. Ask Seven365 to add it to the organisation first.`;
@@ -27949,9 +27986,12 @@ function useMemberController() {
     }
     const user = req.params.id;
     const type = req.params.type;
+    const org = typeof req.query.org === "string" && /^[0-9a-fA-F]{24}$/.test(req.query.org) ? req.query.org : "";
     try {
       await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
-      const data = await _getByUserIdType(user, type);
+      const inOrg = org ? await _getByUserIdTypeOrg(user, type, org).catch(() => null) : null;
+      const liveInOrg = inOrg && inOrg.status !== "deleted" && !inOrg.deletedAt ? inOrg : null;
+      const data = liveInOrg ?? await _getByUserIdType(user, type);
       res.json(data);
       return;
     } catch (error2) {
@@ -38724,8 +38764,8 @@ function useSiteController() {
       }
       const { _id, ...rest } = value;
       await requireSiteWrite(req, _id);
+      const existing = rest?.metadata ? await _getSiteById(_id) : null;
       if (rest?.metadata?.residentAppModules) {
-        const existing = await _getSiteById(_id);
         const org = existing?.orgId ? await _getOrgById(existing.orgId.toString()).catch(
           () => null
         ) : null;
@@ -38740,6 +38780,12 @@ function useSiteController() {
           return;
         }
       }
+      if (rest?.metadata) {
+        rest.metadata = keepStoredSiteModules(
+          rest.metadata,
+          existing?.metadata
+        );
+      }
       await _updateById(_id, rest);
       res.json({ message: "Successfully updated site." });
       return;