@7365admin1/core 3.64.3-staging.289 → 3.64.3-staging.291

package/.changeset/member-lookup-follows-site.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+A person's role now follows the site they are on.
+
+`GET /api/members/user/:id/app/:type` accepts an optional `?site=` (a 24-hex
+site id, like `?org=`). When it is sent, the answer is the person's live
+membership of that app type pinned to that site (inside `?org=` when it is also
+sent); failing that, their organisation-wide membership in `?org=`; failing
+that, any live membership in `?org=`. When none of these exists the route
+answers exactly as before. A removed membership never wins, and a site never
+turns a found membership into "not found". Callers that do not send `site`
+see no change. Login, auth-v2 and verification are unchanged.
+
+The rule is the pure `pickSiteMembership` in `utils/member-lookup.util.ts`.

package/dist/index.d.ts

@@ -7576,7 +7576,6 @@ declare function UseAccessManagementRepo(): {
         userType: string;
         type: string;
         search: string;
-        userId?: string | null;
     }) => Promise<bson.Document>;
     acknowlegdeCardRepo: (params: {
         userId: string[];

package/dist/index.js

@@ -27886,6 +27886,27 @@ async function entitledSites(req) {
   });
 }
 
+// src/utils/member-lookup.util.ts
+var idOf2 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
+function isLiveMembership(m) {
+  return m.status !== "deleted" && !m.deletedAt;
+}
+function pickSiteMembership(rows, type, site, org = "") {
+  site = site.toLowerCase();
+  org = org.toLowerCase();
+  if (!site)
+    return null;
+  const live = rows.filter(
+    (m) => m.type === type && isLiveMembership(m) && (!org || idOf2(m.org) === org)
+  );
+  const atSite = live.find((m) => idOf2(m.siteId) === site);
+  if (atSite)
+    return atSite;
+  if (!org)
+    return null;
+  return live.find((m) => !idOf2(m.siteId)) ?? live[0] ?? null;
+}
+
 // src/controllers/member.controller.ts
 async function requireMemberOrg(req, org) {
   const orgId = org?.toString() ?? "";
@@ -27902,6 +27923,7 @@ function useMemberController() {
     getOrgsByMembership: _getOrgsByMembership,
     getByUserIdType: _getByUserIdType,
     getByUserIdTypeOrg: _getByUserIdTypeOrg,
+    getAllByUserId: _getAllByUserId,
     getById: _getMemberById,
     updateMemberStatus: _updateMemberStatus,
     updateStatusByUserId: _updateStatusByUserId,
@@ -27987,11 +28009,18 @@ function useMemberController() {
     const user = req.params.id;
     const type = req.params.type;
     const org = typeof req.query.org === "string" && /^[0-9a-fA-F]{24}$/.test(req.query.org) ? req.query.org : "";
+    const site = typeof req.query.site === "string" && /^[0-9a-fA-F]{24}$/.test(req.query.site) ? req.query.site : "";
     try {
       await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
-      const inOrg = org ? await _getByUserIdTypeOrg(user, type, org).catch(() => null) : null;
+      const atSite = site ? pickSiteMembership(
+        await _getAllByUserId(user).catch(() => []),
+        type,
+        site,
+        org
+      ) : null;
+      const inOrg = org && !atSite ? await _getByUserIdTypeOrg(user, type, org).catch(() => null) : null;
       const liveInOrg = inOrg && inOrg.status !== "deleted" && !inOrg.deletedAt ? inOrg : null;
-      const data = liveInOrg ?? await _getByUserIdType(user, type);
+      const data = atSite ?? liveInOrg ?? await _getByUserIdType(user, type);
       res.json(data);
       return;
     } catch (error2) {
@@ -56283,7 +56312,6 @@ function UseAccessManagementRepo() {
       const type = params.type;
       const search = params.search;
       const typeFilter = type.toLowerCase() === "all" ? [] : [{ $eq: ["$type", type] }];
-      const userIdFilter = params.userId ? [{ $eq: ["$userId", new import_mongodb90.ObjectId(params.userId)] }] : [];
       const searchFilter = search ? [
         {
           $or: [
@@ -56358,7 +56386,9 @@ function UseAccessManagementRepo() {
                         { $eq: ["$isActivated", true] },
                         { $eq: ["$userType", userType] },
                         ...typeFilter,
-                        ...userIdFilter
+                        // Cards actually held by a user only - a card sitting
+                        // unassigned on the unit (`userId: null`) is left out.
+                        { $ne: ["$userId", null] }
                       ]
                     },
                     ...searchFilter[0]
@@ -71417,24 +71447,21 @@ function useAccessManagementController() {
         unitId,
         userType,
         type,
-        search = "",
-        userId = ""
+        search = ""
       } = req.query;
       const schema2 = import_joi101.default.object({
         site: import_joi101.default.string().hex().required(),
         unitId: import_joi101.default.string().hex().required(),
         userType: import_joi101.default.string().required(),
         type: import_joi101.default.string().valid("all", ...Object.values(EAccessCardTypes)).required(),
-        search: import_joi101.default.string().optional().allow("", null),
-        userId: import_joi101.default.string().hex().optional().allow("", null)
+        search: import_joi101.default.string().optional().allow("", null)
       });
       const { error } = schema2.validate({
         site,
         unitId,
         userType,
         type,
-        search,
-        userId
+        search
       });
       if (error) {
         return res.status(400).json({ message: error.message });
@@ -71446,8 +71473,7 @@ function useAccessManagementController() {
         unitId,
         userType,
         type,
-        search,
-        userId
+        search
       });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {