@7365admin1/core 3.64.3-staging.290 → 3.64.3-staging.291

package/.changeset/member-lookup-follows-site.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": patch
+---
+
+A person's role now follows the site they are on.
+
+`GET /api/members/user/:id/app/:type` accepts an optional `?site=` (a 24-hex
+site id, like `?org=`). When it is sent, the answer is the person's live
+membership of that app type pinned to that site (inside `?org=` when it is also
+sent); failing that, their organisation-wide membership in `?org=`; failing
+that, any live membership in `?org=`. When none of these exists the route
+answers exactly as before. A removed membership never wins, and a site never
+turns a found membership into "not found". Callers that do not send `site`
+see no change. Login, auth-v2 and verification are unchanged.
+
+The rule is the pure `pickSiteMembership` in `utils/member-lookup.util.ts`.

package/dist/index.js

@@ -27886,6 +27886,27 @@ async function entitledSites(req) {
   });
 }
 
+// src/utils/member-lookup.util.ts
+var idOf2 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
+function isLiveMembership(m) {
+  return m.status !== "deleted" && !m.deletedAt;
+}
+function pickSiteMembership(rows, type, site, org = "") {
+  site = site.toLowerCase();
+  org = org.toLowerCase();
+  if (!site)
+    return null;
+  const live = rows.filter(
+    (m) => m.type === type && isLiveMembership(m) && (!org || idOf2(m.org) === org)
+  );
+  const atSite = live.find((m) => idOf2(m.siteId) === site);
+  if (atSite)
+    return atSite;
+  if (!org)
+    return null;
+  return live.find((m) => !idOf2(m.siteId)) ?? live[0] ?? null;
+}
+
 // src/controllers/member.controller.ts
 async function requireMemberOrg(req, org) {
   const orgId = org?.toString() ?? "";
@@ -27902,6 +27923,7 @@ function useMemberController() {
     getOrgsByMembership: _getOrgsByMembership,
     getByUserIdType: _getByUserIdType,
     getByUserIdTypeOrg: _getByUserIdTypeOrg,
+    getAllByUserId: _getAllByUserId,
     getById: _getMemberById,
     updateMemberStatus: _updateMemberStatus,
     updateStatusByUserId: _updateStatusByUserId,
@@ -27987,11 +28009,18 @@ function useMemberController() {
     const user = req.params.id;
     const type = req.params.type;
     const org = typeof req.query.org === "string" && /^[0-9a-fA-F]{24}$/.test(req.query.org) ? req.query.org : "";
+    const site = typeof req.query.site === "string" && /^[0-9a-fA-F]{24}$/.test(req.query.site) ? req.query.site : "";
     try {
       await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
-      const inOrg = org ? await _getByUserIdTypeOrg(user, type, org).catch(() => null) : null;
+      const atSite = site ? pickSiteMembership(
+        await _getAllByUserId(user).catch(() => []),
+        type,
+        site,
+        org
+      ) : null;
+      const inOrg = org && !atSite ? await _getByUserIdTypeOrg(user, type, org).catch(() => null) : null;
       const liveInOrg = inOrg && inOrg.status !== "deleted" && !inOrg.deletedAt ? inOrg : null;
-      const data = liveInOrg ?? await _getByUserIdType(user, type);
+      const data = atSite ?? liveInOrg ?? await _getByUserIdType(user, type);
       res.json(data);
       return;
     } catch (error2) {