@7365admin1/core 3.64.3 → 3.64.4

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @iservice365/core
 
+## 3.64.4
+
+### Patch Changes
+
+- 3255256: Lay the groundwork for module lists becoming a gate, without narrowing anyone.
+
+  - New `utils/module-gate.util.ts`: the list of modules a client's list can
+    govern (generated from layer-common 5a96f95), the spelling groups, the
+    always-included set, and pure functions that work out which modules a
+    caller's apps must hide (`deniedModules`) and who would lose what if a list
+    changed (`moduleImpact`). Nothing calls them yet.
+  - The organisation and site module checks now treat every spelling of a module
+    as the same module (ticking `workOrder` also allows `work_orders`,
+    `work_order` and `work-orders`), and never refuse members, invitations, roles,
+    sites, customers, subscriptions, payment methods or site settings. This only
+    ever refuses less than before.
+  - A Site Settings save (`PATCH /api/sites/id/:id`) now always keeps the site's
+    stored module list. Before this, the save replaced `metadata` wholesale and
+    could wipe or overwrite that list. `PATCH /api/sites/:id/modules` is the only
+    way to change it.
+
 ## 3.64.3
 
 ### Patch Changes

package/dist/index.d.ts

@@ -7547,7 +7547,6 @@ declare function UseAccessManagementRepo(): {
         userType: string;
         type: string;
         search: string;
-        userId?: string | null;
     }) => Promise<bson.Document>;
     acknowlegdeCardRepo: (params: {
         userId: string[];

package/dist/index.js

@@ -11679,13 +11679,42 @@ function normaliseModules(modules) {
   }
   return out;
 }
+var ALWAYS_ALLOWED = Object.freeze([
+  "sites",
+  "subscriptions",
+  "customers",
+  "payment-methods",
+  "members",
+  "invitations",
+  "roles",
+  "roles-and-permissions",
+  "site-settings"
+]);
+var SPELLING_GROUPS = Object.freeze(
+  [
+    ["work_orders", "workOrder", "work_order", "work-orders"],
+    ["visitor-mgmt", "visitorManagement"],
+    ["bulletin-board", "bulletin-board-mgmt"],
+    ["facility-booking-mgmt", "facility-booking"],
+    ["feedbacks", "feedback"],
+    ["building-mgmt", "buildingManagement"],
+    ["roles", "roles-and-permissions"],
+    ["service-provider-mgmt", "service-provider"],
+    ["online-form-configuration", "online-forms"]
+  ].map((group) => Object.freeze(group))
+);
+function moduleSpellings(key) {
+  return SPELLING_GROUPS.find((group) => group.includes(key)) ?? [key];
+}
 function orgAllowsModule(modules, resource) {
   if (!Array.isArray(modules) || modules.length === 0)
     return true;
   const key = typeof resource === "string" ? resource.trim() : "";
   if (!key)
     return true;
-  return modules.includes(key);
+  if (ALWAYS_ALLOWED.includes(key))
+    return true;
+  return moduleSpellings(key).some((spelling) => modules.includes(spelling));
 }
 
 // src/models/site.model.ts
@@ -11712,7 +11741,15 @@ function rejectedSiteModules(orgModules, requested) {
   if (!narrows(orgModules))
     return [];
   const org = normaliseModules(orgModules);
-  return normaliseModules(requested).filter((key) => !org.includes(key));
+  return normaliseModules(requested).filter((key) => !orgAllowsModule(org, key));
+}
+function keepStoredSiteModules(metadata, stored) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return metadata;
+  }
+  const { modules: _sent, ...rest } = metadata;
+  const kept = stored && typeof stored === "object" && !Array.isArray(stored) ? stored.modules : void 0;
+  return kept === void 0 ? rest : { ...rest, modules: kept };
 }
 function rejectedSiteModulesMessage(rejected) {
   return `This organisation has not been given ${rejected.join(", ")}, so a site cannot offer it. Ask Seven365 to add it to the organisation first.`;
@@ -38536,8 +38573,8 @@ function useSiteController() {
       }
       const { _id, ...rest } = value;
       await requireSiteWrite(req, _id);
+      const existing = rest?.metadata ? await _getSiteById(_id) : null;
       if (rest?.metadata?.residentAppModules) {
-        const existing = await _getSiteById(_id);
         const org = existing?.orgId ? await _getOrgById(existing.orgId.toString()).catch(
           () => null
         ) : null;
@@ -38552,6 +38589,12 @@ function useSiteController() {
           return;
         }
       }
+      if (rest?.metadata) {
+        rest.metadata = keepStoredSiteModules(
+          rest.metadata,
+          existing?.metadata
+        );
+      }
       await _updateById(_id, rest);
       res.json({ message: "Successfully updated site." });
       return;
@@ -55505,7 +55548,6 @@ function UseAccessManagementRepo() {
       const type = params.type;
       const search = params.search;
       const typeFilter = type.toLowerCase() === "all" ? [] : [{ $eq: ["$type", type] }];
-      const userIdFilter = params.userId ? [{ $eq: ["$userId", new import_mongodb90.ObjectId(params.userId)] }] : [];
       const searchFilter = search ? [
         {
           $or: [
@@ -55580,7 +55622,9 @@ function UseAccessManagementRepo() {
                         { $eq: ["$isActivated", true] },
                         { $eq: ["$userType", userType] },
                         ...typeFilter,
-                        ...userIdFilter
+                        // Cards actually held by a user only - a card sitting
+                        // unassigned on the unit (`userId: null`) is left out.
+                        { $ne: ["$userId", null] }
                       ]
                     },
                     ...searchFilter[0]
@@ -70586,24 +70630,21 @@ function useAccessManagementController() {
         unitId,
         userType,
         type,
-        search = "",
-        userId = ""
+        search = ""
       } = req.query;
       const schema2 = import_joi101.default.object({
         site: import_joi101.default.string().hex().required(),
         unitId: import_joi101.default.string().hex().required(),
         userType: import_joi101.default.string().required(),
         type: import_joi101.default.string().valid("all", ...Object.values(EAccessCardTypes)).required(),
-        search: import_joi101.default.string().optional().allow("", null),
-        userId: import_joi101.default.string().hex().optional().allow("", null)
+        search: import_joi101.default.string().optional().allow("", null)
       });
       const { error } = schema2.validate({
         site,
         unitId,
         userType,
         type,
-        search,
-        userId
+        search
       });
       if (error) {
         return res.status(400).json({ message: error.message });
@@ -70615,8 +70656,7 @@ function useAccessManagementController() {
         unitId,
         userType,
         type,
-        search,
-        userId
+        search
       });
       return res.status(200).json({ message: "Success", data: result });
     } catch (error) {