@7365admin1/core 3.64.3 → 3.64.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.64.3",
+  "version": "3.64.4",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/module-gate.test.mjs

@@ -0,0 +1,237 @@
+/*
+ * THE MODULE GATE — the per-caller DENY list every app will AND at its gates.
+ *
+ * Owner decision 1B, 2026-09-11. 0 of 199 staging organisations and 0 of 254
+ * staging sites have a list, so the whole safety argument is the default: every
+ * uncertainty must deny NOTHING. A gate that fails closed here hides modules in
+ * eight codebases at once — the 2026-09-07 shape.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  ALWAYS_ALLOWED,
+  SPELLING_GROUPS,
+  GOVERNED_MODULES,
+  IMPACT_NAME_CAP,
+  expandModules,
+  deniedModules,
+  moduleImpact,
+} from "./.build/utils/module-gate.util.mjs";
+import { MODULE_KEY } from "./.build/utils/org-modules.util.mjs";
+
+const WORK_ORDERS = ["work_orders", "workOrder", "work_order", "work-orders"];
+
+/* ── absent and empty deny NOTHING ────────────────────────────────────── */
+
+test("absent, empty or unreadable at both tiers denies nothing", () => {
+  for (const org of [undefined, null, [], "visitor-mgmt", 0, {}]) {
+    for (const site of [undefined, null, [], "visitor-mgmt", 0, {}]) {
+      assert.deepEqual(deniedModules(org, site), [], `${org} / ${site}`);
+    }
+  }
+});
+
+test("an absent tier does not narrow", () => {
+  const orgOnly = deniedModules(["visitor-mgmt"], undefined);
+  const siteOnly = deniedModules(undefined, ["visitor-mgmt"]);
+  assert.deepEqual(siteOnly, orgOnly);
+  assert.ok(!orgOnly.includes("visitor-mgmt"));
+  // CONTROL: the list really does deny something.
+  assert.ok(orgOnly.includes("nfc-patrol"));
+});
+
+test("a list that allows no governed module denies nothing", () => {
+  // A typo, a renamed key, or only the always-included set: not "hide all".
+  assert.deepEqual(deniedModules(["not-a-module"], undefined), []);
+  assert.deepEqual(deniedModules(["members", "roles"], undefined), []);
+  assert.deepEqual(deniedModules(undefined, ["typo"]), []);
+});
+
+/* ── what it denies ───────────────────────────────────────────────────── */
+
+test("a spelling group is allowed as a whole", () => {
+  for (const spelling of WORK_ORDERS) {
+    const denied = deniedModules([spelling, "nfc-patrol"], undefined);
+    for (const other of WORK_ORDERS) assert.ok(!denied.includes(other), `${spelling} -> ${other}`);
+    // CONTROL: something outside the group is still denied.
+    assert.ok(denied.includes("visitor-mgmt"));
+  }
+  assert.deepEqual(expandModules(["workOrder"]).sort(), [...WORK_ORDERS].sort());
+});
+
+test("a denied group is denied under every spelling", () => {
+  const denied = deniedModules(["nfc-patrol"], undefined);
+  for (const spelling of WORK_ORDERS) assert.ok(denied.includes(spelling), spelling);
+});
+
+test("ALWAYS_ALLOWED is never denied", () => {
+  const denied = deniedModules(["nfc-patrol"], ["nfc-patrol"]);
+  assert.ok(denied.length > 0, "control: the list denies something");
+  for (const key of ALWAYS_ALLOWED) assert.ok(!denied.includes(key), key);
+});
+
+test("an unknown or ungoverned resource is never denied", () => {
+  const denied = deniedModules(["nfc-patrol"], undefined);
+  for (const key of ["dashboard", "request", "organizations", "not-a-module", "", "*"]) {
+    assert.ok(!denied.includes(key), key);
+  }
+  // Only governed keys ever come back.
+  for (const key of denied) assert.ok(GOVERNED_MODULES.includes(key), key);
+});
+
+test("both tiers present narrow to the intersection", () => {
+  const denied = deniedModules(["visitor-mgmt", "nfc-patrol"], ["nfc-patrol"]);
+  assert.ok(denied.includes("visitor-mgmt"));
+  assert.ok(!denied.includes("nfc-patrol"));
+});
+
+test("the intersection meets across spellings", () => {
+  const denied = deniedModules(["workOrder", "nfc-patrol"], ["work_orders"]);
+  for (const spelling of WORK_ORDERS) assert.ok(!denied.includes(spelling), spelling);
+  assert.ok(denied.includes("nfc-patrol"));
+});
+
+test("an EMPTY intersection falls back to the organisation's list", () => {
+  const denied = deniedModules(["visitor-mgmt", "nfc-patrol"], ["pool-schedule-mgmt"]);
+  assert.ok(!denied.includes("visitor-mgmt"));
+  assert.ok(!denied.includes("nfc-patrol"));
+  assert.ok(denied.includes("pool-schedule-mgmt"));
+});
+
+/* ── the drift pin ────────────────────────────────────────────────────── */
+
+test("every spelling-group key is governed or always allowed", () => {
+  for (const group of SPELLING_GROUPS) {
+    assert.ok(group.length >= 2, `a group of one: ${group}`);
+    for (const key of group) {
+      assert.ok(
+        GOVERNED_MODULES.includes(key) || ALWAYS_ALLOWED.includes(key),
+        `${key} is in a spelling group but can never be denied or allowed`,
+      );
+    }
+  }
+  // No key belongs to two groups.
+  const all = SPELLING_GROUPS.flat();
+  assert.equal(new Set(all).size, all.length);
+});
+
+test("the governed set is clean", () => {
+  assert.equal(new Set(GOVERNED_MODULES).size, GOVERNED_MODULES.length, "duplicates");
+  for (const key of GOVERNED_MODULES) {
+    assert.ok(!ALWAYS_ALLOWED.includes(key), `${key} is always allowed`);
+    assert.ok(MODULE_KEY.test(key), `${key} could never be saved in a list`);
+  }
+  // Generated 2026-09-11 from layer-common 5a96f95 (55 keys), minus
+  // `notifications`, which must never be hideable. A change in this number
+  // means the list was edited: regenerate it, do not hand-edit it.
+  assert.equal(GOVERNED_MODULES.length, 54);
+  assert.ok(!GOVERNED_MODULES.includes("notifications"), "notifications must never be governed");
+  assert.deepEqual(deniedModules(["visitor-mgmt"], undefined).includes("notifications"), false);
+});
+
+/* ── the impact preview ───────────────────────────────────────────────── */
+
+const ROLES = {
+  star: { _id: "star", name: "Owner", permissions: ["*"] },
+  empty: { _id: "empty", name: "Seeded", permissions: [] },
+  guard: {
+    _id: "guard",
+    name: "Guard",
+    permissions: ["visitor-mgmt:add-visitor", "workOrder:create-work-order"],
+  },
+  other: { _id: "other", name: "Recap", permissions: ["request:create-request", "dashboard:view"] },
+};
+
+const MEMBERS = [
+  { _id: "m1", name: "Ann", type: "security_agency", role: "star" },
+  { _id: "m2", name: "Ben", type: "organization", role: "empty" },
+  { _id: "m3", name: "Cat", type: "security_agency", role: "guard" },
+  { _id: "m4", name: "Dan", type: "security_agency", role: "other" },
+  { _id: "m5", name: "Eve", type: "resident", role: "star" },
+  { _id: "m6", name: "Fay", type: "organization", role: "missing" },
+];
+
+function entry(impact, module) {
+  return impact.modules.find((e) => e.module === module);
+}
+
+test("moduleImpact: *, [] and enumerated roles lose; ungoverned strings and residents do not", () => {
+  const impact = moduleImpact({
+    currentDenied: [],
+    proposedDenied: deniedModules(["nfc-patrol"], undefined),
+    members: MEMBERS,
+    rolesById: ROLES,
+  });
+
+  const visitors = entry(impact, "visitor-mgmt");
+  assert.deepEqual(visitors.members.map((m) => m.name), ["Ann", "Ben", "Cat"]);
+  assert.equal(visitors.roleCount, 3);
+
+  // All four work-order spellings are ONE entry, and `workOrder:` holds it.
+  const workOrders = entry(impact, "work_orders");
+  assert.deepEqual(workOrders.spellings.sort(), [...WORK_ORDERS].sort());
+  assert.deepEqual(workOrders.members.map((m) => m.name), ["Ann", "Ben", "Cat"]);
+
+  // Only `*` and [] hold a module the enumerated role does not.
+  assert.deepEqual(entry(impact, "vehicle-mgmt").members.map((m) => m.name), ["Ann", "Ben"]);
+
+  // Not lost at all: still allowed.
+  assert.equal(entry(impact, "nfc-patrol"), undefined);
+
+  // Dan (ungoverned strings only), Eve (resident), Fay (no role) lose nothing.
+  assert.equal(impact.memberCount, 3);
+  for (const e of impact.modules) {
+    for (const name of ["Dan", "Eve", "Fay"]) {
+      assert.ok(!e.members.some((m) => m.name === name), `${name} in ${e.module}`);
+    }
+  }
+});
+
+test("moduleImpact counts only what is NEWLY denied", () => {
+  const proposed = deniedModules(["nfc-patrol"], undefined);
+  const impact = moduleImpact({
+    currentDenied: proposed.filter((key) => key !== "visitor-mgmt" && key !== "visitorManagement"),
+    proposedDenied: proposed,
+    members: MEMBERS,
+    rolesById: ROLES,
+  });
+  assert.deepEqual(impact.modules.map((e) => e.module), ["visitor-mgmt"]);
+  assert.equal(impact.memberCount, 3);
+
+  const none = moduleImpact({
+    currentDenied: proposed,
+    proposedDenied: proposed,
+    members: MEMBERS,
+    rolesById: ROLES,
+  });
+  assert.deepEqual(none, { memberCount: 0, modules: [] });
+});
+
+test("moduleImpact caps names but never counts", () => {
+  const many = Array.from({ length: IMPACT_NAME_CAP + 10 }, (_, i) => ({
+    _id: `x${i}`,
+    name: `Person ${i}`,
+    type: "organization",
+    role: "star",
+  }));
+  const impact = moduleImpact({
+    currentDenied: [],
+    proposedDenied: ["visitor-mgmt"],
+    members: many,
+    rolesById: ROLES,
+  });
+  const visitors = entry(impact, "visitor-mgmt");
+  assert.equal(visitors.members.length, IMPACT_NAME_CAP);
+  assert.equal(visitors.memberCount, IMPACT_NAME_CAP + 10);
+  assert.equal(impact.memberCount, IMPACT_NAME_CAP + 10);
+});
+
+test("moduleImpact survives junk input", () => {
+  for (const members of [undefined, null, [null, {}]]) {
+    assert.deepEqual(
+      moduleImpact({ currentDenied: null, proposedDenied: null, members, rolesById: null }),
+      { memberCount: 0, modules: [] },
+    );
+  }
+});

package/test/org-modules.test.mjs

@@ -22,6 +22,8 @@ import {
   orgAllowsModule,
   catalogueForOrg,
   MODULE_KEY,
+  ALWAYS_ALLOWED,
+  SPELLING_GROUPS,
 } from "./.build/utils/org-modules.util.mjs";
 
 const CATALOGUE = {
@@ -179,3 +181,79 @@ test("the change is recorded, with the list readable in the row", () => {
   assert.match(body, /modules: modules\.join\(", "\)/);
   assert.match(body, /moduleCount: modules\.length/);
 });
+
+/* ── spelling groups and the always-included set: WIDENING only ───────── */
+
+// The pre-group rules, verbatim, as the contrast oracle.
+function oldOrgAllowsModule(modules, resource) {
+  if (!Array.isArray(modules) || modules.length === 0) return true;
+  const key = typeof resource === "string" ? resource.trim() : "";
+  if (!key) return true;
+  return modules.includes(key);
+}
+function oldCatalogueForOrg(catalogue, modules) {
+  if (!Array.isArray(modules) || modules.length === 0) return catalogue;
+  const narrowed = {};
+  for (const [resource, actions] of Object.entries(catalogue)) {
+    if (oldOrgAllowsModule(modules, resource)) narrowed[resource] = actions;
+  }
+  return Object.keys(narrowed).length ? narrowed : catalogue;
+}
+
+const KEYS = [
+  ...SPELLING_GROUPS.flat(),
+  ...ALWAYS_ALLOWED,
+  "nfc-patrol", "pool-schedule-mgmt", "not-a-module", "has space", " visitor-mgmt ", "",
+];
+const LISTS = [
+  undefined, [], ...KEYS.map((key) => [key]),
+  ["workOrder", "nfc-patrol"], ["work_orders"], ["members"], ["typo", "visitor-mgmt"],
+];
+
+test("every spelling of a ticked module is allowed", () => {
+  for (const group of SPELLING_GROUPS) {
+    for (const ticked of group) {
+      for (const other of group) assert.equal(orgAllowsModule([ticked], other), true, `${ticked} -> ${other}`);
+    }
+  }
+  // CONTROL: a different module is still refused.
+  assert.equal(orgAllowsModule(["workOrder"], "visitor-mgmt"), false);
+  assert.equal(orgAllowsModule(["workOrder"], "nfc-patrol"), false);
+});
+
+test("the always-included set is allowed by any list", () => {
+  for (const key of ALWAYS_ALLOWED) assert.equal(orgAllowsModule(["nfc-patrol"], key), true, key);
+});
+
+test("nothing allowed before is refused now", () => {
+  for (const list of LISTS) {
+    for (const resource of KEYS) {
+      if (oldOrgAllowsModule(list, resource)) {
+        assert.equal(orgAllowsModule(list, resource), true, `${JSON.stringify(list)} / ${resource}`);
+      }
+    }
+  }
+});
+
+test("no catalogue key offered before is dropped now", () => {
+  const catalogue = Object.fromEntries(KEYS.filter(Boolean).map((key) => [key, {}]));
+  const property = { workOrder: {}, members: {}, "pool-schedule-mgmt": {} };
+  for (const list of LISTS) {
+    for (const cat of [catalogue, property, CATALOGUE]) {
+      const before = Object.keys(oldCatalogueForOrg(cat, list));
+      const after = Object.keys(catalogueForOrg(cat, list));
+      for (const key of before) assert.ok(after.includes(key), `${JSON.stringify(list)} dropped ${key}`);
+    }
+  }
+  // The case that needed care: `work_orders` matched nothing EXACTLY in a
+  // property catalogue, so it showed everything. It still does.
+  assert.equal(catalogueForOrg(property, ["work_orders"]), property);
+});
+
+test("a real list now offers every spelling and the always-included set", () => {
+  const cat = { workOrder: {}, "visitor-mgmt": {}, "facility-mgmt": {}, members: {}, "nfc-patrol": {} };
+  assert.deepEqual(
+    Object.keys(catalogueForOrg(cat, ["work_orders", "visitor-mgmt"])).sort(),
+    ["members", "visitor-mgmt", "workOrder"],
+  );
+});

package/test/site-modules.test.mjs

@@ -32,7 +32,9 @@ import {
   rejectedSiteModulesMessage,
   permissionsOutsideModules,
   requireWithinModules,
+  keepStoredSiteModules,
 } from "./.build/utils/site-modules.util.mjs";
+import { ALWAYS_ALLOWED } from "./.build/utils/org-modules.util.mjs";
 
 /* ── reading: it must never return "nothing" ───────────────────────────── */
 
@@ -298,3 +300,85 @@ test("the two EDIT paths pass the existing permissions, so only additions are te
 
   assert.equal(flat.split(CALL).length - 1, 2);
 });
+
+/* ── spelling groups and the always-included set: WIDENING only ───────── */
+
+test("a site may take any spelling of a module the organisation holds", () => {
+  assert.deepEqual(rejectedSiteModules(["workOrder"], ["work_orders", "work-orders", "work_order"]), []);
+  assert.deepEqual(rejectedSiteModules(["visitorManagement"], ["visitor-mgmt"]), []);
+  assert.deepEqual(rejectedSiteModules(["nfc-patrol"], [...ALWAYS_ALLOWED]), []);
+  // CONTROL: a module the organisation lacks is still refused.
+  assert.deepEqual(rejectedSiteModules(["workOrder"], ["nfc-patrol"]), ["nfc-patrol"]);
+});
+
+test("a role may be given any spelling of a module the ceiling holds", () => {
+  assert.deepEqual(
+    permissionsOutsideModules(
+      ["workOrder"],
+      ["work_orders:create-work-order", "members:view-members", "roles-and-permissions:add-role"],
+    ),
+    [],
+  );
+  // CONTROL
+  assert.deepEqual(
+    permissionsOutsideModules(["workOrder"], ["nfc-patrol:see-all-patrols"]),
+    ["nfc-patrol:see-all-patrols"],
+  );
+});
+
+test("nothing accepted before is refused now", () => {
+  // The pre-group rule, verbatim, as the contrast oracle.
+  const oldRejected = (org, requested) =>
+    Array.isArray(org) && org.length
+      ? requested.filter((key) => !org.includes(key))
+      : [];
+  const keys = ["workOrder", "work_orders", "visitor-mgmt", "members", "nfc-patrol", "zzz"];
+  for (const org of [[], ...keys.map((k) => [k]), ["workOrder", "nfc-patrol"]]) {
+    const now = rejectedSiteModules(org, keys);
+    for (const key of now) assert.ok(oldRejected(org, keys).includes(key), `${org} now refuses ${key}`);
+    const perms = keys.map((k) => `${k}:do`);
+    for (const p of permissionsOutsideModules(org, perms)) {
+      assert.ok(oldRejected(org, keys).includes(p.split(":")[0]), `${org} now refuses ${p}`);
+    }
+  }
+});
+
+/* ── S6: a generic site save keeps the stored module list ──────────────── */
+
+test("the stored list wins over whatever the save sent", () => {
+  const stored = { modules: ["visitor-mgmt"], block: 1 };
+  assert.deepEqual(
+    keepStoredSiteModules({ block: 2, modules: ["nfc-patrol"] }, stored),
+    { block: 2, modules: ["visitor-mgmt"] },
+  );
+  // A screen read before the list existed sends none: the list is NOT wiped.
+  assert.deepEqual(keepStoredSiteModules({ block: 2 }, stored), { block: 2, modules: ["visitor-mgmt"] });
+  // An empty stored list is still the stored list.
+  assert.deepEqual(keepStoredSiteModules({ modules: ["a"] }, { modules: [] }), { modules: [] });
+});
+
+test("with no stored list, a sent list is dropped", () => {
+  for (const stored of [undefined, null, {}, { block: 1 }, "junk", []]) {
+    assert.deepEqual(keepStoredSiteModules({ block: 2, modules: ["nfc-patrol"] }, stored), { block: 2 });
+  }
+});
+
+test("everything else in metadata is untouched, and nothing is mutated", () => {
+  const sent = { residentAppModules: { billing: false }, hidQrCodePass: { enabled: true }, modules: ["x"] };
+  const out = keepStoredSiteModules(sent, { modules: ["y"] });
+  assert.deepEqual(out, { residentAppModules: { billing: false }, hidQrCodePass: { enabled: true }, modules: ["y"] });
+  assert.deepEqual(sent.modules, ["x"]);
+  for (const junk of [undefined, null, "x", [1]]) assert.equal(keepStoredSiteModules(junk, { modules: ["y"] }), junk);
+});
+
+test("updateById puts the stored list back before it writes", () => {
+  const body = handler("updateById");
+  const keep = body.indexOf("keepStoredSiteModules(");
+  const write = body.indexOf("await _updateById(");
+  assert.notEqual(keep, -1, "updateById does not keep the stored modules");
+  assert.ok(keep < write, "the write happens before the stored list is restored");
+  assert.match(body, /keepStoredSiteModules\(\s*rest\.metadata,\s*\(existing as any\)\?\.metadata,?\s*\)/);
+  // CONTROL: the derived-field strip and the R4 ceiling are still there.
+  assert.match(body, /withoutDerivedSiteMetadata\(req\.body\.metadata\)/);
+  assert.match(body, /residentAppModulesAboveCeiling\(/);
+});