@7365admin1/core 3.64.5-staging.292 → 3.64.5-staging.294

package/.changeset/member-direct-role-org.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+POST /api/members/direct refuses (400) a role that belongs to a different organisation, unless the caller already holds that role in the organisation being joined.

package/.changeset/site-save-resident-ceiling.md

@@ -0,0 +1,7 @@
+---
+"@7365admin1/core": patch
+---
+
+Site Settings saves are no longer refused because the client has one resident-app
+switch turned off. A save is refused only when it would turn ON a resident-app
+switch that the site has stored as off and the client has switched off.

package/dist/index.d.ts

@@ -11138,7 +11138,9 @@ declare function hasOrgOwnership(userId?: string | ObjectId | null, orgId?: stri
  * `status: { $ne: "deleted" }` is the same liveness test every other membership
  * read in this package uses, so a revoked membership stops conferring the read.
  */
-declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null): Promise<boolean>;
+declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null, 
+/** when given, the live membership must also be in THIS organisation */
+orgId?: string | ObjectId | null): Promise<boolean>;
 
 declare function useAuthControllerV2(): {
     signUp: (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/index.js

@@ -14627,19 +14627,24 @@ async function hasOrgOwnership(userId, orgId) {
   );
   return Boolean(found);
 }
-async function holdsRole(userId, roleId) {
+async function holdsRole(userId, roleId, orgId) {
   const id = userId?.toString() ?? "";
   const role = roleId?.toString() ?? "";
+  const org = orgId?.toString() ?? "";
   if (!id || !role || !import_mongodb25.ObjectId.isValid(id) || !import_mongodb25.ObjectId.isValid(role)) {
     return false;
   }
+  if (orgId !== void 0 && !import_mongodb25.ObjectId.isValid(org))
+    return false;
   const db2 = import_node_server_utils27.useAtlas.getDb();
   if (!db2)
     return false;
   const member = await db2.collection("members").findOne({
     user: new import_mongodb25.ObjectId(id),
     role: new import_mongodb25.ObjectId(role),
-    status: { $ne: "deleted" }
+    status: { $ne: "deleted" },
+    // both shapes, as `hasOrgInvitation` does for `metadata.org`
+    ...org ? { org: { $in: [new import_mongodb25.ObjectId(org), org] } } : {}
   });
   return Boolean(member);
 }
@@ -20662,6 +20667,12 @@ function useMemberService() {
     if (targetRole?.type === PLATFORM_STAFF_MEMBER_TYPE) {
       await requireStaffCaller(callerId5, "assign a Seven365 staff role");
     }
+    const roleOrg = targetRole?.org?.toString?.() ?? "";
+    if (roleOrg && roleOrg !== (orgId?.toString() ?? "").toLowerCase() && !await holdsRole(callerId5, roleId, orgId)) {
+      throw new import_node_server_utils50.BadRequestError(
+        "That role belongs to a different organisation."
+      );
+    }
     const session = import_node_server_utils50.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
@@ -39318,11 +39329,12 @@ function effectiveResidentAppModules(orgModules, siteModules) {
   }
   return effective;
 }
-function residentAppModulesAboveCeiling(orgModules, requested) {
+function residentAppModulesAboveCeiling(orgModules, requested, stored) {
   const org = asModules(orgModules);
   const wanted = asModules(requested);
+  const had = asModules(stored);
   return residentAppModuleKeys.filter(
-    (key) => org[key] === false && wanted[key] === true
+    (key) => org[key] === false && wanted[key] === true && had[key] === false
   );
 }
 function residentAppModulesAboveCeilingMessage(rejected) {
@@ -39542,7 +39554,8 @@ function useSiteController() {
         ) : null;
         const above = residentAppModulesAboveCeiling(
           org?.residentAppModules,
-          rest.metadata.residentAppModules
+          rest.metadata.residentAppModules,
+          existing?.metadata?.residentAppModules
         );
         if (above.length) {
           next(