@7365admin1/core 3.64.5-staging.304 → 3.64.5-staging.305

package/.changeset/module-gate-kill-switch-and-read.md

@@ -0,0 +1,26 @@
+---
+"@7365admin1/core": patch
+---
+
+Module gate: the kill switch now stops the 409, and the check stops reading when there is nothing to decide
+
+Two follow-ups from the module-gate server review, both behaviour-neutral for
+anybody who is not using the kill switch.
+
+**`MODULE_LIST_GATE=off` now means off.** Every other part of the gate checked the
+master switch; `mustAcknowledge` did not. So with the gate switched off, a save that
+narrowed a client's module list was still refused with a 409 "acknowledge the impact
+first" — the one lever a lead would reach for in an emergency, not working for the
+one path that blocks a save from going through. Both the organisation and the site
+save paths go through that function, so both are fixed. With the switch at its
+default the 409 behaves exactly as before, and that is asserted.
+
+**`moduleDeniedForCaller` no longer reads memberships when no list is enforced.** It
+runs on every governed request and read the caller's memberships before finding out
+whether there was anything to decide — and `members.user` has no index to use. It now
+returns early unless the site or its organisation has an enforced list, which is what
+the notification filter already did. No verdict changes: a client that really has an
+enforced list is still measured exactly as before, and that is asserted too.
+
+Also corrects the 3.65.0 changelog, which claimed `MODULE_LIST_GATE` switched all of
+the gate off at once. It did not, for the reason above.

package/dist/index.js

@@ -15855,6 +15855,8 @@ function deniedForMembership({
   return { denied, since: [orgTier.since, siteTier.since].sort().pop() ?? "" };
 }
 function mustAcknowledge(preview, acknowledged) {
+  if (!moduleListGateOn())
+    return false;
   if (acknowledged === true || !preview.newlyDenied.length)
     return false;
   return !preview.impact || preview.impact.memberCount > 0;
@@ -96883,6 +96885,8 @@ async function moduleDeniedForCaller({
     if (!user || !siteId)
       return ALLOW;
     const siteDoc = typeof site === "string" ? await data.site(siteId).catch(() => null) : site ?? null;
+    if (!await siteHasEnforcedList(siteDoc, data))
+      return ALLOW;
     const gate = await gateAtSite(await data.membershipsOf([user]), siteDoc, siteId, data);
     if (gate.exempt)
       return ALLOW;