@7365admin1/core 3.64.5-staging.304 → 3.64.5-staging.306

package/.changeset/module-gate-kill-switch-and-read.md

@@ -0,0 +1,26 @@
+---
+"@7365admin1/core": patch
+---
+
+Module gate: the kill switch now stops the 409, and the check stops reading when there is nothing to decide
+
+Two follow-ups from the module-gate server review, both behaviour-neutral for
+anybody who is not using the kill switch.
+
+**`MODULE_LIST_GATE=off` now means off.** Every other part of the gate checked the
+master switch; `mustAcknowledge` did not. So with the gate switched off, a save that
+narrowed a client's module list was still refused with a 409 "acknowledge the impact
+first" — the one lever a lead would reach for in an emergency, not working for the
+one path that blocks a save from going through. Both the organisation and the site
+save paths go through that function, so both are fixed. With the switch at its
+default the 409 behaves exactly as before, and that is asserted.
+
+**`moduleDeniedForCaller` no longer reads memberships when no list is enforced.** It
+runs on every governed request and read the caller's memberships before finding out
+whether there was anything to decide — and `members.user` has no index to use. It now
+returns early unless the site or its organisation has an enforced list, which is what
+the notification filter already did. No verdict changes: a client that really has an
+enforced list is still measured exactly as before, and that is asserted too.
+
+Also corrects the 3.65.0 changelog, which claimed `MODULE_LIST_GATE` switched all of
+the gate off at once. It did not, for the reason above.

package/.changeset/people-create-reach-gate.md

@@ -0,0 +1,31 @@
+---
+"@7365admin1/core": patch
+---
+
+POST /api/people: count cross-client person creation (gate ships switched off)
+
+The signed-in branch of `POST /api/people` checked only that somebody was signed
+in. The site and organisation came straight from the request body, and where that
+body carries an e-mail, a password and a resident/tenant type, the service goes on
+to create a **user account** and an **active membership** as well as the person row.
+
+`site.people` is the collection every site-reach decision on the platform reads its
+verdict from, so a row written there is not an ordinary record — it manufactures
+reach into another client's estate.
+
+This adds the site-reach check the camera, HID and people-list paths already use,
+behind `PEOPLE_CREATE_REACH_MODE`, and **ships it in `log` mode**: it records what
+it would refuse and refuses nothing. `enforce` refuses; `off` does not look. Any
+unexpected error allows the request — this must never be why a real registration
+fails.
+
+It ships off because of RP-5. A person row carries no `createdBy`, so who created
+the existing rows cannot be established retrospectively and the true refusal count
+is only knowable from live traffic. Measured read-only on staging: 372
+`site.people` rows, of which exactly **1** is self-signup shaped (`platform:
+"mobile"`, `status: "pending"`) and 371 were written by a signed-in caller, across
+3 of 256 sites.
+
+Pre-login self-signup is untouched in every mode: a request with no session takes
+the other branch of `add` before this runs, and that route is already constrained
+by its own allow-list schema with `status` and `platform` pinned server-side.

package/dist/index.js

@@ -15855,6 +15855,8 @@ function deniedForMembership({
   return { denied, since: [orgTier.since, siteTier.since].sort().pop() ?? "" };
 }
 function mustAcknowledge(preview, acknowledged) {
+  if (!moduleListGateOn())
+    return false;
   if (acknowledged === true || !preview.newlyDenied.length)
     return false;
   return !preview.impact || preview.impact.memberCount > 0;
@@ -62476,6 +62478,21 @@ var import_joi72 = __toESM(require("joi"));
 var import_node_server_utils148 = require("@7365admin1/node-server-utils");
 var import_node_server_utils149 = require("@7365admin1/node-server-utils");
 
+// src/utils/people-create-gate.util.ts
+var PEOPLE_CREATE_REACH_MODE_DEFAULT = "log";
+function peopleCreateReachMode(env2 = process.env) {
+  return gateMode(
+    env2.PEOPLE_CREATE_REACH_MODE,
+    ["log", "enforce", "off"],
+    PEOPLE_CREATE_REACH_MODE_DEFAULT
+  );
+}
+function peopleCreateVerdict(params) {
+  if (params.mode === "off" || params.reachable)
+    return { refuse: false, record: false };
+  return { refuse: params.mode === "enforce", record: true };
+}
+
 // src/utils/self-signup-files.util.ts
 function dropUnsentFiles(body) {
   if (!Array.isArray(body?.files))
@@ -62585,6 +62602,41 @@ function usePersonController() {
       next(new import_node_server_utils148.BadRequestError(messages));
       return;
     }
+    try {
+      const mode = peopleCreateReachMode();
+      if (mode !== "off") {
+        const actor = await resolveInviteActor(callerId(req));
+        let reachable = true;
+        if (!staffMayBypass(actor)) {
+          const site = payload?.site ? String(payload.site) : "";
+          const org = payload?.org ? String(payload.org) : "";
+          if (site) {
+            reachable = await useCameraViewService().entitleSite({ siteId: site, userId: actor.id }).then(
+              () => true,
+              () => false
+            );
+          } else if (org) {
+            reachable = actor.orgIds.includes(org);
+          }
+        }
+        const verdict = peopleCreateVerdict({ mode, reachable });
+        if (verdict.record) {
+          import_node_server_utils148.logger.log({
+            level: "info",
+            message: `[people-create] ${verdict.refuse ? "refused" : "would-refuse"} caller=${actor.id} site=${payload?.site ?? ""} org=${payload?.org ?? ""} mode=${mode}`
+          });
+        }
+        if (verdict.refuse) {
+          next(new import_node_server_utils149.UnauthorizedError("Not authorized."));
+          return;
+        }
+      }
+    } catch (gateError) {
+      import_node_server_utils148.logger.log({
+        level: "warn",
+        message: `[people-create] reach check failed open: ${gateError?.message}`
+      });
+    }
     try {
       const data = await _add(payload);
       res.status(201).json({ message: data });
@@ -96883,6 +96935,8 @@ async function moduleDeniedForCaller({
     if (!user || !siteId)
       return ALLOW;
     const siteDoc = typeof site === "string" ? await data.site(siteId).catch(() => null) : site ?? null;
+    if (!await siteHasEnforcedList(siteDoc, data))
+      return ALLOW;
     const gate = await gateAtSite(await data.membershipsOf([user]), siteDoc, siteId, data);
     if (gate.exempt)
       return ALLOW;