@7365admin1/core 3.64.5 → 3.65.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.64.5",
+  "version": "3.65.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/console-permission.test.mjs

@@ -211,10 +211,11 @@ function gateCalls() {
   return calls;
 }
 
-test("every console gate call site names a module - all 46 of them", () => {
+test("every console gate call site names a module - all 48 of them", () => {
   const calls = gateCalls();
-  // 46 since `organization.controller.ts updateModules` was added.
-  assert.equal(calls.length, 46, `gate call sites moved: ${calls.length}`);
+  // 48 since the module gate added `organization.controller.ts previewOrgModules`
+  // and `member.controller.ts getModulesByUserIdType` (self-or-staff, `members`).
+  assert.equal(calls.length, 48, `gate call sites moved: ${calls.length}`);
 
   const ungoverned = calls.filter(
     ([, call]) =>

package/test/e2e/member-direct-role-org.e2e.test.mjs

@@ -0,0 +1,255 @@
+// End-to-end proof that `POST /api/members/direct` only enrols somebody with a
+// role that belongs to the organisation being joined.
+//
+// `roleId` arrived as `Joi.string().hex()` and nothing tied it to `orgId`. The
+// org gate (`requireOrgReach` for yourself, `requireOrgAccess` for somebody
+// else) decides WHERE a membership may be written, but not WHAT it carries, so
+// anybody with reach into one client - an invitation is enough - could enrol
+// there wearing another client's role, and a member could hand a colleague one.
+//
+// Every legitimate caller keeps working, and each has a case below:
+//   - web-app-main sign-in / verify-email: the invitation's role, or "Admin
+//     Service Provider" found by name in the invited org (it may be pinned to a
+//     different site of that org than the `siteId` sent with it);
+//   - web-app-org onboarding: the invitation role, else the owner's existing
+//     organisation-row role (an org-less template for 27 staging owners, and for
+//     1 a role of another client), reused for the app row and the support account.
+//
+// Everything runs against the harness's in-process MongoDB replica set. No
+// staging or production database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "RoleOrg-Passw0rd!";
+const NEWCOMER = "ro-newcomer@e2e.example.com"; // invited into org B, not yet a member
+const MEMBER_B = "ro-member-b@e2e.example.com"; // an ordinary member of org B
+const HOLDER = "ro-holder@e2e.example.com"; // org B owner whose org row carries org A's role
+const SUPPORT = "ro-support@e2e.example.com"; // the account onboarding adds
+const STAFF = "ro-sevenadmin@e2e.example.com";
+
+describe("members/direct only hands out a role of the organisation being joined", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const result = [];
+  const sid = {};
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- members/direct role organisation: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const enrol = (who, body) =>
+    h.api("/members/direct", {
+      method: "POST",
+      sid: sid[who],
+      body: { orgId: id.orgB.toString(), siteId: "", siteName: "", ...body },
+    });
+
+  const rows = (user, type) =>
+    h.db.collection("members").countDocuments({ user, org: id.orgB, type });
+
+  record("0. baseline - everybody signs in", async () => {
+    for (const [k, e] of Object.entries({ NEWCOMER, MEMBER_B, HOLDER, SUPPORT, STAFF })) {
+      sid[k] = await h.login(e, PASSWORD);
+    }
+  });
+
+  // ---- refused: another client's role -------------------------------------
+
+  record("1. an invitee cannot enrol with ANOTHER client's role", async () => {
+    const res = await enrol("NEWCOMER", {
+      userId: id.newcomer.toString(),
+      roleId: id.roleA.toString(),
+      app: "organization",
+    });
+    // 400 from this check; 401 once the self-enrolment role gate (which runs
+    // first, in the controller) is also present — the invitation does not
+    // offer roleA. Either way nothing is written.
+    assert.ok([400, 401].includes(res.status), JSON.stringify(res.body));
+    assert.equal(await rows(id.newcomer, "organization"), 0, "nothing may be written");
+  });
+
+  record("2. a member cannot hand a colleague another client's role", async () => {
+    const res = await enrol("MEMBER_B", {
+      userId: id.support.toString(),
+      roleId: id.roleA.toString(),
+      app: "organization",
+    });
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.equal(await rows(id.support, "organization"), 0);
+  });
+
+  record("3. nor can Seven365 staff attach another client's role", async () => {
+    const res = await enrol("STAFF", {
+      userId: id.support.toString(),
+      roleId: id.roleA.toString(),
+      app: "security_agency",
+    });
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.equal(await rows(id.support, "security_agency"), 0);
+  });
+
+  // ---- still works: every live shape ----------------------------------------
+
+  record("4. STILL WORKS: the invitee enrols with the invited org's role", async () => {
+    const res = await enrol("NEWCOMER", {
+      userId: id.newcomer.toString(),
+      roleId: id.roleB.toString(),
+      app: "organization",
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("5. STILL WORKS: a site role of the org with a DIFFERENT siteId (SP sign-in shape)", async () => {
+    // "Admin Service Provider" is found by name with limit 1, so it may be pinned
+    // to another site of the same org than the invitation's site. Enrolled by a
+    // member of the org, so only this check is exercised.
+    const res = await enrol("MEMBER_B", {
+      userId: id.newcomer.toString(),
+      roleId: id.roleBSite2.toString(),
+      app: "security_agency",
+      siteId: id.siteB1.toString(),
+      siteName: "Site B1",
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("6. STILL WORKS: an org-less template role (the console's Invite Client picker)", async () => {
+    const res = await enrol("MEMBER_B", {
+      userId: id.newcomer.toString(),
+      roleId: id.template.toString(),
+      app: "property_management_agency",
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("7. STILL WORKS: a member adds a colleague with the org's own role", async () => {
+    const res = await enrol("MEMBER_B", {
+      userId: id.support.toString(),
+      roleId: id.roleB.toString(),
+      app: "organization",
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("8. STILL WORKS: onboarding finish reuses a role the owner already holds HERE", async () => {
+    // The owner's organisation row carries org A's role (1 staging owner has this
+    // shape). The finish writes the app row with it, then the support account.
+    const self = await enrol("HOLDER", {
+      userId: id.holder.toString(),
+      roleId: id.roleA.toString(),
+      app: "property_management_agency",
+      onboardingRequired: true,
+    });
+    assert.equal(self.status, 201, JSON.stringify(self.body));
+
+    const support = await enrol("HOLDER", {
+      userId: id.support.toString(),
+      roleId: id.roleA.toString(),
+      app: "property_management_agency",
+    });
+    assert.equal(support.status, 201, JSON.stringify(support.body));
+  });
+
+  record("9. STILL WORKS: a role id that resolves to nothing is not a new refusal", async () => {
+    const res = await enrol("MEMBER_B", {
+      userId: id.support.toString(),
+      roleId: new ObjectId().toString(),
+      app: "cleaning_services",
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("10. CONTROL: holding org A's role in ANOTHER org does not unlock it here", async () => {
+    // The newcomer holds nothing in org B with roleA; a membership in org A with
+    // it (seeded) must not count.
+    const res = await enrol("NEWCOMER", {
+      userId: id.newcomer.toString(),
+      roleId: id.roleA.toString(),
+      app: "cleaning_services",
+    });
+    assert.ok([400, 401].includes(res.status), JSON.stringify(res.body));
+    assert.equal(await rows(id.newcomer, "cleaning_services"), 0);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const orgA = new ObjectId();
+  const orgB = new ObjectId();
+  const siteB1 = new ObjectId();
+  const siteB2 = new ObjectId();
+  const staffRole = new ObjectId();
+  const roleA = new ObjectId();
+  const roleB = new ObjectId();
+  const roleBSite2 = new ObjectId();
+  const template = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: orgA, name: "RO Org A", email: "ro-a@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgB, name: "RO Org B", email: "ro-b@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("sites").insertMany([
+    { _id: siteB1, name: "Site B1", orgId: orgB, status: "active" },
+    { _id: siteB2, name: "Site B2", orgId: orgB, status: "active" },
+  ]);
+
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: roleA, name: "Owner", type: "organization", org: orgA, permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Supervisor", type: "organization", org: orgB, permissions: ["*"], status: "active" },
+    { _id: roleBSite2, name: "Admin Service Provider", type: "security_agency", org: orgB, site: siteB2, permissions: ["*"], status: "active" },
+    { _id: template, name: "Org Owner", type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const emails = [NEWCOMER, MEMBER_B, HOLDER, SUPPORT, STAFF];
+  const users = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+  const [newcomer, memberB, holder, support, staff] = [0, 1, 2, 3, 4].map((i) => users.insertedIds[i]);
+
+  await h.db.collection("members").insertMany([
+    { user: memberB, org: orgB, type: "organization", role: roleB, status: "active" },
+    // the staging shape: an org-B organisation row carrying org A's role
+    { user: holder, org: orgB, type: "organization", role: roleA, status: "active" },
+    // the newcomer holds org A's role, but in org A - it must not count in org B
+    { user: newcomer, org: orgA, type: "organization", role: roleA, status: "active" },
+    { user: staff, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  await h.db.collection("verifications").insertOne({
+    type: "member-invite",
+    email: NEWCOMER,
+    status: "pending",
+    metadata: { org: orgB, role: roleB, app: "organization" },
+    createdAt: now,
+  });
+
+  return { orgA, orgB, siteB1, siteB2, roleA, roleB, roleBSite2, template, newcomer, memberB, holder, support, staff };
+}

package/test/e2e/member-direct-self-enrol-role.e2e.test.mjs

@@ -0,0 +1,204 @@
+// End-to-end proof that a person can add THEMSELVES through
+// `POST /api/members/direct` only with a role they are entitled to.
+//
+// `requireOrgReach` decided where a self-enrolment may land and never looked at
+// the role, so a member with a narrow role - or anybody holding any invitation
+// into the organisation - could add themselves a second membership wearing the
+// owner's `["*"]` role.
+//
+// Allowed: the org owner (any role), a role already held in that org, Seven365
+// staff, the role the caller's own invitation offers (a role-less service-
+// provider invite offers a role of the org whose type is the invite's app).
+// Enrolling SOMEBODY ELSE is unchanged.
+//
+// Everything runs against the harness's in-process MongoDB replica set. No
+// staging or production database, Redis, device or endpoint is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "SelfEnrol-Passw0rd!";
+const U = {
+  NARROW: "se-narrow@e2e.example.com", // member of org B with a narrow role
+  NEWCOMER: "se-newcomer@e2e.example.com", // member-invite into org B offering the narrow role
+  CANCELLED: "se-cancelled@e2e.example.com", // a CANCELLED invite offering the owner role
+  SP: "se-sp@e2e.example.com", // role-less service-provider invite, app security_agency
+  OWNER: "se-owner@e2e.example.com", // org B is registered under this address
+  ADMIN: "se-admin@e2e.example.com", // member of org B with the owner role
+  SUPPORT: "se-support@e2e.example.com",
+  STAFF: "se-sevenadmin@e2e.example.com",
+  CASED: "se-cased@e2e.example.com", // member-invite stored under a differently-cased address
+};
+
+describe("self-enrolment only with a role the caller may give themselves", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- members/direct self-enrol role: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  const enrol = (who, userKey, role, app = "organization", extra = {}) =>
+    h.api("/members/direct", {
+      method: "POST",
+      sid: sid[who],
+      body: {
+        userId: id.users[userKey].toString(),
+        orgId: id.orgB.toString(),
+        roleId: id[role].toString(),
+        app,
+        siteId: "",
+        siteName: "",
+        ...extra,
+      },
+    });
+
+  const rowsWith = (userKey, role) =>
+    h.db.collection("members").countDocuments({ user: id.users[userKey], org: id.orgB, role: id[role] });
+
+  record("0. baseline - everybody signs in", async () => {
+    for (const [k, e] of Object.entries(U)) sid[k] = await h.login(e, PASSWORD);
+  });
+
+  // ---- the escalation, refused -------------------------------------------------
+
+  record("1. a narrow member cannot give themselves the owner role", async () => {
+    const res = await enrol("NARROW", "NARROW", "ownerRole", "property_management_agency");
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal(await rowsWith("NARROW", "ownerRole"), 0, "nothing may be written");
+  });
+
+  record("2. an invitee cannot take a role their invitation does not offer", async () => {
+    const res = await enrol("NEWCOMER", "NEWCOMER", "ownerRole");
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal(await rowsWith("NEWCOMER", "ownerRole"), 0);
+  });
+
+  record("3. a cancelled invitation offers nothing", async () => {
+    const res = await enrol("CANCELLED", "CANCELLED", "ownerRole");
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  record("4. a role-less SP invite does not offer a role of another type", async () => {
+    const res = await enrol("SP", "SP", "ownerRole", "security_agency");
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+  });
+
+  // ---- every live self-enrolment, still working ---------------------------------
+
+  record("5. member-invite sign-up: the invitation's role, org row then app row", async () => {
+    assert.equal((await enrol("NEWCOMER", "NEWCOMER", "narrowRole")).status, 201);
+    assert.equal((await enrol("NEWCOMER", "NEWCOMER", "narrowRole", "property_management_agency")).status, 201);
+  });
+
+  record("6. SP sign-in: the org's Admin Service Provider role of the invite's app, both rows", async () => {
+    const extra = { siteId: id.siteB.toString(), siteName: "SE Site B" };
+    assert.equal((await enrol("SP", "SP", "spRole", "organization", extra)).status, 201);
+    assert.equal((await enrol("SP", "SP", "spRole", "security_agency", extra)).status, 201);
+  });
+
+  record("7. onboarding owner: organisation row and app row with the owner role", async () => {
+    assert.equal((await enrol("OWNER", "OWNER", "ownerRole", "organization", { onboardingRequired: true })).status, 201);
+    assert.equal((await enrol("OWNER", "OWNER", "ownerRole", "property_management_agency")).status, 201);
+  });
+
+  record("8. onboarding finish: an app row repeating a role already held here", async () => {
+    const res = await enrol("NARROW", "NARROW", "narrowRole", "cleaning_services");
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("9. Seven365 staff", async () => {
+    const res = await enrol("STAFF", "STAFF", "ownerRole");
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("10. UNCHANGED: enrolling somebody else (owner adds the support account)", async () => {
+    const res = await enrol("OWNER", "SUPPORT", "ownerRole");
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("11. UNCHANGED: an admin adds a colleague", async () => {
+    const res = await enrol("ADMIN", "SUPPORT", "narrowRole", "property_management_agency");
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+
+  record("12. a role-less SP invite does not offer ANOTHER org's role of the invite's type", async () => {
+    const res = await enrol("SP", "SP", "foreignSpRole", "security_agency");
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal(await rowsWith("SP", "foreignSpRole"), 0);
+  });
+
+  record("13. the invitation is matched to the account whatever the address's case", async () => {
+    const res = await enrol("CASED", "CASED", "narrowRole");
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const orgB = new ObjectId();
+  const siteB = new ObjectId();
+  const orgC = new ObjectId();
+  const [ownerRole, narrowRole, spRole, staffRole, foreignSpRole] = [0, 1, 2, 3, 4].map(() => new ObjectId());
+
+  await h.db.collection("organizations").insertOne({
+    _id: orgB, name: "SE Org B", email: U.OWNER, type: "org",
+    nature: "property_management_agency", status: "active", createdAt: now,
+  });
+  await h.db.collection("sites").insertOne({ _id: siteB, name: "SE Site B", orgId: orgB, status: "active" });
+  await h.db.collection("roles").insertMany([
+    { _id: ownerRole, name: "owner", type: "organization", org: orgB, permissions: ["*"], default: true, status: "active" },
+    { _id: narrowRole, name: "Viewer", type: "organization", org: orgB, permissions: ["see-all-feedback"], status: "active" },
+    { _id: spRole, name: "Admin Service Provider", type: "security_agency", org: orgB, site: siteB, permissions: ["*"], status: "active" },
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: foreignSpRole, name: "Admin Service Provider", type: "security_agency", org: orgC, permissions: ["*"], status: "active" },
+  ]);
+
+  const emails = Object.values(U);
+  const inserted = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+  const users = Object.fromEntries(Object.keys(U).map((k, i) => [k, inserted.insertedIds[i]]));
+
+  await h.db.collection("members").insertMany([
+    { user: users.NARROW, org: orgB, type: "organization", role: narrowRole, status: "active" },
+    { user: users.ADMIN, org: orgB, type: "organization", role: ownerRole, status: "active" },
+    { user: users.STAFF, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  await h.db.collection("verifications").insertMany([
+    { type: "member-invite", email: U.NEWCOMER, status: "pending", metadata: { org: orgB, role: narrowRole, app: "organization" }, createdAt: now },
+    { type: "member-invite", email: U.CANCELLED, status: "cancelled", metadata: { org: orgB, role: ownerRole, app: "organization" }, createdAt: now },
+    { type: "service-provider-invite", email: U.SP, status: "pending", metadata: { org: orgB, siteId: siteB, app: "security_agency" }, createdAt: now },
+    { type: "member-invite", email: "SE-Cased@E2E.example.com", status: "pending", metadata: { org: orgB, role: narrowRole, app: "organization" }, createdAt: now },
+  ]);
+
+  return { orgB, siteB, ownerRole, narrowRole, spRole, foreignSpRole, users };
+}

package/test/e2e/org-anon-lookup-projection.e2e.test.mjs

@@ -190,7 +190,7 @@ async function seed(h) {
     },
   ]);
 
-  await h.db.collection("users").insertOne({
+  const caller = await h.db.collection("users").insertOne({
     email: CALLER,
     name: "Org Lookup Caller",
     status: "active",
@@ -198,5 +198,15 @@ async function seed(h) {
     createdAt: now,
   });
 
+  // The signed-in twin gives the whole document to somebody with a relationship
+  // to the organisation (organization-record-reach.e2e), so the caller whose
+  // read case 8 checks is a member of it.
+  await h.db.collection("members").insertOne({
+    user: caller.insertedId,
+    org: orgs.insertedIds[0],
+    type: "organization",
+    status: "active",
+  });
+
   return { org: orgs.insertedIds[0] };
 }

package/test/e2e/organization-read-scope.e2e.test.mjs

@@ -180,9 +180,12 @@ describe("organisation lookups are scoped to the caller", { concurrency: 1 }, ()
     assert.notEqual(res.status, 401, JSON.stringify(res.body));
   });
 
-  record("15. and the guarded by-id read is unchanged too", async () => {
+  record("15. the guarded by-id read answers another client with its name only", async () => {
+    // Still a 200 - the mobile apps sign the user out on a 401 from this read -
+    // but no longer the whole record. See organization-record-reach.e2e.
     const res = await h.api(`/organizations/id/${id.orgB}`, { sid: mallorySid });
     assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(Object.keys(res.body ?? {}).sort(), ["_id", "name"]);
   });
 });