@7365admin1/core 3.64.5 → 3.65.1

package/test/modules-endpoint.test.mjs

@@ -0,0 +1,525 @@
+/*
+ * THE MODULE GATE, SERVER STEP (master plan W1-A).
+ *
+ *   GET  /api/members/user/:id/app/:type/modules  -> { denied }
+ *   POST /api/organizations/:id/modules/preview     -> { newlyDenied, impact }
+ *   POST /api/sites/:id/modules/preview             -> the same, for a site
+ *   PATCH ... /modules                               -> 409 until a narrowing is acknowledged
+ *
+ * Owner rules pinned here: an absent list means everything; ALWAYS_ALLOWED is
+ * never denied; the switch turns it all off; any error denies nothing; a list
+ * is enforced only once saved through the acknowledged preview (2026-09-11).
+ * The rules run on the SHIPPED service with an in-memory data layer; the
+ * wiring is read from the shipped controllers.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+import {
+  deniedModulesForUser,
+  orgModulePreview,
+  siteModulePreview,
+} from "./.build/services/module-gate.service.mjs";
+import {
+  ALWAYS_ALLOWED,
+  GATE_LIST_HASH_FIELD,
+  impactUnacknowledgedMessage,
+  mustAcknowledge,
+} from "./.build/utils/module-gate.util.mjs";
+import { pickLookupMembership } from "./.build/utils/member-lookup.util.mjs";
+import { orgModulesHandlers } from "./.build/controllers/organization.controller.mjs";
+import { siteModulesHandlers } from "./.build/controllers/site.controller.mjs";
+import { memberModulesHandlers } from "./.build/controllers/member.controller.mjs";
+import {
+  ConsoleAuditAction,
+  pickAuditFields,
+} from "./.build/utils/console-audit.util.mjs";
+import {
+  ORG,
+  OTHER_ORG,
+  SITE,
+  OTHER_SITE,
+  USER,
+  USER_2,
+  CLIENT_SAVE,
+  SITE_SAVE,
+  ackRow,
+  oldRow,
+  member,
+  fakeGate,
+  withEnv,
+} from "./module-gate.fixtures.mjs";
+
+const LIST = ["visitor-mgmt", "workOrder"];
+const org = (modules) => ({ _id: ORG, modules });
+const ask = (data, over = {}) =>
+  deniedModulesForUser({ user: USER, type: "security_agency", org: ORG, ...over }, data);
+
+/* ── /modules: absent means everything ───────────────────────────────── */
+
+test("no list, or an empty one, denies nothing and reads no audit row", async () => {
+  for (const modules of [undefined, null, []]) {
+    const { data, calls } = fakeGate({ rows: [member()], orgs: { [ORG]: org(modules) } });
+    assert.deepEqual(await ask(data), [], String(modules));
+    assert.equal(calls.latestSave ?? 0, 0, "inert: no extra read while no list is stored");
+  }
+});
+
+test("CONTROL: an acknowledged list denies what it does not give", async () => {
+  const { data } = fakeGate({
+    rows: [member()],
+    orgs: { [ORG]: org(LIST) },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+  });
+  const denied = await ask(data);
+  assert.ok(denied.includes("nfc-patrol"));
+  assert.ok(!denied.includes("visitor-mgmt"));
+  // A spelling group is allowed as a whole.
+  assert.ok(!denied.includes("work_orders"));
+  for (const key of ALWAYS_ALLOWED) assert.ok(!denied.includes(key), key);
+});
+
+/* ── owner decision: only an acknowledged save counts ─────────────────── */
+
+test("a list saved before the acknowledged path is NOT enforced", async () => {
+  for (const save of [undefined, oldRow(LIST)]) {
+    const { data } = fakeGate({
+      rows: [member()],
+      orgs: { [ORG]: org(LIST) },
+      saves: save ? { [`${CLIENT_SAVE}|${ORG}`]: save } : {},
+    });
+    assert.deepEqual(await ask(data), [], save ? "old row" : "no row");
+  }
+});
+
+test("a list changed after its acknowledged save falls back to absent", async () => {
+  const { data } = fakeGate({
+    rows: [member()],
+    orgs: { [ORG]: org(["visitor-mgmt"]) }, // edited by some other route
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+  });
+  assert.deepEqual(await ask(data), []);
+});
+
+/* ── the site tier ────────────────────────────────────────────────────── */
+
+test("a site list applies only when the site belongs to the member's own organisation", async () => {
+  const siteList = ["visitor-mgmt"];
+  const gate = (siteId, siteOrg) =>
+    fakeGate({
+      rows: [member()],
+      orgs: { [ORG]: org(LIST) },
+      sites: { [siteId]: { _id: siteId, orgId: siteOrg, metadata: { modules: siteList } } },
+      saves: {
+        [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST),
+        [`${SITE_SAVE}|${siteId}`]: ackRow(siteList),
+      },
+    }).data;
+
+  const orgOnly = await ask(gate(OTHER_SITE, OTHER_ORG), { site: OTHER_SITE });
+  assert.ok(!orgOnly.includes("work_orders"), "another org's site list is ignored (Q1)");
+
+  // CONTROL: the same list on the member's own organisation's site narrows.
+  const own = await ask(gate(SITE, ORG), { site: SITE });
+  assert.ok(own.includes("work_orders"));
+  assert.ok(!own.includes("visitor-mgmt"));
+});
+
+/* ── fails open ───────────────────────────────────────────────────────── */
+
+test("MODULE_LIST_GATE=off denies nothing and reads nothing", async () => {
+  const setup = {
+    rows: [member()],
+    orgs: { [ORG]: org(LIST) },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+  };
+  for (const off of ["off", "OFF", "false", "0"]) {
+    const { data, calls } = fakeGate(setup);
+    assert.deepEqual(await withEnv({ MODULE_LIST_GATE: off }, () => ask(data)), [], off);
+    assert.deepEqual(calls, {}, `${off}: nothing read`);
+  }
+  // CONTROL: on (and the code default) enforces.
+  const { data } = fakeGate(setup);
+  assert.ok((await withEnv({ MODULE_LIST_GATE: undefined }, () => ask(data))).length > 0);
+});
+
+test("any lookup error denies nothing", async () => {
+  const setup = {
+    rows: [member()],
+    orgs: { [ORG]: org(LIST) },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+  };
+  for (const broken of ["membershipsOf", "isPlatformStaff", "org", "latestSave"]) {
+    const { data } = fakeGate({ ...setup, throwOn: [broken] });
+    assert.deepEqual(await ask(data), [], broken);
+  }
+});
+
+test("Seven365 staff, residents and people with no membership get nothing denied", async () => {
+  const setup = { orgs: { [ORG]: org(LIST) }, saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) } };
+  assert.deepEqual(await ask(fakeGate({ ...setup, rows: [member()], staff: true }).data), []);
+  assert.deepEqual(
+    await ask(fakeGate({ ...setup, rows: [member({ type: "resident" })] }).data, { type: "resident" }),
+    [],
+  );
+  assert.deepEqual(await ask(fakeGate({ ...setup, rows: [] }).data), []);
+});
+
+/* ── the same membership getByUserIdType answers with ─────────────────── */
+
+test("pickLookupMembership mirrors getByUserIdType: site pick, live org row, first of type", () => {
+  const first = member({ _id: "first", org: OTHER_ORG });
+  const inOrg = member({ _id: "inOrg" });
+  const pinned = member({ _id: "pinned", siteId: SITE });
+  assert.equal(pickLookupMembership([first, inOrg, pinned], "security_agency", SITE, ORG)._id, "pinned");
+  assert.equal(pickLookupMembership([first, inOrg], "security_agency", "", ORG)._id, "inOrg");
+  // A removed row in the org does not win; the old first-of-type answer does.
+  const gone = member({ _id: "gone", status: "deleted" });
+  assert.equal(pickLookupMembership([first, gone], "security_agency", "", ORG)._id, "first");
+  assert.equal(pickLookupMembership([first], "cleaning_services", "", ORG), null);
+});
+
+/* ── the impact preview ───────────────────────────────────────────────── */
+
+const ROLES = {
+  star: { name: "Owner", permissions: ["*"] },
+  guard: { name: "Guard", permissions: ["visitor-mgmt:add-visitor"] },
+};
+const PEOPLE = [
+  member({ _id: "p1", name: "Ann", role: "star" }),
+  member({ _id: "p2", name: "Ben", role: "guard" }),
+];
+
+test("the preview names who loses what, against full access for a never-acknowledged list", async () => {
+  // Stored, but saved the OLD way: today it is absent, so this is a first save.
+  const { data } = fakeGate({ members: PEOPLE, roles: ROLES, saves: {} });
+  const preview = await orgModulePreview(org(["nfc-patrol", "feedback"]), ["nfc-patrol"], data);
+  assert.equal(preview.enforces, true);
+  assert.ok(preview.newlyDenied.includes("visitor-mgmt"));
+  const visitors = preview.impact.modules.find((m) => m.module === "visitor-mgmt");
+  assert.deepEqual(visitors.members.map((m) => m.name).sort(), ["Ann", "Ben"]);
+  assert.equal(preview.impact.memberCount, 2);
+});
+
+test("re-saving the enforced list, or saving an empty one, reads no member and needs no acknowledgement", async () => {
+  const { data, calls } = fakeGate({
+    members: PEOPLE,
+    roles: ROLES,
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+    throwOn: ["staffMembers", "roles"],
+  });
+  for (const proposed of [LIST, [], [...LIST, "nfc-patrol"]]) {
+    const preview = await orgModulePreview(org(LIST), proposed, data);
+    assert.deepEqual(preview.newlyDenied, [], String(proposed));
+    assert.equal(mustAcknowledge(preview, undefined), false);
+  }
+  assert.equal(calls.staffMembers ?? 0, 0);
+});
+
+test("re-saving the STORED list unchanged, never acknowledged: no acknowledgement, no marker, no member read", async () => {
+  const { data, calls } = fakeGate({ members: PEOPLE, roles: ROLES, throwOn: ["staffMembers", "roles"] });
+  const reordered = [...LIST].reverse(); // set-equal, order-insensitive
+  const orgSide = await orgModulePreview(org(LIST), reordered, data);
+  assert.deepEqual(orgSide, { newlyDenied: [], impact: { memberCount: 0, modules: [] }, enforces: false });
+  assert.equal(mustAcknowledge(orgSide, undefined), false);
+  const siteSide = await siteModulePreview({ _id: SITE, orgId: ORG, metadata: { modules: LIST } }, org(undefined), reordered, data);
+  assert.equal(siteSide.enforces, false);
+  assert.deepEqual(siteSide.newlyDenied, []);
+  assert.equal(calls.staffMembers ?? 0, 0);
+
+  // CONTROL: a CHANGE to the same stored list is previewed against full access, and enforces.
+  const changed = await orgModulePreview(org(LIST), ["visitor-mgmt"], fakeGate({ members: PEOPLE, roles: ROLES }).data);
+  assert.equal(changed.enforces, true);
+  assert.ok(changed.newlyDenied.length > 0);
+  // And an already-enforced list re-saved unchanged keeps its marker.
+  const kept = fakeGate({ saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) } }).data;
+  assert.equal((await orgModulePreview(org(LIST), reordered, kept)).enforces, true);
+});
+
+test("a preview that cannot be computed is treated as a loss", async () => {
+  const { data } = fakeGate({ throwOn: ["staffMembers"] });
+  const preview = await orgModulePreview(org(undefined), ["nfc-patrol"], data);
+  assert.equal(preview.impact, null);
+  assert.equal(mustAcknowledge(preview, undefined), true);
+  assert.equal(mustAcknowledge(preview, true), false);
+});
+
+test("the site preview reads the site's members inside its organisation's enforced list", async () => {
+  const site = { _id: SITE, orgId: ORG, metadata: {} };
+  const { data, calls } = fakeGate({
+    members: PEOPLE,
+    roles: ROLES,
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+  });
+  const preview = await siteModulePreview(site, org(LIST), ["visitor-mgmt"], data);
+  assert.deepEqual(calls.staffMembersQuery, { org: ORG, site: SITE });
+  // Only what the org allowed can be newly denied at the site.
+  assert.ok(preview.newlyDenied.includes("work_orders"));
+  assert.ok(!preview.newlyDenied.includes("nfc-patrol"), "already denied by the org");
+  assert.equal(preview.impact.memberCount, 1); // only `*` held work orders
+});
+
+test("mustAcknowledge: only a real loss, unacknowledged, refuses", () => {
+  const loss = { newlyDenied: ["nfc-patrol"], impact: { memberCount: 2, modules: [] } };
+  const nobody = { newlyDenied: ["nfc-patrol"], impact: { memberCount: 0, modules: [] } };
+  const nothing = { newlyDenied: [], impact: null };
+  assert.equal(mustAcknowledge(loss, undefined), true);
+  assert.equal(mustAcknowledge(loss, "true"), true, "only the boolean true acknowledges");
+  assert.equal(mustAcknowledge(loss, true), false);
+  assert.equal(mustAcknowledge(nobody, undefined), false);
+  assert.equal(mustAcknowledge(nothing, undefined), false);
+  const message = impactUnacknowledgedMessage({
+    newlyDenied: ["nfc-patrol"],
+    impact: { memberCount: 2, modules: [{ module: "nfc-patrol", memberCount: 2 }] },
+  });
+  assert.match(message, /2 people would lose nfc-patrol \(2\)/);
+  assert.match(message, /acknowledgeImpact: true/);
+});
+
+/* ── the audit row is the marker ──────────────────────────────────────── */
+
+test("both module-list audit actions keep the marker, the acknowledgement and the count", () => {
+  assert.equal(GATE_LIST_HASH_FIELD, "gateListHash");
+  for (const action of [ConsoleAuditAction.CLIENT_MODULES_CHANGED, ConsoleAuditAction.SITE_MODULES_CHANGED]) {
+    const row = pickAuditFields(action, {
+      modules: "a, b",
+      moduleCount: 2,
+      gateListHash: "f".repeat(64),
+      acknowledged: false,
+      impactMemberCount: 3,
+      email: "someone@example.com",
+    });
+    assert.deepEqual(Object.keys(row).sort(), [
+      "acknowledged",
+      "gateListHash",
+      "impactMemberCount",
+      "moduleCount",
+      "modules",
+    ]);
+    assert.equal(row.gateListHash.length, 64, "the fingerprint survives the 120-character cut");
+  }
+});
+
+/* ── the shipped handlers, called with stubbed req/res and in-memory deps ── */
+
+/** Run one handler: what it answered (`json`) or passed to `next` (`error`). */
+async function call(handler, { params = {}, body = {}, query = {} } = {}) {
+  const out = { json: undefined, error: undefined };
+  const res = { json: (v) => ((out.json = v), res), status: () => res };
+  await handler({ params, body, query, user: { _id: USER } }, res, (e) => (out.error = e));
+  return out;
+}
+
+const refused = () => Object.assign(new Error("Not authorized."), { statusCode: 401 });
+const NARROW = ["visitor-mgmt"]; // takes work orders away from Ann (`*`)
+
+/** Everything the handlers touch, in memory; `log` records the order of reads and writes. */
+function deps({ stored = LIST, saves = {}, guard = async () => USER } = {}) {
+  const log = [];
+  const gate = fakeGate({ members: PEOPLE, roles: ROLES, saves });
+  const note = (name, value) => (log.push(name), value);
+  return {
+    log,
+    calls: gate.calls,
+    writes: () => log.filter((n) => n === "write" || n === "audit"),
+    audit: [],
+    shared: {
+      _updateById: async () => note("write"),
+      _update: async () => note("write"),
+      gateData: gate.data,
+    },
+    guard,
+    stored,
+  };
+}
+
+function orgHandlers(d) {
+  return orgModulesHandlers({
+    ...d.shared,
+    requireConsolePermission: async (...a) => (d.log.push("guard"), d.guard(...a)),
+    _getById: async (id) => (d.log.push("read"), { _id: id, modules: d.stored }),
+    recordConsoleAction: async (row) => (d.log.push("audit"), d.audit.push(row)),
+  });
+}
+
+const ESTATE = {
+  id: USER,
+  isSuperAdmin: false,
+  orgIds: [ORG],
+  propertyManagementOrgIds: [],
+  memberships: [{ org: ORG, siteId: "", orgLevelRole: true, type: "property_management" }],
+};
+// Reaches the site only through an active engagement: no membership in the site's org.
+const VENDOR = {
+  ...ESTATE,
+  orgIds: [OTHER_ORG],
+  memberships: [{ org: OTHER_ORG, siteId: "", orgLevelRole: true, type: "security_agency" }],
+};
+// Pinned to the site, so the site guard admits them, and `orgIds` counts them.
+const RESIDENT = {
+  ...ESTATE,
+  memberships: [{ org: ORG, siteId: SITE, orgLevelRole: false, type: "resident" }],
+};
+const STAFF = { ...ESTATE, isSuperAdmin: true, staffPermissions: [], orgIds: [], memberships: [] };
+
+function siteHandlers(d, actor) {
+  return siteModulesHandlers({
+    ...d.shared,
+    requireSiteWrite: async () => {
+      d.log.push("guard");
+      if (!actor) throw refused();
+      return actor;
+    },
+    _getSiteById: async (id) =>
+      (d.log.push("read"), d.missing ? null : { _id: id, orgId: ORG, name: "Tower", metadata: { modules: d.stored } }),
+    _getOrgById: async (id) => (d.log.push("read-org"), { _id: id }),
+    recordConsoleAction: async (row) => (d.log.push("audit"), d.audit.push(row)),
+  });
+}
+
+const HASH = GATE_LIST_HASH_FIELD;
+
+test("updateModules: a narrowing save is refused with 409 before anything is written; acknowledged, it saves with the marker", async () => {
+  const d = deps({ saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) } });
+  const { updateModules } = orgHandlers(d);
+  const out = await call(updateModules, { params: { id: ORG }, body: { modules: NARROW } });
+  assert.equal(out.error?.statusCode, 409);
+  assert.match(out.error.message, /acknowledgeImpact: true/);
+  assert.deepEqual(d.writes(), [], "nothing written");
+
+  // CONTROL: acknowledged, the same save goes through, and its row is the marker.
+  const ok = await call(updateModules, { params: { id: ORG }, body: { modules: NARROW, acknowledgeImpact: true } });
+  assert.equal(ok.error, undefined);
+  assert.deepEqual(d.writes(), ["write", "audit"], "written, then recorded");
+  assert.equal(d.audit[0].after[HASH].length, 64);
+  assert.equal(d.audit[0].after.acknowledged, true);
+});
+
+test("updateModules: the Super Admin console re-saving an UNCHANGED, never-acknowledged list needs no acknowledgement and writes no marker", async () => {
+  const d = deps(); // LIST stored the old way: no save row
+  const { updateModules } = orgHandlers(d);
+  const out = await call(updateModules, { params: { id: ORG }, body: { modules: [...LIST].reverse() } });
+  assert.equal(out.error, undefined);
+  assert.deepEqual(d.writes(), ["write", "audit"]);
+  assert.equal(d.audit[0].after[HASH], undefined, "the list stays unenforced");
+  assert.equal(d.calls.staffMembers ?? 0, 0, "nobody's roles read");
+});
+
+test("the console guard runs first: a refused caller reads and writes nothing", async () => {
+  const d = deps({ guard: async () => { throw refused(); } });
+  const { updateModules, previewOrgModules } = orgHandlers(d);
+  for (const handler of [updateModules, previewOrgModules]) {
+    const out = await call(handler, { params: { id: ORG }, body: { modules: NARROW } });
+    assert.equal(out.error?.statusCode, 401);
+    assert.equal(out.json, undefined);
+  }
+  assert.deepEqual(d.log, ["guard", "guard"]);
+  assert.deepEqual(d.calls, {});
+});
+
+test("previewOrgModules answers who loses what and writes nothing", async () => {
+  const d = deps({ saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) } });
+  const out = await call(orgHandlers(d).previewOrgModules, { params: { id: ORG }, body: { modules: NARROW } });
+  assert.ok(out.json.impact.memberCount > 0);
+  assert.deepEqual(d.writes(), []);
+});
+
+test("updateSiteModules: Seven365 staff's narrowing save gets 409 before any write; acknowledged, it carries the marker", async () => {
+  const d = deps({ stored: undefined });
+  const { updateSiteModules } = siteHandlers(d, STAFF);
+  const out = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  assert.equal(out.error?.statusCode, 409);
+  assert.deepEqual(d.writes(), []);
+
+  const ok = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW, acknowledgeImpact: true } });
+  assert.equal(ok.error, undefined);
+  assert.deepEqual(d.writes(), ["write", "audit"]);
+  assert.equal(d.audit[0].after[HASH].length, 64);
+});
+
+test("updateSiteModules: anyone but staff (estate member, resident, engaged provider) still saves, but writes no marker", async () => {
+  for (const [who, actor] of [["estate member", ESTATE], ["resident", RESIDENT], ["provider", VENDOR]]) {
+    const d = deps({ stored: undefined });
+    const { updateSiteModules } = siteHandlers(d, actor);
+    const out = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW, acknowledgeImpact: true } });
+    assert.equal(out.error, undefined, `${who}: the existing save is not narrowed`);
+    assert.deepEqual(d.writes(), ["write", "audit"], who);
+    assert.equal(d.audit[0].after[HASH], undefined, `${who}: the list can never be enforced`);
+    assert.equal(d.calls.staffMembers ?? 0, 0, `${who}: the estate's staff are never read for it`);
+  }
+});
+
+test("updateSiteModules: re-saving the stored site list unchanged needs no acknowledgement and writes no marker", async () => {
+  const d = deps({ stored: NARROW });
+  const out = await call(siteHandlers(d, STAFF).updateSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  assert.equal(out.error, undefined);
+  assert.equal(d.audit[0].after[HASH], undefined);
+});
+
+test("previewSiteModules: an engagement-only provider or a resident is refused before any member is read", async () => {
+  for (const [who, actor] of [["provider", VENDOR], ["resident", RESIDENT]]) {
+    const d = deps({ stored: undefined });
+    const out = await call(siteHandlers(d, actor).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+    assert.equal(out.error?.statusCode, 401, who);
+    assert.equal(out.json, undefined, `${who}: no staff names or roles leave`);
+    assert.deepEqual(d.log, ["guard", "read"], who);
+    assert.deepEqual(d.calls, {}, who);
+  }
+
+  // A missing site answers as missing, like the rest of the site routes.
+  const gone = deps();
+  gone.missing = true;
+  const missing = await call(siteHandlers(gone, ESTATE).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  assert.equal(missing.error?.statusCode, 404);
+
+  // A caller the site guard refuses reads nothing at all.
+  const none = deps();
+  assert.equal((await call(siteHandlers(none, null).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } })).error?.statusCode, 401);
+  assert.deepEqual(none.log, ["guard"]);
+
+  // CONTROL: the estate's own member gets the preview, and nothing is written.
+  for (const actor of [ESTATE, STAFF]) {
+    const ok = deps({ stored: undefined });
+    const answer = await call(siteHandlers(ok, actor).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+    assert.ok(answer.json.impact.memberCount > 0);
+    assert.deepEqual(ok.writes(), []);
+  }
+});
+
+test("/modules: the self-or-staff guard runs before any lookup", async () => {
+  const { data, calls } = fakeGate({ rows: [member()] });
+  const { getModulesByUserIdType } = memberModulesHandlers({
+    requireSelfOrPlatformStaff: async () => { throw refused(); },
+    gateData: data,
+  });
+  const out = await call(getModulesByUserIdType, { params: { id: USER_2, type: "security_agency" } });
+  assert.equal(out.error?.statusCode, 401);
+  assert.deepEqual(calls, {}, "nothing looked up");
+
+  // CONTROL: past the guard it answers `{ denied }`, and a non-hex org/site is not passed on.
+  const ok = memberModulesHandlers({ requireSelfOrPlatformStaff: async () => USER, gateData: data });
+  const answer = await call(ok.getModulesByUserIdType, {
+    params: { id: USER, type: "security_agency" },
+    query: { org: { $ne: "" }, site: "not-an-id" },
+  });
+  assert.deepEqual(answer.json, { denied: [] });
+});
+
+test("owner decision 3: nothing in the gate reads the resident-app switches", () => {
+  for (const file of [
+    "../src/services/module-gate.service.ts",
+    "../src/utils/notification-access.util.ts",
+    "../src/utils/module-access.util.ts",
+  ]) {
+    const text = readFileSync(new URL(file, import.meta.url), "utf8");
+    assert.ok(!/residentAppModules/.test(text), `${file} reads residentAppModules`);
+  }
+});
+
+test("the gate never reads roles through the self-healing GET /api/roles path", () => {
+  const text = readFileSync(new URL("../src/services/module-gate.service.ts", import.meta.url), "utf8");
+  assert.ok(!/useRoleController|getRoles\(|healDefaultRoles/.test(text));
+  // And it never writes.
+  assert.ok(!/insert|updateOne|updateMany|deleteOne|deleteMany|\$set/.test(text));
+});