@7365admin1/core 3.64.5 → 3.65.1

package/test/notification-access.test.mjs

@@ -0,0 +1,197 @@
+/*
+ * Q7 (owner, 2026-09-11): staff get no notifications for modules they cannot
+ * open. Shipped in LOG-ONLY mode: counted, logged, and still sent to everyone.
+ * Only the Super Admin module list can ever drop anybody; the role check is
+ * logged only (master plan rule 3). Any error sends to everyone.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+import {
+  filterByAccess,
+  notificationAccessReport,
+  notifyAccessMode,
+} from "./.build/utils/notification-access.util.mjs";
+import {
+  ORG,
+  SITE,
+  USER,
+  USER_2,
+  CLIENT_SAVE,
+  SITE_SAVE,
+  ackRow,
+  oldRow,
+  member,
+  fakeGate,
+  withEnv,
+} from "./module-gate.fixtures.mjs";
+
+const SITE_DOC = { _id: SITE, orgId: ORG, metadata: {} };
+// The client was given visitors only: work orders, feedback, incidents... are denied.
+const LIST = ["visitor-mgmt"];
+const enforced = (over = {}) =>
+  fakeGate({
+    orgs: { [ORG]: { _id: ORG, modules: LIST } },
+    sites: { [SITE]: SITE_DOC },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(LIST) },
+    roles: { r1: { permissions: ["*"] } },
+    ...over,
+  });
+const WO = { category: "workOrder", siteId: SITE };
+const on = (fn) => withEnv({ NOTIFY_ACCESS_FILTER: "on", MODULE_LIST_GATE: undefined }, fn);
+
+test("the code default is LOG; anything unrecognised is log", () => {
+  assert.equal(notifyAccessMode({}), "log");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "garbage" }), "log");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "ON" }), "on");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "off" }), "off");
+});
+
+test("LOG never drops: the denied recipient is counted and still sent to", async () => {
+  const { data } = enforced({ rows: [member()] });
+  const report = await notificationAccessReport([USER], WO, data);
+  assert.deepEqual(report.dropByModule, [USER], "control: the list does deny work orders");
+  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: undefined }, () => filterByAccess([USER], WO, data));
+  assert.deepEqual(sent, [USER]);
+});
+
+test("ON drops only the member whose client list denies the module", async () => {
+  const other = member({ user: USER_2, org: "9".repeat(24), siteId: SITE }); // a provider: own org, no list
+  const { data } = enforced({ rows: [member(), other] });
+  assert.deepEqual(await on(() => filterByAccess([USER, USER_2], WO, data)), [USER_2]);
+  // CONTROL: a category the list gives is kept.
+  assert.deepEqual(await on(() => filterByAccess([USER], { category: "visitors", siteId: SITE }, data)), [USER]);
+});
+
+test("the kill switch and OFF read nothing and drop nothing", async () => {
+  for (const env of [
+    { NOTIFY_ACCESS_FILTER: "off" },
+    { NOTIFY_ACCESS_FILTER: "on", MODULE_LIST_GATE: "off" },
+  ]) {
+    const { data, calls } = enforced({ rows: [member()] });
+    assert.deepEqual(await withEnv(env, () => filterByAccess([USER], WO, data)), [USER]);
+    assert.deepEqual(calls, {}, JSON.stringify(env));
+  }
+});
+
+test("an old, never-acknowledged list drops nobody", async () => {
+  const { data } = enforced({ rows: [member()], saves: { [`${CLIENT_SAVE}|${ORG}`]: oldRow(LIST) } });
+  assert.deepEqual(await on(() => filterByAccess([USER], WO, data)), [USER]);
+});
+
+test("exempt sends: no site, an unknown category, or one no permission governs", async () => {
+  for (const ctx of [
+    { category: "workOrder" },
+    { category: "not-a-category", siteId: SITE },
+    { category: "myVisitors", siteId: SITE },
+    { category: "prelovedMarketplace", siteId: SITE },
+    { category: "marketplaceOrder", siteId: SITE },
+  ]) {
+    const { data, calls } = enforced({ rows: [member()] });
+    assert.equal(await notificationAccessReport([USER], ctx, data), null, JSON.stringify(ctx));
+    assert.deepEqual(await on(() => filterByAccess([USER], ctx, data)), [USER]);
+    assert.deepEqual(calls, {}, "an exempt send reads nothing");
+  }
+});
+
+test("exempt recipients: residents, Seven365 staff, and anyone with no membership here", async () => {
+  const resident = member({ type: "resident", siteId: SITE });
+  const staff = member({ user: USER_2 });
+  const staffRow = member({ user: USER_2, type: "admin", org: "" });
+  const { data } = enforced({ rows: [resident, staff, staffRow] });
+  const stranger = "1".repeat(24); // a push-token user with no member row
+  const report = await notificationAccessReport([USER, USER_2, stranger], WO, data);
+  assert.deepEqual(report.dropByModule, []);
+  assert.deepEqual(report.noMember, [stranger], "counted, never dropped");
+  assert.deepEqual(await on(() => filterByAccess([USER, USER_2, stranger], WO, data)), [USER, USER_2, stranger]);
+});
+
+test("spelling groups: a list giving `workOrder` keeps every work-order notification", async () => {
+  const list = ["workOrder"];
+  const { data } = enforced({
+    rows: [member()],
+    orgs: { [ORG]: { _id: ORG, modules: list } },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(list) },
+  });
+  assert.deepEqual(await on(() => filterByAccess([USER], WO, data)), [USER]);
+});
+
+test("an ungoverned resource is never denied, and a two-module category needs both denied", async () => {
+  const { data } = enforced({ rows: [member()] });
+  // cameraFault is governed by `site-settings`, which a list can never take away.
+  assert.deepEqual(await on(() => filterByAccess([USER], { category: "cameraFault", siteId: SITE }, data)), [USER]);
+  const list = ["facility-mgmt"]; // facilityBooking = facility-booking-mgmt + facility-mgmt
+  const one = enforced({
+    rows: [member()],
+    orgs: { [ORG]: { _id: ORG, modules: list } },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(list) },
+  }).data;
+  assert.deepEqual(await on(() => filterByAccess([USER], { category: "facilityBooking", siteId: SITE }, one)), [USER]);
+});
+
+test("a person kept by ANY of their memberships at the site is kept", async () => {
+  const pinnedElsewhereOrg = member({ _id: "x2", org: "9".repeat(24), siteId: SITE });
+  const { data } = enforced({ rows: [member(), pinnedElsewhereOrg] });
+  assert.deepEqual(await on(() => filterByAccess([USER], WO, data)), [USER]);
+});
+
+test("the ROLE check is logged, never enforced: `*` and [] hold everything", async () => {
+  // A list that gives work orders, so only the role can matter (and a list
+  // must be enforced here for anything to be looked at at all).
+  const gives = ["workOrder", "visitor-mgmt"];
+  const listed = {
+    sites: { [SITE]: SITE_DOC },
+    orgs: { [ORG]: { _id: ORG, modules: gives } },
+    saves: { [`${CLIENT_SAVE}|${ORG}`]: ackRow(gives) },
+  };
+  const { data } = fakeGate({
+    ...listed,
+    rows: [member({ role: "star" }), member({ user: USER_2, role: "visitorsOnly" })],
+    roles: { star: { permissions: ["*"] }, visitorsOnly: { permissions: ["visitor-mgmt:add-visitor"] } },
+  });
+  const report = await notificationAccessReport([USER, USER_2], WO, data);
+  assert.deepEqual(report.dropByRole, [USER_2]);
+  assert.deepEqual(report.dropByModule, []);
+  assert.deepEqual(await on(() => filterByAccess([USER, USER_2], WO, data)), [USER, USER_2]);
+
+  const empty = fakeGate({ ...listed, rows: [member()], roles: { r1: { permissions: [] } } }).data;
+  assert.deepEqual((await notificationAccessReport([USER], WO, empty)).dropByRole, []);
+});
+
+test("no ENFORCED list at the site or its org: returns early, with no members or roles query", async () => {
+  for (const setup of [
+    {}, // no list anywhere: today's whole estate
+    { orgs: { [ORG]: { _id: ORG, modules: LIST } } }, // stored, never acknowledged
+  ]) {
+    const { data, calls } = fakeGate({ rows: [member()], sites: { [SITE]: SITE_DOC }, ...setup });
+    assert.deepEqual(await on(() => filterByAccess([USER], WO, data)), [USER]);
+    assert.equal(calls.membershipsOf ?? 0, 0, "no members query");
+    assert.equal(calls.roles ?? 0, 0, "no roles query");
+  }
+
+  // CONTROL: an enforced SITE list alone is enough to look, and to drop.
+  const { data, calls } = fakeGate({
+    rows: [member()],
+    sites: { [SITE]: { ...SITE_DOC, metadata: { modules: LIST } } },
+    saves: { [`${SITE_SAVE}|${SITE}`]: ackRow(LIST) },
+  });
+  assert.deepEqual(await on(() => filterByAccess([USER], WO, data)), []);
+  assert.equal(calls.membershipsOf, 1);
+});
+
+test("any error sends to everyone, even in ON mode", async () => {
+  for (const broken of ["membershipsOf", "site", "org", "latestSave", "roles"]) {
+    const { data } = enforced({ rows: [member()], throwOn: [broken] });
+    assert.deepEqual(await on(() => filterByAccess([USER], WO, data)), [USER], broken);
+  }
+});
+
+test("core's sender filters BEFORE the preference guard, on both channels", () => {
+  const text = readFileSync(new URL("../src/services/notification.service.ts", import.meta.url), "utf8");
+  const send = text.slice(text.indexOf("async function send("), text.indexOf("const SAFETY_APP_SLUG"));
+  const filter = send.indexOf("userIds = await filterByAccess(userIds, { category: key, siteId: data?.siteId })");
+  assert.ok(filter > 0, "send() does not call the filter");
+  assert.ok(filter < send.indexOf('_filterRecipients(userIds, key, "inApp")'));
+  assert.ok(filter < send.indexOf('_filterRecipients(userIds, key, "push")'));
+});

package/test/org-record-reach.test.mjs

@@ -0,0 +1,45 @@
+/*
+ * GET /api/organizations/id/:id hands the WHOLE record only to a real
+ * relationship; everybody else gets the name-only projection, never a 401.
+ * The behaviour is proved end to end in test/e2e/organization-record-reach
+ * (needs a local mongod, so CI does not run it); these source checks keep the
+ * wiring from quietly regressing in the suite CI does run.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const ORG = readFileSync("src/controllers/organization.controller.ts", "utf8");
+const AUTHZ = readFileSync("src/utils/console-authz.util.ts", "utf8");
+const ACTOR = readFileSync("src/utils/invite-actor.util.ts", "utf8");
+
+const body = (src, name, len = 1800) => src.slice(src.indexOf(name), src.indexOf(name) + len);
+
+test("getById decides full vs name-only through canReadOrgRecord", () => {
+  const getById = body(ORG, "async function getById(");
+  assert.match(getById, /\(await canReadOrgRecord\(req, _id\)\)\s*\?\s*await _getById\(_id\)\s*:\s*await _getNameById\(_id\)/);
+  // CONTROL: the old "any session gets everything" line is gone.
+  assert.doesNotMatch(getById, /callerId\(req\) \? await _getById/);
+});
+
+test("canReadOrgRecord never throws a refusal - it answers yes or no", () => {
+  const fn = body(AUTHZ, "export async function canReadOrgRecord(", 1400);
+  assert.match(fn, /gate\.then\(\(\) => true, \(\) => false\)/);
+  assert.match(fn, /requireOrgReach\(req, org\)/);
+  assert.match(fn, /requireConsolePermission\(req, "organizations", "see-organization-details"\)/);
+  assert.match(fn, /hasOrgSiteReach\(id, org, actor\.orgIds\)/);
+});
+
+test("the resident road counts only an active account and an active/approved site.people row; the provider road ignores a dead engagement", () => {
+  const fn = body(ACTOR, "export async function hasOrgSiteReach(", 4500);
+  // A rejected or resubmit applicant can sign in with the site and unit they
+  // applied for still on the account.
+  assert.match(fn, /projection: \{ site: 1, unitId: 1, status: 1 \}/);
+  assert.match(fn, /if \(!user \|\| !readsAsApprovedAccount\(user\.status\)\) return false;/);
+  assert.ok(
+    fn.indexOf("readsAsApprovedAccount(user.status)") < fn.indexOf('collection("site.people")'),
+    "the account check runs before any resident road",
+  );
+  assert.match(fn, /status: \{ \$in: \["active", "approved"\] \}/);
+  assert.match(fn, /status: "active",\s*deletedAt: \{ \$in: \["", null\] \}/);
+});

package/test/resident-app-modules.test.mjs

@@ -100,18 +100,55 @@ test("every one of the ten keys is always answered", () => {
 
 test("turning ON a module Seven365 turned OFF is refused, by name", () => {
   assert.deepEqual(
-    residentAppModulesAboveCeiling({ access: false }, { access: true }),
+    residentAppModulesAboveCeiling({ access: false }, { access: true }, { access: false }),
     ["access"],
   );
   assert.deepEqual(
     residentAppModulesAboveCeiling(
       { access: false, onlineForm: false },
       { access: true, onlineForm: true, feedback: true },
+      { access: false, onlineForm: false, feedback: false },
     ),
     ["access", "onlineForm"],
   );
 });
 
+/*
+ * L2, 2026-09-11. Every Site Settings save sends the WHOLE metadata back: the
+ * PM resident panel fills absent switches in as `true` and sends all ten, and
+ * the HID QR / face-reader panels send back whatever they read. Judging the
+ * request alone meant ONE unticked module at the client refused every save at
+ * every one of its sites - including saves that never touched a resident switch.
+ */
+test("a save that re-sends what the site already has is never refused", () => {
+  const ceiling = { access: false, onlineForm: false };
+  // nothing stored: the panel sends all ten as true (absent == on)
+  assert.deepEqual(residentAppModulesAboveCeiling(ceiling, allOn(), undefined), []);
+  assert.deepEqual(residentAppModulesAboveCeiling(ceiling, allOn(), {}), []);
+  // stored true (saved before the ceiling existed) is re-sent unchanged
+  assert.deepEqual(residentAppModulesAboveCeiling(ceiling, allOn(), allOn()), []);
+  // stored false is re-sent unchanged while ANOTHER switch changes
+  assert.deepEqual(
+    residentAppModulesAboveCeiling(
+      ceiling,
+      { ...allOn(), access: false, feedback: false },
+      { ...allOn(), access: false },
+    ),
+    [],
+  );
+});
+
+test("only the switch actually being flipped from off to on is named", () => {
+  assert.deepEqual(
+    residentAppModulesAboveCeiling(
+      { access: false, onlineForm: false },
+      allOn(),
+      { access: false, onlineForm: true },
+    ),
+    ["access"],
+  );
+});
+
 test("an organisation with no ceiling refuses nothing", () => {
   // Every live organisation is in this state today. If this refused, the Site
   // Settings panel would stop saving for everybody on deploy.
@@ -184,6 +221,13 @@ test("the site WRITE refuses only when it actually carries the switches", () =>
   assert.match(SITE_CONTROLLER, /residentAppModulesAboveCeiling\(/);
 });
 
+test("the site WRITE judges the request against what the site already STORES", () => {
+  const start = SITE_CONTROLLER.search(/residentAppModulesAboveCeiling\(\s/);
+  assert.ok(start >= 0, "the site write calls residentAppModulesAboveCeiling");
+  const call = SITE_CONTROLLER.slice(start, start + 300);
+  assert.match(call, /\(existing as any\)\?\.metadata\?\.residentAppModules/);
+});
+
 test("Seven365 sets the ceiling on the console's own endpoint, and it is optional", () => {
   // Optional so the existing console screen, which sends only `modules`, keeps
   // working and leaves the resident-app ceiling exactly as it was.

package/test/role-member-org-scope.test.mjs

@@ -89,7 +89,8 @@ test("enrolling yourself needs reach; enrolling anybody else needs membership",
   const body = fn(memberController, "createMemberDirect");
   assert.match(
     body,
-    /if \(userId === callerId\(req\)\)[\s\S]{0,120}await requireOrgReach\(req, orgId\)[\s\S]{0,80}else[\s\S]{0,80}await requireOrgAccess\(req, orgId\)/,
+    // ...and yourself only with a role you may give yourself (requireSelfEnrolRole).
+    /if \(userId === callerId\(req\)\)[\s\S]{0,120}await requireOrgReach\(req, orgId\)[\s\S]{0,120}await requireSelfEnrolRole\(req, orgId, roleId\)[\s\S]{0,40}else[\s\S]{0,80}await requireOrgAccess\(req, orgId\)/,
   );
 });
 

package/test/site-modules.test.mjs

@@ -33,7 +33,29 @@ import {
   permissionsOutsideModules,
   requireWithinModules,
   keepStoredSiteModules,
+  siteModulesForOrg,
 } from "./.build/utils/site-modules.util.mjs";
+
+test("a site's list narrows a role only when the site belongs to the role's organisation", () => {
+  const site = { orgId: "org-client", metadata: { modules: ["visitor-mgmt"] } };
+  assert.deepEqual(siteModulesForOrg(site, "org-client"), ["visitor-mgmt"]);
+  // A provider's role at the client's site: the client's site list does not apply.
+  assert.equal(siteModulesForOrg(site, "org-provider"), undefined);
+  // Older site rows carry `org` instead of `orgId`.
+  assert.deepEqual(siteModulesForOrg({ org: "org-client", metadata: { modules: ["a"] } }, "org-client"), ["a"]);
+  // A site with no recorded owner does not narrow an org's role; no site, nothing.
+  assert.equal(siteModulesForOrg({ metadata: { modules: ["a"] } }, "org-client"), undefined);
+  assert.equal(siteModulesForOrg(null, "org-client"), undefined);
+  // A role with NO organisation (role-v2 allows it) is still limited by the
+  // site's own list, exactly as before - leaving `org` out must not widen.
+  assert.deepEqual(siteModulesForOrg(site, ""), ["visitor-mgmt"]);
+  assert.deepEqual(siteModulesForOrg(site, undefined), ["visitor-mgmt"]);
+});
+
+test("moduleCeiling passes the site list through the owner check", () => {
+  const src = readFileSync("src/utils/module-ceiling.util.ts", "utf8");
+  assert.match(src, /effectiveSiteModules\(\s*\(orgDoc as any\)\?\.modules,\s*siteModulesForOrg\(siteDoc, orgId\),\s*\)/);
+});
 import { ALWAYS_ALLOWED } from "./.build/utils/org-modules.util.mjs";
 
 /* ── reading: it must never return "nothing" ───────────────────────────── */

package/test/staff-console-authz.test.mjs

@@ -120,6 +120,15 @@ const GUARDED = [
     "requireConsolePermission",
     "_update(",
   ],
+  // The read-only "who would lose what" preview that must come before a
+  // narrowing `updateModules` save: the same gate, since it reads a client's
+  // member names and roles.
+  [
+    "organization.controller.ts",
+    "previewOrgModules",
+    "requireConsolePermission",
+    "orgModulePreview(",
+  ],
   ["organization-v2.controller.ts", "getAll", "requireConsolePermission", "_getAll("],
   [
     "organization-v2.controller.ts",

package/test/user-field-self-allowlist.test.mjs

@@ -0,0 +1,39 @@
+/*
+ * PATCH /api/users/field/:id (and /v2): self-service is an explicit allow-list
+ * of profile fields; `status` and every other field are staff-only, and
+ * `defaultOrg` only to an organisation the caller reaches. Proved end to end in
+ * test/e2e/user-field-self-allowlist (needs a local mongod, so CI does not run
+ * it); these source checks keep the wiring in the suite CI does run.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const AUTHZ = readFileSync("src/utils/console-authz.util.ts", "utf8");
+const V1 = readFileSync("src/controllers/user.controller.ts", "utf8");
+const V2 = readFileSync("src/controllers/user-v2.controller.ts", "utf8");
+
+const allow = AUTHZ.slice(AUTHZ.indexOf("export const SELF_EDITABLE_USER_FIELDS"));
+const listed = allow.slice(0, allow.indexOf("];")).match(/"([a-zA-Z]+)"/g).map((s) => s.slice(1, -1));
+
+test("the self-service list is exactly the profile fields the apps send", () => {
+  assert.deepEqual([...listed].sort(), ["contact", "dateOfBirth", "gender", "name", "nric", "profile"]);
+  for (const f of ["status", "email", "plateNumber", "defaultOrg"]) {
+    assert.ok(!listed.includes(f), `${f} must not be self-service`);
+  }
+});
+
+test("defaultOrg is self-set only through requireOrgReach, and the fall-through is staff", () => {
+  const start = AUTHZ.indexOf("export async function requireUserFieldWrite(");
+  const fn = AUTHZ.slice(start, AUTHZ.indexOf("export const SELF_EDITABLE_USER_FIELDS"));
+  assert.match(fn, /field === "defaultOrg"/);
+  assert.match(fn, /requireOrgReach\(req, org\)/);
+  // the LAST statement of the function: anything not allowed above is staff
+  assert.match(fn, /return await requirePlatformStaff\(req, grant\);\s*\}\s*(\/\*\*[\s\S]*?\*\/\s*)?$/);
+});
+
+test("both controllers hand the value to the gate", () => {
+  for (const src of [V1, V2]) {
+    assert.match(src, /requireUserFieldWrite\(req, _id, payload\.field, \{ resource: "users" \}, payload\.value\)/);
+  }
+});