@7365admin1/core 3.65.1 → 3.65.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.65.1",
+  "version": "3.65.2",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/console-permission.test.mjs

@@ -211,11 +211,12 @@ function gateCalls() {
   return calls;
 }
 
-test("every console gate call site names a module - all 48 of them", () => {
+test("every console gate call site names a module - all 49 of them", () => {
   const calls = gateCalls();
   // 48 since the module gate added `organization.controller.ts previewOrgModules`
   // and `member.controller.ts getModulesByUserIdType` (self-or-staff, `members`).
-  assert.equal(calls.length, 48, `gate call sites moved: ${calls.length}`);
+  // 49: `member.controller.ts getAllByUser` (self-or-staff, `members`).
+  assert.equal(calls.length, 49, `gate call sites moved: ${calls.length}`);
 
   const ungoverned = calls.filter(
     ([, call]) =>

package/test/e2e/member-by-user-reach.e2e.test.mjs

@@ -0,0 +1,135 @@
+// End-to-end proof that `GET /api/members/users/:id` — every membership a
+// person holds, across every client — is no longer readable by anybody.
+//
+// It was `requireAuth` and nothing more, so any signed-in account could read
+// which organisations, apps and sites any other person works for. Now:
+//   - the person themselves and Seven365 staff get the whole list;
+//   - anybody else gets only the rows in organisations they reach — filtered,
+//     never refused, so no screen gets a 401 and no mobile app signs out.
+//
+// Consumers exercised (every call site in the org):
+//   - web-app-account / web-app-org layouts/default.vue, web-app-main
+//     pages/sign-in.vue: the signed-in user's OWN id (case 1).
+//   - layer-common ServiceProviderMain.vue (e-mail check + view dialog): a
+//     client admin reading a PROVIDER's id (case 3).
+//   - layer-common InvitationClientForm.vue (web-app-org super-admin client
+//     list): Seven365 staff reading anybody (case 2).
+//
+// Everything runs against the harness's throwaway in-process MongoDB. Nothing
+// real is touched; assertions compare ids and counts only.
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Reach-Passw0rd!";
+const PROVIDER = "provider@e2e.example.com";   // works on client A's and client B's sites
+const ADMIN_A = "admin-a@e2e.example.com";     // client A's own admin
+const STRANGER = "stranger@e2e.example.com";   // a resident of client C only
+const RESUBMIT = "resubmit@e2e.example.com";   // applicant at client A, asked to resubmit
+const STAFF = "sevenstaff@e2e.example.com";
+
+describe("GET /members/users/:id is self/staff in full, otherwise filtered to reach", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const [k, email] of Object.entries({ PROVIDER, ADMIN_A, STRANGER, RESUBMIT, STAFF })) {
+      sid[k] = await h.login(email, PASSWORD);
+    }
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const read = async (who, userId) => {
+    const res = await h.api(`/members/users/${userId}`, { sid: sid[who] });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body.total, res.body.items.length);
+    return res.body.items.map((m) => String(m.org ?? "")).sort();
+  };
+
+  it("1. the person reads all of their own memberships", async () => {
+    assert.deepEqual(await read("PROVIDER", id.provider), [id.orgA, id.orgB, id.orgSP].map(String).sort());
+  });
+
+  it("2. Seven365 staff read anybody's in full (the console's client form)", async () => {
+    assert.deepEqual(await read("STAFF", id.provider), [id.orgA, id.orgB, id.orgSP].map(String).sort());
+  });
+
+  it("3. a client admin sees only the provider's row in their own client", async () => {
+    // ServiceProviderMain's e-mail check still finds the row at this org/site.
+    const res = await h.api(`/members/users/${id.provider}`, { sid: sid.ADMIN_A });
+    assert.equal(res.status, 200);
+    assert.deepEqual(res.body.items.map((m) => String(m.org)), [String(id.orgA)]);
+    assert.equal(res.body.items[0].type, "cleaning");
+    assert.equal(String(res.body.items[0].siteId), String(id.siteA));
+    const text = JSON.stringify(res.body);
+    assert.ok(!text.includes(String(id.orgB)) && !text.includes(String(id.orgSP)), "no other client leaks");
+  });
+
+  it("4. a stranger gets an empty list, not a 401", async () => {
+    assert.deepEqual(await read("STRANGER", id.provider), []);
+  });
+
+  it("5. a resubmit applicant with an active resident row reaches nothing", async () => {
+    assert.deepEqual(await read("RESUBMIT", id.provider), []);
+  });
+
+  it("6. a Seven365 staff row (no org) is never in a client's reach", async () => {
+    assert.deepEqual(await read("ADMIN_A", id.staff), []);
+  });
+
+  it("7. the same person's cached list is still whole for them afterwards", async () => {
+    // The filter must never be written into the per-person cache.
+    assert.equal((await read("PROVIDER", id.provider)).length, 3);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const [orgA, orgB, orgC, orgSP, siteA, siteB] = Array.from({ length: 6 }, () => new ObjectId());
+  const [staffRole, roleA, roleB, roleC, roleSP] = Array.from({ length: 5 }, () => new ObjectId());
+
+  const org = (_id, name) => ({ _id, name, email: `${name.replace(/\W/g, "").toLowerCase()}@e2e.example.com`, type: "org", nature: "property_management_agency", status: "active", createdAt: now });
+  await h.db.collection("organizations").insertMany([org(orgA, "Client A"), org(orgB, "Client B"), org(orgC, "Client C"), org(orgSP, "Clean Co")]);
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "Site A", org: orgA, orgId: orgA, status: "active" },
+    { _id: siteB, name: "Site B", org: orgB, orgId: orgB, status: "active" },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: roleA, name: "Admin", org: orgA, permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Admin", org: orgB, permissions: ["*"], status: "active" },
+    { _id: roleC, name: "Resident", org: orgC, permissions: [], status: "active" },
+    { _id: roleSP, name: "Owner", org: orgSP, permissions: ["*"], status: "active" },
+  ]);
+
+  const people = [
+    [PROVIDER, "active"], [ADMIN_A, "active"], [STRANGER, "active"], [RESUBMIT, "resubmit"], [STAFF, "active"],
+  ];
+  const users = await h.db.collection("users").insertMany(
+    people.map(([email, status]) => ({ email, name: email.split("@")[0], status, createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: people.map(([e]) => e) } }, { $set: { password: hashed } });
+  const [provider, adminA, stranger, resubmit, staff] = people.map((_, i) => users.insertedIds[i]);
+
+  await h.db.collection("members").insertMany([
+    { user: provider, org: orgSP, type: "organization", role: roleSP, status: "active" },
+    { user: provider, org: orgA, siteId: siteA, type: "cleaning", role: roleA, status: "active" },
+    { user: provider, org: orgB, siteId: siteB, type: "cleaning", role: roleB, status: "active" },
+    { user: adminA, org: orgA, type: "organization", role: roleA, status: "active" },
+    { user: stranger, org: orgC, type: "resident", role: roleC, status: "active" },
+    { user: resubmit, org: orgA, type: "resident", role: roleA, status: "active" },
+    { user: staff, type: "admin", role: staffRole, status: "active" },
+  ]);
+
+  return { orgA, orgB, orgC, orgSP, siteA, siteB, provider, adminA, stranger, resubmit, staff };
+}

package/test/resident-ownership-scope.test.mjs

@@ -69,11 +69,15 @@ test("onboarding completion is STOPPED, not tightened, and says so", () => {
   assert.match(body, /DELIBERATELY LEFT AT ORG REACH/);
 });
 
-test("the all-clients membership read is deliberately left alone", () => {
+test("the all-clients membership read is whole for self/staff, filtered for others", () => {
   // `GET /api/members/users/:id` is how layer-common's ServiceProviderMain looks
-  // somebody else up by e-mail. Self-scoping it would break that screen, and the
-  // route-to-permission map still lists it as an open judgement call.
-  assert.doesNotMatch(fn(member, "getAllByUser"), /requireSelfOrPlatformStaff/);
+  // somebody else up by e-mail, so it is FILTERED to reached orgs, not refused.
+  // Behaviour: test/e2e/member-by-user-reach.e2e.test.mjs.
+  const body = fn(member, "getAllByUser");
+  assert.match(body, /requireSelfOrPlatformStaff\(req, userId/);
+  assert.match(body, /membershipsInReach\(req, data\.items\)/);
+  assert.match(fn(member, "membershipsInReach"), /requireOrgReach\(req, org\)/);
+  assert.match(fn(member, "membershipsInReach"), /callerAccountApproved/);
 });
 
 /* ------------------------------------------------------------- D3.14 */