@7365admin1/core 3.65.2 → 3.66.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.65.2",
+  "version": "3.66.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/backfill-org-owner-roles.test.mjs

@@ -14,9 +14,10 @@
  */
 
 import { strict as assert } from "node:assert";
+import { readFileSync } from "node:fs";
 import test from "node:test";
 
-import { planForOrg, APP_SERVICE_TYPES } from "../tools/backfill-org-owner-roles/backfill.mjs";
+import { planForOrg, planOwnerMembership, totalFromPageRange, APP_SERVICE_TYPES } from "../tools/backfill-org-owner-roles/backfill.mjs";
 import { defaultOwnerRoles } from "./.build/utils/org-default-roles.util.mjs";
 import { MEMBER_TYPES } from "./.build/models/member.model.mjs";
 
@@ -164,3 +165,215 @@ test("a second run over the same organisations plans nothing", () => {
   assert.equal(first.reduce((n, p) => n + p.payloads.length, 0), APP_SERVICE_TYPES.length * 4);
   assert.equal(second.reduce((n, p) => n + (p.payloads?.length ?? 0), 0), 0);
 });
+
+// ─── THE OWNER MEMBERSHIP ───────────────────────────────────────────────────
+//
+// The second half of the tool. Same discipline: the tool decides one thing --
+// "what membership is this organisation missing" -- and that decision is what
+// is tested. Every case has a positive control beside it, because a planner
+// that refused everything would otherwise pass "never writes a second owner"
+// and "fails closed" perfectly while repairing nothing.
+
+const USER = "6a951ce503be44033d434f67";
+const ROLE = "6aa0c7308d25d0ba14fc5c12";
+const owner = (extra = {}) => ({ _id: USER, email: "owner@example.com", ...extra });
+
+test("the row it plans is the one the console's landing page reads", () => {
+  const plan = planOwnerMembership(org({ email: "owner@example.com" }), 0, owner(), ROLE);
+
+  assert.deepEqual(plan.payload, {
+    userId: USER,
+    orgId: ORG,
+    roleId: ROLE,
+    app: "organization",
+    onboardingRequired: true,
+  });
+
+  // `GET /api/members/user/:id/app/organization` is the query. A row of any
+  // other type leaves the owner locked out exactly as they are now, so the
+  // string is the contract and not a default.
+  assert.equal(plan.payload.app, "organization");
+  assert.ok(MEMBER_TYPES.includes(plan.payload.app));
+
+  // POSITIVE CONTROL: the app-typed row the wizard writes for a SITE person is
+  // not this row, and must not satisfy the assertion above.
+  assert.throws(() => assert.equal("property_management_agency", "organization"));
+});
+
+test("an organisation that already has an owner is skipped, with no exceptions", () => {
+  for (const count of [1, 2, 9, 146]) {
+    const plan = planOwnerMembership(org(), count, owner(), ROLE);
+    assert.equal(plan.payload, undefined, `count ${count} must plan nothing`);
+    assert.match(plan.skip, /already has/);
+  }
+
+  // POSITIVE CONTROL: zero is the one count that must NOT be skipped, or the
+  // tool repairs nothing at all.
+  assert.ok(planOwnerMembership(org(), 0, owner(), ROLE).payload);
+});
+
+test("an unknown member count fails closed", () => {
+  for (const count of [-1, null, undefined, NaN, "0", 1.5]) {
+    const plan = planOwnerMembership(org(), count, owner(), ROLE);
+    assert.equal(plan.payload, undefined, `count ${String(count)} must plan nothing`);
+  }
+
+  // POSITIVE CONTROL: a real integer zero still plans.
+  assert.ok(planOwnerMembership(org(), 0, owner(), ROLE).payload);
+});
+
+test("refuses to guess an owner, and refuses to point at no role", () => {
+  // Nobody holds the organisation's e-mail address: there is no owner to write.
+  assert.equal(planOwnerMembership(org(), 0, null, ROLE).payload, undefined);
+  assert.equal(planOwnerMembership(org(), 0, owner({ _id: "" }), ROLE).payload, undefined);
+  assert.equal(planOwnerMembership(org(), 0, owner({ _id: "not-an-id" }), ROLE).payload, undefined);
+
+  // A membership pointing at no role is a member with no permissions at all.
+  assert.equal(planOwnerMembership(org(), 0, owner(), "").payload, undefined);
+  assert.equal(planOwnerMembership(org(), 0, owner(), "nope").payload, undefined);
+
+  // ... and an organisation with no usable id, exactly as `planForOrg` refuses.
+  assert.equal(planOwnerMembership({ _id: "" }, 0, owner(), ROLE).payload, undefined);
+
+  // POSITIVE CONTROL: all four present and well-formed does plan.
+  assert.ok(planOwnerMembership(org(), 0, owner(), ROLE).payload);
+});
+
+// ── the guard that decides whether an organisation is touched at all ────────
+//
+// Both counters fail closed on -1, so this parse is the whole safety rule. It
+// used to fail OPEN: `Number("".split(" of ").pop())` is 0 and
+// `Number.isInteger(0)` is true, so an absent or empty `pageRange` read as
+// "this organisation has no owner" and it would have been written to.
+
+test("an unreadable pageRange is -1, never a confident zero", () => {
+  for (const bad of ["", "   ", undefined, null, "-- - -- of --", "of", "1-1 of", "1-1 of many", {}, []]) {
+    assert.equal(totalFromPageRange(bad), -1, `${JSON.stringify(bad)} must not read as a count`);
+    // ... and -1 must actually stop the write, not merely be returned.
+    assert.equal(planOwnerMembership(org(), totalFromPageRange(bad), owner(), ROLE).payload, undefined);
+  }
+
+  // POSITIVE CONTROL: the OLD parse called an empty pageRange zero owners. If
+  // this ever stops throwing, the fail-open is back.
+  assert.throws(() => assert.equal(Number("".split(" of ").pop()), -1));
+});
+
+// ── the dry run must not write, and "writes nothing" is a claim about a read ──
+//
+// `GET /api/roles` SELF-HEALS: `role.controller` seeds the two owner roles when
+// a whole-org, unsearched, page-1 list comes back empty. A dry run that resolved
+// the owner role therefore WROTE - 6 roles across 3 production organisations on
+// 2026-09-09, from a run that printed "nothing was written". The role is
+// resolved under `--apply` only, where the role pass creates it anyway.
+
+const TOOL = readFileSync("tools/backfill-org-owner-roles/backfill.mjs", "utf8");
+const SNIPPET = readFileSync(
+  "tools/backfill-org-owner-roles/repair-owner-membership-devtools-snippet.js",
+  "utf8",
+);
+/** The body of one function, up to the next top-level `}` at column 0. */
+const body = (src, signature) => {
+  const start = src.indexOf(signature);
+  assert.ok(start >= 0, `${signature} not found`);
+  const end = src.indexOf("\n}", start);
+  return src.slice(start, end < 0 ? undefined : end);
+};
+
+test("the dry-run report never lists an organisation's roles", () => {
+  const report = body(TOOL, "async function reportMemberships(");
+  assert.doesNotMatch(report, /orgOwnerRoleId|api\/roles/);
+
+  // POSITIVE CONTROL: the apply path DOES resolve it - if this stops matching,
+  // the membership has nothing to point at.
+  assert.match(body(TOOL, "async function main("), /orgOwnerRoleId\(id\)/);
+});
+
+test("the snippet resolves the owner role only after APPLY", () => {
+  const [beforeApply, afterApply] = SNIPPET.split("if (!APPLY) {");
+  assert.equal(SNIPPET.includes("const APPLY = false;"), true, "APPLY must default to false");
+  assert.doesNotMatch(beforeApply, /call\(`\/api\/roles/);
+
+  // POSITIVE CONTROL: after the APPLY gate it must read the list, or the
+  // membership points at nothing.
+  assert.match(afterApply, /call\(`\/api\/roles\?org=\$\{p\.id\}&type=organization/);
+});
+
+test("no tool counts roles with a whole-org page-1 list, because that list WRITES", () => {
+  // role.controller :399-406 seeds the two owner roles when a whole-org,
+  // unsearched, site-less, page-1 list comes back empty -- the zero-role
+  // organisations these tools target. page=2 cannot heal, and the total in
+  // `pageRange` is countDocuments, so it is the same number either way.
+  const DRY = readFileSync("tools/backfill-org-owner-roles/dry-run-devtools-snippet.js", "utf8");
+
+  for (const [name, src] of [["backfill.mjs", TOOL], ["dry-run snippet", DRY]]) {
+    const reads = src.match(/\/api\/roles\?org=\$\{[a-zA-Z.]+\}&limit=1&page=[0-9]+/g) ?? [];
+    assert.ok(reads.length, `${name}: expected a role count read`);
+    for (const read of reads) {
+      assert.match(read, /page=2$/, `${name}: ${read} is a page-1 whole-org list, which seeds roles`);
+    }
+  }
+
+  // POSITIVE CONTROL: the shape that heals must be absent from both files. If
+  // this ever matches again, a "dry run" writes.
+  for (const src of [TOOL, DRY]) {
+    assert.doesNotMatch(src, /\/api\/roles\?org=\$\{[a-zA-Z.]+\}&limit=1&page=1/);
+  }
+});
+
+test("the apply pass says why it skipped an organisation it promised to repair", () => {
+  // The dry run resolves no role, so an organisation holding roles but none
+  // named `owner` prints as "to add" and must not then vanish in silence.
+  const main = body(TOOL, "async function main(");
+  assert.match(main, /if \(!plan\.payload\) \{/);
+  assert.match(main, /refused\.push\(\{ org, error: plan\.skip \}\)/);
+
+  // POSITIVE CONTROL: the bare `continue` that swallowed it must be gone.
+  assert.doesNotMatch(main, /if \(!plan\.payload\) continue;/);
+});
+
+test("a SUSPENDED owner membership counts, so no second one is written", () => {
+  // `createMemberDirect` does not de-duplicate, and a suspended owner row is a
+  // deliberate state - counting only `active` would write beside it.
+  const count = body(TOOL, "async function orgMemberCount(");
+  assert.match(count, /\["active", "suspended"\]/);
+  assert.match(count, /status=\$\{status\}/);
+  assert.match(count, /if \(count < 0\) return -1;/);
+
+  const snippetCount = body(SNIPPET, "for (const org of orgs.filter(");
+  assert.match(snippetCount, /\["active", "suspended"\]/);
+
+  // POSITIVE CONTROL: the OLD query pinned one status into the URL. If this
+  // ever matches again, the duplicate is back.
+  for (const src of [count, snippetCount]) {
+    assert.doesNotMatch(src, /status=active&limit=1/);
+  }
+});
+
+test("the header does not promise more than the tool does", () => {
+  // `POST /api/members/direct` also repoints the owner's `defaultOrg` and
+  // completes pending invitations, so "INSERT ONLY / never updates a user" was
+  // false. Both claims are the reason a lead would run this unattended.
+  for (const [name, src] of [["backfill.mjs", TOOL], ["repair snippet", SNIPPET]]) {
+    // One line, gutter stripped: these phrases wrap across comment lines, and a
+    // claim that moved to the next line is still the claim.
+    const header = src
+      .slice(0, src.indexOf("*/"))
+      .replace(/\n\s*\*\s?/g, " ")
+      .replace(/\s+/g, " ");
+    assert.match(header, /defaultOrg/, name);
+    assert.match(header, /completes any pending invitation/, name);
+    assert.match(header, /SELF-HEALS/, name);
+    assert.doesNotMatch(header, /INSERT ONLY/, name);
+  }
+});
+
+test("a genuinely empty page still reads as zero, so the repair still happens", () => {
+  // Measured against the live API: an empty result is "0-0 of 0", not "".
+  assert.equal(totalFromPageRange("0-0 of 0"), 0);
+  assert.ok(planOwnerMembership(org(), totalFromPageRange("0-0 of 0"), owner(), ROLE).payload);
+
+  // and a populated page is its total, not its page size
+  assert.equal(totalFromPageRange("1-1 of 2"), 2);
+  assert.equal(totalFromPageRange("1-10 of 146"), 146);
+  assert.match(planOwnerMembership(org(), totalFromPageRange("1-1 of 2"), owner(), ROLE).skip, /already has 2/);
+});

package/test/console-permission.test.mjs

@@ -211,12 +211,14 @@ function gateCalls() {
   return calls;
 }
 
-test("every console gate call site names a module - all 49 of them", () => {
+test("every console gate call site names a module - all 50 of them", () => {
   const calls = gateCalls();
   // 48 since the module gate added `organization.controller.ts previewOrgModules`
   // and `member.controller.ts getModulesByUserIdType` (self-or-staff, `members`).
   // 49: `member.controller.ts getAllByUser` (self-or-staff, `members`).
-  assert.equal(calls.length, 49, `gate call sites moved: ${calls.length}`);
+  // 50: `organization.controller.ts repairOwnerMembership` (staff, `organizations`)
+  // - the repair for an organisation whose owner membership was never written.
+  assert.equal(calls.length, 50, `gate call sites moved: ${calls.length}`);
 
   const ungoverned = calls.filter(
     ([, call]) =>

package/test/e2e/harness.mjs

@@ -659,6 +659,7 @@ function buildApp(nsu, core) {
       getByEmail,
       getOrgsByEmail,
       update,
+      repairOwnerMembership,
     } = core.useOrgController();
 
     organizations.post("/", requireAuth, add);
@@ -671,6 +672,10 @@ function buildApp(nsu, core) {
     organizations.get("/email/:email", requireAuth, getByEmail);
     organizations.get("/orgs/:email", requireAuth, getOrgsByEmail);
     organizations.put("/:id", requireAuth, update);
+    // The owner-membership repair. API-core's own route is a separate change;
+    // this mount is the shape it will carry (`requireAuth`, and the staff gate
+    // inside the handler).
+    organizations.post("/:id/owner-membership", requireAuth, repairOwnerMembership);
   }
 
   // mirrors iservice365-API-core/src/routes/promo-code.route.ts