@7365admin1/core 3.65.2 → 3.66.0

package/test/staff-console-authz.test.mjs

@@ -129,6 +129,18 @@ const GUARDED = [
     "requireConsolePermission",
     "orgModulePreview(",
   ],
+  // Repairing an organisation whose owner membership was never written. Writing
+  // a membership for somebody else is a console operation, so it takes the staff
+  // gate plus the `organizations` module — and nothing about WHO gets the row
+  // comes from the request: the account is derived server-side from the
+  // organisation's own registered address (`hasOrgOwnership`). See
+  // org-owner-repair.test.mjs and its e2e twin.
+  [
+    "organization.controller.ts",
+    "repairOwnerMembership",
+    "requireConsolePermission",
+    "createMemberDirect(",
+  ],
   ["organization-v2.controller.ts", "getAll", "requireConsolePermission", "_getAll("],
   [
     "organization-v2.controller.ts",

package/tools/backfill-org-owner-roles/backfill.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 /**
  * GIVE EVERY ROLE-LESS ORGANISATION THE TWO OWNER ROLES A PAID SIGNUP ALREADY
- * GETS -- through the ordinary authenticated API, never the database.
+ * GETS, AND EVERY OWNER-LESS ORGANISATION ITS OWNER MEMBERSHIP -- through the
+ * ordinary authenticated API, never the database.
  *
  * ## Why this exists
  *
@@ -15,9 +16,35 @@
  *
  * ## What it will not do
  *
- * - **INSERT ONLY.** The only request it ever sends that is not a GET is
- *   `POST /api/roles`. It never updates, deletes or repoints a role, member,
- *   invitation or user.
+ * - **It only ever ADDS.** The only requests it sends that are not a GET are
+ *   `POST /api/roles` and `POST /api/members/direct`. It never deletes or
+ *   repoints a role, member, invitation or user. Two server-side side effects
+ *   ride along with the membership, so "insert only" would overstate it:
+ *   `createMemberDirect` also points the owner's `defaultOrg` at this
+ *   organisation and completes any pending invitation for that address.
+ * - **A dry run really does write nothing** -- but only because it does not
+ *   list an organisation's roles. `GET /api/roles` SELF-HEALS: a whole-org,
+ *   unsearched, page-1 list that comes back empty seeds the two owner roles
+ *   (that is how 6 roles appeared across 3 production organisations on
+ *   2026-09-09). The owner role is therefore resolved under `--apply` only.
+ *
+ * ## The second half: the owner membership
+ *
+ * An organisation created through `POST /api/organizations/onboarding` before
+ * 2026-09-08 got no `members` row of its own. Until 3.60.0 that row was written
+ * by the wizard's step 1, which is skippable -- so an owner who skipped it, or
+ * whose browser dropped the call, ended up owning an organisation they cannot
+ * open: `GET /api/members/user/:id/app/organization` answers 404, and every
+ * console lands them back on "create an organisation". Measured on production
+ * 2026-09-09: JLL Singapore (31 Aug) and two QA organisations are in exactly
+ * that state, and no organisation created since has been -- the server now
+ * writes the row with the organisation itself.
+ *
+ * Who the owner is, is not guessed. It is the same rule the server's own
+ * `hasOrgOwnership` uses to let that person reach the organisation at all: the
+ * account whose e-mail address the organisation is registered under. An
+ * organisation whose e-mail resolves to no account, or that already holds an
+ * `organization` membership, is skipped.
  * - **No database.** It holds no connection string and speaks only to the API,
  *   so every write is authorised, rate-limited and audited exactly like a write
  *   from the console.
@@ -72,6 +99,8 @@ export const APP_SERVICE_TYPES = [
   "pool_maintenance_services",
 ];
 
+import { pathToFileURL } from "node:url";
+
 const HEX24 = /^[0-9a-fA-F]{24}$/;
 
 /**
@@ -140,7 +169,69 @@ export function planForOrg(org, existingRoleCount) {
   return { payloads };
 }
 
-// ─── everything below is I/O ────────────────────────────────────────────────
+/**
+ * The owner membership this organisation is missing, if it is missing one.
+ *
+ * Pure, for the same reason `planForOrg` is: the decision is what the tests
+ * exercise, and no decision is taken in the I/O below.
+ *
+ * `type: "organization"` is not a detail. It is the exact row every console
+ * landing page reads (`GET /api/members/user/:id/app/organization`), so a row
+ * of any other type leaves the owner locked out just the same.
+ *
+ * @returns `{ skip: <reason> }` or `{ payload: {...} }`
+ */
+export function planOwnerMembership(org, orgMemberCount, owner, ownerRoleId) {
+  const id = org?._id?.toString() ?? "";
+  if (!HEX24.test(id)) return { skip: "organisation has no usable id" };
+
+  if (!Number.isInteger(orgMemberCount) || orgMemberCount < 0) {
+    // Not knowing is not the same as knowing there are none. Fail closed.
+    return { skip: "existing member count unknown" };
+  }
+
+  // Somebody already belongs to it. Never a second owner.
+  if (orgMemberCount > 0) return { skip: `already has ${orgMemberCount} organization member(s)` };
+
+  const userId = owner?._id?.toString() ?? "";
+  if (!HEX24.test(userId)) return { skip: "no account holds this organisation's e-mail address" };
+
+  const roleId = ownerRoleId?.toString() ?? "";
+  if (!HEX24.test(roleId)) return { skip: "organisation has no `organization` owner role to point at" };
+
+  return {
+    payload: {
+      userId,
+      orgId: id,
+      roleId,
+      app: "organization",
+      // What `POST /api/organizations/onboarding` writes for a brand-new owner.
+      // The onboarding wizard is still ahead of them, so it stays true here.
+      onboardingRequired: true,
+    },
+  };
+}
+
+/**
+ * The TOTAL out of a `pageRange` string, or -1 for "could not tell".
+ *
+ * Both counters below fail CLOSED on -1, so this is the guard that decides
+ * whether an organisation is repaired at all -- and it used to fail OPEN.
+ * `Number("".split(" of ").pop())` is `0`, and `Number.isInteger(0)` is true,
+ * so an ABSENT or empty `pageRange` -- a shape change, an error body that still
+ * parses, a field that stops being sent -- read as "this organisation has no
+ * owner" and it would have been written to.
+ *
+ * A genuine empty page is NOT that case and must still repair: the API answers
+ * `"0-0 of 0"` for it (measured against the live API, not assumed), which has a
+ * digit and parses to 0. Only a string with no total at all returns -1.
+ */
+export function totalFromPageRange(pageRange) {
+  const match = / of ([0-9]+)$/.exec(String(pageRange ?? "").trim());
+  return match ? Number(match[1]) : -1;
+}
+
+// ─── everything below is I/O ──────────────────────────────────
 
 const API = (process.env.API ?? "").replace(/\/+$/, "");
 const SID = process.env.SEVEN365_SID ?? "";
@@ -171,11 +262,75 @@ async function allOrganizations() {
   return out;
 }
 
-/** How many ACTIVE roles this organisation holds. `GET /roles` lists only active rows. */
+/**
+ * How many ACTIVE roles this organisation holds -- counted WITHOUT tripping the
+ * self-heal. `GET /roles` lists only active rows, so a soft-deleted role reads
+ * as none.
+ *
+ * `page=2`, not `page=1`, and that is the whole point. `role.controller`
+ * (:399-406) treats a whole-org, unsearched, site-less, **page-1** list that
+ * comes back empty as a repair request and SEEDS the two owner roles. That is
+ * exactly the organisations this tool is about to plan for, so reading page 1
+ * here created the roles it then reported as "0 to add" -- a dry run that wrote.
+ * (It is worse than it looks: the repository skips `page * limit`, so with
+ * `limit=1&page=1` even an organisation holding ONE role comes back empty and
+ * heals.) Page 2 cannot heal, and `pageRange` still carries the true total: it
+ * is built as `${start}-${end} of ${length}` from `countDocuments`, whatever
+ * page was asked for.
+ */
 async function roleCount(orgId) {
-  const { pageRange = "" } = await api(`/api/roles?org=${orgId}&limit=1&page=1`);
-  const total = Number(pageRange.split(" of ").pop());
-  return Number.isInteger(total) ? total : -1;
+  const { pageRange } = await api(`/api/roles?org=${orgId}&limit=1&page=2`);
+  return totalFromPageRange(pageRange);
+}
+
+/**
+ * How many `organization` memberships this organisation holds, ACTIVE or
+ * SUSPENDED.
+ *
+ * `GET /api/members` requires both `type` and `status`, and `organization` is
+ * the only type the console's landing page asks for -- so this counts exactly
+ * the row whose absence is the defect. Both statuses are counted because a
+ * deliberately SUSPENDED owner row still means this organisation has an owner:
+ * counting only `active` would read it as owner-less and write a second
+ * membership beside it, and `createMemberDirect` does not de-duplicate. A
+ * `deleted` row is genuinely gone and is not counted. -1 means "could not
+ * tell", which `planOwnerMembership` fails closed on.
+ */
+async function orgMemberCount(orgId) {
+  let total = 0;
+  for (const status of ["active", "suspended"]) {
+    const { pageRange } = await api(
+      `/api/members?org=${orgId}&type=organization&status=${status}&limit=1&page=1`,
+    );
+    const count = totalFromPageRange(pageRange);
+    if (count < 0) return -1;
+    total += count;
+  }
+  return total;
+}
+
+/** The account the organisation's e-mail address belongs to, or null. */
+async function userByEmail(email) {
+  const address = (email ?? "").toString().trim();
+  if (!address) return null;
+  return await api(`/api/users/email/${encodeURIComponent(address)}`).catch(() => null);
+}
+
+/**
+ * The organisation's own `organization` owner role, or "".
+ *
+ * `type` is a SERVER-SIDE filter here, not a convenience: `GET /api/roles`
+ * does not honour `limit`. Asked for an organisation holding two roles with
+ * `limit=100` it answers one item and `pages: 2` -- so scanning "the list"
+ * silently reads one page and can miss the very role this points the membership
+ * at. Filtering on the server returns the role itself, whatever the paging does.
+ */
+async function orgOwnerRoleId(orgId) {
+  const { items = [] } = await api(
+    `/api/roles?org=${orgId}&type=organization&limit=100&page=1`,
+  ).catch(() => ({}));
+  const owner = items.find((role) => String(role?.name ?? "").toLowerCase() === "owner");
+  return owner?._id?.toString() ?? "";
 }
 
 async function main() {
@@ -203,8 +358,16 @@ async function main() {
     console.log(`  ${org._id}  ${org.name}  [${org.nature ?? "(no nature)"}]  -> ${payloads.map((p) => p.type).join(" + ")}`);
   }
 
+  const pendingRole = new Set(planned.map(({ org }) => org._id.toString()));
+
   if (!APPLY) {
-    console.log("\nDRY RUN. Nothing was written. Re-run with --apply to write.");
+    await reportMemberships(orgs);
+    console.log(
+      "\nDRY RUN. Nothing was written. The owner role is deliberately NOT looked up:" +
+        "\na whole-org `GET /api/roles` list that comes back empty SEEDS the two owner roles," +
+        "\nso resolving it here would write. `--apply` resolves it after the role pass instead." +
+        "\nRe-run with --apply to write.",
+    );
     return;
   }
 
@@ -238,9 +401,88 @@ async function main() {
     for (const p of partial) console.log(`  ${p.org._id} ${p.org.name}: wrote ${p.wrote}/${p.of} -- ${p.error}`);
     process.exitCode = 1;
   }
+  // SECOND, and only now: the owner membership. It points at the `organization`
+  // owner role, which for a role-less organisation is the one the loop above
+  // has just created -- so this cannot run before it.
+  let members = 0;
+  const refused = [];
+
+  for (const org of orgs) {
+    const id = org?._id?.toString() ?? "";
+    const plan = planOwnerMembership(
+      org,
+      await orgMemberCount(id),
+      await userByEmail(org?.email),
+      await orgOwnerRoleId(id),
+    );
+    if (!plan.payload) {
+      // Say why. The dry run judges the role at `--apply` time, so an
+      // organisation that holds roles but none named `owner` is reported as "to
+      // add" and would otherwise vanish here without a word.
+      if (plan.skip && !/already has/.test(plan.skip)) refused.push({ org, error: plan.skip });
+      continue;
+    }
+
+    try {
+      await api("/api/members/direct", { method: "POST", body: JSON.stringify(plan.payload) });
+      members++;
+      console.log(`  MEMBER  ${org._id}  ${org.name}  -> ${org.email}`);
+    } catch (error) {
+      refused.push({ org, error: error.message });
+    }
+  }
+
+  console.log(`\nowner memberships written: ${members}`);
+  if (refused.length) {
+    console.log(`\nREFUSED -- ${refused.length} organisation(s) still have no owner:`);
+    for (const r of refused) console.log(`  ${r.org._id} ${r.org.name}: ${r.error}`);
+    process.exitCode = 1;
+  }
+}
+
+/**
+ * Dry-run half of the membership pass: says what it would do, writes nothing.
+ *
+ * It deliberately does NOT look the owner role up. `GET /api/roles` is not a
+ * read: `role.controller` self-heals a whole-org, unsearched, page-1 list that
+ * comes back empty by SEEDING the two owner roles -- 6 roles were created across
+ * 3 production organisations that way on 2026-09-09, by a run that reported
+ * "nothing was written". `--apply` resolves the role after the role pass, where
+ * a seed is the intended outcome anyway.
+ */
+async function reportMemberships(orgs) {
+  const would = [];
+  const skipped = [];
+  // A stand-in id, never sent, so the plan's OTHER guards -- member count, the
+  // owner account, a malformed organisation -- still decide the answer here.
+  const AT_APPLY = "0".repeat(24);
+
+  for (const org of orgs) {
+    const id = org?._id?.toString() ?? "";
+    const plan = planOwnerMembership(org, await orgMemberCount(id), await userByEmail(org?.email), AT_APPLY);
+
+    if (plan.payload) {
+      would.push({ org });
+    } else if (!/already has/.test(plan.skip)) {
+      skipped.push({ org, why: plan.skip });
+    }
+  }
+
+  console.log(`\nowner memberships to add : ${would.length}`);
+  for (const { org } of would) {
+    console.log(`  ${org._id}  ${org.name}  -> ${org.email}  role (resolved at --apply)`);
+  }
+  if (skipped.length) {
+    console.log(`\nowner-less but NOT repairable automatically (${skipped.length}):`);
+    for (const s of skipped) console.log(`  ${s.org._id} ${s.org.name}: ${s.why}`);
+  }
 }
 
-if (import.meta.url === `file://${process.argv[1]?.replace(/\\/g, "/")}`) {
+// Windows: `file://${path}` builds file://C:/... while import.meta.url is
+// file:///C:/... , so the hand-rolled comparison never matched and the tool
+// exited 0 having done nothing at all -- which reads exactly like "no work to
+// do". `pathToFileURL` is the platform's own answer and is correct on both.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   main().catch((error) => {
     console.error(error.message);
     process.exit(1);

package/tools/backfill-org-owner-roles/dry-run-devtools-snippet.js

@@ -2,7 +2,11 @@
  * DRY RUN ONLY -- paste into the DevTools console of a SIGNED-IN Seven365
  * platform-staff session on https://org.app.iservice365.org
  *
- * GETs only. It writes nothing, anywhere. It sends no Authorization header and
+ * GETs only -- and it counts roles with `page=2` on purpose, because
+ * `GET /api/roles` is NOT a read: `role.controller` seeds an organisation's two
+ * owner roles when a whole-org, unsearched, **page-1** list comes back empty.
+ * Reading page 1 here would write to exactly the organisations this reports on.
+ * It sends no Authorization header and
  * puts no secret in a URL: the session rides as the `sid` cookie the app
  * already set, which `requireAuth` reads first (node-server-utils
  * authorization.middleware).
@@ -36,8 +40,12 @@
 
   // 2. how many ACTIVE roles each one holds -- `GET /roles` lists only active
   //    rows, so a soft-deleted role reads as none. Five at a time, to be polite.
+  //    `page=2`: a whole-org page-1 list that comes back EMPTY makes the server
+  //    seed the two owner roles, so page 1 would write to the very
+  //    organisations this snippet exists to count. The total in `pageRange` is
+  //    `countDocuments`, so it is the same number whichever page is asked for.
   const roleCount = async (id) => {
-    const { pageRange = "" } = await get(`/api/roles?org=${id}&limit=1&page=1`);
+    const { pageRange = "" } = await get(`/api/roles?org=${id}&limit=1&page=2`);
     return Number(pageRange.split(" of ").pop());
   };
 

package/tools/backfill-org-owner-roles/repair-owner-membership-devtools-snippet.js

@@ -0,0 +1,175 @@
+/**
+ * REPAIR THE OWNER-LESS ORGANISATIONS -- paste into the DevTools console of a
+ * SIGNED-IN Seven365 platform-staff session on https://org.app.iservice365.org
+ *
+ * Same job as `backfill.mjs`, same rules, no terminal and no session id to
+ * copy anywhere: the session rides as the `sid` cookie the app already set.
+ *
+ * ## What it repairs
+ *
+ * An organisation created through the onboarding wizard before 2026-09-08 was
+ * written with NO `members` row of its own -- the row was the wizard's step 1,
+ * which is skippable. The owner is then locked out of the organisation they
+ * created: `GET /api/members/user/:id/app/organization` answers 404 and every
+ * console offers to create an organisation instead of opening theirs.
+ *
+ * ## What it will not do
+ *
+ * - **It only ever ADDS** -- `POST /api/roles` and `POST /api/members/direct`.
+ *   It never deletes or repoints anything. Two server-side side effects ride
+ *   along with the membership, though: `createMemberDirect` also points the
+ *   owner's `defaultOrg` at this organisation and completes any pending
+ *   invitation for that address.
+ * - **ACTIVE organisations only.** A suspended or deleted organisation is left
+ *   exactly as it is.
+ * - **Never a second owner.** An organisation that already holds an `active` OR
+ *   `suspended` `organization` membership is skipped, so a re-run writes
+ *   nothing and a deliberately suspended owner is never duplicated.
+ * - **The dry run writes nothing** -- and to keep that true it does not list an
+ *   organisation's roles. `GET /api/roles` SELF-HEALS: a whole-org, unsearched,
+ *   page-1 list that comes back empty seeds the two owner roles. The role is
+ *   resolved in the APPLY pass only.
+ * - **Never guesses who the owner is.** It is the account whose e-mail address
+ *   the organisation is registered under -- the same rule the server's own
+ *   `hasOrgOwnership` uses to let that person reach the organisation at all.
+ *   No account, no repair.
+ *
+ * ## How to run it
+ *
+ * 1. Paste as-is. `APPLY` is false, so it only prints the plan.
+ * 2. Read the plan. Then change `APPLY` to true and paste again to write.
+ */
+(async () => {
+  const APPLY = false;
+
+  const APP_SERVICE_TYPES = [
+    "real_estate_developer", "property_management_agency", "security_agency",
+    "cleaning_services", "mechanical_electrical_services", "landscaping_services",
+    "pest_control_services", "pool_maintenance_services",
+  ];
+
+  const call = async (path, init) => {
+    const res = await fetch(path, {
+      credentials: "include",
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      ...init,
+    });
+    const text = await res.text();
+    if (!res.ok) throw new Error(`${init?.method ?? "GET"} ${path} -> ${res.status} ${text.slice(0, 200)}`);
+    return text ? JSON.parse(text) : {};
+  };
+  const post = (path, body) => call(path, { method: "POST", body: JSON.stringify(body) });
+  const ownerRolePayloads = (org) =>
+    [{ org: org._id, name: "owner", permissions: ["*"], type: "organization" }].concat(
+      APP_SERVICE_TYPES.includes(org.nature)
+        ? [{ org: org._id, name: "owner", permissions: ["*"], type: org.nature }]
+        : [],
+    );
+
+  // 1. every organisation this session can see
+  const orgs = [];
+  for (let page = 1; page < 100; page++) {
+    const { items = [], pages = 1 } = await call(`/api/organizations?page=${page}&limit=100`);
+    orgs.push(...items);
+    if (page >= pages || !items.length) break;
+  }
+  if (orgs.length < 100) {
+    console.warn("Fewer than 100 organisations visible -- this session is probably NOT platform staff, so this is a subset, not the fleet.");
+  }
+
+  // 2. plan. Active organisations only, and only the ones nobody belongs to.
+  const plan = [];
+  const skipped = [];
+
+  for (const org of orgs.filter((o) => o.status === "active")) {
+    const id = org._id;
+    try {
+      // ACTIVE and SUSPENDED, added: the API requires a status, and a suspended
+      // owner row still means this organisation HAS an owner -- writing beside
+      // it would duplicate a membership somebody suspended on purpose.
+      // Strict: `Number("".split(" of ").pop())` is 0, so an absent or empty
+      // pageRange used to read as "no owner" and this would have written to it.
+      // A genuinely empty page is "0-0 of 0" and still parses to 0.
+      let members = 0;
+      let unreadable;
+      for (const status of ["active", "suspended"]) {
+        const { pageRange } = await call(`/api/members?org=${id}&type=organization&status=${status}&limit=1&page=1`);
+        const match = / of ([0-9]+)$/.exec(String(pageRange ?? "").trim());
+        if (!match) { unreadable = pageRange; break; }
+        members += Number(match[1]);
+      }
+      if (unreadable !== undefined) { skipped.push({ id, name: org.name, why: `member count unreadable (pageRange: ${JSON.stringify(unreadable)})` }); continue; }
+      if (members > 0) continue;
+
+      const owner = org.email
+        ? await call(`/api/users/email/${encodeURIComponent(org.email)}`).catch(() => null)
+        : null;
+      if (!owner?._id) { skipped.push({ id, name: org.name, why: `no account holds ${org.email || "(no e-mail)"}` }); continue; }
+
+      // The owner role is NOT looked up here: that list read seeds the two
+      // owner roles when the organisation has none, which would make this dry
+      // run a write. The APPLY pass resolves it instead.
+      plan.push({ id, name: org.name, nature: org.nature, email: org.email, userId: owner._id, org });
+    } catch (error) {
+      skipped.push({ id, name: org.name, why: error.message });
+    }
+  }
+
+  console.log(APPLY ? "=== APPLY -- this WILL write ===" : "=== DRY RUN -- nothing was written ===");
+  console.log("active organisations with NO owner:", plan.length);
+  console.table(plan.map((p) => ({
+    org: p.id, name: p.name, owner: p.email, userId: p.userId,
+    ownerRole: "(resolved at APPLY)",
+  })));
+  if (skipped.length) console.warn("owner-less but NOT repairable automatically:", skipped);
+
+  if (!APPLY) {
+    window.__ownerRepairPlan = plan;
+    console.log("Set APPLY = true and paste again to write. Plan also on window.__ownerRepairPlan");
+    return;
+  }
+
+  let roles = 0, members = 0;
+  const failed = [];
+
+  for (const p of plan) {
+    try {
+      // Resolve the owner role HERE. `type` is filtered SERVER-SIDE because
+      // `GET /api/roles` does not honour `limit`: an organisation with two roles
+      // answers one item and pages: 2, so scanning a page can miss the role the
+      // membership must point at. This same read seeds the two owner roles when
+      // the organisation has none -- intended under APPLY, which is why the dry
+      // run above never makes it.
+      const { items: existing = [] } = await call(`/api/roles?org=${p.id}&type=organization&limit=100&page=1`);
+      if (!existing.find((r) => String(r.name).toLowerCase() === "owner")) {
+        for (const payload of ownerRolePayloads(p.org)) {
+          await post("/api/roles", payload);
+          roles++;
+        }
+      }
+
+      // Read the role id back from the LIST rather than from the create
+      // response: the membership points at it, and a wrong id is a member with
+      // somebody else's permissions. The list is the same query the console
+      // reads, so it is the shape that is actually pinned by a caller.
+      const { items: after = [] } = await call(`/api/roles?org=${p.id}&type=organization&limit=100&page=1`);
+      const roleId = (after.find((r) => String(r.name).toLowerCase() === "owner") || {})._id;
+      if (!roleId) throw new Error("no organization owner role to point at");
+
+      await post("/api/members/direct", {
+        userId: p.userId,
+        orgId: p.id,
+        roleId: String(roleId),
+        app: "organization",
+        onboardingRequired: true,
+      });
+      members++;
+      console.log(`  REPAIRED  ${p.name}  ->  ${p.email}`);
+    } catch (error) {
+      failed.push({ org: p.id, name: p.name, error: error.message });
+    }
+  }
+
+  console.log(`roles created: ${roles}   owner memberships created: ${members}`);
+  if (failed.length) console.error("STILL OWNER-LESS:", failed);
+})();