@7365admin1/core 3.65.2 → 3.67.0

package/test/e2e/org-owner-repair.e2e.test.mjs

@@ -0,0 +1,469 @@
+/**
+ * THE ORGANISATION WITH NO OWNER, end to end.
+ *
+ * ## What this proves
+ *
+ * An organisation created before 3.60.0 can exist with **no `members` row at
+ * all** — the wizard step that wrote the owner's own membership was skippable.
+ * Every console landing page then calls
+ * `GET /api/members/user/:id/app/organization`, gets a 404, and tells the real
+ * owner that no organisation exists. Measured on production 2026-09-09: three
+ * active organisations in that state, "JLL Singapore" among them.
+ *
+ * So the shape of the proof is: the landing lookup is **404 BEFORE**, a Seven365
+ * staff member calls the repair, and the same lookup **answers the membership
+ * after**. Everything else here is a way the repair could do harm — a second
+ * click, two simultaneous clicks, a non-staff caller, an organisation that
+ * already has members, a suspended one, an address nobody holds — and each one
+ * must write nothing.
+ *
+ * Everything runs against the harness's in-process MongoDB replica set, a
+ * loopback Redis and a loopback mail sink. **No staging or production database,
+ * Redis, mailbox or endpoint is touched.**
+ *
+ * Run with: npx tsup src/index.ts --format cjs,esm --no-dts
+ *           node --test --test-concurrency=1 --test-timeout=600000 \
+ *             test/e2e/org-owner-repair.e2e.test.mjs
+ */
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "OwnerRepair-Passw0rd!";
+
+const U = {
+  STAFF: "oor-staff@e2e.example.com", // Seven365 console
+  OWNER: "oor-owner@e2e.example.com", // holds the broken org's address
+  ROLELESS: "oor-roleless@e2e.example.com", // its org holds no role at all
+  CASED: "oor-cased@e2e.example.com", // org address differs only in case
+  RACER: "oor-racer@e2e.example.com", // two simultaneous repairs
+  MEMBERED: "oor-membered@e2e.example.com", // its org already has a member
+  SUSPENDED: "oor-suspended@e2e.example.com", // its org is suspended
+  STALE: "oor-stale@e2e.example.com", // a claim left behind by a killed process
+  FRESHCLAIM: "oor-freshclaim@e2e.example.com", // a repair genuinely in flight
+  STALERACE: "oor-stalerace@e2e.example.com", // two racers over a stale claim
+};
+
+/** The claim ledger, and how old a row has to be to count as abandoned. */
+const CLAIMS = "org-owner-repair-claims";
+const STALE_AGO = 11 * 60 * 1000;
+
+/** Nobody holds this one — the "no account" refusal. */
+const ORPHAN_ADDRESS = "oor-nobody@e2e.example.com";
+
+const repair = (h, sid, orgId) =>
+  h.api(`/organizations/${orgId}/owner-membership`, { method: "POST", sid });
+
+describe("an organisation with no owner membership repairs, once", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+  const result = [];
+
+  const record = (name, fn) =>
+    it(name, async () => {
+      try {
+        await fn();
+        result.push(["PASS", name]);
+      } catch (error) {
+        result.push(["FAIL", name]);
+        throw error;
+      }
+    });
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+    console.log("\n--- organizations owner-membership repair: per-case result ---");
+    for (const [verdict, name] of result) console.log(`${verdict}  ${name}`);
+  });
+
+  /** `organization` membership rows that exist (every status but deleted). */
+  const rows = (orgKey) =>
+    h.db.collection("members").countDocuments({
+      org: id[orgKey],
+      type: "organization",
+      status: { $ne: "deleted" },
+    });
+
+  /** The call every console landing page makes on load. */
+  const landing = (userKey) =>
+    h.api(`/members/user/${id.users[userKey].toString()}/app/organization`, {
+      sid: sid[userKey],
+    });
+
+  record("0. everybody signs in", async () => {
+    for (const [k, e] of Object.entries(U)) sid[k] = await h.login(e, PASSWORD);
+  });
+
+  // ── the defect, and the repair ───────────────────────────────────────────
+
+  record("1. BEFORE: the owner's landing lookup is 404 — 'no organisation exists'", async () => {
+    const res = await landing("OWNER");
+    assert.equal(res.status, 404, JSON.stringify(res.body));
+    assert.equal(await rows("orgBroken"), 0, "the organisation has no member at all");
+  });
+
+  record("2. a non-staff caller is refused, and writes nothing", async () => {
+    // The organisation's own owner is not Seven365 staff. This is the endpoint's
+    // whole authorization story: it is a console operation, not a self-service
+    // way into an organisation.
+    const res = await repair(h, sid.OWNER, id.orgBroken);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    assert.equal(await rows("orgBroken"), 0, "nothing may be written");
+  });
+
+  record("3. no session at all is refused", async () => {
+    const res = await h.api(`/organizations/${id.orgBroken}/owner-membership`, {
+      method: "POST",
+    });
+    assert.equal(res.status, 401);
+    assert.equal(await rows("orgBroken"), 0);
+  });
+
+  record("4. staff repair writes exactly the row onboarding writes", async () => {
+    const res = await repair(h, sid.STAFF, id.orgBroken);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(await rows("orgBroken"), 1, "exactly one row");
+
+    const row = await h.db
+      .collection("members")
+      .findOne({ org: id.orgBroken, type: "organization" });
+
+    assert.equal(row.user.toString(), id.users.OWNER.toString(), "the owner, not anybody else");
+    assert.equal(row.role.toString(), id.ownerRole.toString(), "the organisation's own owner role");
+    assert.equal(row.type, "organization", "the type the landing page asks for");
+    assert.equal(row.status, "active");
+    assert.equal(row.onboardingRequired, true, "the wizard is still ahead of them");
+    assert.equal(row.onboardingCompleted, false);
+  });
+
+  record("5. AFTER: the same landing lookup now answers the membership", async () => {
+    const res = await landing("OWNER");
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(res.body.org.toString(), id.orgBroken.toString());
+    assert.equal(res.body.type, "organization");
+    assert.equal(res.body.role.toString(), id.ownerRole.toString());
+  });
+
+  record("6. the repair is audited: who, which client, which account and role", async () => {
+    const row = await h.db
+      .collection("console-audit")
+      .findOne({ action: "client.owner-repaired", org: id.orgBroken });
+
+    assert.ok(row, "no audit row was written");
+    assert.equal(row.actor.toString(), id.users.STAFF.toString(), "the actor is the session");
+    assert.equal(row.targetType, "organization");
+    assert.equal(row.after.member, id.users.OWNER.toString());
+    assert.equal(row.after.role, id.ownerRole.toString());
+    assert.equal(row.after.memberType, "organization");
+    // An audit trail is the last place an address belongs.
+    assert.ok(!("email" in row.after), "the owner's e-mail was recorded");
+  });
+
+  // ── idempotence ──────────────────────────────────────────────────────────
+
+  record("7. a second click writes nothing, and the count is still 1", async () => {
+    const res = await repair(h, sid.STAFF, id.orgBroken);
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.equal(await rows("orgBroken"), 1, "a second owner was written");
+
+    // ... and a third, for good measure.
+    await repair(h, sid.STAFF, id.orgBroken);
+    assert.equal(await rows("orgBroken"), 1);
+  });
+
+  record("8. two SIMULTANEOUS repairs write exactly one row", async () => {
+    // The race the claim exists for: both callers read a count of zero before
+    // either writes. Two clicks on a slow console do exactly this.
+    const [a, b] = await Promise.all([
+      repair(h, sid.STAFF, id.orgRace),
+      repair(h, sid.STAFF, id.orgRace),
+    ]);
+
+    assert.equal(await rows("orgRace"), 1, "the race wrote two owner rows");
+
+    const statuses = [a.status, b.status].sort();
+    assert.deepEqual(statuses, [200, 400], `one winner, one refusal: ${JSON.stringify(statuses)}`);
+
+    const res = await landing("RACER");
+    assert.equal(res.status, 200, "the winner's row is the one the landing page reads");
+  });
+
+  // ── every refusal, and each one writes nothing ───────────────────────────
+
+  record("9. an organisation that already has a member is refused", async () => {
+    const before = await rows("orgMembered");
+    assert.equal(before, 1, "seeded with one member");
+
+    const res = await repair(h, sid.STAFF, id.orgMembered);
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.match(String(res.body.message ?? res.body), /already has/);
+    assert.equal(await rows("orgMembered"), 1, "nothing may be added beside it");
+  });
+
+  record("10. a SUSPENDED organisation is refused", async () => {
+    const res = await repair(h, sid.STAFF, id.orgSuspended);
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.match(String(res.body.message ?? res.body), /active/);
+    assert.equal(await rows("orgSuspended"), 0);
+  });
+
+  record("11. an address no account holds is refused — the owner is never guessed", async () => {
+    const res = await repair(h, sid.STAFF, id.orgOrphan);
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.match(String(res.body.message ?? res.body), /No account holds/);
+    assert.equal(await rows("orgOrphan"), 0);
+  });
+
+  record("12. an organisation that does not exist is a 404, not a write", async () => {
+    const res = await repair(h, sid.STAFF, new ObjectId().toString());
+    assert.equal(res.status, 404, JSON.stringify(res.body));
+  });
+
+  record("13. a malformed id is a 400, not a 500", async () => {
+    const res = await repair(h, sid.STAFF, "not-an-id");
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+  });
+
+  // ── the cases that must still work ───────────────────────────────────────
+
+  record("14. the address is matched whatever its case", async () => {
+    // The organisation is registered under `OOR-Cased@E2E.example.com` and the
+    // account under `oor-cased@e2e.example.com`. `hasOrgOwnership` compares by
+    // collation, and so must the lookup that finds the candidate.
+    const res = await repair(h, sid.STAFF, id.orgCased);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(await rows("orgCased"), 1);
+
+    const landed = await landing("CASED");
+    assert.equal(landed.status, 200);
+  });
+
+  record("15. an organisation with no ROLE at all is given one, then repaired", async () => {
+    // 74 of 195 staging organisations hold not one role. The repair seeds the
+    // two owner roles in process — the same self-heal the roles list uses — and
+    // then points the membership at the `organization` one. Never over HTTP:
+    // `GET /api/roles` self-heals, so reading it would itself be a write.
+    assert.equal(
+      await h.db.collection("roles").countDocuments({ org: id.orgRoleless }),
+      0,
+      "seeded with no roles",
+    );
+
+    const res = await repair(h, sid.STAFF, id.orgRoleless);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(await rows("orgRoleless"), 1);
+
+    const role = await h.db
+      .collection("roles")
+      .findOne({ org: id.orgRoleless, type: "organization", name: "owner" });
+    assert.ok(role, "the owner role was not seeded");
+    assert.deepEqual(role.permissions, ["*"]);
+    assert.equal(role.default, true);
+
+    const row = await h.db
+      .collection("members")
+      .findOne({ org: id.orgRoleless, type: "organization" });
+    assert.equal(row.role.toString(), role._id.toString());
+
+    const landed = await landing("ROLELESS");
+    assert.equal(landed.status, 200);
+  });
+
+  // ── the switch ───────────────────────────────────────────────────────────
+
+  record("16. ORG_OWNER_REPAIR=off refuses, and writes nothing", async () => {
+    // Read on every call, so a lead's override takes effect without a rebuild.
+    const restore = process.env.ORG_OWNER_REPAIR;
+    process.env.ORG_OWNER_REPAIR = "off";
+
+    try {
+      const res = await repair(h, sid.STAFF, id.orgSwitch);
+      assert.equal(res.status, 400, JSON.stringify(res.body));
+      assert.match(String(res.body.message ?? res.body), /switched off/);
+      assert.equal(await rows("orgSwitch"), 0, "the switch did not stop the write");
+    } finally {
+      if (restore === undefined) delete process.env.ORG_OWNER_REPAIR;
+      else process.env.ORG_OWNER_REPAIR = restore;
+    }
+
+    // ... and with the switch back on, the same organisation repairs — so case
+    // 16 proved the switch, not a broken organisation.
+    const res = await repair(h, sid.STAFF, id.orgSwitch);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(await rows("orgSwitch"), 1);
+  });
+
+  // ── a claim that outlived the request that took it ───────────────────────
+
+  record("17. a claim left behind by a killed process does NOT block forever", async () => {
+    // The failure mode: the claim is inserted before the membership is written,
+    // so a process killed in between leaves a row that refuses every later
+    // attempt. The only remedy would be deleting a row by hand in the database,
+    // which this project forbids — so one unlucky restart would permanently
+    // block the repair for exactly the organisations this exists for.
+    await h.db.collection(CLAIMS).insertOne({
+      _id: id.orgStale,
+      repairedAt: new Date(Date.now() - STALE_AGO),
+    });
+
+    const res = await repair(h, sid.STAFF, id.orgStale);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.equal(await rows("orgStale"), 1, "the stale claim was not taken over");
+
+    // The claim it leaves behind is FRESH, so the next attempt stands down.
+    const claim = await h.db.collection(CLAIMS).findOne({ _id: id.orgStale });
+    assert.ok(Date.now() - new Date(claim.repairedAt).getTime() < STALE_AGO);
+
+    const again = await repair(h, sid.STAFF, id.orgStale);
+    assert.equal(again.status, 400, "the replacement claim does not hold");
+    assert.equal(await rows("orgStale"), 1);
+
+    const landed = await landing("STALE");
+    assert.equal(landed.status, 200);
+  });
+
+  record("18. a claim that is still FRESH is respected — a live repair is not raced", async () => {
+    await h.db.collection(CLAIMS).insertOne({
+      _id: id.orgFresh,
+      repairedAt: new Date(),
+    });
+
+    const res = await repair(h, sid.STAFF, id.orgFresh);
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.match(String(res.body.message ?? res.body), /already running|already run/);
+    assert.equal(await rows("orgFresh"), 0, "a fresh claim was overrun");
+  });
+
+  record("19. two requests over ONE stale claim still write exactly one row", async () => {
+    // Both find the same abandoned claim. The takeover is a conditional
+    // compare-and-delete on the `_id` AND the stale timestamp, so only one can
+    // win it; the loser's insert collides with the winner's fresh claim.
+    await h.db.collection(CLAIMS).insertOne({
+      _id: id.orgStaleRace,
+      repairedAt: new Date(Date.now() - STALE_AGO),
+    });
+
+    const [a, b] = await Promise.all([
+      repair(h, sid.STAFF, id.orgStaleRace),
+      repair(h, sid.STAFF, id.orgStaleRace),
+    ]);
+
+    assert.equal(await rows("orgStaleRace"), 1, "the stale-claim race wrote two owners");
+    assert.deepEqual(
+      [a.status, b.status].sort(),
+      [200, 400],
+      `one winner, one refusal: ${JSON.stringify([a.status, b.status])}`,
+    );
+  });
+
+  record("20. no organisation in this run gained a second owner", async () => {
+    for (const key of [
+      "orgBroken", "orgRace", "orgCased", "orgRoleless", "orgSwitch", "orgMembered",
+      "orgStale", "orgStaleRace",
+    ]) {
+      assert.equal(await rows(key), 1, `${key} holds more than one owner`);
+    }
+    for (const key of ["orgSuspended", "orgOrphan", "orgFresh"]) {
+      assert.equal(await rows(key), 0, `${key} was written to`);
+    }
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+
+  const orgBroken = new ObjectId();
+  const orgRace = new ObjectId();
+  const orgCased = new ObjectId();
+  const orgRoleless = new ObjectId();
+  const orgSwitch = new ObjectId();
+  const orgMembered = new ObjectId();
+  const orgSuspended = new ObjectId();
+  const orgOrphan = new ObjectId();
+  const orgStale = new ObjectId();
+  const orgFresh = new ObjectId();
+  const orgStaleRace = new ObjectId();
+
+  const ownerRole = new ObjectId();
+  const raceRole = new ObjectId();
+  const casedRole = new ObjectId();
+  const switchRole = new ObjectId();
+  const memberedRole = new ObjectId();
+  const suspendedRole = new ObjectId();
+  const orphanRole = new ObjectId();
+  const staleRole = new ObjectId();
+  const freshRole = new ObjectId();
+  const staleRaceRole = new ObjectId();
+  const staffRole = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    // active, NO members, an account holds its address — the defect.
+    { _id: orgBroken, name: "OOR Broken", email: U.OWNER, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgRace, name: "OOR Race", email: U.RACER, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    // the organisation's address differs from the account's only in case
+    { _id: orgCased, name: "OOR Cased", email: "OOR-Cased@E2E.example.com", type: "org", nature: "security_agency", status: "active", createdAt: now },
+    // active, no members AND no roles at all
+    { _id: orgRoleless, name: "OOR Roleless", email: U.ROLELESS, type: "org", nature: "security_agency", status: "active", createdAt: now },
+    { _id: orgSwitch, name: "OOR Switch", email: U.SUSPENDED, type: "org", nature: "cleaning_services", status: "active", createdAt: now },
+    // already has an organization member — must never gain a second
+    { _id: orgMembered, name: "OOR Membered", email: U.MEMBERED, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    // suspended
+    { _id: orgSuspended, name: "OOR Suspended", email: U.SUSPENDED, type: "org", nature: "property_management_agency", status: "suspended", createdAt: now },
+    // nobody holds this address
+    { _id: orgOrphan, name: "OOR Orphan", email: ORPHAN_ADDRESS, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    // a claim row is planted on each of these three by cases 17-19
+    { _id: orgStale, name: "OOR Stale", email: U.STALE, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgFresh, name: "OOR Fresh", email: U.FRESHCLAIM, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgStaleRace, name: "OOR Stale Race", email: U.STALERACE, type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+  ]);
+
+  await h.db.collection("roles").insertMany([
+    { _id: ownerRole, name: "owner", type: "organization", org: orgBroken, permissions: ["*"], default: true, status: "active" },
+    { _id: raceRole, name: "owner", type: "organization", org: orgRace, permissions: ["*"], default: true, status: "active" },
+    { _id: casedRole, name: "owner", type: "organization", org: orgCased, permissions: ["*"], default: true, status: "active" },
+    { _id: switchRole, name: "owner", type: "organization", org: orgSwitch, permissions: ["*"], default: true, status: "active" },
+    { _id: memberedRole, name: "owner", type: "organization", org: orgMembered, permissions: ["*"], default: true, status: "active" },
+    { _id: suspendedRole, name: "owner", type: "organization", org: orgSuspended, permissions: ["*"], default: true, status: "active" },
+    { _id: orphanRole, name: "owner", type: "organization", org: orgOrphan, permissions: ["*"], default: true, status: "active" },
+    { _id: staleRole, name: "owner", type: "organization", org: orgStale, permissions: ["*"], default: true, status: "active" },
+    { _id: freshRole, name: "owner", type: "organization", org: orgFresh, permissions: ["*"], default: true, status: "active" },
+    { _id: staleRaceRole, name: "owner", type: "organization", org: orgStaleRace, permissions: ["*"], default: true, status: "active" },
+    // Seven365 staff: a members row of type "admin" whose role is ALSO type
+    // "admin". An empty permission list means everything, exactly as
+    // `createDefaultUser` seeds it.
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+  ]);
+
+  const emails = Object.values(U);
+  const inserted = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+  const users = Object.fromEntries(Object.keys(U).map((k, i) => [k, inserted.insertedIds[i]]));
+
+  await h.db.collection("members").insertMany([
+    { user: users.STAFF, type: "admin", role: staffRole, status: "active" },
+    // the one organisation that already has its owner
+    {
+      user: users.MEMBERED, org: orgMembered, orgName: "OOR Membered", type: "organization",
+      role: memberedRole, status: "active", email: U.MEMBERED, name: U.MEMBERED,
+    },
+  ]);
+
+  return {
+    users,
+    orgBroken, orgRace, orgCased, orgRoleless, orgSwitch, orgMembered, orgSuspended, orgOrphan,
+    orgStale, orgFresh, orgStaleRace,
+    ownerRole, raceRole, casedRole, switchRole,
+  };
+}

package/test/notification-access.test.mjs

@@ -41,21 +41,50 @@ const enforced = (over = {}) =>
 const WO = { category: "workOrder", siteId: SITE };
 const on = (fn) => withEnv({ NOTIFY_ACCESS_FILTER: "on", MODULE_LIST_GATE: undefined }, fn);
 
-test("the code default is LOG; anything unrecognised is log", () => {
-  assert.equal(notifyAccessMode({}), "log");
-  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "garbage" }), "log");
-  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "ON" }), "on");
+test("the code default is ON; anything unrecognised falls back to that default", () => {
+  // Owner, 2026-09-13: turn the filter on. Unset env => the code default.
+  assert.equal(notifyAccessMode({}), "on");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "garbage" }), "on");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "LOG" }), "log");
   assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "off" }), "off");
 });
 
-test("LOG never drops: the denied recipient is counted and still sent to", async () => {
+test("the DEFAULT drops, with no env var set at all", async () => {
+  // The flip itself: this is the test that fails if the default goes back to
+  // `log`. `undefined` means "nothing set on the server", i.e. production.
+  const { data } = enforced({ rows: [member()] });
+  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: undefined, MODULE_LIST_GATE: undefined }, () =>
+    filterByAccess([USER], WO, data),
+  );
+  assert.deepEqual(sent, [], "the denied recipient is dropped by the default alone");
+});
+
+test("LOG still never drops: the denied recipient is counted and still sent to", async () => {
   const { data } = enforced({ rows: [member()] });
   const report = await notificationAccessReport([USER], WO, data);
   assert.deepEqual(report.dropByModule, [USER], "control: the list does deny work orders");
-  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: undefined }, () => filterByAccess([USER], WO, data));
+  // A lead putting it back to `log` must still send to everyone, with no deploy.
+  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: "log" }, () => filterByAccess([USER], WO, data));
   assert.deepEqual(sent, [USER]);
 });
 
+test("a client with NO enforced list is untouched by the default being on", async () => {
+  // Why the flip is safe on the day it ships: no organisation and no site had an
+  // enforced list, so the filter returns early and reads nothing.
+  const { data, calls } = fakeGate({
+    orgs: { [ORG]: { _id: ORG } },
+    sites: { [SITE]: SITE_DOC },
+    roles: { r1: { permissions: ["*"] } },
+    rows: [member()],
+  });
+  assert.deepEqual(await filterByAccess([USER], WO, data), [USER]);
+  // It does read the org and the site to find out whether a list is enforced.
+  // What it must not do is the expensive part: `members.user` has no index to
+  // use, so a members/roles read on every send is the cost worth avoiding.
+  assert.equal(calls.members, undefined, "no members read while nothing is enforced");
+  assert.equal(calls.roles, undefined, "no roles read while nothing is enforced");
+});
+
 test("ON drops only the member whose client list denies the module", async () => {
   const other = member({ user: USER_2, org: "9".repeat(24), siteId: SITE }); // a provider: own org, no list
   const { data } = enforced({ rows: [member(), other] });