@7365admin1/core 3.66.0 → 3.68.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.66.0",
+  "version": "3.68.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/module-access.test.mjs

@@ -126,3 +126,30 @@ test("a site document passed in is used as is", async () => {
   assert.deepEqual(result, { refuse: true, denied: true });
   assert.equal(calls.site ?? 0, 0);
 });
+
+test("nothing enforced: no membership or role read at all", async () => {
+  // This runs on every governed request. While no client has an enforced list
+  // there is nothing to decide, and `members.user` has no index to use, so the
+  // read is pure cost on every request for every client.
+  const { data, calls } = fakeGate({
+    rows: [member()],
+    orgs: { [ORG]: { _id: ORG } },
+    sites: { [SITE]: SITE_DOC },
+  });
+
+  assert.deepEqual(await withEnv({ MODULE_LIST_GATE: undefined }, () => check(data)), ALLOW);
+  assert.equal(calls.membershipsOf, undefined, "no memberships read while nothing is enforced");
+  assert.equal(calls.roles, undefined, "no roles read while nothing is enforced");
+});
+
+test("an ENFORCED list still reads what it needs, and still decides", async () => {
+  // The control for the test above: the early return must not have turned the
+  // gate off for a client that really has a list.
+  const { data, calls } = enforced();
+
+  assert.deepEqual(await withEnv({ MODULE_LIST_GATE: undefined }, () => check(data)), {
+    refuse: false,
+    denied: true,
+  });
+  assert.ok(calls.membershipsOf >= 1, "an enforced client is still measured");
+});

package/test/module-gate-kill-switch.test.mjs

@@ -0,0 +1,48 @@
+/*
+ * MODULE_LIST_GATE=off must mean OFF.
+ *
+ * Every other part of the module gate checks the master switch. The
+ * acknowledge-before-save path did not, so turning the switch off still left a
+ * narrowing save refused with a 409 — the one lever a lead would reach for in an
+ * emergency, not working for the one path that blocks a save from going through.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { mustAcknowledge } from "./.build/utils/module-gate.util.mjs";
+import { withEnv } from "./module-gate.fixtures.mjs";
+
+/** A save that newly denies something, and somebody really loses it. */
+const narrowing = {
+  newlyDenied: ["work_orders"],
+  impact: { memberCount: 3, modules: [{ module: "work_orders", memberCount: 3 }] },
+};
+
+test("by default a narrowing save still needs acknowledgement", async () => {
+  // The control. If this ever goes false, the 409 has been switched off for
+  // everyone, which is the opposite of the intent.
+  await withEnv({ MODULE_LIST_GATE: undefined }, async () => {
+    assert.equal(mustAcknowledge(narrowing, undefined), true);
+  });
+});
+
+test("MODULE_LIST_GATE=off stops the 409 as well", async () => {
+  await withEnv({ MODULE_LIST_GATE: "off" }, async () => {
+    assert.equal(mustAcknowledge(narrowing, undefined), false);
+  });
+});
+
+test("with the gate off, the save goes through however the impact reads", async () => {
+  await withEnv({ MODULE_LIST_GATE: "off" }, async () => {
+    // Unknown impact is treated as a loss everywhere else, so it is the case
+    // most likely to keep refusing by accident.
+    assert.equal(mustAcknowledge({ newlyDenied: ["work_orders"], impact: null }, undefined), false);
+  });
+});
+
+test("acknowledging still works, and a save that denies nothing new never needed it", async () => {
+  await withEnv({ MODULE_LIST_GATE: undefined }, async () => {
+    assert.equal(mustAcknowledge(narrowing, true), false);
+    assert.equal(mustAcknowledge({ newlyDenied: [], impact: null }, undefined), false);
+  });
+});

package/test/notification-access.test.mjs

@@ -41,21 +41,50 @@ const enforced = (over = {}) =>
 const WO = { category: "workOrder", siteId: SITE };
 const on = (fn) => withEnv({ NOTIFY_ACCESS_FILTER: "on", MODULE_LIST_GATE: undefined }, fn);
 
-test("the code default is LOG; anything unrecognised is log", () => {
-  assert.equal(notifyAccessMode({}), "log");
-  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "garbage" }), "log");
-  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "ON" }), "on");
+test("the code default is ON; anything unrecognised falls back to that default", () => {
+  // Owner, 2026-09-13: turn the filter on. Unset env => the code default.
+  assert.equal(notifyAccessMode({}), "on");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "garbage" }), "on");
+  assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "LOG" }), "log");
   assert.equal(notifyAccessMode({ NOTIFY_ACCESS_FILTER: "off" }), "off");
 });
 
-test("LOG never drops: the denied recipient is counted and still sent to", async () => {
+test("the DEFAULT drops, with no env var set at all", async () => {
+  // The flip itself: this is the test that fails if the default goes back to
+  // `log`. `undefined` means "nothing set on the server", i.e. production.
+  const { data } = enforced({ rows: [member()] });
+  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: undefined, MODULE_LIST_GATE: undefined }, () =>
+    filterByAccess([USER], WO, data),
+  );
+  assert.deepEqual(sent, [], "the denied recipient is dropped by the default alone");
+});
+
+test("LOG still never drops: the denied recipient is counted and still sent to", async () => {
   const { data } = enforced({ rows: [member()] });
   const report = await notificationAccessReport([USER], WO, data);
   assert.deepEqual(report.dropByModule, [USER], "control: the list does deny work orders");
-  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: undefined }, () => filterByAccess([USER], WO, data));
+  // A lead putting it back to `log` must still send to everyone, with no deploy.
+  const sent = await withEnv({ NOTIFY_ACCESS_FILTER: "log" }, () => filterByAccess([USER], WO, data));
   assert.deepEqual(sent, [USER]);
 });
 
+test("a client with NO enforced list is untouched by the default being on", async () => {
+  // Why the flip is safe on the day it ships: no organisation and no site had an
+  // enforced list, so the filter returns early and reads nothing.
+  const { data, calls } = fakeGate({
+    orgs: { [ORG]: { _id: ORG } },
+    sites: { [SITE]: SITE_DOC },
+    roles: { r1: { permissions: ["*"] } },
+    rows: [member()],
+  });
+  assert.deepEqual(await filterByAccess([USER], WO, data), [USER]);
+  // It does read the org and the site to find out whether a list is enforced.
+  // What it must not do is the expensive part: `members.user` has no index to
+  // use, so a members/roles read on every send is the cost worth avoiding.
+  assert.equal(calls.members, undefined, "no members read while nothing is enforced");
+  assert.equal(calls.roles, undefined, "no roles read while nothing is enforced");
+});
+
 test("ON drops only the member whose client list denies the module", async () => {
   const other = member({ user: USER_2, org: "9".repeat(24), siteId: SITE }); // a provider: own org, no list
   const { data } = enforced({ rows: [member(), other] });

package/test/socket-session.test.mjs

@@ -0,0 +1,119 @@
+/*
+ * Proving who is on the other end of a socket.
+ *
+ * `/manpower` streams every client site's live staffing level — how many guards
+ * are actually on shift against how many were promised — to anyone who connects,
+ * with no credential of any kind. The authenticated twin `/manpower-live` uses
+ * this check; the old namespace is deliberately left open, because the guard app
+ * installed on phones today connects to it.
+ *
+ * Every refusal must look identical. A socket refused because its session
+ * expired must not be distinguishable from one refused for sending nothing, or
+ * the difference becomes an oracle.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  MANPOWER_LIVE_NAMESPACE,
+  authoriseSocketSession,
+  sidFromHandshake,
+  userIdOfSession,
+} from "./.build/utils/socket-session.util.mjs";
+
+const SID = "a-live-session-id";
+const USER = "64b7f0000000000000000007";
+
+/** A session store holding exactly one live session. */
+const store = async (sid) => (sid === SID ? { user: USER } : null);
+
+test("the authenticated namespace is a NEW one, not the open feed", () => {
+  // If this ever became "/manpower", the guard handsets in the field would be
+  // cut off the moment it deployed.
+  assert.equal(MANPOWER_LIVE_NAMESPACE, "/manpower-live");
+  assert.notEqual(MANPOWER_LIVE_NAMESPACE, "/manpower");
+});
+
+test("the session id is read from every shape the clients send", () => {
+  assert.equal(sidFromHandshake({ headers: { cookie: `a=1; sid=${SID}; b=2` } }), SID);
+  assert.equal(sidFromHandshake({ auth: { sid: SID } }), SID);
+  assert.equal(sidFromHandshake({ auth: { token: SID } }), SID);
+  assert.equal(sidFromHandshake({ headers: { authorization: `Bearer ${SID}` } }), SID);
+  assert.equal(sidFromHandshake({ headers: { authorization: SID } }), SID);
+});
+
+test("the cookie wins, and an empty one does not mask the auth payload", () => {
+  assert.equal(
+    sidFromHandshake({ headers: { cookie: `sid=${SID}` }, auth: { sid: "other" } }),
+    SID,
+  );
+  assert.equal(sidFromHandshake({ headers: { cookie: "sid=" }, auth: { sid: SID } }), SID);
+});
+
+test("an empty handshake presents nothing", () => {
+  assert.equal(sidFromHandshake({}), "");
+  assert.equal(sidFromHandshake({ headers: {}, auth: {} }), "");
+  assert.equal(sidFromHandshake({ auth: { sid: "   " } }), "");
+});
+
+test("a session's user id is read under either spelling", () => {
+  assert.equal(userIdOfSession({ user: USER }), USER);
+  assert.equal(userIdOfSession({ _id: USER }), USER);
+  assert.equal(userIdOfSession(null), "");
+  assert.equal(userIdOfSession({}), "");
+});
+
+test("a live session is admitted", async () => {
+  assert.equal(await authoriseSocketSession({ auth: { sid: SID } }, store), USER);
+});
+
+test("an anonymous socket is refused - the whole point of the new namespace", async () => {
+  await assert.rejects(() => authoriseSocketSession({}, store), /Unauthorized/);
+});
+
+test("an expired or invented session id is refused", async () => {
+  await assert.rejects(
+    () => authoriseSocketSession({ auth: { sid: "not-real" } }, store),
+    /Unauthorized/,
+  );
+});
+
+test("a session that resolves to nobody is refused", async () => {
+  await assert.rejects(
+    () => authoriseSocketSession({ auth: { sid: SID } }, async () => ({})),
+    /Unauthorized/,
+  );
+});
+
+test("a session store that is DOWN refuses, it does not let everyone in", async () => {
+  // Fail closed here: this is an authentication decision, not a feature flag.
+  await assert.rejects(
+    () =>
+      authoriseSocketSession({ auth: { sid: SID } }, async () => {
+        throw new Error("redis is unreachable");
+      }),
+    /Unauthorized/,
+  );
+});
+
+test("every refusal carries the SAME message", async () => {
+  const messages = [];
+  for (const [handshake, read] of [
+    [{}, store],
+    [{ auth: { sid: "not-real" } }, store],
+    [{ auth: { sid: SID } }, async () => ({})],
+    [
+      { auth: { sid: SID } },
+      async () => {
+        throw new Error("redis is unreachable");
+      },
+    ],
+  ]) {
+    await authoriseSocketSession(handshake, read).catch((error) =>
+      messages.push(error.message),
+    );
+  }
+
+  assert.equal(messages.length, 4);
+  assert.deepEqual([...new Set(messages)], ["Unauthorized"]);
+});