@7365admin1/core 3.68.1 → 3.68.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.68.1",
+  "version": "3.68.3",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/user-invite-dedupe.e2e.test.mjs

@@ -0,0 +1,138 @@
+// Re-inviting the same person must not add a second pending invitation.
+//
+// `createSimpleUserInvite` (POST /api/auth/invite/user — the console's Invite
+// Client form and the org/hygiene invite screens) looked for an existing
+// invitation and threw the answer away, so every click added another pending
+// row and another e-mail. Now a pending invitation for the same person, app,
+// organisation and site is sent again on the SAME row: fresh expiry, the new
+// request's role. Accepted or cancelled invitations are left alone.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "InviteDedupe-Passw0rd!";
+const STAFF = "sevenadmin-dedupe@e2e.example.com";
+const OWNER = "owner-dedupe@e2e.example.com";
+const CLIENT = "Client-Dedupe@e2e.example.com";
+
+describe("re-inviting reuses the pending invitation", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  let staffSid;
+  let ownerSid;
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    staffSid = await h.login(STAFF, PASSWORD);
+    ownerSid = await h.login(OWNER, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const invites = (email) =>
+    h.db
+      .collection("verifications")
+      .find({ type: "user-invite", email: new RegExp(`^${email}$`, "i") })
+      .toArray();
+
+  const invite = (sid, body) =>
+    h.api("/auth/invite/user", { method: "POST", sid, body });
+
+  it("the console's client invite, sent twice, is one row and the same link", async () => {
+    const body = { email: CLIENT, app: ["security_agency"], role: id.templateRole.toString(), name: "Org Owner" };
+
+    const first = await invite(staffSid, body);
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+
+    const sent = h.mails.length;
+    // a different letter case is the same person
+    const second = await invite(staffSid, { ...body, email: CLIENT.toLowerCase() });
+    assert.equal(second.status, 201, JSON.stringify(second.body));
+
+    const rows = await invites(CLIENT);
+    assert.equal(rows.length, 1, "no second pending invitation");
+    assert.deepEqual(second.body.verificationIds, first.body.verificationIds);
+
+    // the e-mail is sent again, carrying the same link
+    const mail = await h.mailAt(sent);
+    assert.ok(mail.body.includes(first.body.verificationIds[0]), "resent mail links the same invitation");
+  });
+
+  it("an organisation invite sent again takes the new role", async () => {
+    const body = {
+      email: "member-dedupe@e2e.example.com",
+      app: ["organization"],
+      org: id.org.toString(),
+      siteId: id.site.toString(),
+      siteName: "Dedupe Site",
+      role: id.roleA.toString(),
+    };
+
+    assert.equal((await invite(ownerSid, body)).status, 201);
+    assert.equal((await invite(ownerSid, { ...body, role: id.roleB.toString() })).status, 201);
+
+    const rows = await invites(body.email);
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].metadata.role.toString(), id.roleB.toString());
+    assert.equal(rows[0].metadata.org.toString(), id.org.toString(), "still stored as the organisation id");
+  });
+
+  it("a different app, or an invitation already accepted, still creates a new one", async () => {
+    const body = { email: "multi-dedupe@e2e.example.com", app: ["security_agency"], role: id.templateRole.toString() };
+
+    await invite(staffSid, body);
+    await invite(staffSid, { ...body, app: ["cleaning_services"] });
+    assert.equal((await invites(body.email)).length, 2);
+
+    await h.db.collection("verifications").updateMany({ email: body.email }, { $set: { status: "complete" } });
+    await invite(staffSid, body);
+    assert.equal((await invites(body.email)).length, 3);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const site = new ObjectId();
+  const staffRole = new ObjectId();
+  const templateRole = new ObjectId();
+  const roleA = new ObjectId();
+  const roleB = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "Dedupe Org", email: OWNER, type: "org", nature: "property_management_agency", status: "active", createdAt: now,
+  });
+  await h.db.collection("sites").insertOne({ _id: site, name: "Dedupe Site", org, orgId: org, status: "active" });
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: templateRole, name: "Org Owner", type: "organization", permissions: ["*"], status: "active" },
+    { _id: roleA, name: "Supervisor", org, permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Manager", org, permissions: ["*"], status: "active" },
+  ]);
+  await h.db.collection("subscriptions").insertOne({
+    org, type: "organization", status: "active", maxSeats: 0, paidSeats: 0, currentSeats: 0, createdAt: now,
+  });
+
+  const users = await h.db.collection("users").insertMany(
+    [STAFF, OWNER].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertMany([
+    { user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" },
+    { user: users.insertedIds[1], org, type: "organization", role: roleA, status: "active" },
+  ]);
+
+  return { org, site, templateRole, roleA, roleB };
+}

package/test/member-duplicate-error.test.mjs

@@ -0,0 +1,30 @@
+/*
+ * A duplicate membership must read as "already a member" (400), not a 500.
+ *
+ * The live unique index on `members` is `org_1_siteId_1_user_1_type_1`; the old
+ * check only recognised a message naming `org_1_user_1`, so every real duplicate
+ * fell through as a raw MongoServerError.
+ */
+import { strict as assert } from "node:assert";
+import test from "node:test";
+
+import { isDuplicateMemberError } from "./.build/models/member.model.mjs";
+
+test("the live unique index's duplicate is recognised", () => {
+  const err = Object.assign(
+    new Error(
+      'E11000 duplicate key error collection: iservice365.members index: org_1_siteId_1_user_1_type_1 dup key: { org: ObjectId("6a951ce603be44033d434f68") }',
+    ),
+    { code: 11000 },
+  );
+  assert.equal(isDuplicateMemberError(err), true);
+});
+
+test("a duplicate is recognised by code alone", () => {
+  assert.equal(isDuplicateMemberError({ code: 11000, message: "" }), true);
+});
+
+test("other errors are left alone", () => {
+  assert.equal(isDuplicateMemberError(new Error("connection reset")), false);
+  assert.equal(isDuplicateMemberError(undefined), false);
+});