@7365admin1/core 3.68.2 → 3.69.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/core
 
+## 3.69.0
+
+### Minor Changes
+
+- d2cf85f: Invite Client: Seven365 staff can choose a new client's modules (`modules` on `POST /api/auth/invite/user`, console `organizations` permission). Onboarding from that invitation stores the list on the organisation and records the save row that makes the module gate enforce it. A new-client invitation no longer carries a shared template role, so the owner holds the organisation's own seeded owner role.
+
+## 3.68.3
+
+### Patch Changes
+
+- 1d5050b: Re-inviting the same person to the same app, organisation and site now re-sends the pending invitation instead of adding a duplicate; invite request logs no longer record the invitee's e-mail address.
+
 ## 3.68.2
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,10 +1,8 @@
 import * as mongodb from 'mongodb';
 import { ObjectId, ClientSession, Db, Collection, Document, AggregateOptions } from 'mongodb';
 import Joi from 'joi';
-import { Request, Response, NextFunction } from 'express';
+import { Request, Response, NextFunction, RequestHandler } from 'express';
 import * as bson from 'bson';
-import * as qs from 'qs';
-import * as express_serve_static_core from 'express-serve-static-core';
 import { z } from 'zod';
 import { Server } from 'socket.io';
 
@@ -971,24 +969,25 @@ type TMemberModulesDeps = {
     requireSelfOrPlatformStaff: typeof requireSelfOrPlatformStaff;
     gateData?: TModuleGateData;
 };
+type MemberController = {
+    createMember: RequestHandler;
+    getByUserId: RequestHandler;
+    getByUserIdType: RequestHandler;
+    getModulesByUserIdType: RequestHandler;
+    getAll: RequestHandler;
+    getAllByUser: RequestHandler;
+    getOrgsByMembership: RequestHandler;
+    updateMemberStatus: RequestHandler;
+    updateRoleById: RequestHandler;
+    createMemberDirect: RequestHandler;
+    updateSiteById: RequestHandler;
+    getByUserIdTypeOrg: RequestHandler;
+    completeOnboarding: RequestHandler;
+};
 declare function memberModulesHandlers({ requireSelfOrPlatformStaff, gateData, }: TMemberModulesDeps): {
     getModulesByUserIdType: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
-declare function useMemberController(): {
-    createMember: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getByUserId: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getByUserIdType: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getModulesByUserIdType: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
-    getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getAllByUser: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getOrgsByMembership: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateMemberStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateRoleById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    createMemberDirect: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateSiteById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getByUserIdTypeOrg: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    completeOnboarding: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-};
+declare function useMemberController(): MemberController;
 
 declare function useMemberService(): {
     createMember: (id: string) => Promise<{
@@ -1057,6 +1056,10 @@ declare class MVerification implements TVerification {
     constructor(value: TVerification);
 }
 
+type TKeyValuePair<K extends string | number | symbol = string, V = any> = {
+    [key in K]: V;
+};
+
 declare function useVerificationRepo(): {
     createIndex: () => Promise<void>;
     createTextIndex: () => Promise<void>;
@@ -1076,6 +1079,10 @@ declare function useVerificationRepo(): {
     }) => Promise<{}>;
     getByIdByType: (type: string) => Promise<TVerification[]>;
     updateStatusById: (_id: string | ObjectId, status: string, session?: ClientSession) => Promise<mongodb.UpdateResult<bson.Document>>;
+    reissuePendingById: (_id: string | ObjectId, { metadata, expireAt }: {
+        metadata: TKeyValuePair;
+        expireAt: string;
+    }) => Promise<number>;
     getByStatus: (status: string) => Promise<TVerification[]>;
     findOne: (query: any) => Promise<mongodb.WithId<bson.Document> | null>;
     completePendingInvites: ({ email, orgId, siteId, app, session, }: {
@@ -1087,10 +1094,6 @@ declare function useVerificationRepo(): {
     }) => Promise<mongodb.UpdateResult<bson.Document>>;
 };
 
-type TKeyValuePair<K extends string | number | symbol = string, V = any> = {
-    [key in K]: V;
-};
-
 declare function useVerificationService(): {
     createUserInvite: ({ email, metadata, }: {
         email: string;
@@ -1560,22 +1563,23 @@ type TOrgOwnerRepairDeps = {
 declare function orgOwnerRepairHandlers({ requireConsolePermission, getOrgUncached, countOrgMembers, claim, release, holdsClaim, findUserByEmail, confirmOwnership, findOwnerRoleId, healDefaultRoles, createMemberDirect, recordConsoleAction, gateOn, }: TOrgOwnerRepairDeps): {
     repairOwnerMembership: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
-declare function useOrgController(): {
-    add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    addOnboardingOrg: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getOrgsByUserId: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getByName: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getByEmail: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    update: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getOrgsByEmail: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getAdminOrgForResident: (_req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
-    previewOrgModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
-    repairOwnerMembership: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
-};
+type OrgController = {
+    add: RequestHandler;
+    addOnboardingOrg: RequestHandler;
+    getAll: RequestHandler;
+    getOrgsByUserId: RequestHandler;
+    getByName: RequestHandler;
+    getById: RequestHandler;
+    getByEmail: RequestHandler;
+    update: RequestHandler;
+    getOrgsByEmail: RequestHandler;
+    getAdminOrgForResident: RequestHandler;
+    updateStatus: RequestHandler;
+    updateModules: RequestHandler;
+    previewOrgModules: RequestHandler;
+    repairOwnerMembership: RequestHandler;
+};
+declare function useOrgController(): OrgController;
 
 /**
  * V2 organization HTTP surface — new handlers; v1 `useOrgController` remains unchanged.
@@ -3163,19 +3167,20 @@ declare function siteModulesHandlers({ requireSiteWrite, _getSiteById, _getOrgBy
     updateSiteModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     previewSiteModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
-declare function useSiteController(): {
-    createSite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getSites: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getSiteById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateSiteBlock: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    deleteSite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateSiteModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
-    previewSiteModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
-    updateGuardPostsById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    siteInformation: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getAllSitesForResidentCreation: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-};
+type SiteController = {
+    createSite: RequestHandler;
+    getSites: RequestHandler;
+    getSiteById: RequestHandler;
+    updateSiteBlock: RequestHandler;
+    deleteSite: RequestHandler;
+    updateById: RequestHandler;
+    updateSiteModules: RequestHandler;
+    previewSiteModules: RequestHandler;
+    updateGuardPostsById: RequestHandler;
+    siteInformation: RequestHandler;
+    getAllSitesForResidentCreation: RequestHandler;
+};
+declare function useSiteController(): SiteController;
 
 type TChat = {
     _id?: ObjectId;
@@ -11161,6 +11166,8 @@ type TVerificationMetadataV2 = {
     invitedByName?: string;
     /** True when the sender was a property management company — those need approval. */
     invitedByPropertyManagement?: boolean;
+    /** A new client's modules, chosen by Seven365 on Invite Client. */
+    modules?: string[];
 };
 /**
  * The one-time code an invitee types to prove they own the mailbox, held on the

package/dist/index.js

@@ -11268,9 +11268,6 @@ var import_node_server_utils45 = require("@7365admin1/node-server-utils");
 // src/services/verification.service.ts
 var import_node_server_utils41 = require("@7365admin1/node-server-utils");
 
-// src/repositories/verification.repo.ts
-var import_node_server_utils19 = require("@7365admin1/node-server-utils");
-
 // src/models/verification.model.ts
 var import_node_server_utils18 = require("@7365admin1/node-server-utils");
 var import_mongodb16 = require("mongodb");
@@ -11319,6 +11316,7 @@ var MVerification = class {
 };
 
 // src/repositories/verification.repo.ts
+var import_node_server_utils19 = require("@7365admin1/node-server-utils");
 var import_mongodb17 = require("mongodb");
 function useVerificationRepo() {
   const db2 = import_node_server_utils19.useAtlas.getDb();
@@ -11548,6 +11546,28 @@ function useVerificationRepo() {
       throw new import_node_server_utils19.InternalServerError("Error updating verification status.");
     }
   }
+  async function reissuePendingById(_id, { metadata, expireAt }) {
+    try {
+      _id = new import_mongodb17.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils19.BadRequestError("Invalid verification ID format.");
+    }
+    try {
+      const result = await collection.updateOne(
+        { _id, status: "pending" },
+        { $set: { metadata, expireAt, updatedAt: (/* @__PURE__ */ new Date()).toISOString() } }
+      );
+      delNamespace().catch(
+        (err) => import_node_server_utils19.logger.error(`Failed to clear cache for namespace: ${namespace_collection3}`, err)
+      );
+      delCache((0, import_node_server_utils19.makeCacheKey)(namespace_collection3, { _id })).catch(
+        (err) => import_node_server_utils19.logger.error(`Failed to delete cache for verification ${_id}`, err)
+      );
+      return result.modifiedCount;
+    } catch (error) {
+      throw new import_node_server_utils19.InternalServerError("Error re-sending the invitation.");
+    }
+  }
   async function getByStatus(status) {
     try {
       const data = await collection.find({ status }).toArray();
@@ -11617,6 +11637,7 @@ function useVerificationRepo() {
     getVerifications,
     getByIdByType,
     updateStatusById,
+    reissuePendingById,
     getByStatus,
     findOne,
     completePendingInvites
@@ -17606,7 +17627,8 @@ function useVerificationService() {
     add,
     getById: _getById,
     updateStatusById: _updateStatusById,
-    getByStatus: _getByStatus
+    getByStatus: _getByStatus,
+    reissuePendingById
   } = useVerificationRepo();
   const { getUserByEmail } = useUserRepo();
   const { getById: getOrgById, getByEmail: getOrgByEmail } = useOrgRepo();
@@ -17681,13 +17703,6 @@ function useVerificationService() {
     }
     const verificationIds = [];
     for (const app of apps) {
-      await useVerificationRepo().findOne({
-        type,
-        email,
-        "metadata.app": app,
-        "metadata.org": metadata.org,
-        "metadata.siteId": metadata.siteId
-      });
       const value = {
         type,
         email,
@@ -17698,7 +17713,24 @@ function useVerificationService() {
         expireAt: new Date(Date.now() + 72 * 60 * 60 * 1e3).toISOString(),
         createdAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const createdId = await add(value);
+      const stored = new MVerification({
+        ...value,
+        metadata: { ...value.metadata }
+      }).metadata;
+      const pending = await useVerificationRepo().findOne({
+        type,
+        // same address in any letter case, as `completePendingInvites` reads it
+        email: new RegExp(`^${email.replace(/[.*+?^$()|[\]{}\\]/g, "\\$&")}$`, "i"),
+        status: "pending",
+        "metadata.app": app,
+        "metadata.org": stored.org,
+        "metadata.siteId": stored.siteId
+      });
+      const reissued = pending?._id && await reissuePendingById(pending._id, {
+        metadata: stored,
+        expireAt: value.expireAt
+      });
+      const createdId = reissued ? pending._id : await add(value);
       verificationIds.push(createdId.toString());
       const link = `${APP_MAIN}/verify/invitation/${createdId}`;
       const emailContent = (0, import_node_server_utils41.compileHandlebar)({
@@ -29782,6 +29814,7 @@ function useMemberController() {
 // src/controllers/verification.controller.ts
 var import_node_server_utils66 = require("@7365admin1/node-server-utils");
 var import_joi28 = __toESM(require("joi"));
+var withoutEmail = (payload) => JSON.stringify({ ...payload, email: payload?.email ? "[redacted]" : void 0 });
 function callerId2(req) {
   const user = req.user;
   return user?.user?.toString?.() || user?._id?.toString?.();
@@ -29848,7 +29881,7 @@ function useVerificationController() {
     const payload = { ...req.body };
     import_node_server_utils66.logger.log({
       level: "info",
-      message: `[invite/user] payload: ${JSON.stringify(payload)}`
+      message: `[invite/user] payload: ${withoutEmail(payload)}`
     });
     const validation = import_joi28.default.object({
       email: import_joi28.default.string().email().required(),
@@ -29857,7 +29890,9 @@ function useVerificationController() {
       name: import_joi28.default.string().optional().allow("", null),
       org: import_joi28.default.string().hex().optional().allow("", null),
       siteId: import_joi28.default.string().hex().optional().allow("", null),
-      siteName: import_joi28.default.string().optional().allow("", null)
+      siteName: import_joi28.default.string().optional().allow("", null),
+      // The modules Seven365 gives a NEW client (the console's Invite Client).
+      modules: modulesSchema.optional()
     });
     const { error, value } = validation.validate(payload);
     if (error) {
@@ -29872,12 +29907,24 @@ function useVerificationController() {
       const {
         email,
         app,
-        role,
         name,
         org,
         siteId,
-        siteName
+        siteName,
+        modules
       } = value;
+      const newClient = !org && !app.includes(PLATFORM_STAFF_MEMBER_TYPE);
+      const role = newClient ? "" : value.role;
+      let clientModules;
+      if (modules !== void 0) {
+        const invitedBy = await requireConsolePermission(req, "organizations");
+        if (!newClient || app.length !== 1) {
+          throw new import_node_server_utils66.BadRequestError(
+            "Modules can only be chosen when inviting a new client, one application at a time."
+          );
+        }
+        clientModules = { modules: normaliseModules(modules), invitedBy };
+      }
       await requireInviteReach(req, org, app, role);
       const verificationIds = await _createSimpleUserInvite({
         email,
@@ -29887,7 +29934,8 @@ function useVerificationController() {
           name,
           org,
           siteId,
-          siteName
+          siteName,
+          ...clientModules
         }
       });
       const responseBody = {
@@ -29904,7 +29952,7 @@ function useVerificationController() {
     } catch (error2) {
       import_node_server_utils66.logger.log({
         level: "error",
-        message: `[invite/user] error for payload ${JSON.stringify(payload)}: ${error2.message}`
+        message: `[invite/user] error for payload ${withoutEmail(payload)}: ${error2.message}`
       });
       next(error2);
       return;
@@ -29914,7 +29962,7 @@ function useVerificationController() {
     const payload = { ...req.body };
     import_node_server_utils66.logger.log({
       level: "info",
-      message: `[invite/member] payload: ${JSON.stringify(payload)}`
+      message: `[invite/member] payload: ${withoutEmail(payload)}`
     });
     const validation = import_joi28.default.object({
       email: import_joi28.default.string().email().required(),
@@ -29966,7 +30014,7 @@ function useVerificationController() {
     } catch (error2) {
       import_node_server_utils66.logger.log({
         level: "error",
-        message: `[invite/member] error for payload ${JSON.stringify(payload)}: ${error2.message}`
+        message: `[invite/member] error for payload ${withoutEmail(payload)}: ${error2.message}`
       });
       next(error2);
       return;
@@ -29976,7 +30024,7 @@ function useVerificationController() {
     const payload = req.body;
     import_node_server_utils66.logger.log({
       level: "info",
-      message: `[service-providers/invite] payload: ${JSON.stringify(payload)}`
+      message: `[service-providers/invite] payload: ${withoutEmail(payload)}`
     });
     const validation = import_joi28.default.object({
       email: import_joi28.default.string().email().required(),
@@ -30033,7 +30081,7 @@ function useVerificationController() {
     } catch (error2) {
       import_node_server_utils66.logger.log({
         level: "error",
-        message: `[service-providers/invite] error for payload ${JSON.stringify(payload)}: ${error2.message}`
+        message: `[service-providers/invite] error for payload ${withoutEmail(payload)}: ${error2.message}`
       });
       next(error2);
       return;
@@ -31675,6 +31723,7 @@ function useOrgController() {
       let invitedFrom = null;
       let invitedRole = null;
       let inviteAlreadyComplete = false;
+      let invitedModules = null;
       let self = null;
       if (inviteId) {
         const [invite, caller] = await Promise.all([
@@ -31687,6 +31736,11 @@ function useOrgController() {
           invitedFrom = String(invite._id);
           invitedRole = invite.metadata?.role ? String(invite.metadata.role) : null;
           inviteAlreadyComplete = invite.status === "complete" /* COMPLETE */;
+          const chosen = normaliseModules(invite.metadata?.modules);
+          const invitedBy = invite.metadata?.invitedBy;
+          if (chosen.length && invitedBy && invite.metadata?.app === body.nature) {
+            invitedModules = { modules: chosen, invitedBy: String(invitedBy) };
+          }
         } else {
           import_node_server_utils71.logger.log({
             level: "warn",
@@ -31702,7 +31756,29 @@ function useOrgController() {
           );
         }
       }
-      const _id = await _add({ ...body, createdBy, invitedFrom, invitedRole });
+      const _id = await _add({
+        ...body,
+        createdBy,
+        invitedFrom,
+        invitedRole,
+        ...invitedModules && { modules: invitedModules.modules }
+      });
+      if (invitedModules) {
+        await recordConsoleAction({
+          action: "client.modules-changed" /* CLIENT_MODULES_CHANGED */,
+          actor: invitedModules.invitedBy,
+          org: String(_id),
+          target: String(_id).toLowerCase(),
+          targetType: "organization" /* ORGANIZATION */,
+          after: pickAuditFields("client.modules-changed" /* CLIENT_MODULES_CHANGED */, {
+            modules: invitedModules.modules.join(", "),
+            moduleCount: invitedModules.modules.length,
+            gateListHash: moduleListHash(invitedModules.modules),
+            acknowledged: false,
+            impactMemberCount: 0
+          })
+        });
+      }
       if (invitedFrom && !inviteAlreadyComplete) {
         try {
           await useVerificationRepoV2().updateStatusById(