@7365admin1/core 3.68.2 → 3.69.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.68.2",
+  "version": "3.69.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/client-invite-modules.e2e.test.mjs

@@ -0,0 +1,164 @@
+// Invite Client: Seven365 chooses the new client's modules, and the owner gets
+// the client's OWN owner role (owner, 2026-09-14: "Client Owner Super Admin can
+// only have the full access on what Seven365 Super Admin given to them, same
+// goes to the modules").
+//
+// - `POST /api/auth/invite/user` with no organisation drops the role (it was a
+//   shared, org-less template) and, for staff only, stores `modules`.
+// - `POST /api/organizations/onboarding` from that invitation writes the list on
+//   the organisation plus the save row that makes the module gate enforce it,
+//   and the owner's membership holds the organisation's own seeded owner role.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "ClientModules-Passw0rd!";
+const STAFF = "sevenadmin-cim@e2e.example.com";
+const OUTSIDER = "outsider-cim@e2e.example.com";
+const CLIENT = "client-cim@e2e.example.com";
+const OTHER_NATURE = "othernature-cim@e2e.example.com";
+
+const MODULES = ["visitor-mgmt", "members", "roles", "invitations", "sites"];
+
+// `module-gate.util moduleListHash`: sorted keys, one per line, sha256.
+const listHash = (keys) => createHash("sha256").update([...keys].sort().join("\n")).digest("hex");
+
+describe("Invite Client chooses modules and the owner gets the client's own role", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const invite = (who, body) => h.api("/auth/invite/user", { method: "POST", sid: sid[who], body });
+  const inviteOf = (email) =>
+    h.db.collection("verifications").findOne({ type: "user-invite", email }, { sort: { createdAt: -1 } });
+
+  it("a staff invite for a new client stores the modules and no role", async () => {
+    const res = await invite(STAFF, {
+      email: CLIENT,
+      app: ["security_agency"],
+      role: id.templateRole.toString(),
+      modules: [...MODULES, "visitor-mgmt"],
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const row = await inviteOf(CLIENT);
+    assert.ok(!row.metadata.role, "the shared template role is not kept");
+    assert.deepEqual(row.metadata.modules, MODULES, "stored once each, in order");
+    assert.equal(String(row.metadata.invitedBy), id.staffUser.toString());
+  });
+
+  it("only Seven365 staff may choose modules", async () => {
+    const res = await invite(OUTSIDER, { email: "x-cim@e2e.example.com", app: ["security_agency"], modules: MODULES });
+    assert.ok([401, 403].includes(res.status), `expected a refusal, got ${res.status}`);
+    assert.equal(await inviteOf("x-cim@e2e.example.com"), null, "nothing was written");
+  });
+
+  it("modules are refused for more than one application or an existing organisation", async () => {
+    const two = await invite(STAFF, { email: "two-cim@e2e.example.com", app: ["security_agency", "cleaning_services"], modules: MODULES });
+    assert.equal(two.status, 400, JSON.stringify(two.body));
+
+    const existing = await invite(STAFF, {
+      email: "existing-cim@e2e.example.com",
+      app: ["organization"],
+      org: id.org.toString(),
+      modules: MODULES,
+    });
+    assert.equal(existing.status, 400, JSON.stringify(existing.body));
+  });
+
+  it("a Seven365 staff invitation keeps its role", async () => {
+    const res = await invite(STAFF, { email: "newstaff-cim@e2e.example.com", app: ["admin"], role: id.staffRole.toString() });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    assert.equal(String((await inviteOf("newstaff-cim@e2e.example.com")).metadata.role), id.staffRole.toString());
+  });
+
+  it("onboarding from the invitation enforces the list and gives the owner the client's own owner role", async () => {
+    const row = await inviteOf(CLIENT);
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[CLIENT],
+      body: { name: "CIM Security Client", type: "org", nature: "security_agency", email: CLIENT, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Security Client" });
+    assert.deepEqual(org.modules, MODULES);
+    assert.ok(!org.invitedRole, "no template recorded on the organisation");
+
+    const save = await h.db
+      .collection("console-audit")
+      .find({ action: "client.modules-changed", target: org._id.toString().toLowerCase() })
+      .toArray();
+    assert.equal(save.length, 1, "one save row");
+    assert.equal(save[0].after.gateListHash, listHash(MODULES), "the gate's enforcement marker");
+    assert.equal(String(save[0].actor), id.staffUser.toString(), "the staff member who chose the list");
+
+    const member = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const role = await h.db.collection("roles").findOne({ _id: member.role });
+    assert.equal(String(role.org), org._id.toString(), "the organisation's own role, not a shared template");
+    assert.equal(role.name, "owner");
+    assert.deepEqual(role.permissions, ["*"]);
+  });
+
+  it("an organisation of a different nature gets no list", async () => {
+    await invite(STAFF, { email: OTHER_NATURE, app: ["security_agency"], modules: MODULES });
+    const row = await inviteOf(OTHER_NATURE);
+
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[OTHER_NATURE],
+      body: { name: "CIM Cleaning Client", type: "org", nature: "cleaning_services", email: OTHER_NATURE, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Cleaning Client" });
+    assert.ok(!org.modules?.length, "a Security list would hide every Cleaning module");
+    assert.equal(
+      await h.db.collection("console-audit").countDocuments({ target: org._id.toString().toLowerCase() }),
+      0,
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const staffRole = new ObjectId();
+  const templateRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "CIM Existing Org", email: "existing-org-cim@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now,
+  });
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: templateRole, name: "Org Owner", type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertOne({ user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" });
+
+  return { org, staffRole, templateRole, staffUser: users.insertedIds[0] };
+}

package/test/e2e/user-invite-dedupe.e2e.test.mjs

@@ -0,0 +1,138 @@
+// Re-inviting the same person must not add a second pending invitation.
+//
+// `createSimpleUserInvite` (POST /api/auth/invite/user — the console's Invite
+// Client form and the org/hygiene invite screens) looked for an existing
+// invitation and threw the answer away, so every click added another pending
+// row and another e-mail. Now a pending invitation for the same person, app,
+// organisation and site is sent again on the SAME row: fresh expiry, the new
+// request's role. Accepted or cancelled invitations are left alone.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "InviteDedupe-Passw0rd!";
+const STAFF = "sevenadmin-dedupe@e2e.example.com";
+const OWNER = "owner-dedupe@e2e.example.com";
+const CLIENT = "Client-Dedupe@e2e.example.com";
+
+describe("re-inviting reuses the pending invitation", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  let staffSid;
+  let ownerSid;
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    staffSid = await h.login(STAFF, PASSWORD);
+    ownerSid = await h.login(OWNER, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const invites = (email) =>
+    h.db
+      .collection("verifications")
+      .find({ type: "user-invite", email: new RegExp(`^${email}$`, "i") })
+      .toArray();
+
+  const invite = (sid, body) =>
+    h.api("/auth/invite/user", { method: "POST", sid, body });
+
+  it("the console's client invite, sent twice, is one row and the same link", async () => {
+    const body = { email: CLIENT, app: ["security_agency"], role: id.templateRole.toString(), name: "Org Owner" };
+
+    const first = await invite(staffSid, body);
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+
+    const sent = h.mails.length;
+    // a different letter case is the same person
+    const second = await invite(staffSid, { ...body, email: CLIENT.toLowerCase() });
+    assert.equal(second.status, 201, JSON.stringify(second.body));
+
+    const rows = await invites(CLIENT);
+    assert.equal(rows.length, 1, "no second pending invitation");
+    assert.deepEqual(second.body.verificationIds, first.body.verificationIds);
+
+    // the e-mail is sent again, carrying the same link
+    const mail = await h.mailAt(sent);
+    assert.ok(mail.body.includes(first.body.verificationIds[0]), "resent mail links the same invitation");
+  });
+
+  it("an organisation invite sent again takes the new role", async () => {
+    const body = {
+      email: "member-dedupe@e2e.example.com",
+      app: ["organization"],
+      org: id.org.toString(),
+      siteId: id.site.toString(),
+      siteName: "Dedupe Site",
+      role: id.roleA.toString(),
+    };
+
+    assert.equal((await invite(ownerSid, body)).status, 201);
+    assert.equal((await invite(ownerSid, { ...body, role: id.roleB.toString() })).status, 201);
+
+    const rows = await invites(body.email);
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].metadata.role.toString(), id.roleB.toString());
+    assert.equal(rows[0].metadata.org.toString(), id.org.toString(), "still stored as the organisation id");
+  });
+
+  it("a different app, or an invitation already accepted, still creates a new one", async () => {
+    const body = { email: "multi-dedupe@e2e.example.com", app: ["security_agency"], role: id.templateRole.toString() };
+
+    await invite(staffSid, body);
+    await invite(staffSid, { ...body, app: ["cleaning_services"] });
+    assert.equal((await invites(body.email)).length, 2);
+
+    await h.db.collection("verifications").updateMany({ email: body.email }, { $set: { status: "complete" } });
+    await invite(staffSid, body);
+    assert.equal((await invites(body.email)).length, 3);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const site = new ObjectId();
+  const staffRole = new ObjectId();
+  const templateRole = new ObjectId();
+  const roleA = new ObjectId();
+  const roleB = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "Dedupe Org", email: OWNER, type: "org", nature: "property_management_agency", status: "active", createdAt: now,
+  });
+  await h.db.collection("sites").insertOne({ _id: site, name: "Dedupe Site", org, orgId: org, status: "active" });
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: templateRole, name: "Org Owner", type: "organization", permissions: ["*"], status: "active" },
+    { _id: roleA, name: "Supervisor", org, permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Manager", org, permissions: ["*"], status: "active" },
+  ]);
+  await h.db.collection("subscriptions").insertOne({
+    org, type: "organization", status: "active", maxSeats: 0, paidSeats: 0, currentSeats: 0, createdAt: now,
+  });
+
+  const users = await h.db.collection("users").insertMany(
+    [STAFF, OWNER].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertMany([
+    { user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" },
+    { user: users.insertedIds[1], org, type: "organization", role: roleA, status: "active" },
+  ]);
+
+  return { org, site, templateRole, roleA, roleB };
+}