@7365admin1/core 3.68.3 → 3.69.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.68.3",
+  "version": "3.69.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/client-invite-modules.e2e.test.mjs

@@ -0,0 +1,164 @@
+// Invite Client: Seven365 chooses the new client's modules, and the owner gets
+// the client's OWN owner role (owner, 2026-09-14: "Client Owner Super Admin can
+// only have the full access on what Seven365 Super Admin given to them, same
+// goes to the modules").
+//
+// - `POST /api/auth/invite/user` with no organisation drops the role (it was a
+//   shared, org-less template) and, for staff only, stores `modules`.
+// - `POST /api/organizations/onboarding` from that invitation writes the list on
+//   the organisation plus the save row that makes the module gate enforce it,
+//   and the owner's membership holds the organisation's own seeded owner role.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "ClientModules-Passw0rd!";
+const STAFF = "sevenadmin-cim@e2e.example.com";
+const OUTSIDER = "outsider-cim@e2e.example.com";
+const CLIENT = "client-cim@e2e.example.com";
+const OTHER_NATURE = "othernature-cim@e2e.example.com";
+
+const MODULES = ["visitor-mgmt", "members", "roles", "invitations", "sites"];
+
+// `module-gate.util moduleListHash`: sorted keys, one per line, sha256.
+const listHash = (keys) => createHash("sha256").update([...keys].sort().join("\n")).digest("hex");
+
+describe("Invite Client chooses modules and the owner gets the client's own role", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const invite = (who, body) => h.api("/auth/invite/user", { method: "POST", sid: sid[who], body });
+  const inviteOf = (email) =>
+    h.db.collection("verifications").findOne({ type: "user-invite", email }, { sort: { createdAt: -1 } });
+
+  it("a staff invite for a new client stores the modules and no role", async () => {
+    const res = await invite(STAFF, {
+      email: CLIENT,
+      app: ["security_agency"],
+      role: id.templateRole.toString(),
+      modules: [...MODULES, "visitor-mgmt"],
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const row = await inviteOf(CLIENT);
+    assert.ok(!row.metadata.role, "the shared template role is not kept");
+    assert.deepEqual(row.metadata.modules, MODULES, "stored once each, in order");
+    assert.equal(String(row.metadata.invitedBy), id.staffUser.toString());
+  });
+
+  it("only Seven365 staff may choose modules", async () => {
+    const res = await invite(OUTSIDER, { email: "x-cim@e2e.example.com", app: ["security_agency"], modules: MODULES });
+    assert.ok([401, 403].includes(res.status), `expected a refusal, got ${res.status}`);
+    assert.equal(await inviteOf("x-cim@e2e.example.com"), null, "nothing was written");
+  });
+
+  it("modules are refused for more than one application or an existing organisation", async () => {
+    const two = await invite(STAFF, { email: "two-cim@e2e.example.com", app: ["security_agency", "cleaning_services"], modules: MODULES });
+    assert.equal(two.status, 400, JSON.stringify(two.body));
+
+    const existing = await invite(STAFF, {
+      email: "existing-cim@e2e.example.com",
+      app: ["organization"],
+      org: id.org.toString(),
+      modules: MODULES,
+    });
+    assert.equal(existing.status, 400, JSON.stringify(existing.body));
+  });
+
+  it("a Seven365 staff invitation keeps its role", async () => {
+    const res = await invite(STAFF, { email: "newstaff-cim@e2e.example.com", app: ["admin"], role: id.staffRole.toString() });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    assert.equal(String((await inviteOf("newstaff-cim@e2e.example.com")).metadata.role), id.staffRole.toString());
+  });
+
+  it("onboarding from the invitation enforces the list and gives the owner the client's own owner role", async () => {
+    const row = await inviteOf(CLIENT);
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[CLIENT],
+      body: { name: "CIM Security Client", type: "org", nature: "security_agency", email: CLIENT, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Security Client" });
+    assert.deepEqual(org.modules, MODULES);
+    assert.ok(!org.invitedRole, "no template recorded on the organisation");
+
+    const save = await h.db
+      .collection("console-audit")
+      .find({ action: "client.modules-changed", target: org._id.toString().toLowerCase() })
+      .toArray();
+    assert.equal(save.length, 1, "one save row");
+    assert.equal(save[0].after.gateListHash, listHash(MODULES), "the gate's enforcement marker");
+    assert.equal(String(save[0].actor), id.staffUser.toString(), "the staff member who chose the list");
+
+    const member = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const role = await h.db.collection("roles").findOne({ _id: member.role });
+    assert.equal(String(role.org), org._id.toString(), "the organisation's own role, not a shared template");
+    assert.equal(role.name, "owner");
+    assert.deepEqual(role.permissions, ["*"]);
+  });
+
+  it("an organisation of a different nature gets no list", async () => {
+    await invite(STAFF, { email: OTHER_NATURE, app: ["security_agency"], modules: MODULES });
+    const row = await inviteOf(OTHER_NATURE);
+
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[OTHER_NATURE],
+      body: { name: "CIM Cleaning Client", type: "org", nature: "cleaning_services", email: OTHER_NATURE, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Cleaning Client" });
+    assert.ok(!org.modules?.length, "a Security list would hide every Cleaning module");
+    assert.equal(
+      await h.db.collection("console-audit").countDocuments({ target: org._id.toString().toLowerCase() }),
+      0,
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const staffRole = new ObjectId();
+  const templateRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "CIM Existing Org", email: "existing-org-cim@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now,
+  });
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: templateRole, name: "Org Owner", type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertOne({ user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" });
+
+  return { org, staffRole, templateRole, staffUser: users.insertedIds[0] };
+}