@7365admin1/core 3.68.3 → 3.70.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.68.3",
+  "version": "3.70.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -43,6 +43,7 @@
     "exceljs": "^4.4.0",
     "express": "^4.21.2",
     "fast-levenshtein": "^3.0.0",
+    "handlebars": "^4.7.8",
     "iservice365-expo-notifications": "^1.0.0",
     "joi": "^17.13.3",
     "jsonwebtoken": "^9.0.2",
@@ -62,5 +63,6 @@
     "xlsx": "^0.18.5",
     "xml2js": "^0.6.2",
     "zod": "^3.24.2"
-  }
+  },
+  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

package/test/e2e/client-invite-modules.e2e.test.mjs

@@ -0,0 +1,164 @@
+// Invite Client: Seven365 chooses the new client's modules, and the owner gets
+// the client's OWN owner role (owner, 2026-09-14: "Client Owner Super Admin can
+// only have the full access on what Seven365 Super Admin given to them, same
+// goes to the modules").
+//
+// - `POST /api/auth/invite/user` with no organisation drops the role (it was a
+//   shared, org-less template) and, for staff only, stores `modules`.
+// - `POST /api/organizations/onboarding` from that invitation writes the list on
+//   the organisation plus the save row that makes the module gate enforce it,
+//   and the owner's membership holds the organisation's own seeded owner role.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "ClientModules-Passw0rd!";
+const STAFF = "sevenadmin-cim@e2e.example.com";
+const OUTSIDER = "outsider-cim@e2e.example.com";
+const CLIENT = "client-cim@e2e.example.com";
+const OTHER_NATURE = "othernature-cim@e2e.example.com";
+
+const MODULES = ["visitor-mgmt", "members", "roles", "invitations", "sites"];
+
+// `module-gate.util moduleListHash`: sorted keys, one per line, sha256.
+const listHash = (keys) => createHash("sha256").update([...keys].sort().join("\n")).digest("hex");
+
+describe("Invite Client chooses modules and the owner gets the client's own role", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const invite = (who, body) => h.api("/auth/invite/user", { method: "POST", sid: sid[who], body });
+  const inviteOf = (email) =>
+    h.db.collection("verifications").findOne({ type: "user-invite", email }, { sort: { createdAt: -1 } });
+
+  it("a staff invite for a new client stores the modules and no role", async () => {
+    const res = await invite(STAFF, {
+      email: CLIENT,
+      app: ["security_agency"],
+      role: id.templateRole.toString(),
+      modules: [...MODULES, "visitor-mgmt"],
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const row = await inviteOf(CLIENT);
+    assert.ok(!row.metadata.role, "the shared template role is not kept");
+    assert.deepEqual(row.metadata.modules, MODULES, "stored once each, in order");
+    assert.equal(String(row.metadata.invitedBy), id.staffUser.toString());
+  });
+
+  it("only Seven365 staff may choose modules", async () => {
+    const res = await invite(OUTSIDER, { email: "x-cim@e2e.example.com", app: ["security_agency"], modules: MODULES });
+    assert.ok([401, 403].includes(res.status), `expected a refusal, got ${res.status}`);
+    assert.equal(await inviteOf("x-cim@e2e.example.com"), null, "nothing was written");
+  });
+
+  it("modules are refused for more than one application or an existing organisation", async () => {
+    const two = await invite(STAFF, { email: "two-cim@e2e.example.com", app: ["security_agency", "cleaning_services"], modules: MODULES });
+    assert.equal(two.status, 400, JSON.stringify(two.body));
+
+    const existing = await invite(STAFF, {
+      email: "existing-cim@e2e.example.com",
+      app: ["organization"],
+      org: id.org.toString(),
+      modules: MODULES,
+    });
+    assert.equal(existing.status, 400, JSON.stringify(existing.body));
+  });
+
+  it("a Seven365 staff invitation keeps its role", async () => {
+    const res = await invite(STAFF, { email: "newstaff-cim@e2e.example.com", app: ["admin"], role: id.staffRole.toString() });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    assert.equal(String((await inviteOf("newstaff-cim@e2e.example.com")).metadata.role), id.staffRole.toString());
+  });
+
+  it("onboarding from the invitation enforces the list and gives the owner the client's own owner role", async () => {
+    const row = await inviteOf(CLIENT);
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[CLIENT],
+      body: { name: "CIM Security Client", type: "org", nature: "security_agency", email: CLIENT, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Security Client" });
+    assert.deepEqual(org.modules, MODULES);
+    assert.ok(!org.invitedRole, "no template recorded on the organisation");
+
+    const save = await h.db
+      .collection("console-audit")
+      .find({ action: "client.modules-changed", target: org._id.toString().toLowerCase() })
+      .toArray();
+    assert.equal(save.length, 1, "one save row");
+    assert.equal(save[0].after.gateListHash, listHash(MODULES), "the gate's enforcement marker");
+    assert.equal(String(save[0].actor), id.staffUser.toString(), "the staff member who chose the list");
+
+    const member = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const role = await h.db.collection("roles").findOne({ _id: member.role });
+    assert.equal(String(role.org), org._id.toString(), "the organisation's own role, not a shared template");
+    assert.equal(role.name, "owner");
+    assert.deepEqual(role.permissions, ["*"]);
+  });
+
+  it("an organisation of a different nature gets no list", async () => {
+    await invite(STAFF, { email: OTHER_NATURE, app: ["security_agency"], modules: MODULES });
+    const row = await inviteOf(OTHER_NATURE);
+
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[OTHER_NATURE],
+      body: { name: "CIM Cleaning Client", type: "org", nature: "cleaning_services", email: OTHER_NATURE, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Cleaning Client" });
+    assert.ok(!org.modules?.length, "a Security list would hide every Cleaning module");
+    assert.equal(
+      await h.db.collection("console-audit").countDocuments({ target: org._id.toString().toLowerCase() }),
+      0,
+    );
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const staffRole = new ObjectId();
+  const templateRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "CIM Existing Org", email: "existing-org-cim@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now,
+  });
+  await h.db.collection("roles").insertMany([
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+    { _id: templateRole, name: "Org Owner", type: "organization", permissions: ["*"], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  await h.db.collection("members").insertOne({ user: users.insertedIds[0], type: "admin", role: staffRole, status: "active" });
+
+  return { org, staffRole, templateRole, staffUser: users.insertedIds[0] };
+}

package/test/e2e/harness.mjs

@@ -319,6 +319,7 @@ function buildApp(nsu, core) {
       updateRoleById,
       updateSiteById,
       completeOnboarding,
+      getModulesByUserIdType,
     } = core.useMemberController();
 
     members.post("/verification/:id", requireAuth, createMember);
@@ -332,6 +333,7 @@ function buildApp(nsu, core) {
     members.put("/site", requireAuth, updateSiteById);
     members.put("/:id/onboarding/complete", requireAuth, completeOnboarding);
     members.get("/user/:id/app/:type/org", requireAuth, getByUserIdTypeOrg);
+    members.get("/user/:id/app/:type/modules", requireAuth, getModulesByUserIdType);
   }
 
   // mirrors iservice365-API-core/src/routes/organization-v2.route.ts
@@ -596,6 +598,8 @@ function buildApp(nsu, core) {
       updateGuardPostsById,
       siteInformation,
       getAllSitesForResidentCreation,
+      updateSiteModules,
+      previewSiteModules,
     } = core.useSiteController();
 
     sites.post("/", requireAuth, createSite);
@@ -604,6 +608,8 @@ function buildApp(nsu, core) {
     sites.put("/:id/block", requireAuth, updateSiteBlock);
     sites.delete("/:id", requireAuth, deleteSite);
     sites.patch("/id/:id", requireAuth, updateById);
+    sites.patch("/:id/modules", requireAuth, updateSiteModules);
+    sites.post("/:id/modules/preview", requireAuth, previewSiteModules);
     sites.patch("/guard-post/id/:id", requireAuth, updateGuardPostsById);
     sites.patch("/information/id/:id", requireAuth, siteInformation);
     sites.get("/site/resident", getAllSitesForResidentCreation); // no requireAuth — as shipped

package/test/e2e/site-modules-client-admin.e2e.test.mjs

@@ -0,0 +1,139 @@
+// Per-site modules, set by the client's own owner/admin (owner, 2026-09-14):
+// Seven365 gives the organisation its modules; the organisation's owner/admin
+// decides which of those each site gets; the site's staff get only that.
+//
+// - `PATCH /api/sites/:id/modules` and its preview need Seven365 staff or the
+//   caller's ORGANISATION membership with `*` or `sites:manage-site-modules`.
+//   Reaching the site (a guard pinned to it) is not enough.
+// - A key the organisation was not given is refused.
+// - An acknowledged save by the client admin is ENFORCED: the site's staff are
+//   denied what the site list leaves out.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "SiteModules-Passw0rd!";
+const OWNER = "owner-smca@e2e.example.com";
+const ADMIN_WITH = "admin-with-smca@e2e.example.com";
+const ADMIN_WITHOUT = "admin-without-smca@e2e.example.com";
+const GUARD = "guard-smca@e2e.example.com";
+
+const ORG_MODULES = ["visitor-mgmt", "work_orders", "members", "roles", "invitations", "sites"];
+const SITE_LIST = ["visitor-mgmt"];
+
+const listHash = (keys) => createHash("sha256").update([...keys].sort().join("\n")).digest("hex");
+
+describe("A client's owner/admin sets which modules each site gets", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [OWNER, ADMIN_WITH, ADMIN_WITHOUT, GUARD]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const save = (who, body) =>
+    h.api(`/sites/${id.site}/modules`, { method: "PATCH", sid: sid[who], body });
+  const preview = (who, body) =>
+    h.api(`/sites/${id.site}/modules/preview`, { method: "POST", sid: sid[who], body });
+  const stored = async () => (await h.db.collection("sites").findOne({ _id: id.site }))?.metadata?.modules;
+
+  it("a guard at the site, or an admin without the permission, is refused and nothing is written", async () => {
+    for (const who of [GUARD, ADMIN_WITHOUT]) {
+      const res = await save(who, { modules: SITE_LIST, acknowledgeImpact: true });
+      assert.equal(res.status, 401, `${who}: ${JSON.stringify(res.body)}`);
+      const peek = await preview(who, { modules: SITE_LIST });
+      assert.equal(peek.status, 401, `${who} preview: ${JSON.stringify(peek.body)}`);
+    }
+    assert.equal(await stored(), undefined);
+  });
+
+  it("a module the organisation was not given is refused", async () => {
+    const res = await save(OWNER, { modules: [...SITE_LIST, "cleaning-schedule"], acknowledgeImpact: true });
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.equal(await stored(), undefined);
+  });
+
+  it("the admin holding the permission can preview", async () => {
+    const res = await preview(ADMIN_WITH, { modules: SITE_LIST });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+
+  it("the owner's narrowing save needs acknowledging, then is enforced for the site's staff", async () => {
+    const before = await h.api(`/members/user/${id.guardUser}/app/security_agency/modules?site=${id.site}`, { sid: sid[GUARD] });
+    assert.equal(before.status, 200, JSON.stringify(before.body));
+    assert.ok(!JSON.stringify(before.body).includes("work_orders"), "CONTROL: nothing denied before the save");
+
+    const unacknowledged = await save(OWNER, { modules: SITE_LIST });
+    assert.equal(unacknowledged.status, 409, JSON.stringify(unacknowledged.body));
+    assert.equal(await stored(), undefined, "a refused save writes nothing");
+
+    const ok = await save(OWNER, { modules: SITE_LIST, acknowledgeImpact: true });
+    assert.equal(ok.status, 200, JSON.stringify(ok.body));
+    assert.deepEqual(await stored(), SITE_LIST);
+
+    const row = await h.db
+      .collection("console-audit")
+      .findOne({ action: "site.modules-changed", target: id.site.toString() }, { sort: { createdAt: -1 } });
+    assert.equal(row?.after?.gateListHash, listHash(SITE_LIST), "the client admin's save is the enforcement marker");
+
+    const after = await h.api(`/members/user/${id.guardUser}/app/security_agency/modules?site=${id.site}`, { sid: sid[GUARD] });
+    assert.equal(after.status, 200, JSON.stringify(after.body));
+    assert.ok(JSON.stringify(after.body).includes("work_orders"), `the guard loses what the site left out: ${JSON.stringify(after.body)}`);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const site = new ObjectId();
+  const ownerRole = new ObjectId();
+  const withRole = new ObjectId();
+  const withoutRole = new ObjectId();
+  const guardRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "SMCA Security", email: "org-smca@e2e.example.com", type: "org", nature: "security_agency",
+    status: "active", modules: ORG_MODULES, createdAt: now,
+  });
+  await h.db.collection("sites").insertOne({ _id: site, name: "SMCA Tower", orgId: org, status: "active", createdAt: now });
+  await h.db.collection("roles").insertMany([
+    { _id: ownerRole, name: "owner", type: "organization", org, permissions: ["*"], status: "active" },
+    { _id: withRole, name: "Site modules admin", type: "organization", org, permissions: ["sites:manage-site-modules"], status: "active" },
+    { _id: withoutRole, name: "Sites viewer", type: "organization", org, permissions: ["sites:see-all-sites"], status: "active" },
+    { _id: guardRole, name: "Guard", type: "security_agency", org, site, permissions: ["*"], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [OWNER, ADMIN_WITH, ADMIN_WITHOUT, GUARD].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  const [owner, withUser, withoutUser, guard] = Object.values(users.insertedIds);
+  const member = (user, role, type, siteId = "") => ({
+    user, org, role, type, siteId, siteName: "", name: "", email: "", status: "active", deletedAt: "", createdAt: now,
+  });
+  await h.db.collection("members").insertMany([
+    member(owner, ownerRole, "organization"),
+    member(withUser, withRole, "organization"),
+    member(withoutUser, withoutRole, "organization"),
+    member(guard, guardRole, "security_agency", site),
+  ]);
+
+  return { org, site, guardUser: guard };
+}

package/test/modules-endpoint.test.mjs

@@ -362,10 +362,13 @@ const RESIDENT = {
   memberships: [{ org: ORG, siteId: SITE, orgLevelRole: false, type: "resident" }],
 };
 const STAFF = { ...ESTATE, isSuperAdmin: true, staffPermissions: [], orgIds: [], memberships: [] };
+// The client's owner/admin: the estate member whose organisation row holds the permission.
+const CLIENT_ADMIN = { ...ESTATE, id: "client-admin" };
 
 function siteHandlers(d, actor) {
   return siteModulesHandlers({
     ...d.shared,
+    canManageSiteModules: async (who) => (d.log.push("manage"), who === STAFF || who === CLIENT_ADMIN),
     requireSiteWrite: async () => {
       d.log.push("guard");
       if (!actor) throw refused();
@@ -438,18 +441,30 @@ test("updateSiteModules: Seven365 staff's narrowing save gets 409 before any wri
   assert.equal(d.audit[0].after[HASH].length, 64);
 });
 
-test("updateSiteModules: anyone but staff (estate member, resident, engaged provider) still saves, but writes no marker", async () => {
+test("updateSiteModules: an estate member without the permission, a resident or an engaged provider is refused and nothing is written", async () => {
   for (const [who, actor] of [["estate member", ESTATE], ["resident", RESIDENT], ["provider", VENDOR]]) {
     const d = deps({ stored: undefined });
     const { updateSiteModules } = siteHandlers(d, actor);
     const out = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW, acknowledgeImpact: true } });
-    assert.equal(out.error, undefined, `${who}: the existing save is not narrowed`);
-    assert.deepEqual(d.writes(), ["write", "audit"], who);
-    assert.equal(d.audit[0].after[HASH], undefined, `${who}: the list can never be enforced`);
+    assert.equal(out.error?.statusCode, 401, who);
+    assert.deepEqual(d.writes(), [], `${who}: nothing written`);
     assert.equal(d.calls.staffMembers ?? 0, 0, `${who}: the estate's staff are never read for it`);
   }
 });
 
+test("updateSiteModules: the client's owner/admin gets the same 409-then-marker as staff (owner rule 2026-09-14)", async () => {
+  const d = deps({ stored: undefined });
+  const { updateSiteModules } = siteHandlers(d, CLIENT_ADMIN);
+  const out = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  assert.equal(out.error?.statusCode, 409);
+  assert.deepEqual(d.writes(), []);
+
+  const ok = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW, acknowledgeImpact: true } });
+  assert.equal(ok.error, undefined);
+  assert.deepEqual(d.writes(), ["write", "audit"]);
+  assert.equal(d.audit[0].after[HASH].length, 64, "the client admin's save enforces the list");
+});
+
 test("updateSiteModules: re-saving the stored site list unchanged needs no acknowledgement and writes no marker", async () => {
   const d = deps({ stored: NARROW });
   const out = await call(siteHandlers(d, STAFF).updateSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
@@ -457,20 +472,20 @@ test("updateSiteModules: re-saving the stored site list unchanged needs no ackno
   assert.equal(d.audit[0].after[HASH], undefined);
 });
 
-test("previewSiteModules: an engagement-only provider or a resident is refused before any member is read", async () => {
-  for (const [who, actor] of [["provider", VENDOR], ["resident", RESIDENT]]) {
+test("previewSiteModules: anyone who may not manage the site's modules is refused before any member is read", async () => {
+  for (const [who, actor] of [["provider", VENDOR], ["resident", RESIDENT], ["estate member without the permission", ESTATE]]) {
     const d = deps({ stored: undefined });
     const out = await call(siteHandlers(d, actor).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
     assert.equal(out.error?.statusCode, 401, who);
     assert.equal(out.json, undefined, `${who}: no staff names or roles leave`);
-    assert.deepEqual(d.log, ["guard", "read"], who);
+    assert.deepEqual(d.log, ["guard", "read", "manage"], who);
     assert.deepEqual(d.calls, {}, who);
   }
 
   // A missing site answers as missing, like the rest of the site routes.
   const gone = deps();
   gone.missing = true;
-  const missing = await call(siteHandlers(gone, ESTATE).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  const missing = await call(siteHandlers(gone, CLIENT_ADMIN).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
   assert.equal(missing.error?.statusCode, 404);
 
   // A caller the site guard refuses reads nothing at all.
@@ -479,7 +494,7 @@ test("previewSiteModules: an engagement-only provider or a resident is refused b
   assert.deepEqual(none.log, ["guard"]);
 
   // CONTROL: the estate's own member gets the preview, and nothing is written.
-  for (const actor of [ESTATE, STAFF]) {
+  for (const actor of [CLIENT_ADMIN, STAFF]) {
     const ok = deps({ stored: undefined });
     const answer = await call(siteHandlers(ok, actor).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
     assert.ok(answer.json.impact.memberCount > 0);