@7365admin1/core 3.69.0 → 3.71.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.69.0",
+  "version": "3.71.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -43,6 +43,7 @@
     "exceljs": "^4.4.0",
     "express": "^4.21.2",
     "fast-levenshtein": "^3.0.0",
+    "handlebars": "^4.7.8",
     "iservice365-expo-notifications": "^1.0.0",
     "joi": "^17.13.3",
     "jsonwebtoken": "^9.0.2",
@@ -62,5 +63,6 @@
     "xlsx": "^0.18.5",
     "xml2js": "^0.6.2",
     "zod": "^3.24.2"
-  }
+  },
+  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

package/test/e2e/harness.mjs

@@ -319,6 +319,7 @@ function buildApp(nsu, core) {
       updateRoleById,
       updateSiteById,
       completeOnboarding,
+      getModulesByUserIdType,
     } = core.useMemberController();
 
     members.post("/verification/:id", requireAuth, createMember);
@@ -332,6 +333,7 @@ function buildApp(nsu, core) {
     members.put("/site", requireAuth, updateSiteById);
     members.put("/:id/onboarding/complete", requireAuth, completeOnboarding);
     members.get("/user/:id/app/:type/org", requireAuth, getByUserIdTypeOrg);
+    members.get("/user/:id/app/:type/modules", requireAuth, getModulesByUserIdType);
   }
 
   // mirrors iservice365-API-core/src/routes/organization-v2.route.ts
@@ -596,6 +598,8 @@ function buildApp(nsu, core) {
       updateGuardPostsById,
       siteInformation,
       getAllSitesForResidentCreation,
+      updateSiteModules,
+      previewSiteModules,
     } = core.useSiteController();
 
     sites.post("/", requireAuth, createSite);
@@ -604,6 +608,8 @@ function buildApp(nsu, core) {
     sites.put("/:id/block", requireAuth, updateSiteBlock);
     sites.delete("/:id", requireAuth, deleteSite);
     sites.patch("/id/:id", requireAuth, updateById);
+    sites.patch("/:id/modules", requireAuth, updateSiteModules);
+    sites.post("/:id/modules/preview", requireAuth, previewSiteModules);
     sites.patch("/guard-post/id/:id", requireAuth, updateGuardPostsById);
     sites.patch("/information/id/:id", requireAuth, siteInformation);
     sites.get("/site/resident", getAllSitesForResidentCreation); // no requireAuth — as shipped

package/test/e2e/member-list-site-scope.e2e.test.mjs

@@ -0,0 +1,111 @@
+// GET /api/members?org=: belonging to the organisation is not belonging to every
+// site in it. A guard pinned to site A sees site A's members only; a request for
+// site B is refused; the organisation's own admin and Seven365 staff see all;
+// a resident sees none.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "MemberListScope-Passw0rd!";
+const ADMIN = "admin-mls@e2e.example.com";
+const GUARD_A = "guard-a-mls@e2e.example.com";
+const GUARD_B = "guard-b-mls@e2e.example.com";
+const RESIDENT = "resident-mls@e2e.example.com";
+const STAFF = "staff-mls@e2e.example.com";
+
+describe("Member lists follow the caller's sites", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [ADMIN, GUARD_A, GUARD_B, RESIDENT, STAFF]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const list = (who, extra = "") =>
+    h.api(`/members?org=${id.org}&type=security_agency&status=active&limit=50${extra}`, { sid: sid[who] });
+  const emails = (res) => (res.body?.items ?? []).map((row) => row.email).sort();
+
+  it("a guard pinned to site A lists only site A's members", async () => {
+    const res = await list(GUARD_A);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(emails(res), [GUARD_A]);
+  });
+
+  it("a guard asking for a site they are not pinned to is refused", async () => {
+    const res = await list(GUARD_A, `&siteId=${id.siteB}`);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    const own = await list(GUARD_A, `&siteId=${id.siteA}`);
+    assert.equal(own.status, 200, JSON.stringify(own.body));
+    assert.deepEqual(emails(own), [GUARD_A]);
+  });
+
+  it("CONTROL: the organisation's admin and Seven365 staff list every site", async () => {
+    for (const who of [ADMIN, STAFF]) {
+      const res = await list(who);
+      assert.equal(res.status, 200, `${who}: ${JSON.stringify(res.body)}`);
+      assert.deepEqual(emails(res), [GUARD_A, GUARD_B].sort(), who);
+    }
+  });
+
+  it("a resident of the organisation lists no staff", async () => {
+    const res = await list(RESIDENT);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(emails(res), []);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const siteA = new ObjectId();
+  const siteB = new ObjectId();
+  const adminRole = new ObjectId();
+  const guardRoleA = new ObjectId();
+  const guardRoleB = new ObjectId();
+  const residentRole = new ObjectId();
+  const staffRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({ _id: org, name: "MLS Security", email: "org-mls@e2e.example.com", type: "org", nature: "security_agency", status: "active", createdAt: now });
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "MLS A", orgId: org, status: "active", createdAt: now },
+    { _id: siteB, name: "MLS B", orgId: org, status: "active", createdAt: now },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: adminRole, name: "owner", type: "organization", org, permissions: ["*"], status: "active" },
+    { _id: guardRoleA, name: "Guard A", type: "security_agency", org, site: siteA, permissions: ["*"], status: "active" },
+    { _id: guardRoleB, name: "Guard B", type: "security_agency", org, site: siteB, permissions: ["*"], status: "active" },
+    { _id: residentRole, name: "Resident", type: "resident", org, site: siteA, permissions: ["*"], status: "active" },
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [ADMIN, GUARD_A, GUARD_B, RESIDENT, STAFF].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+  const [admin, guardA, guardB, resident, staff] = Object.values(users.insertedIds);
+  const member = (user, role, type, email, siteId = "") => ({ user, org, role, type, siteId, siteName: "", name: email, email, status: "active", deletedAt: "", createdAt: now });
+  await h.db.collection("members").insertMany([
+    member(admin, adminRole, "organization", ADMIN),
+    member(guardA, guardRoleA, "security_agency", GUARD_A, siteA),
+    member(guardB, guardRoleB, "security_agency", GUARD_B, siteB),
+    member(resident, residentRole, "resident", RESIDENT, siteA),
+    { user: staff, type: "admin", role: staffRole, status: "active", name: STAFF, email: STAFF, createdAt: now },
+  ]);
+
+  return { org, siteA, siteB };
+}

package/test/e2e/site-modules-client-admin.e2e.test.mjs

@@ -0,0 +1,139 @@
+// Per-site modules, set by the client's own owner/admin (owner, 2026-09-14):
+// Seven365 gives the organisation its modules; the organisation's owner/admin
+// decides which of those each site gets; the site's staff get only that.
+//
+// - `PATCH /api/sites/:id/modules` and its preview need Seven365 staff or the
+//   caller's ORGANISATION membership with `*` or `sites:manage-site-modules`.
+//   Reaching the site (a guard pinned to it) is not enough.
+// - A key the organisation was not given is refused.
+// - An acknowledged save by the client admin is ENFORCED: the site's staff are
+//   denied what the site list leaves out.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "SiteModules-Passw0rd!";
+const OWNER = "owner-smca@e2e.example.com";
+const ADMIN_WITH = "admin-with-smca@e2e.example.com";
+const ADMIN_WITHOUT = "admin-without-smca@e2e.example.com";
+const GUARD = "guard-smca@e2e.example.com";
+
+const ORG_MODULES = ["visitor-mgmt", "work_orders", "members", "roles", "invitations", "sites"];
+const SITE_LIST = ["visitor-mgmt"];
+
+const listHash = (keys) => createHash("sha256").update([...keys].sort().join("\n")).digest("hex");
+
+describe("A client's owner/admin sets which modules each site gets", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [OWNER, ADMIN_WITH, ADMIN_WITHOUT, GUARD]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const save = (who, body) =>
+    h.api(`/sites/${id.site}/modules`, { method: "PATCH", sid: sid[who], body });
+  const preview = (who, body) =>
+    h.api(`/sites/${id.site}/modules/preview`, { method: "POST", sid: sid[who], body });
+  const stored = async () => (await h.db.collection("sites").findOne({ _id: id.site }))?.metadata?.modules;
+
+  it("a guard at the site, or an admin without the permission, is refused and nothing is written", async () => {
+    for (const who of [GUARD, ADMIN_WITHOUT]) {
+      const res = await save(who, { modules: SITE_LIST, acknowledgeImpact: true });
+      assert.equal(res.status, 401, `${who}: ${JSON.stringify(res.body)}`);
+      const peek = await preview(who, { modules: SITE_LIST });
+      assert.equal(peek.status, 401, `${who} preview: ${JSON.stringify(peek.body)}`);
+    }
+    assert.equal(await stored(), undefined);
+  });
+
+  it("a module the organisation was not given is refused", async () => {
+    const res = await save(OWNER, { modules: [...SITE_LIST, "cleaning-schedule"], acknowledgeImpact: true });
+    assert.equal(res.status, 400, JSON.stringify(res.body));
+    assert.equal(await stored(), undefined);
+  });
+
+  it("the admin holding the permission can preview", async () => {
+    const res = await preview(ADMIN_WITH, { modules: SITE_LIST });
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+  });
+
+  it("the owner's narrowing save needs acknowledging, then is enforced for the site's staff", async () => {
+    const before = await h.api(`/members/user/${id.guardUser}/app/security_agency/modules?site=${id.site}`, { sid: sid[GUARD] });
+    assert.equal(before.status, 200, JSON.stringify(before.body));
+    assert.ok(!JSON.stringify(before.body).includes("work_orders"), "CONTROL: nothing denied before the save");
+
+    const unacknowledged = await save(OWNER, { modules: SITE_LIST });
+    assert.equal(unacknowledged.status, 409, JSON.stringify(unacknowledged.body));
+    assert.equal(await stored(), undefined, "a refused save writes nothing");
+
+    const ok = await save(OWNER, { modules: SITE_LIST, acknowledgeImpact: true });
+    assert.equal(ok.status, 200, JSON.stringify(ok.body));
+    assert.deepEqual(await stored(), SITE_LIST);
+
+    const row = await h.db
+      .collection("console-audit")
+      .findOne({ action: "site.modules-changed", target: id.site.toString() }, { sort: { createdAt: -1 } });
+    assert.equal(row?.after?.gateListHash, listHash(SITE_LIST), "the client admin's save is the enforcement marker");
+
+    const after = await h.api(`/members/user/${id.guardUser}/app/security_agency/modules?site=${id.site}`, { sid: sid[GUARD] });
+    assert.equal(after.status, 200, JSON.stringify(after.body));
+    assert.ok(JSON.stringify(after.body).includes("work_orders"), `the guard loses what the site left out: ${JSON.stringify(after.body)}`);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const site = new ObjectId();
+  const ownerRole = new ObjectId();
+  const withRole = new ObjectId();
+  const withoutRole = new ObjectId();
+  const guardRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({
+    _id: org, name: "SMCA Security", email: "org-smca@e2e.example.com", type: "org", nature: "security_agency",
+    status: "active", modules: ORG_MODULES, createdAt: now,
+  });
+  await h.db.collection("sites").insertOne({ _id: site, name: "SMCA Tower", orgId: org, status: "active", createdAt: now });
+  await h.db.collection("roles").insertMany([
+    { _id: ownerRole, name: "owner", type: "organization", org, permissions: ["*"], status: "active" },
+    { _id: withRole, name: "Site modules admin", type: "organization", org, permissions: ["sites:manage-site-modules"], status: "active" },
+    { _id: withoutRole, name: "Sites viewer", type: "organization", org, permissions: ["sites:see-all-sites"], status: "active" },
+    { _id: guardRole, name: "Guard", type: "security_agency", org, site, permissions: ["*"], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [OWNER, ADMIN_WITH, ADMIN_WITHOUT, GUARD].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+
+  const [owner, withUser, withoutUser, guard] = Object.values(users.insertedIds);
+  const member = (user, role, type, siteId = "") => ({
+    user, org, role, type, siteId, siteName: "", name: "", email: "", status: "active", deletedAt: "", createdAt: now,
+  });
+  await h.db.collection("members").insertMany([
+    member(owner, ownerRole, "organization"),
+    member(withUser, withRole, "organization"),
+    member(withoutUser, withoutRole, "organization"),
+    member(guard, guardRole, "security_agency", site),
+  ]);
+
+  return { org, site, guardUser: guard };
+}

package/test/member-list-site-scope.test.mjs

@@ -0,0 +1,30 @@
+// GET /api/members?org=: a caller pinned to sites lists only those sites' members
+// (owner policy: agency staff see only their assigned site).
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { memberListSiteScope } from "./.build/utils/member-lookup.util.mjs";
+
+const ORG = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const OTHER = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const A = "111111111111111111111111";
+const B = "222222222222222222222222";
+const m = (org, siteId, type = "security_agency", orgLevelRole = false) => ({ org, siteId, type, orgLevelRole });
+
+test("an organisation-wide membership, or an organisation-level role, lists every site", () => {
+  assert.equal(memberListSiteScope([m(ORG, "", "organization")], ORG), null);
+  assert.equal(memberListSiteScope([m(ORG, A, "security_agency", true)], ORG), null);
+});
+
+test("a caller pinned to sites lists only those sites", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A), m(ORG, B), m(ORG, A, "cleaning_services")], ORG), [A, B]);
+});
+
+test("memberships in another organisation do not widen this one", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A), m(OTHER, "", "organization")], ORG), [A]);
+});
+
+test("a resident-only caller lists nothing; an owner or invitee with no membership keeps today's answer", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A, "resident")], ORG), []);
+  assert.equal(memberListSiteScope([], ORG), null);
+});

package/test/modules-endpoint.test.mjs

@@ -362,10 +362,13 @@ const RESIDENT = {
   memberships: [{ org: ORG, siteId: SITE, orgLevelRole: false, type: "resident" }],
 };
 const STAFF = { ...ESTATE, isSuperAdmin: true, staffPermissions: [], orgIds: [], memberships: [] };
+// The client's owner/admin: the estate member whose organisation row holds the permission.
+const CLIENT_ADMIN = { ...ESTATE, id: "client-admin" };
 
 function siteHandlers(d, actor) {
   return siteModulesHandlers({
     ...d.shared,
+    canManageSiteModules: async (who) => (d.log.push("manage"), who === STAFF || who === CLIENT_ADMIN),
     requireSiteWrite: async () => {
       d.log.push("guard");
       if (!actor) throw refused();
@@ -438,18 +441,30 @@ test("updateSiteModules: Seven365 staff's narrowing save gets 409 before any wri
   assert.equal(d.audit[0].after[HASH].length, 64);
 });
 
-test("updateSiteModules: anyone but staff (estate member, resident, engaged provider) still saves, but writes no marker", async () => {
+test("updateSiteModules: an estate member without the permission, a resident or an engaged provider is refused and nothing is written", async () => {
   for (const [who, actor] of [["estate member", ESTATE], ["resident", RESIDENT], ["provider", VENDOR]]) {
     const d = deps({ stored: undefined });
     const { updateSiteModules } = siteHandlers(d, actor);
     const out = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW, acknowledgeImpact: true } });
-    assert.equal(out.error, undefined, `${who}: the existing save is not narrowed`);
-    assert.deepEqual(d.writes(), ["write", "audit"], who);
-    assert.equal(d.audit[0].after[HASH], undefined, `${who}: the list can never be enforced`);
+    assert.equal(out.error?.statusCode, 401, who);
+    assert.deepEqual(d.writes(), [], `${who}: nothing written`);
     assert.equal(d.calls.staffMembers ?? 0, 0, `${who}: the estate's staff are never read for it`);
   }
 });
 
+test("updateSiteModules: the client's owner/admin gets the same 409-then-marker as staff (owner rule 2026-09-14)", async () => {
+  const d = deps({ stored: undefined });
+  const { updateSiteModules } = siteHandlers(d, CLIENT_ADMIN);
+  const out = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  assert.equal(out.error?.statusCode, 409);
+  assert.deepEqual(d.writes(), []);
+
+  const ok = await call(updateSiteModules, { params: { id: SITE }, body: { modules: NARROW, acknowledgeImpact: true } });
+  assert.equal(ok.error, undefined);
+  assert.deepEqual(d.writes(), ["write", "audit"]);
+  assert.equal(d.audit[0].after[HASH].length, 64, "the client admin's save enforces the list");
+});
+
 test("updateSiteModules: re-saving the stored site list unchanged needs no acknowledgement and writes no marker", async () => {
   const d = deps({ stored: NARROW });
   const out = await call(siteHandlers(d, STAFF).updateSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
@@ -457,20 +472,20 @@ test("updateSiteModules: re-saving the stored site list unchanged needs no ackno
   assert.equal(d.audit[0].after[HASH], undefined);
 });
 
-test("previewSiteModules: an engagement-only provider or a resident is refused before any member is read", async () => {
-  for (const [who, actor] of [["provider", VENDOR], ["resident", RESIDENT]]) {
+test("previewSiteModules: anyone who may not manage the site's modules is refused before any member is read", async () => {
+  for (const [who, actor] of [["provider", VENDOR], ["resident", RESIDENT], ["estate member without the permission", ESTATE]]) {
     const d = deps({ stored: undefined });
     const out = await call(siteHandlers(d, actor).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
     assert.equal(out.error?.statusCode, 401, who);
     assert.equal(out.json, undefined, `${who}: no staff names or roles leave`);
-    assert.deepEqual(d.log, ["guard", "read"], who);
+    assert.deepEqual(d.log, ["guard", "read", "manage"], who);
     assert.deepEqual(d.calls, {}, who);
   }
 
   // A missing site answers as missing, like the rest of the site routes.
   const gone = deps();
   gone.missing = true;
-  const missing = await call(siteHandlers(gone, ESTATE).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
+  const missing = await call(siteHandlers(gone, CLIENT_ADMIN).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
   assert.equal(missing.error?.statusCode, 404);
 
   // A caller the site guard refuses reads nothing at all.
@@ -479,7 +494,7 @@ test("previewSiteModules: an engagement-only provider or a resident is refused b
   assert.deepEqual(none.log, ["guard"]);
 
   // CONTROL: the estate's own member gets the preview, and nothing is written.
-  for (const actor of [ESTATE, STAFF]) {
+  for (const actor of [CLIENT_ADMIN, STAFF]) {
     const ok = deps({ stored: undefined });
     const answer = await call(siteHandlers(ok, actor).previewSiteModules, { params: { id: SITE }, body: { modules: NARROW } });
     assert.ok(answer.json.impact.memberCount > 0);