@7365admin1/core 3.70.0 → 3.71.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.70.0",
+  "version": "3.71.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/member-list-site-scope.e2e.test.mjs

@@ -0,0 +1,111 @@
+// GET /api/members?org=: belonging to the organisation is not belonging to every
+// site in it. A guard pinned to site A sees site A's members only; a request for
+// site B is refused; the organisation's own admin and Seven365 staff see all;
+// a resident sees none.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "MemberListScope-Passw0rd!";
+const ADMIN = "admin-mls@e2e.example.com";
+const GUARD_A = "guard-a-mls@e2e.example.com";
+const GUARD_B = "guard-b-mls@e2e.example.com";
+const RESIDENT = "resident-mls@e2e.example.com";
+const STAFF = "staff-mls@e2e.example.com";
+
+describe("Member lists follow the caller's sites", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [ADMIN, GUARD_A, GUARD_B, RESIDENT, STAFF]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const list = (who, extra = "") =>
+    h.api(`/members?org=${id.org}&type=security_agency&status=active&limit=50${extra}`, { sid: sid[who] });
+  const emails = (res) => (res.body?.items ?? []).map((row) => row.email).sort();
+
+  it("a guard pinned to site A lists only site A's members", async () => {
+    const res = await list(GUARD_A);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(emails(res), [GUARD_A]);
+  });
+
+  it("a guard asking for a site they are not pinned to is refused", async () => {
+    const res = await list(GUARD_A, `&siteId=${id.siteB}`);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    const own = await list(GUARD_A, `&siteId=${id.siteA}`);
+    assert.equal(own.status, 200, JSON.stringify(own.body));
+    assert.deepEqual(emails(own), [GUARD_A]);
+  });
+
+  it("CONTROL: the organisation's admin and Seven365 staff list every site", async () => {
+    for (const who of [ADMIN, STAFF]) {
+      const res = await list(who);
+      assert.equal(res.status, 200, `${who}: ${JSON.stringify(res.body)}`);
+      assert.deepEqual(emails(res), [GUARD_A, GUARD_B].sort(), who);
+    }
+  });
+
+  it("a resident of the organisation lists no staff", async () => {
+    const res = await list(RESIDENT);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(emails(res), []);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const siteA = new ObjectId();
+  const siteB = new ObjectId();
+  const adminRole = new ObjectId();
+  const guardRoleA = new ObjectId();
+  const guardRoleB = new ObjectId();
+  const residentRole = new ObjectId();
+  const staffRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({ _id: org, name: "MLS Security", email: "org-mls@e2e.example.com", type: "org", nature: "security_agency", status: "active", createdAt: now });
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "MLS A", orgId: org, status: "active", createdAt: now },
+    { _id: siteB, name: "MLS B", orgId: org, status: "active", createdAt: now },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: adminRole, name: "owner", type: "organization", org, permissions: ["*"], status: "active" },
+    { _id: guardRoleA, name: "Guard A", type: "security_agency", org, site: siteA, permissions: ["*"], status: "active" },
+    { _id: guardRoleB, name: "Guard B", type: "security_agency", org, site: siteB, permissions: ["*"], status: "active" },
+    { _id: residentRole, name: "Resident", type: "resident", org, site: siteA, permissions: ["*"], status: "active" },
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [ADMIN, GUARD_A, GUARD_B, RESIDENT, STAFF].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+  const [admin, guardA, guardB, resident, staff] = Object.values(users.insertedIds);
+  const member = (user, role, type, email, siteId = "") => ({ user, org, role, type, siteId, siteName: "", name: email, email, status: "active", deletedAt: "", createdAt: now });
+  await h.db.collection("members").insertMany([
+    member(admin, adminRole, "organization", ADMIN),
+    member(guardA, guardRoleA, "security_agency", GUARD_A, siteA),
+    member(guardB, guardRoleB, "security_agency", GUARD_B, siteB),
+    member(resident, residentRole, "resident", RESIDENT, siteA),
+    { user: staff, type: "admin", role: staffRole, status: "active", name: STAFF, email: STAFF, createdAt: now },
+  ]);
+
+  return { org, siteA, siteB };
+}

package/test/member-list-site-scope.test.mjs

@@ -0,0 +1,30 @@
+// GET /api/members?org=: a caller pinned to sites lists only those sites' members
+// (owner policy: agency staff see only their assigned site).
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { memberListSiteScope } from "./.build/utils/member-lookup.util.mjs";
+
+const ORG = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const OTHER = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const A = "111111111111111111111111";
+const B = "222222222222222222222222";
+const m = (org, siteId, type = "security_agency", orgLevelRole = false) => ({ org, siteId, type, orgLevelRole });
+
+test("an organisation-wide membership, or an organisation-level role, lists every site", () => {
+  assert.equal(memberListSiteScope([m(ORG, "", "organization")], ORG), null);
+  assert.equal(memberListSiteScope([m(ORG, A, "security_agency", true)], ORG), null);
+});
+
+test("a caller pinned to sites lists only those sites", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A), m(ORG, B), m(ORG, A, "cleaning_services")], ORG), [A, B]);
+});
+
+test("memberships in another organisation do not widen this one", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A), m(OTHER, "", "organization")], ORG), [A]);
+});
+
+test("a resident-only caller lists nothing; an owner or invitee with no membership keeps today's answer", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A, "resident")], ORG), []);
+  assert.equal(memberListSiteScope([], ORG), null);
+});