@7365admin1/core 3.70.0 → 3.72.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.70.0",
+  "version": "3.72.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/client-invite-modules.e2e.test.mjs

@@ -25,6 +25,10 @@ const STAFF = "sevenadmin-cim@e2e.example.com";
 const OUTSIDER = "outsider-cim@e2e.example.com";
 const CLIENT = "client-cim@e2e.example.com";
 const OTHER_NATURE = "othernature-cim@e2e.example.com";
+const ROLE_CLIENT = "roleclient-cim@e2e.example.com";
+
+// The owner role Seven365 chooses with the modules (owner, 2026-09-15).
+const OWNER_PERMISSIONS = ["visitor-mgmt:view-visitors", "visitor-mgmt:add-visitor", "members:view-members"];
 
 const MODULES = ["visitor-mgmt", "members", "roles", "invitations", "sites"];
 
@@ -39,7 +43,7 @@ describe("Invite Client chooses modules and the owner gets the client's own role
   before(async () => {
     h = await startHarness();
     Object.assign(id, await seed(h));
-    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE]) sid[email] = await h.login(email, PASSWORD);
+    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE, ROLE_CLIENT]) sid[email] = await h.login(email, PASSWORD);
   }, { timeout: 300000 });
 
   after(async () => {
@@ -136,6 +140,119 @@ describe("Invite Client chooses modules and the owner gets the client's own role
       0,
     );
   });
+  it("permissions are refused outside the modules, without modules, or empty", async () => {
+    const outside = await invite(STAFF, {
+      email: "outside-cim@e2e.example.com", app: ["security_agency"], modules: MODULES,
+      permissions: ["patrol-mgmt:view-patrols"],
+    });
+    assert.equal(outside.status, 400, JSON.stringify(outside.body));
+
+    const noModules = await invite(STAFF, {
+      email: "nomodules-cim@e2e.example.com", app: ["security_agency"], permissions: OWNER_PERMISSIONS,
+    });
+    assert.equal(noModules.status, 400, JSON.stringify(noModules.body));
+
+    const empty = await invite(STAFF, {
+      email: "empty-cim@e2e.example.com", app: ["security_agency"], modules: MODULES, permissions: [],
+    });
+    assert.equal(empty.status, 400, JSON.stringify(empty.body));
+
+    for (const email of ["outside-cim@e2e.example.com", "nomodules-cim@e2e.example.com", "empty-cim@e2e.example.com"]) {
+      assert.equal(await inviteOf(email), null, "nothing was written for " + email);
+    }
+  });
+
+  it("a re-invite replaces the chosen permissions on the pending invitation", async () => {
+    const first = await invite(STAFF, { email: ROLE_CLIENT, app: ["security_agency"], modules: MODULES, permissions: ["members:view-members"] });
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    const again = await invite(STAFF, { email: ROLE_CLIENT, app: ["security_agency"], modules: MODULES, permissions: [...OWNER_PERMISSIONS, "members:view-members"] });
+    assert.equal(again.status, 201, JSON.stringify(again.body));
+
+    const rows = await h.db.collection("verifications").find({ type: "user-invite", email: ROLE_CLIENT }).toArray();
+    assert.equal(rows.length, 1, "one pending invitation");
+    assert.deepEqual(rows[0].metadata.permissions, OWNER_PERMISSIONS, "the latest choice, once each");
+  });
+
+  it("onboarding gives the owner the application role Seven365 chose, and the owner can take it", async () => {
+    const row = await inviteOf(ROLE_CLIENT);
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[ROLE_CLIENT],
+      body: { name: "CIM Role Client", type: "org", nature: "security_agency", email: ROLE_CLIENT, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Role Client" });
+    assert.ok(org.invitedRole, "the chosen role is recorded for the finish");
+
+    const appRole = await h.db.collection("roles").findOne({ _id: org.invitedRole });
+    assert.equal(String(appRole.org), org._id.toString(), "the client's own role");
+    assert.equal(appRole.type, "security_agency");
+    assert.equal(appRole.name, "owner");
+    assert.deepEqual(appRole.permissions, OWNER_PERMISSIONS, "exactly what was ticked");
+
+    // Running the organisation is never narrowed.
+    const orgMember = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const orgRole = await h.db.collection("roles").findOne({ _id: orgMember.role });
+    assert.deepEqual(orgRole.permissions, ["*"]);
+
+    // The finish writes the application membership with that role (web-app-org onboarding-finish).
+    const site = new ObjectId();
+    const owner = await h.db.collection("users").findOne({ email: ROLE_CLIENT });
+    const member = await h.api("/members/direct", {
+      method: "POST",
+      sid: sid[ROLE_CLIENT],
+      body: { userId: owner._id.toString(), orgId: org._id.toString(), roleId: org.invitedRole.toString(), app: "security_agency", siteId: site.toString(), siteName: "HQ" },
+    });
+    assert.equal(member.status, 201, JSON.stringify(member.body));
+    const appMember = await h.db.collection("members").findOne({ org: org._id, type: "security_agency", user: owner._id });
+    assert.equal(String(appMember.role), String(org.invitedRole));
+  });
+
+  it("the client cannot widen its application roles past what Seven365 chose; Seven365 can", async () => {
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Role Client" });
+    const roleId = org.invitedRole.toString();
+    const patch = (who, permissions) =>
+      h.api(`/roles/permissions/id/${roleId}`, { method: "PATCH", sid: sid[who], body: { permissions } });
+    const roleNow = async () => (await h.db.collection("roles").findOne({ _id: org.invitedRole })).permissions;
+
+    const wider = await patch(ROLE_CLIENT, [...OWNER_PERMISSIONS, "visitor-mgmt:delete-visitor"]);
+    assert.ok([401, 403].includes(wider.status), `owner widening refused, got ${wider.status} ${JSON.stringify(wider.body)}`);
+    assert.deepEqual(await roleNow(), OWNER_PERMISSIONS, "nothing was written");
+
+    const runOrg = await patch(ROLE_CLIENT, [...OWNER_PERMISSIONS, "members:delete-member"]);
+    assert.equal(runOrg.status, 200, "running the organisation is not capped: " + JSON.stringify(runOrg.body));
+
+    const staffRole = await h.api("/roles", {
+      method: "POST", sid: sid[ROLE_CLIENT],
+      body: { name: "Guard lead", type: "security_agency", org: org._id.toString(), permissions: ["*"] },
+    });
+    assert.equal(staffRole.status, 201, JSON.stringify(staffRole.body));
+    const created = await h.db.collection("roles").findOne({ org: org._id, name: "Guard lead" });
+    assert.ok(!created.permissions.includes("*"), "an everything role becomes the grant");
+    assert.ok(created.permissions.includes("visitor-mgmt:view-visitors"));
+    assert.ok(!created.permissions.includes("visitor-mgmt:delete-visitor"));
+
+    const widerStaffRole = await h.api("/roles", {
+      method: "POST", sid: sid[ROLE_CLIENT],
+      body: { name: "Too wide", type: "security_agency", org: org._id.toString(), permissions: ["visitor-mgmt:delete-visitor"] },
+    });
+    assert.ok([401, 403].includes(widerStaffRole.status), `got ${widerStaffRole.status}`);
+
+    const bySeven365 = await patch(STAFF, [...OWNER_PERMISSIONS, "members:delete-member", "visitor-mgmt:delete-visitor"]);
+    assert.equal(bySeven365.status, 200, JSON.stringify(bySeven365.body));
+    assert.ok((await roleNow()).includes("visitor-mgmt:delete-visitor"), "Seven365 widened the grant");
+  });
+
+  it("a client invited before this keeps its roles uncapped", async () => {
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Security Client" });
+    const member = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const res = await h.api("/roles", {
+      method: "POST", sid: sid[CLIENT],
+      body: { name: "Anything", type: "security_agency", org: org._id.toString(), permissions: ["visitor-mgmt:delete-visitor"] },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body) + " member " + Boolean(member));
+  });
 });
 
 async function seed(h) {
@@ -153,7 +270,7 @@ async function seed(h) {
   ]);
 
   const users = await h.db.collection("users").insertMany(
-    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE, ROLE_CLIENT].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
   );
   const hashed = await h.hashPassword(PASSWORD);
   await h.db.collection("users").updateMany({}, { $set: { password: hashed } });

package/test/e2e/member-list-site-scope.e2e.test.mjs

@@ -0,0 +1,111 @@
+// GET /api/members?org=: belonging to the organisation is not belonging to every
+// site in it. A guard pinned to site A sees site A's members only; a request for
+// site B is refused; the organisation's own admin and Seven365 staff see all;
+// a resident sees none.
+//
+// In-process MongoDB, loopback Redis and a loopback mail sink only (harness.mjs).
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "MemberListScope-Passw0rd!";
+const ADMIN = "admin-mls@e2e.example.com";
+const GUARD_A = "guard-a-mls@e2e.example.com";
+const GUARD_B = "guard-b-mls@e2e.example.com";
+const RESIDENT = "resident-mls@e2e.example.com";
+const STAFF = "staff-mls@e2e.example.com";
+
+describe("Member lists follow the caller's sites", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  const sid = {};
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    for (const email of [ADMIN, GUARD_A, GUARD_B, RESIDENT, STAFF]) sid[email] = await h.login(email, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const list = (who, extra = "") =>
+    h.api(`/members?org=${id.org}&type=security_agency&status=active&limit=50${extra}`, { sid: sid[who] });
+  const emails = (res) => (res.body?.items ?? []).map((row) => row.email).sort();
+
+  it("a guard pinned to site A lists only site A's members", async () => {
+    const res = await list(GUARD_A);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(emails(res), [GUARD_A]);
+  });
+
+  it("a guard asking for a site they are not pinned to is refused", async () => {
+    const res = await list(GUARD_A, `&siteId=${id.siteB}`);
+    assert.equal(res.status, 401, JSON.stringify(res.body));
+    const own = await list(GUARD_A, `&siteId=${id.siteA}`);
+    assert.equal(own.status, 200, JSON.stringify(own.body));
+    assert.deepEqual(emails(own), [GUARD_A]);
+  });
+
+  it("CONTROL: the organisation's admin and Seven365 staff list every site", async () => {
+    for (const who of [ADMIN, STAFF]) {
+      const res = await list(who);
+      assert.equal(res.status, 200, `${who}: ${JSON.stringify(res.body)}`);
+      assert.deepEqual(emails(res), [GUARD_A, GUARD_B].sort(), who);
+    }
+  });
+
+  it("a resident of the organisation lists no staff", async () => {
+    const res = await list(RESIDENT);
+    assert.equal(res.status, 200, JSON.stringify(res.body));
+    assert.deepEqual(emails(res), []);
+  });
+});
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const org = new ObjectId();
+  const siteA = new ObjectId();
+  const siteB = new ObjectId();
+  const adminRole = new ObjectId();
+  const guardRoleA = new ObjectId();
+  const guardRoleB = new ObjectId();
+  const residentRole = new ObjectId();
+  const staffRole = new ObjectId();
+
+  await h.db.collection("organizations").insertOne({ _id: org, name: "MLS Security", email: "org-mls@e2e.example.com", type: "org", nature: "security_agency", status: "active", createdAt: now });
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "MLS A", orgId: org, status: "active", createdAt: now },
+    { _id: siteB, name: "MLS B", orgId: org, status: "active", createdAt: now },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: adminRole, name: "owner", type: "organization", org, permissions: ["*"], status: "active" },
+    { _id: guardRoleA, name: "Guard A", type: "security_agency", org, site: siteA, permissions: ["*"], status: "active" },
+    { _id: guardRoleB, name: "Guard B", type: "security_agency", org, site: siteB, permissions: ["*"], status: "active" },
+    { _id: residentRole, name: "Resident", type: "resident", org, site: siteA, permissions: ["*"], status: "active" },
+    { _id: staffRole, name: "Super Admin", type: "admin", default: true, permissions: [], status: "active" },
+  ]);
+
+  const users = await h.db.collection("users").insertMany(
+    [ADMIN, GUARD_A, GUARD_B, RESIDENT, STAFF].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({}, { $set: { password: hashed } });
+  const [admin, guardA, guardB, resident, staff] = Object.values(users.insertedIds);
+  const member = (user, role, type, email, siteId = "") => ({ user, org, role, type, siteId, siteName: "", name: email, email, status: "active", deletedAt: "", createdAt: now });
+  await h.db.collection("members").insertMany([
+    member(admin, adminRole, "organization", ADMIN),
+    member(guardA, guardRoleA, "security_agency", GUARD_A, siteA),
+    member(guardB, guardRoleB, "security_agency", GUARD_B, siteB),
+    member(resident, residentRole, "resident", RESIDENT, siteA),
+    { user: staff, type: "admin", role: staffRole, status: "active", name: STAFF, email: STAFF, createdAt: now },
+  ]);
+
+  return { org, siteA, siteB };
+}

package/test/member-list-site-scope.test.mjs

@@ -0,0 +1,30 @@
+// GET /api/members?org=: a caller pinned to sites lists only those sites' members
+// (owner policy: agency staff see only their assigned site).
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { memberListSiteScope } from "./.build/utils/member-lookup.util.mjs";
+
+const ORG = "aaaaaaaaaaaaaaaaaaaaaaaa";
+const OTHER = "bbbbbbbbbbbbbbbbbbbbbbbb";
+const A = "111111111111111111111111";
+const B = "222222222222222222222222";
+const m = (org, siteId, type = "security_agency", orgLevelRole = false) => ({ org, siteId, type, orgLevelRole });
+
+test("an organisation-wide membership, or an organisation-level role, lists every site", () => {
+  assert.equal(memberListSiteScope([m(ORG, "", "organization")], ORG), null);
+  assert.equal(memberListSiteScope([m(ORG, A, "security_agency", true)], ORG), null);
+});
+
+test("a caller pinned to sites lists only those sites", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A), m(ORG, B), m(ORG, A, "cleaning_services")], ORG), [A, B]);
+});
+
+test("memberships in another organisation do not widen this one", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A), m(OTHER, "", "organization")], ORG), [A]);
+});
+
+test("a resident-only caller lists nothing; an owner or invitee with no membership keeps today's answer", () => {
+  assert.deepEqual(memberListSiteScope([m(ORG, A, "resident")], ORG), []);
+  assert.equal(memberListSiteScope([], ORG), null);
+});

package/test/org-default-roles.test.mjs

@@ -259,3 +259,25 @@ test("positive control: the guard DOES refuse the shapes this seeding avoids", (
     "a platform grant on a client role is still refused",
   );
 });
+
+// Owner, 2026-09-15: the permissions Seven365 chose on Invite Client land on the
+// NATURE-typed owner role only; the organisation owner role keeps "*".
+test("chosen owner permissions narrow only the application owner role", () => {
+  const chosen = ["visitor-mgmt:view-visitors", "members:view-members"];
+  const roles = defaultOwnerRoles(ORG, "security_agency", chosen);
+  const owner = (type) => roles.find((r) => r.type === type && r.name === "owner");
+
+  assert.deepEqual(owner("security_agency").permissions, chosen);
+  assert.deepEqual(owner("organization").permissions, ["*"]);
+  // An empty list would mean EVERYTHING, so it is ignored rather than stored.
+  assert.deepEqual(
+    defaultOwnerRoles(ORG, "security_agency", []).find((r) => r.type === "security_agency" && r.name === "owner").permissions,
+    ["*"],
+  );
+});
+
+test("the owner-permissions kill switch", async () => {
+  const { clientInviteOwnerPermissionsOn } = await import("./.build/utils/org-default-roles.util.mjs");
+  assert.equal(clientInviteOwnerPermissionsOn({}), true);
+  assert.equal(clientInviteOwnerPermissionsOn({ CLIENT_INVITE_OWNER_PERMISSIONS: "off" }), false);
+});

package/test/org-modules.test.mjs

@@ -257,3 +257,29 @@ test("a real list now offers every spelling and the always-included set", () =>
     ["members", "visitor-mgmt", "workOrder"],
   );
 });
+
+// Owner, 2026-09-15: the owner role chosen on Invite Client must stay inside the
+// chosen modules.
+test("permissions outside the chosen modules are named", async () => {
+  const { normalisePermissions, permissionsOutsideModules } = await import("./.build/utils/org-modules.util.mjs");
+  const chosen = normalisePermissions([" visitor-mgmt:view-visitors", "visitor-mgmt:view-visitors", "*", "patrol-mgmt:view", "members:view-members", 7]);
+  assert.deepEqual(chosen, ["visitor-mgmt:view-visitors", "patrol-mgmt:view", "members:view-members"]);
+  // members is always allowed; visitorManagement is a spelling of visitor-mgmt.
+  assert.deepEqual(permissionsOutsideModules(chosen, ["visitorManagement"]), ["patrol-mgmt:view"]);
+});
+
+test("roles stay inside the owner grant Seven365 chose", async () => {
+  const { boundToOwnerGrant } = await import("./.build/utils/org-modules.util.mjs");
+  const ceiling = ["visitor-mgmt:view-visitors", "visitor-mgmt:add-visitor"];
+
+  assert.deepEqual(boundToOwnerGrant(null, ["x:y"]), { permissions: ["x:y"], refused: [] }, "no ceiling, no change");
+  assert.deepEqual(boundToOwnerGrant(ceiling, ["*"]).permissions, ceiling, "everything becomes the grant");
+  assert.deepEqual(boundToOwnerGrant(ceiling, []).permissions, ceiling, "an empty list means everything too");
+  assert.deepEqual(boundToOwnerGrant(ceiling, ["visitor-mgmt:delete-visitor"]).refused, ["visitor-mgmt:delete-visitor"]);
+  assert.deepEqual(boundToOwnerGrant(ceiling, ["members:delete-member", "visitor-mgmt:add-visitor"]).refused, [], "running the organisation is not capped");
+  assert.deepEqual(
+    boundToOwnerGrant(ceiling, ["visitor-mgmt:delete-visitor"], ["visitor-mgmt:delete-visitor"]).refused,
+    [],
+    "a string already held is never refused",
+  );
+});