@7365admin1/core 3.71.0 → 3.72.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.71.0",
+  "version": "3.72.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/e2e/client-invite-modules.e2e.test.mjs

@@ -25,6 +25,10 @@ const STAFF = "sevenadmin-cim@e2e.example.com";
 const OUTSIDER = "outsider-cim@e2e.example.com";
 const CLIENT = "client-cim@e2e.example.com";
 const OTHER_NATURE = "othernature-cim@e2e.example.com";
+const ROLE_CLIENT = "roleclient-cim@e2e.example.com";
+
+// The owner role Seven365 chooses with the modules (owner, 2026-09-15).
+const OWNER_PERMISSIONS = ["visitor-mgmt:view-visitors", "visitor-mgmt:add-visitor", "members:view-members"];
 
 const MODULES = ["visitor-mgmt", "members", "roles", "invitations", "sites"];
 
@@ -39,7 +43,7 @@ describe("Invite Client chooses modules and the owner gets the client's own role
   before(async () => {
     h = await startHarness();
     Object.assign(id, await seed(h));
-    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE]) sid[email] = await h.login(email, PASSWORD);
+    for (const email of [STAFF, OUTSIDER, CLIENT, OTHER_NATURE, ROLE_CLIENT]) sid[email] = await h.login(email, PASSWORD);
   }, { timeout: 300000 });
 
   after(async () => {
@@ -136,6 +140,119 @@ describe("Invite Client chooses modules and the owner gets the client's own role
       0,
     );
   });
+  it("permissions are refused outside the modules, without modules, or empty", async () => {
+    const outside = await invite(STAFF, {
+      email: "outside-cim@e2e.example.com", app: ["security_agency"], modules: MODULES,
+      permissions: ["patrol-mgmt:view-patrols"],
+    });
+    assert.equal(outside.status, 400, JSON.stringify(outside.body));
+
+    const noModules = await invite(STAFF, {
+      email: "nomodules-cim@e2e.example.com", app: ["security_agency"], permissions: OWNER_PERMISSIONS,
+    });
+    assert.equal(noModules.status, 400, JSON.stringify(noModules.body));
+
+    const empty = await invite(STAFF, {
+      email: "empty-cim@e2e.example.com", app: ["security_agency"], modules: MODULES, permissions: [],
+    });
+    assert.equal(empty.status, 400, JSON.stringify(empty.body));
+
+    for (const email of ["outside-cim@e2e.example.com", "nomodules-cim@e2e.example.com", "empty-cim@e2e.example.com"]) {
+      assert.equal(await inviteOf(email), null, "nothing was written for " + email);
+    }
+  });
+
+  it("a re-invite replaces the chosen permissions on the pending invitation", async () => {
+    const first = await invite(STAFF, { email: ROLE_CLIENT, app: ["security_agency"], modules: MODULES, permissions: ["members:view-members"] });
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    const again = await invite(STAFF, { email: ROLE_CLIENT, app: ["security_agency"], modules: MODULES, permissions: [...OWNER_PERMISSIONS, "members:view-members"] });
+    assert.equal(again.status, 201, JSON.stringify(again.body));
+
+    const rows = await h.db.collection("verifications").find({ type: "user-invite", email: ROLE_CLIENT }).toArray();
+    assert.equal(rows.length, 1, "one pending invitation");
+    assert.deepEqual(rows[0].metadata.permissions, OWNER_PERMISSIONS, "the latest choice, once each");
+  });
+
+  it("onboarding gives the owner the application role Seven365 chose, and the owner can take it", async () => {
+    const row = await inviteOf(ROLE_CLIENT);
+    const res = await h.api("/organizations/onboarding", {
+      method: "POST",
+      sid: sid[ROLE_CLIENT],
+      body: { name: "CIM Role Client", type: "org", nature: "security_agency", email: ROLE_CLIENT, inviteId: row._id.toString() },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Role Client" });
+    assert.ok(org.invitedRole, "the chosen role is recorded for the finish");
+
+    const appRole = await h.db.collection("roles").findOne({ _id: org.invitedRole });
+    assert.equal(String(appRole.org), org._id.toString(), "the client's own role");
+    assert.equal(appRole.type, "security_agency");
+    assert.equal(appRole.name, "owner");
+    assert.deepEqual(appRole.permissions, OWNER_PERMISSIONS, "exactly what was ticked");
+
+    // Running the organisation is never narrowed.
+    const orgMember = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const orgRole = await h.db.collection("roles").findOne({ _id: orgMember.role });
+    assert.deepEqual(orgRole.permissions, ["*"]);
+
+    // The finish writes the application membership with that role (web-app-org onboarding-finish).
+    const site = new ObjectId();
+    const owner = await h.db.collection("users").findOne({ email: ROLE_CLIENT });
+    const member = await h.api("/members/direct", {
+      method: "POST",
+      sid: sid[ROLE_CLIENT],
+      body: { userId: owner._id.toString(), orgId: org._id.toString(), roleId: org.invitedRole.toString(), app: "security_agency", siteId: site.toString(), siteName: "HQ" },
+    });
+    assert.equal(member.status, 201, JSON.stringify(member.body));
+    const appMember = await h.db.collection("members").findOne({ org: org._id, type: "security_agency", user: owner._id });
+    assert.equal(String(appMember.role), String(org.invitedRole));
+  });
+
+  it("the client cannot widen its application roles past what Seven365 chose; Seven365 can", async () => {
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Role Client" });
+    const roleId = org.invitedRole.toString();
+    const patch = (who, permissions) =>
+      h.api(`/roles/permissions/id/${roleId}`, { method: "PATCH", sid: sid[who], body: { permissions } });
+    const roleNow = async () => (await h.db.collection("roles").findOne({ _id: org.invitedRole })).permissions;
+
+    const wider = await patch(ROLE_CLIENT, [...OWNER_PERMISSIONS, "visitor-mgmt:delete-visitor"]);
+    assert.ok([401, 403].includes(wider.status), `owner widening refused, got ${wider.status} ${JSON.stringify(wider.body)}`);
+    assert.deepEqual(await roleNow(), OWNER_PERMISSIONS, "nothing was written");
+
+    const runOrg = await patch(ROLE_CLIENT, [...OWNER_PERMISSIONS, "members:delete-member"]);
+    assert.equal(runOrg.status, 200, "running the organisation is not capped: " + JSON.stringify(runOrg.body));
+
+    const staffRole = await h.api("/roles", {
+      method: "POST", sid: sid[ROLE_CLIENT],
+      body: { name: "Guard lead", type: "security_agency", org: org._id.toString(), permissions: ["*"] },
+    });
+    assert.equal(staffRole.status, 201, JSON.stringify(staffRole.body));
+    const created = await h.db.collection("roles").findOne({ org: org._id, name: "Guard lead" });
+    assert.ok(!created.permissions.includes("*"), "an everything role becomes the grant");
+    assert.ok(created.permissions.includes("visitor-mgmt:view-visitors"));
+    assert.ok(!created.permissions.includes("visitor-mgmt:delete-visitor"));
+
+    const widerStaffRole = await h.api("/roles", {
+      method: "POST", sid: sid[ROLE_CLIENT],
+      body: { name: "Too wide", type: "security_agency", org: org._id.toString(), permissions: ["visitor-mgmt:delete-visitor"] },
+    });
+    assert.ok([401, 403].includes(widerStaffRole.status), `got ${widerStaffRole.status}`);
+
+    const bySeven365 = await patch(STAFF, [...OWNER_PERMISSIONS, "members:delete-member", "visitor-mgmt:delete-visitor"]);
+    assert.equal(bySeven365.status, 200, JSON.stringify(bySeven365.body));
+    assert.ok((await roleNow()).includes("visitor-mgmt:delete-visitor"), "Seven365 widened the grant");
+  });
+
+  it("a client invited before this keeps its roles uncapped", async () => {
+    const org = await h.db.collection("organizations").findOne({ name: "CIM Security Client" });
+    const member = await h.db.collection("members").findOne({ org: org._id, type: "organization" });
+    const res = await h.api("/roles", {
+      method: "POST", sid: sid[CLIENT],
+      body: { name: "Anything", type: "security_agency", org: org._id.toString(), permissions: ["visitor-mgmt:delete-visitor"] },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body) + " member " + Boolean(member));
+  });
 });
 
 async function seed(h) {
@@ -153,7 +270,7 @@ async function seed(h) {
   ]);
 
   const users = await h.db.collection("users").insertMany(
-    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+    [STAFF, OUTSIDER, CLIENT, OTHER_NATURE, ROLE_CLIENT].map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
   );
   const hashed = await h.hashPassword(PASSWORD);
   await h.db.collection("users").updateMany({}, { $set: { password: hashed } });

package/test/org-default-roles.test.mjs

@@ -259,3 +259,25 @@ test("positive control: the guard DOES refuse the shapes this seeding avoids", (
     "a platform grant on a client role is still refused",
   );
 });
+
+// Owner, 2026-09-15: the permissions Seven365 chose on Invite Client land on the
+// NATURE-typed owner role only; the organisation owner role keeps "*".
+test("chosen owner permissions narrow only the application owner role", () => {
+  const chosen = ["visitor-mgmt:view-visitors", "members:view-members"];
+  const roles = defaultOwnerRoles(ORG, "security_agency", chosen);
+  const owner = (type) => roles.find((r) => r.type === type && r.name === "owner");
+
+  assert.deepEqual(owner("security_agency").permissions, chosen);
+  assert.deepEqual(owner("organization").permissions, ["*"]);
+  // An empty list would mean EVERYTHING, so it is ignored rather than stored.
+  assert.deepEqual(
+    defaultOwnerRoles(ORG, "security_agency", []).find((r) => r.type === "security_agency" && r.name === "owner").permissions,
+    ["*"],
+  );
+});
+
+test("the owner-permissions kill switch", async () => {
+  const { clientInviteOwnerPermissionsOn } = await import("./.build/utils/org-default-roles.util.mjs");
+  assert.equal(clientInviteOwnerPermissionsOn({}), true);
+  assert.equal(clientInviteOwnerPermissionsOn({ CLIENT_INVITE_OWNER_PERMISSIONS: "off" }), false);
+});

package/test/org-modules.test.mjs

@@ -257,3 +257,29 @@ test("a real list now offers every spelling and the always-included set", () =>
     ["members", "visitor-mgmt", "workOrder"],
   );
 });
+
+// Owner, 2026-09-15: the owner role chosen on Invite Client must stay inside the
+// chosen modules.
+test("permissions outside the chosen modules are named", async () => {
+  const { normalisePermissions, permissionsOutsideModules } = await import("./.build/utils/org-modules.util.mjs");
+  const chosen = normalisePermissions([" visitor-mgmt:view-visitors", "visitor-mgmt:view-visitors", "*", "patrol-mgmt:view", "members:view-members", 7]);
+  assert.deepEqual(chosen, ["visitor-mgmt:view-visitors", "patrol-mgmt:view", "members:view-members"]);
+  // members is always allowed; visitorManagement is a spelling of visitor-mgmt.
+  assert.deepEqual(permissionsOutsideModules(chosen, ["visitorManagement"]), ["patrol-mgmt:view"]);
+});
+
+test("roles stay inside the owner grant Seven365 chose", async () => {
+  const { boundToOwnerGrant } = await import("./.build/utils/org-modules.util.mjs");
+  const ceiling = ["visitor-mgmt:view-visitors", "visitor-mgmt:add-visitor"];
+
+  assert.deepEqual(boundToOwnerGrant(null, ["x:y"]), { permissions: ["x:y"], refused: [] }, "no ceiling, no change");
+  assert.deepEqual(boundToOwnerGrant(ceiling, ["*"]).permissions, ceiling, "everything becomes the grant");
+  assert.deepEqual(boundToOwnerGrant(ceiling, []).permissions, ceiling, "an empty list means everything too");
+  assert.deepEqual(boundToOwnerGrant(ceiling, ["visitor-mgmt:delete-visitor"]).refused, ["visitor-mgmt:delete-visitor"]);
+  assert.deepEqual(boundToOwnerGrant(ceiling, ["members:delete-member", "visitor-mgmt:add-visitor"]).refused, [], "running the organisation is not capped");
+  assert.deepEqual(
+    boundToOwnerGrant(ceiling, ["visitor-mgmt:delete-visitor"], ["visitor-mgmt:delete-visitor"]).refused,
+    [],
+    "a string already held is never refused",
+  );
+});