@7365admin1/core 3.74.0 → 3.75.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.74.0",
+  "version": "3.75.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/backfill-org-owner-roles.test.mjs

@@ -63,6 +63,11 @@ test("a role-less organisation gets exactly the roles defaultOwnerRoles writes",
   for (const nature of APP_SERVICE_TYPES) {
     const { payloads } = planForOrg(org({ nature }), 0);
     const expected = defaultOwnerRoles(ORG, nature);
+    // The tool posts the nature as the role type; POST /api/roles stores a
+    // developer's as property_management_agency (`serviceAppType`), which is
+    // what defaultOwnerRoles writes directly.
+    const appType = nature === "real_estate_developer" ? "property_management_agency" : nature;
+    for (const p of payloads) if (p.type === nature) p.type = appType;
 
     // Four now, not two. The tool duplicates the permission list so it runs
     // with no build step, and THIS is the assertion that stops the copy
@@ -72,7 +77,7 @@ test("a role-less organisation gets exactly the roles defaultOwnerRoles writes",
     assert.deepEqual(payloads.map(apiShape), expected.map(apiShape), nature);
     assert.deepEqual(
       payloads.map((p) => p.type),
-      ["organization", "organization", nature, nature],
+      ["organization", "organization", appType, appType],
     );
     assert.deepEqual(payloads.map((p) => p.name), [
       "owner", "Administrator", "owner", "Administrator",

package/test/e2e/client-invite-service365.e2e.test.mjs

@@ -24,6 +24,7 @@ const PM_CLIENT = "pm-cis@e2e.example.com";
 const RED_CLIENT = "red-cis@e2e.example.com";
 
 const MODULES = ["visitor-mgmt", "members", "roles", "invitations", "sites"];
+const RED_OWNER = ["visitor-mgmt:view-visitors", "members:view-members"];
 
 // Every switch explicit, the way the form sends them.
 const RESIDENT_APP = {
@@ -97,12 +98,60 @@ describe("Invite Client gives a Property Management client its Service365 module
   });
 
   it("a real estate developer gets the same Property Management set", async () => {
-    const res = await invite(STAFF, { email: RED_CLIENT, app: ["real_estate_developer"], modules: MODULES, residentAppModules: RESIDENT_APP });
+    // Owner, 2026-09-15: Invite Client now offers Real Estate Developer, with the
+    // owner role chosen from the Property Management catalogue like a PM client.
+    const res = await invite(STAFF, { email: RED_CLIENT, app: ["real_estate_developer"], modules: MODULES, permissions: RED_OWNER, residentAppModules: RESIDENT_APP });
     assert.equal(res.status, 201, JSON.stringify(res.body));
     const made = await onboard(RED_CLIENT, "CIS Developer Client", "real_estate_developer");
     assert.equal(made.status, 201, JSON.stringify(made.body));
     const org = await h.db.collection("organizations").findOne({ name: "CIS Developer Client" });
     assert.deepEqual(org.residentAppModules, RESIDENT_APP);
+    assert.deepEqual(org.modules, MODULES);
+    const owner = await h.db.collection("roles").findOne({ _id: org.invitedRole });
+    assert.ok(owner, "the chosen owner role is recorded on the organisation");
+    // The Property Management app reads property_management_agency roles and
+    // memberships; a developer-typed one was a role no application could open.
+    assert.equal(owner.type, "property_management_agency");
+    assert.deepEqual([...owner.permissions].sort(), [...RED_OWNER].sort());
+    assert.equal(org.nature, "real_estate_developer", "the organisation keeps its nature");
+  });
+
+  it("a real estate developer's owner opens the Property Management app, capped like a PM client", async () => {
+    const org = await h.db.collection("organizations").findOne({ name: "CIS Developer Client" });
+    const owner = await h.db.collection("users").findOne({ email: RED_CLIENT });
+
+    // Onboarding's finish sends the invitation's app, which for a developer is its nature.
+    const member = await h.api("/members/direct", {
+      method: "POST",
+      sid: sid[RED_CLIENT],
+      body: { userId: owner._id.toString(), orgId: org._id.toString(), roleId: org.invitedRole.toString(), app: "real_estate_developer", siteId: new ObjectId().toString(), siteName: "Show flat" },
+    });
+    assert.equal(member.status, 201, JSON.stringify(member.body));
+    const rows = await h.db.collection("members").find({ org: org._id, user: owner._id, type: { $ne: "organization" } }).toArray();
+    assert.deepEqual(rows.map((r) => r.type), ["property_management_agency"]);
+
+    // Asked either way, the lookup answers with that one row.
+    for (const type of ["property_management_agency", "real_estate_developer"]) {
+      const res = await h.api(`/members/user/${owner._id}/app/${type}/org?org=${org._id}`, { sid: sid[RED_CLIENT] });
+      assert.equal(res.status, 200, `${type}: ${JSON.stringify(res.body)}`);
+      assert.equal(String(res.body._id), String(rows[0]._id));
+    }
+
+    // The grant caps the developer's roles, whichever type the request names.
+    for (const type of ["property_management_agency", "real_estate_developer"]) {
+      const wider = await h.api("/roles", {
+        method: "POST", sid: sid[RED_CLIENT],
+        body: { name: `Too wide ${type}`, type, org: org._id.toString(), permissions: ["visitor-mgmt:delete-visitor"] },
+      });
+      assert.ok([401, 403].includes(wider.status), `${type}: got ${wider.status} ${JSON.stringify(wider.body)}`);
+    }
+    const lead = await h.api("/roles", {
+      method: "POST", sid: sid[RED_CLIENT],
+      body: { name: "Estate lead", type: "real_estate_developer", org: org._id.toString(), permissions: ["visitor-mgmt:view-visitors"] },
+    });
+    assert.equal(lead.status, 201, JSON.stringify(lead.body));
+    const stored = await h.db.collection("roles").findOne({ org: org._id, name: "Estate lead" });
+    assert.equal(stored.type, "property_management_agency");
   });
 });
 

package/test/org-default-roles.test.mjs

@@ -281,3 +281,14 @@ test("the owner-permissions kill switch", async () => {
   assert.equal(clientInviteOwnerPermissionsOn({}), true);
   assert.equal(clientInviteOwnerPermissionsOn({ CLIENT_INVITE_OWNER_PERMISSIONS: "off" }), false);
 });
+
+test("a real estate developer's application roles are Property Management roles", () => {
+  // Owner, 2026-09-12: a developer is the Property Management set. The PM app
+  // asks for property_management_agency roles; a developer-typed one was
+  // invisible to every application.
+  const roles = defaultOwnerRoles(ORG, "real_estate_developer", ["members:view-members"]);
+  const types = roles.map((r) => r.type).sort();
+  assert.deepEqual(types, ["organization", "organization", "property_management_agency", "property_management_agency"]);
+  const owner = roles.find((r) => r.type === "property_management_agency" && r.name === "owner");
+  assert.deepEqual(owner.permissions, ["members:view-members"]);
+});