@7365admin1/core 3.75.0 → 3.76.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.75.0",
+  "version": "3.76.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/camera-live-link.test.mjs

@@ -0,0 +1,163 @@
+/**
+ * The server signs the LIVE view link, the same way it already signs recorded
+ * footage — and hands it out WITHOUT touching `camera.host`.
+ *
+ * Both halves are asserted here, and they are different claims:
+ *
+ *  1. `signLiveLink` produces exactly the string the relay's `playback.js`
+ *     verifies (the expected signature is recomputed here by hand, not taken
+ *     from the function under test).
+ *  2. The camera payloads this estate actually returns CARRY it — proved
+ *     through `withLiveLink(publicCameraFields(...))`, the wrapper the wall,
+ *     the health sweep and the single-camera view all go through.
+ */
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+import {
+  PLAYBACK_LINK_SECONDS,
+  signLiveLink,
+  signPlaybackLink,
+  withLiveLink,
+} from "./.build/utils/camera-playback.util.mjs";
+import {
+  isRelayPlayerUrl,
+} from "./.build/utils/camera-capability.util.mjs";
+import { publicCameraFields } from "./.build/utils/camera-view.util.mjs";
+
+const KEY = "k".repeat(40);
+const RELAY = "the-loft.example.net";
+const RELAYS = { [RELAY]: KEY };
+const NOW = new Date("2026-09-16T08:00:00Z");
+const EXP = Math.floor(NOW.getTime() / 1000) + PLAYBACK_LINK_SECONDS;
+
+/** What the relay computes. Written out here so the test is not the code twice. */
+const expectedSig = (channel, exp = EXP, key = KEY) =>
+  createHmac("sha256", key).update(`${channel}|${exp}`).digest("hex");
+
+test("a live link is signed over channel|exp with the relay's key", () => {
+  const link = signLiveLink(`https://${RELAY}/7`, { relays: RELAYS, now: NOW });
+
+  assert.equal(link.liveAuth, `exp=${EXP}&sig=${expectedSig("7")}`);
+  assert.equal(link.liveUrl, `https://${RELAY}/7?${link.liveAuth}`);
+  assert.equal(link.liveExpiresAt, new Date(EXP * 1000).toISOString());
+});
+
+test("the live link and the recorded-footage link sign DIFFERENT messages", () => {
+  const start = new Date("2026-09-16T07:00:00Z");
+  const end = new Date("2026-09-16T07:10:00Z");
+  const recorded = signPlaybackLink({
+    host: `https://${RELAY}/7`,
+    key: KEY,
+    start,
+    end,
+    now: NOW,
+  });
+  const live = signLiveLink(`https://${RELAY}/7`, { relays: RELAYS, now: NOW });
+
+  // Same key, same expiry, different signature - so a recording link cannot be
+  // replayed as a live link, which is what the relay's tests assert from the
+  // other side.
+  assert.equal(new URL(recorded.playerUrl).searchParams.get("exp"), String(EXP));
+  assert.notEqual(
+    new URL(recorded.playerUrl).searchParams.get("sig"),
+    new URL(live.liveUrl).searchParams.get("sig"),
+  );
+});
+
+test("the link lives as long as a recorded-footage link, and no longer", () => {
+  assert.equal(PLAYBACK_LINK_SECONDS, 120);
+  const link = signLiveLink(`https://${RELAY}/7`, { relays: RELAYS, now: NOW });
+  const exp = Number(new URLSearchParams(link.liveAuth).get("exp"));
+  assert.equal(exp - Math.floor(NOW.getTime() / 1000), PLAYBACK_LINK_SECONDS);
+});
+
+test("no relay configured for that address means NOTHING changes", () => {
+  // The estate has cameras on hosts nobody has configured. They must keep their
+  // plain link rather than get a signature no relay can check.
+  assert.equal(signLiveLink(`https://other.example.net/7`, { relays: RELAYS, now: NOW }), null);
+  assert.equal(signLiveLink(`https://${RELAY}/7`, { relays: {}, now: NOW }), null);
+  // A host with no channel is genuinely unresolvable, not channel 1.
+  assert.equal(signLiveLink(`https://${RELAY}/lobby`, { relays: RELAYS, now: NOW }), null);
+  assert.equal(signLiveLink(undefined, { relays: RELAYS, now: NOW }), null);
+  assert.equal(signLiveLink("", { relays: RELAYS, now: NOW }), null);
+});
+
+test("one signature serves the page, the socket, the still and the clip", () => {
+  // It covers the CHANNEL, not the path - which is why appending it to
+  // /screenshot/<ch> and /record/<ch>/duration/<n> works, and why the clients
+  // that splice `screenshot` into the path are unaffected.
+  const { liveAuth } = signLiveLink(`https://${RELAY}/7`, { relays: RELAYS, now: NOW });
+  for (const path of ["/7", "/api/stream/7", "/screenshot/7", "/record/7/duration/10"]) {
+    const url = new URL(`https://${RELAY}${path}?${liveAuth}`);
+    assert.equal(url.searchParams.get("sig"), expectedSig("7"));
+  }
+});
+
+test("the camera payloads the estate returns carry the signed link", () => {
+  const camera = { _id: "c1", name: "Lobby", type: "ip", status: "active", host: `https://${RELAY}/7` };
+  const fields = withLiveLink(publicCameraFields(camera), { relays: RELAYS, now: NOW });
+
+  assert.equal(fields.liveUrl, `https://${RELAY}/7?exp=${EXP}&sig=${expectedSig("7")}`);
+  assert.equal(fields.liveAuth, `exp=${EXP}&sig=${expectedSig("7")}`);
+});
+
+test("the stored host is handed back UNCHANGED, and stays a relay player URL", () => {
+  const host = `https://${RELAY}/7`;
+  const fields = withLiveLink(publicCameraFields({ _id: "c1", type: "ip", status: "active", host }), {
+    relays: RELAYS,
+    now: NOW,
+  });
+
+  // If `host` ever carried the signature, `isRelayPlayerUrl` would refuse it
+  // (it rejects any query), the liveVideo capability would switch off for both
+  // mobile apps and the web wall, and the patrol-route form would freeze an
+  // expiring signature into the route document. So this is load-bearing.
+  assert.equal(fields.host, host);
+  assert.equal(isRelayPlayerUrl(fields.host), true);
+});
+
+/**
+ * The WIRING, asserted on the service source — the same reason and the same
+ * method as `camera-entitlement-wiring.test.mjs`: constructing the service needs
+ * a live Atlas connection, so the only way to prove the service actually calls
+ * this is to assert the source.
+ *
+ * Without this, every assertion above could pass while the wall still handed out
+ * unsigned links — a helper nobody called.
+ */
+test("EVERY camera payload the service returns goes through withLiveLink", () => {
+  const source = readFileSync(
+    fileURLToPath(new URL("../src/services/camera-view.service.ts", import.meta.url)),
+    "utf8",
+  );
+
+  const uses = [...source.matchAll(/publicCameraFields\(/g)];
+  // The import line names it too; the call sites are what matter.
+  const callSites = uses.filter((m) => !/import|from/.test(source.slice(Math.max(0, m.index - 80), m.index)));
+  assert.ok(callSites.length >= 3, `expected the wall, the health sweep and the single view, found ${callSites.length}`);
+
+  for (const match of callSites) {
+    const before = source.slice(Math.max(0, match.index - 60), match.index);
+    assert.match(
+      before,
+      /withLiveLink\(\s*$/,
+      `a camera payload at offset ${match.index} is handed out without a signed live link`,
+    );
+  }
+});
+
+test("an ANPR camera gets no host and therefore no live link", () => {
+  // `publicCameraFields` already withholds `host` for ANPR; nothing may put one
+  // back. ANPR belongs to visitor and vehicle management, not to CCTV.
+  const fields = withLiveLink(
+    publicCameraFields({ _id: "c2", type: "anpr", status: "active", host: `https://${RELAY}/7` }),
+    { relays: RELAYS, now: NOW },
+  );
+  assert.equal(fields.host, undefined);
+  assert.equal(fields.liveUrl, undefined);
+  assert.equal(fields.liveAuth, undefined);
+});

package/test/default-staff-role.test.mjs

@@ -127,7 +127,7 @@ test("getRoleByName applies the type to the query when one is given", () => {
   );
   assert.match(
     fn,
-    /type \? \{ name, type \} : \{ name \}/,
+    /type \? \{ name, type: appTypeQuery\(type\) \} : \{ name \}/,
     "getRoleByName no longer narrows by type when a type is supplied",
   );
 });

package/test/e2e/client-invite-service365.e2e.test.mjs

@@ -153,6 +153,63 @@ describe("Invite Client gives a Property Management client its Service365 module
     const stored = await h.db.collection("roles").findOne({ org: org._id, name: "Estate lead" });
     assert.equal(stored.type, "property_management_agency");
   });
+
+  it("rows stored before 3.75.0 as real_estate_developer are still found, and still capped", async () => {
+    // Nobody has read production to prove no such row exists, so every lookup by
+    // type must find BOTH stored spellings.
+    const now = new Date().toISOString();
+    const hashed = (await h.db.collection("users").findOne({ email: RED_CLIENT })).password;
+    const oldEmail = "red-old-cis@e2e.example.com";
+    const newEmail = "red-new-cis@e2e.example.com";
+    const users = await h.db.collection("users").insertMany(
+      [oldEmail, newEmail].map((email) => ({ email, name: email.split("@")[0], status: "active", password: hashed, createdAt: now })),
+    );
+    const [oldUser, newUser] = [users.insertedIds[0], users.insertedIds[1]];
+    const org = new ObjectId();
+    const oldOwnerRole = new ObjectId();
+    await h.db.collection("roles").insertOne({
+      _id: oldOwnerRole, org, name: "owner", type: "real_estate_developer", default: true,
+      permissions: ["visitor-mgmt:view-visitors"], status: "active", createdAt: now, deletedAt: "",
+    });
+    await h.db.collection("organizations").insertOne({
+      _id: org, name: "CIS Old Developer", nature: "real_estate_developer", email: oldEmail,
+      invitedRole: oldOwnerRole, status: "active", createdAt: now, deletedAt: "",
+    });
+    await h.db.collection("members").insertMany([
+      { user: oldUser, org, orgName: "CIS Old Developer", name: oldEmail, email: oldEmail, type: "organization", role: oldOwnerRole, siteId: "", status: "active", createdAt: now, deletedAt: "" },
+      { user: oldUser, org, orgName: "CIS Old Developer", name: oldEmail, email: oldEmail, type: "real_estate_developer", role: oldOwnerRole, siteId: "", status: "active", createdAt: now, deletedAt: "" },
+      { user: newUser, org, orgName: "CIS Old Developer", name: newEmail, email: newEmail, type: "property_management_agency", role: oldOwnerRole, siteId: "", status: "active", createdAt: now, deletedAt: "" },
+    ]);
+    const oldSid = await h.login(oldEmail, PASSWORD);
+    const newSid = await h.login(newEmail, PASSWORD);
+
+    for (const [who, sidOf, stored] of [[oldUser, oldSid, "real_estate_developer"], [newUser, newSid, "property_management_agency"]]) {
+      for (const asked of ["property_management_agency", "real_estate_developer"]) {
+        const byOrg = await h.api(`/members/user/${who}/app/${asked}/org?org=${org}`, { sid: sidOf });
+        assert.equal(byOrg.status, 200, `${stored} asked as ${asked}: ${JSON.stringify(byOrg.body)}`);
+        assert.equal(byOrg.body.type, stored);
+        const plain = await h.api(`/members/user/${who}/app/${asked}`, { sid: sidOf });
+        assert.equal(plain.status, 200, `${stored} (no org) asked as ${asked}: ${JSON.stringify(plain.body)}`);
+        const modules = await h.api(`/members/user/${who}/app/${asked}/modules?org=${org}`, { sid: sidOf });
+        assert.equal(modules.status, 200, JSON.stringify(modules.body));
+      }
+    }
+
+    // The role list by type shows the old developer-typed owner role to the PM app.
+    const roles = await h.api(`/roles?org=${org}&type=property_management_agency`, { sid: oldSid });
+    assert.equal(roles.status, 200, JSON.stringify(roles.body));
+    const items = roles.body.items ?? roles.body;
+    assert.ok(items.some((r) => String(r._id) === String(oldOwnerRole)), "the stored developer role is listed");
+
+    // The owner grant on a developer-typed role still caps both type spellings.
+    for (const type of ["property_management_agency", "real_estate_developer"]) {
+      const wider = await h.api("/roles", {
+        method: "POST", sid: oldSid,
+        body: { name: `Old wide ${type}`, type, org: org.toString(), permissions: ["visitor-mgmt:delete-visitor"] },
+      });
+      assert.ok([401, 403].includes(wider.status), `${type}: got ${wider.status} ${JSON.stringify(wider.body)}`);
+    }
+  });
 });
 
 async function seed(h) {

package/test/service-app-type.test.mjs

@@ -0,0 +1,35 @@
+// Lookups by type must find every stored spelling of an application. Core 3.75.0
+// writes a Real Estate Developer's memberships and roles as
+// property_management_agency, but rows written before it carry
+// real_estate_developer, and production has not been read to prove there are none.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { appTypeQuery, sameAppType, serviceAppType, storedAppTypes } from "./.build/utils/service-app-type.util.mjs";
+import { pickLookupMembership, pickSiteMembership } from "./.build/utils/member-lookup.util.mjs";
+
+test("writes use the Property Management type; lookups match both stored values", () => {
+  assert.equal(serviceAppType("real_estate_developer"), "property_management_agency");
+  for (const asked of ["property_management_agency", "real_estate_developer"]) {
+    assert.deepEqual(storedAppTypes(asked).sort(), ["property_management_agency", "real_estate_developer"]);
+    assert.deepEqual(appTypeQuery(asked).$in.sort(), ["property_management_agency", "real_estate_developer"]);
+  }
+  assert.equal(appTypeQuery("security_agency"), "security_agency", "other apps keep an exact match");
+  assert.ok(sameAppType("real_estate_developer", "property_management_agency"));
+  assert.ok(!sameAppType("security_agency", "property_management_agency"));
+  assert.ok(!sameAppType("", ""));
+});
+
+test("the module deny list picks a membership stored with either spelling", () => {
+  const org = "68b0f1a2c3d4e5f601234567";
+  const site = "68b0f1a2c3d4e5f601234568";
+  const old = { _id: "m1", type: "real_estate_developer", org, siteId: site, status: "active" };
+  const now = { _id: "m2", type: "property_management_agency", org, siteId: site, status: "active" };
+  for (const row of [old, now]) {
+    for (const asked of ["property_management_agency", "real_estate_developer"]) {
+      assert.equal(pickLookupMembership([row], asked, "", org)?._id, row._id, `${row.type} asked as ${asked}`);
+      assert.equal(pickSiteMembership([row], asked, site, org)?._id, row._id);
+    }
+    assert.equal(pickLookupMembership([row], "security_agency", "", org), null);
+  }
+});