@7365admin1/core 3.78.0 → 3.79.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.78.0",
+  "version": "3.79.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/test/notification-category.util.test.mjs

@@ -20,9 +20,18 @@ import {
 const keys = (result) => result.map((c) => c.key);
 
 describe("notification categories", () => {
-  it("a wildcard role is offered everything that is rendered", () => {
+  it("a wildcard role is offered everything that is rendered, except a staff-only category", () => {
     const offered = categoriesForPermissions({ permissions: ["*"] });
 
+    assert.deepEqual(
+      keys(offered),
+      NOTIFICATION_CATEGORIES.filter((c) => c.rendered && !c.staffOnly).map((c) => c.key),
+    );
+  });
+
+  it("Seven365 staff are offered the staff-only categories too", () => {
+    const offered = categoriesForPermissions({ permissions: ["*"], isStaff: true });
+
     assert.deepEqual(
       keys(offered),
       NOTIFICATION_CATEGORIES.filter((c) => c.rendered).map((c) => c.key),

package/test/staff-platform-notifications.test.mjs

@@ -0,0 +1,95 @@
+/*
+ * Seven365's own staff get told when a client is created and when an invited
+ * client owner accepts. Nothing addressed Seven365 staff before this, so their
+ * bell was empty by construction (owner, 2026-09-21).
+ *
+ * The category test runs the real built module. The wiring tests read the
+ * source, because `notification.service.ts` and `verification.controller.ts`
+ * pull in the whole server (mongo, mailer, expo) and are not in the suite's
+ * build list.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import {
+  NOTIFICATION_CATEGORIES,
+  categoriesForPermissions,
+  categorySupportsChannel,
+} from "./.build/utils/notification-category.util.mjs";
+
+const keys = (params) => categoriesForPermissions(params).map((c) => c.key);
+
+test("the platform category is shown to Seven365 staff", () => {
+  assert.ok(keys({ permissions: ["*"], isStaff: true }).includes("platform"));
+});
+
+test("a wildcard client role does NOT get the staff switch", () => {
+  // ~85 client roles hold `*`, and `*` opens every other category. Without the
+  // staffOnly flag every one of them would be shown a switch for messages that
+  // are never addressed to them.
+  const client = keys({ permissions: ["*"] });
+  assert.ok(!client.includes("platform"));
+  // CONTROL: the wildcard still opens the ordinary categories.
+  assert.ok(client.includes("feedback"));
+});
+
+test("a resident and an ordinary role do not get it either", () => {
+  assert.ok(!keys({ isResident: true }).includes("platform"));
+  assert.ok(!keys({ permissions: { feedbacks: ["see-all-feedback"] } }).includes("platform"));
+});
+
+test("the category delivers in-app and push, and is switchable", () => {
+  const platform = NOTIFICATION_CATEGORIES.find((c) => c.key === "platform");
+  assert.equal(platform.rendered, true);
+  assert.equal(categorySupportsChannel("platform", "inApp"), true);
+  assert.equal(categorySupportsChannel("platform", "push"), true);
+  // No mailer recipient for a staff list, so no dead email switch.
+  assert.equal(categorySupportsChannel("platform", "email"), false);
+});
+
+test("the stored module tag is one core accepts", () => {
+  // `_addNotification` validates `module` against NotificationModule; an
+  // unknown tag is dropped from the feed (the inventory alerts, 2026-09-19).
+  const model = readFileSync("src/models/notification.model.ts", "utf8");
+  assert.match(model, /PLATFORM = "platform"/);
+  const service = readFileSync("src/services/notification.service.ts", "utf8");
+  assert.match(service, /module: "platform"/);
+});
+
+test("both senders resolve the staff list themselves and never throw", () => {
+  const service = readFileSync("src/services/notification.service.ts", "utf8");
+  for (const name of ["clientCreated", "clientInvitationAccepted"]) {
+    const body = service.slice(service.indexOf(`static async ${name}(`), service.indexOf(`static async ${name}(`) + 900);
+    assert.match(body, /const staff = await staffRecipients\(\);/, name);
+    assert.match(body, /if \(!staff\.length\) return;/, name);
+    // CONTROL: a caller cannot pass its own recipient list in.
+    assert.doesNotMatch(body, /userIds/, name);
+  }
+  assert.match(service, /async function staffRecipients\(\)[\s\S]{0,300}catch/);
+});
+
+test("listStaffUserIds asks the same two questions as isSuperAdmin", () => {
+  const util = readFileSync("src/utils/super-admin.util.ts", "utf8");
+  const fn = util.slice(util.indexOf("export async function listStaffUserIds"), util.indexOf("export async function isSuperAdmin"));
+  assert.match(fn, /type: "admin", status: \{ \$ne: "deleted" \}/);
+  assert.match(fn, /type: "admin", \.\.\.LIVE_ROLE/);
+});
+
+test("creating a client and accepting an invitation both notify, without blocking the request", () => {
+  const org = readFileSync("src/controllers/organization.controller.ts", "utf8");
+  const add = org.slice(org.indexOf("async function add("), org.indexOf("async function add(") + 2600);
+  assert.match(add, /void NotificationService\.clientCreated\(/);
+  assert.ok(
+    add.indexOf("NotificationService.clientCreated") > add.indexOf("seedDefaultRoles(org"),
+    "notify only after the organisation really exists",
+  );
+
+  const ver = readFileSync("src/controllers/verification.controller.ts", "utf8");
+  const upd = ver.slice(ver.indexOf("async function updateVerificationStatus("));
+  const call = upd.indexOf("NotificationService.clientInvitationAccepted");
+  assert.match(upd.slice(0, call + 60), /void NotificationService\.clientInvitationAccepted/);
+  assert.ok(call > upd.indexOf("_updateStatusById(id, status)"), "only after the status really changed");
+  // CONTROL: the already-complete early return sits above, so a replayed
+  // acceptance cannot notify twice.
+  assert.ok(upd.indexOf("if (verification.status === 'complete')") < call);
+});