@dhyasama/totem-merge 7.1.1 → 7.1.3

package/.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## What and why
+
+<!-- What does this change do, and why is it needed? -->
+
+## Author self-review
+
+Totem has a single engineer, so this PR is self-reviewed under the single-engineer exception in the Change Management Policy. Before merging:
+
+- [ ] I re-read the full diff after the last push
+- [ ] The change was tested (how: )
+- [ ] No secrets, credentials, or customer data are added (`gitleaks` passing)
+- [ ] Access, IAM, or security-group changes are least-privilege and explained above
+- [ ] Rollback plan is clear (revert this PR, or: )
+
+After merge without peer approval, justify this PR on Vanta's Code Changes page.

package/.github/workflows/secret-scan.yml

@@ -0,0 +1,42 @@
+name: Secret scan
+# Fails if a push or pull request adds a credential. Scans only the new commits,
+# with the rules in .gitleaks.toml; findings are redacted in the log.
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install gitleaks 8.30.1 (checksum verified)
+        run: |
+          curl -sSfL -o gitleaks.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tgz" | sha256sum -c -
+          tar -xzf gitleaks.tgz gitleaks
+      - name: Scan the new commits
+        env:
+          EVENT: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
+          AFTER: ${{ github.sha }}
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if [ "$EVENT" = "pull_request" ]; then
+            RANGE="$PR_BASE..$PR_HEAD"
+          elif [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then
+            RANGE="$BEFORE..$AFTER"
+          elif git rev-parse --verify -q "origin/$DEFAULT_BRANCH" >/dev/null && [ "$(git rev-parse "origin/$DEFAULT_BRANCH")" != "$AFTER" ]; then
+            RANGE="origin/$DEFAULT_BRANCH..$AFTER"
+          else
+            RANGE="-1 $AFTER"
+          fi
+          echo "Scanning: $RANGE"
+          ./gitleaks git . --config .gitleaks.toml --log-opts="$RANGE" --redact --no-banner --exit-code 1

package/.gitleaks.toml

@@ -0,0 +1,197 @@
+# Secret scanning rules for gitleaks (https://github.com/gitleaks/gitleaks).
+# Used by .github/workflows/secret-scan.yml on every push and pull request.
+# Defaults plus Totem-specific rules; values are never stored here, only patterns.
+title = "Totem secret scan"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "totem-personal-api-key"
+description = "Totem personal API key (opaque tvc_ key)"
+regex = '''\btvc_[A-Za-z0-9_-]{43}\b'''
+keywords = ["tvc_"]
+
+[[rules]]
+id = "mongodb-uri-creds"
+description = "MongoDB connection string with embedded credentials"
+regex = '''mongodb(?:\+srv)?://([^:/\s'"@]+):([^@/\s'"]+)@'''
+secretGroup = 2
+keywords = ["mongodb"]
+
+[[rules]]
+id = "redis-uri-creds"
+description = "Redis/Valkey URI with embedded password"
+regex = '''rediss?://[^:/\s'"@]*:([^@/\s'"]+)@'''
+secretGroup = 1
+keywords = ["redis://", "rediss://"]
+
+[[rules]]
+id = "aiven-service-password"
+description = "Aiven service password"
+regex = '''AVNS_[A-Za-z0-9_-]{12,}'''
+keywords = ["AVNS_"]
+
+[[rules]]
+id = "basic-auth-url"
+description = "HTTP(S) URL with embedded basic-auth password"
+regex = '''https?://[A-Za-z0-9._%+-]+:([^@/\s'"]{6,})@[A-Za-z0-9.-]+'''
+secretGroup = 1
+keywords = ["http://", "https://"]
+
+[[rules]]
+id = "google-api-key-any"
+description = "Google API key (Maps, Gemini, etc.)"
+regex = '''AIza[0-9A-Za-z_-]{35}'''
+keywords = ["AIza"]
+
+[[rules]]
+id = "google-oauth-client-secret"
+description = "Google OAuth client secret (new or legacy format)"
+regex = '''(?i)(?:client_?secret|clientSecret)['"]?\s*[:=]\s*['"](GOCSPX-[A-Za-z0-9_-]{20,}|[A-Za-z0-9_-]{24})['"]'''
+secretGroup = 1
+keywords = ["client_secret", "clientsecret", "gocspx"]
+
+[[rules]]
+id = "gocspx-anywhere"
+description = "Google OAuth client secret prefix"
+regex = '''GOCSPX-[A-Za-z0-9_-]{20,}'''
+keywords = ["GOCSPX-"]
+
+[[rules]]
+id = "openai-key-any"
+description = "OpenAI API key"
+regex = '''sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9]{48}'''
+keywords = ["sk-"]
+
+[[rules]]
+id = "aws-access-key-id-any"
+description = "AWS access key ID"
+regex = '''\b((?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA)[A-Z0-9]{16})\b'''
+keywords = ["AKIA", "ASIA", "AGPA", "AIDA", "AROA", "AIPA", "ANPA", "ANVA"]
+
+[[rules]]
+id = "aws-secret-access-key"
+description = "AWS secret access key assignment"
+regex = '''(?i)(?:aws)?_?secret_?(?:access)?_?key['"]?\s*[:=]\s*['"]([A-Za-z0-9/+=]{40})['"]'''
+secretGroup = 1
+keywords = ["secret"]
+
+[[rules]]
+id = "private-key-block"
+description = "PEM private key"
+regex = '''-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY'''
+keywords = ["PRIVATE KEY"]
+
+[[rules]]
+id = "gcp-service-account"
+description = "GCP service account JSON"
+regex = '''"private_key_id"\s*:\s*"[a-f0-9]{40}"'''
+keywords = ["private_key_id"]
+
+[[rules]]
+id = "npm-token"
+description = "npm access token"
+regex = '''npm_[A-Za-z0-9]{36}|//registry\.npmjs\.org/:_authToken\s*=\s*([A-Za-z0-9-]{20,})'''
+keywords = ["npm_", "_authToken"]
+
+[[rules]]
+id = "github-token"
+description = "GitHub token"
+regex = '''\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|github_pat_[A-Za-z0-9_]{50,}'''
+keywords = ["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"]
+
+[[rules]]
+id = "slack-token"
+description = "Slack token or webhook"
+regex = '''xox[baprs]-[A-Za-z0-9-]{10,}|https://hooks\.slack\.com/services/T[A-Za-z0-9]+/B[A-Za-z0-9]+/[A-Za-z0-9]+'''
+keywords = ["xox", "hooks.slack.com"]
+
+[[rules]]
+id = "stripe-key"
+description = "Stripe live/test secret key"
+regex = '''\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b'''
+keywords = ["sk_live", "sk_test", "rk_live", "rk_test"]
+
+[[rules]]
+id = "sendgrid-key"
+description = "SendGrid API key"
+regex = '''SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}'''
+keywords = ["SG."]
+
+[[rules]]
+id = "twilio-key"
+description = "Twilio SID/key"
+regex = '''\b(?:SK|AC)[a-f0-9]{32}\b'''
+keywords = ["SK", "AC"]
+entropy = 3.0
+
+[[rules]]
+id = "uuid-token-assignment"
+description = "UUID-shaped token assigned near a secret-like keyword (Postmark, Logentries, Fixer, etc.)"
+regex = '''(?i)(?:token|api_?key|apikey|secret|logentries|postmark|le_token)['"]?\s*[:=]\s*['"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]'''
+secretGroup = 1
+keywords = ["token", "key", "secret", "logentries", "postmark"]
+
+[[rules]]
+id = "hex-or-b64-token-assignment"
+description = "Long token/secret/apikey literal assigned in code"
+regex = '''(?i)(?:api_?key|apikey|api_?secret|access_?token|auth_?token|secret_?key|client_?secret|private_?key|signing_?secret|jwt_?secret|session_?secret|cookie_?secret|encryption_?key|webhook_?secret)['"]?\s*[:=]\s*['"]([A-Za-z0-9_\-/+=.]{16,})['"]'''
+secretGroup = 1
+entropy = 3.2
+keywords = ["key", "secret", "token"]
+
+[[rules]]
+id = "password-assignment"
+description = "Password literal assigned in code"
+regex = '''(?i)(?:password|passwd|pwd|pass)['"]?\s*[:=]\s*['"]([^'"\s]{8,})['"]'''
+secretGroup = 1
+entropy = 3.0
+keywords = ["password", "passwd", "pwd", "pass"]
+
+[[rules]]
+id = "jwt-literal"
+description = "JSON Web Token literal"
+regex = '''\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b'''
+keywords = ["eyJ"]
+
+[[rules]]
+id = "azure-storage-key"
+description = "Azure storage account key"
+regex = '''(?i)AccountKey\s*=\s*([A-Za-z0-9+/=]{86,88})'''
+secretGroup = 1
+keywords = ["AccountKey"]
+
+[[rules]]
+id = "generic-bearer"
+description = "Hardcoded bearer token"
+regex = '''(?i)['"]?authorization['"]?\s*[:=]\s*['"]Bearer\s+([A-Za-z0-9_\-.=]{20,})['"]'''
+secretGroup = 1
+keywords = ["bearer"]
+
+[[allowlists]]
+description = "Paths that are never source secrets"
+paths = [
+  '''(^|/)node_modules/''',
+  '''(^|/)bower_components/''',
+  '''(^|/)\.next/''',
+  '''(^|/)dist/''',
+  '''(^|/)build/''',
+  '''(^|/)vendor/''',
+  '''package-lock\.json$''',
+  '''yarn\.lock$''',
+  '''pnpm-lock\.yaml$''',
+  '''\.min\.js$''',
+  '''\.map$''',
+  '''\.(png|jpg|jpeg|gif|svg|ico|woff2?|ttf|eot|pdf|xlsx|docx|mp3|wav|zip)$''',
+]
+
+[[allowlists]]
+description = "Obvious placeholders"
+regexes = [
+  '''(?i)process\.env''',
+  '''(?i)(your|my|example|sample|dummy|fake|placeholder|changeme|xxx+|\*{4,}|<[^>]+>)''',
+  '''(?i)mongodb(\+srv)?://(user|username|USER|USERNAME|<user>)[:@]''',
+  '''(?i)localhost''',
+  '''(?i)synthetic''',
+]

package/cli.js

@@ -85,8 +85,8 @@ var buildProgram = function buildProgram() {
       console.log('Getting orgs...');
 
       async.parallel([
-        Organization.getById.bind(Organization, target, { role: 'none' }),
-        Organization.getById.bind(Organization, source, { role: 'none' })
+        Organization.getById.bind(Organization, target, { isWorkerProcess: true, includeLPs: false }),
+        Organization.getById.bind(Organization, source, { isWorkerProcess: true, includeLPs: false })
       ], function(err, results) {
 
         if (err) { done(err); }

package/index.js

@@ -21,7 +21,6 @@ var Merge = function(mongoose, config) {
   this.Organization = mongoose.model('Organization');
   this.Person = mongoose.model('Person');
   this.Round = mongoose.model('Round');
-  this.Snapshot = mongoose.model('Snapshot');
 
   // turn on debug if in development and not explicitly turned off
   mongoose.set('debug', (!config.suppressDebugLog && this.env == 'development'));

package/infrastructure/security-checks/runtime-secrets.md

@@ -13,4 +13,4 @@ fallback in production or Lambda. Explicit development defaults remain unchanged
 
 See the [shared restart and cleanup runbook](https://github.com/Totem-VC/totem-services/blob/main/infrastructure/security-checks/runtime-secrets.md) for release verification, credential cleanup, and remaining limitations.
 
-Run `node --test infrastructure/security-checks/runtime-secret-contract.cjs` for isolated loader checks. These source changes require the normal application release to affect running processes. No credential was rotated.
+Run `node --test infrastructure/security-checks/runtime-secret-contract.cjs` for isolated loader checks. Loader changes require a normal application release and process replacement to affect running processes.

package/lib/customerMergeGuard.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const { Types: { ObjectId } } = require('mongoose');
+
+// Use Organization's own connection, including for callers that have not
+// registered the additive Customer model. Never filter on active/premium:
+// inactive tenant identities must remain protected too.
+module.exports = function customerMergeGuard(Organization, target, source, cb) {
+  const blocked = () => new Error('Customer organizations cannot be merged');
+  if ([target, source].some(org => org && org.customer && org.customer.totemUrl)) {
+    return cb(blocked(), null);
+  }
+
+  let lookup;
+  try {
+    const ids = [target, source].map(org => {
+      const id = org && (org._id || org.id);
+      if (!id || !/^[a-f0-9]{24}$/i.test(String(id))) {
+        throw new Error('A valid organization ID is required before merging');
+      }
+      return new ObjectId(String(id));
+    });
+    lookup = Organization.db.collection('customers').findOne({
+      $or: [{ _id: { $in: ids } }, { organization: { $in: ids } }]
+    }, { projection: { _id: 1 } });
+  } catch (err) {
+    return cb(err, null);
+  }
+  // Separate success and rejection handlers so a consumer callback exception
+  // cannot cause a second callback invocation.
+  return Promise.resolve(lookup).then(
+    customer => cb(customer ? blocked() : null, null),
+    err => cb(err, null)
+  );
+};

package/lib/helpers.js

@@ -4,20 +4,6 @@ var _ = require('underscore');
 var utilities = require('@dhyasama/totem-utilities');
 var phoneFormatter = require('phone-formatter');
 
-var createSnapshot = module.exports.createSnapshot = function createSnapshot(context, collectionName, doc, createdBy, cb) {
-
-  context.logger.writeToInfoLog('Creating snapshot - ' + collectionName + ' - ' + createdBy + ' - ' + doc._id);
-
-  var snapshot = new context.Snapshot({
-    createdBy: createdBy,
-    collectionName: collectionName,
-    doc: doc
-  });
-
-  context.Snapshot.upsert(snapshot, cb);
-
-};
-
 // Generic, recursive object merging
 var mergeObjects = function mergeObjects(target, source, doNotMergeKeys) {
 

package/lib/organizations.js

@@ -5,6 +5,7 @@ let _ = require('underscore');
 let helpers = require('./helpers');
 let mongoose = require('mongoose');
 let ObjectId = mongoose.Types.ObjectId;
+let verifyCustomerMerge = require('./customerMergeGuard');
 let logger;
 
 var merge = function merge(context, target, source, mergedBy, customerId, cb) {
@@ -38,13 +39,7 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
 
   async.series([
 
-    verifyOkToMerge.bind(null, target, source),
-
-    // Create a snapshot of the target
-    helpers.createSnapshot.bind(null, context, 'Organization', target, username),
-
-    // Create a snapshot of the source
-    helpers.createSnapshot.bind(null, context, 'Organization', source, username),
+    verifyCustomerMerge.bind(null, context.Organization, target, source),
 
     // Merge the source into the target
     mergeSourceIntoTarget.bind(null, target, source),
@@ -64,10 +59,10 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
     if (err) { return cb(err, null); }
 
     // result from saveOrganization
-    var updatedTarget = results[5];
+    var updatedTarget = results[3];
 
     // result from updateOrganizations within updateReferences
-    var updatedReferencesOrgs = results[6][5];
+    var updatedReferencesOrgs = results[4][5];
 
     // Check if target had reference(s) updated
     var targetIdStr = target.id && target.id.toString();
@@ -119,21 +114,6 @@ var mergeSourceIntoTarget = function mergeEntities(target, source, cb) {
 
 };
 
-var verifyOkToMerge = function verifyOkToMerge(target, source, cb) {
-
-  logger.writeToInfoLog('Verify ok to merge...');
-
-  // Cannot merge if target is a customer
-  if (target && target.customer && target.customer.totemUrl) { return cb(true, null); }
-
-  // Cannot merge if source is a customer
-  else if (source && source.customer && source.customer.totemUrl) { return cb(true, null); }
-
-  // Ok to merge
-  else { return cb(null, null); }
-
-};
-
 var updateReferences = function updateReferences(context, target, source, mergedBy, customerId, cb) {
 
   logger.writeToInfoLog('Update references...');
@@ -461,4 +441,4 @@ var updateRounds = function updateRounds(newOrgId, oldOrgId, cb) {
 
 };
 
-module.exports.merge = merge;
+module.exports.merge = merge;

package/lib/people.js

@@ -33,12 +33,6 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
 
   async.series([
 
-    // Create a snapshot of the target
-    helpers.createSnapshot.bind(null, context, 'Person', target, username),
-
-    // Create a snapshot of the source
-    helpers.createSnapshot.bind(null, context, 'Person', source, username),
-
     // Merge the source into the target
     mergeSourceIntoTarget.bind(null, target, source),
 
@@ -57,7 +51,7 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
     if (err) return cb(err, null);
 
     // result from savePerson
-    var updatedTarget = results[4];
+    var updatedTarget = results[2];
 
     // return updated target
     return cb(null, updatedTarget);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dhyasama/totem-merge",
-  "version": "7.1.1",
+  "version": "7.1.3",
   "description": "Org and person merging package",
   "main": "index.js",
   "scripts": {
@@ -27,18 +27,9 @@
     "mongoose": "^8.24.3"
   },
   "devDependencies": {
-    "@dhyasama/totem-models": "^12.14.0",
+    "@dhyasama/totem-models": "15.1.0",
     "mocha": "^12.0.2",
     "mocha-mongoose": "^1.1.1",
     "should": "^8.2.2"
-  },
-  "overrides": {
-    "r7insight_node": {
-      "lodash": "4.18.1",
-      "semver": "5.7.2",
-      "codependency": {
-        "semver": "5.7.2"
-      }
-    }
   }
 }

package/test/customer-merge-guard.mongo.test.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const mongoose = require('mongoose');
+const guard = require('../lib/customerMergeGuard');
+const uri = process.env.CUSTOMER_MERGE_TEST_URI;
+
+(uri ? describe : describe.skip)('customer merge guard with MongoDB', function() {
+  let connection, Organization, customers;
+  before(async function() {
+    if (!/^mongodb:\/\/127\.0\.0\.1:\d+\/customer_merge_guard_test(?:\?|$)/.test(uri)) {
+      throw new Error('Only the local customer_merge_guard_test database is allowed');
+    }
+    connection = await mongoose.createConnection(uri).asPromise();
+    Organization = connection.model('MergeGuardOrganization', new mongoose.Schema({ name: String }));
+    customers = connection.collection('customers');
+  });
+  after(async function() { if (connection) await connection.close(); });
+
+  it('blocks either tenant identity including inactive records and permits shared companies', async function() {
+    const target = new Organization({ name: 'Synthetic target' });
+    const source = new Organization({ name: 'Synthetic source' });
+    const run = () => new Promise(resolve => guard(Organization, target, source, resolve));
+    try {
+      assert.equal(await run(), null);
+      for (const org of [source, target]) {
+        await customers.insertOne({ _id: org._id, organization: org._id, settings: { active: false } });
+        assert.match((await run()).message, /cannot be merged/);
+        await customers.deleteOne({ _id: org._id });
+      }
+      assert.equal(await run(), null);
+    } finally {
+      await customers.deleteMany({ _id: { $in: [target._id, source._id] } });
+    }
+  });
+});

package/test/customer-merge-guard.test.js

@@ -0,0 +1,76 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { Types: { ObjectId } } = require('mongoose');
+const guard = require('../lib/customerMergeGuard');
+const merge = require('../lib/organizations').merge;
+
+function fixture(records = [], failure) {
+  const target = { _id: new ObjectId() };
+  const source = { _id: new ObjectId() };
+  const calls = [];
+  const Organization = { db: { collection(name) {
+    assert.equal(name, 'customers');
+    return { async findOne(query, options) {
+      calls.push(query);
+      assert.deepEqual(options, { projection: { _id: 1 } });
+      if (failure) throw failure;
+      return records.find(record => query.$or.some(clause => {
+        const key = Object.keys(clause)[0];
+        return clause[key].$in.some(id => String(id) === String(record[key]));
+      })) || null;
+    } };
+  } } };
+  const run = () => new Promise(resolve => guard(Organization, target, source, err => resolve(err)));
+  return { target, source, Organization, calls, run, records };
+}
+
+describe('customer organization merge guard', function() {
+  for (const side of ['target', 'source']) {
+    for (const active of [true, false]) {
+      it(`blocks ${active ? 'active' : 'inactive'} Customer on ${side} without legacy settings`, async function() {
+        const f = fixture();
+        f.records.push({ _id: f[side]._id, settings: { active } });
+        assert.match((await f.run()).message, /cannot be merged/);
+      });
+    }
+    it(`preserves the legacy ${side} guard without a database lookup`, async function() {
+      const f = fixture();
+      f[side].customer = { totemUrl: 'fixture' };
+      assert.match((await f.run()).message, /cannot be merged/);
+      assert.equal(f.calls.length, 0);
+    });
+  }
+  it('also protects the organization reference if a Customer id is inconsistent', async function() {
+    const f = fixture();
+    f.records.push({ _id: new ObjectId(), organization: f.source._id });
+    assert.match((await f.run()).message, /cannot be merged/);
+  });
+  it('allows two shared organizations without Customer records', async function() {
+    const f = fixture();
+    assert.equal(await f.run(), null);
+    assert.equal(f.calls.length, 1);
+  });
+  it('fails closed when the lookup fails', async function() {
+    const failure = new Error('Database unavailable');
+    assert.equal(await fixture([], failure).run(), failure);
+  });
+  it('fails closed before querying an invalid identity', async function() {
+    const f = fixture();
+    f.source._id = 'invalid';
+    assert.match((await f.run()).message, /valid organization ID/);
+    assert.equal(f.calls.length, 0);
+  });
+  it('blocks the public merge pipeline before mutation or deletion', async function() {
+    const f = fixture();
+    f.records.push({ _id: f.source._id });
+    const before = JSON.stringify([f.target, f.source]);
+    const context = {
+      Organization: f.Organization,
+      logger: { writeToInfoLog() {} }
+    };
+    const err = await new Promise(resolve => merge(context, f.target, f.source, 'test', new ObjectId(), resolve));
+    assert.match(err.message, /cannot be merged/);
+    assert.equal(JSON.stringify([f.target, f.source]), before);
+  });
+});

package/test/index.js

@@ -175,7 +175,7 @@ describeMerge('Merge', function() {
       should.not.exist(err);
       should.exist(newOrg1);
 
-      Organization.getById(newOrg1.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result1) {
+      Organization.getById(newOrg1.id, { CUSTOMER_ID: customer._id }, function(err, result1) {
 
         should.not.exist(err);
         should.exist(result1);
@@ -187,7 +187,7 @@ describeMerge('Merge', function() {
           should.not.exist(err);
           should.exist(newOrg2);
 
-          Organization.getById(newOrg2.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result2) {
+          Organization.getById(newOrg2.id, { CUSTOMER_ID: customer._id }, function(err, result2) {
 
             should.not.exist(err);
             should.exist(result2);
@@ -199,7 +199,7 @@ describeMerge('Merge', function() {
               should.not.exist(err);
               should.exist(newOrg3);
 
-              Organization.getById(newOrg3.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result3) {
+              Organization.getById(newOrg3.id, { CUSTOMER_ID: customer._id }, function(err, result3) {
 
                 should.not.exist(err);
                 should.exist(result3);
@@ -211,7 +211,7 @@ describeMerge('Merge', function() {
                   should.not.exist(err);
                   should.exist(newOrg4);
 
-                  Organization.getById(newOrg4.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result4) {
+                  Organization.getById(newOrg4.id, { CUSTOMER_ID: customer._id }, function(err, result4) {
 
                     should.not.exist(err);
                     should.exist(result4);
@@ -223,7 +223,7 @@ describeMerge('Merge', function() {
                       should.not.exist(err);
                       should.exist(newOrg5);
 
-                      Organization.getById(newOrg5.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result5) {
+                      Organization.getById(newOrg5.id, { CUSTOMER_ID: customer._id }, function(err, result5) {
 
                         should.not.exist(err);
                         should.exist(result5);
@@ -235,7 +235,7 @@ describeMerge('Merge', function() {
                           should.not.exist(err);
                           should.exist(newOrg6);
 
-                          Organization.getById(newOrg6.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result6) {
+                          Organization.getById(newOrg6.id, { CUSTOMER_ID: customer._id }, function(err, result6) {
 
                             should.not.exist(err);
                             should.exist(result6);
@@ -822,7 +822,7 @@ describeMerge('Merge', function() {
               should.not.exist(err);
               should.exist(merged);
 
-              Organization.getById(result.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, finalResult) {
+              Organization.getById(result.id, { CUSTOMER_ID: customer._id }, function(err, finalResult) {
 
                 should.not.exist(err);
                 should.exist(finalResult);
@@ -883,7 +883,7 @@ describeMerge('Merge', function() {
               should.not.exist(err);
               should.exist(merged);
 
-              Organization.getById(result.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, finalResult) {
+              Organization.getById(result.id, { CUSTOMER_ID: customer._id }, function(err, finalResult) {
 
                 should.not.exist(err);
                 should.exist(finalResult);