@i4e/invest4edu-access-core 0.41.0 → 0.42.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.41.0",
+  "version": "0.42.1",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/client-profile/profile-service.js

@@ -128,7 +128,10 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
   async function roleNamesOf(userId, session) {
     const maps = await db().collection("userentitymappings").find({ user_id: userId, status: { $ne: 0 }, role_id: { $ne: null } }, { session, projection: { role_id: 1 } }).toArray();
     if (!maps.length) return [];
-    const roles = await db().collection("roles").find({ _id: { $in: maps.map((m) => m.role_id) } }, { session, projection: { role_name: 1 } }).toArray();
+    // role_id is an ARRAY on real mappings; `$in` must get the role ids themselves, not the arrays
+    // (an array inside `$in` only matches an equal array, so every caller read as role-less).
+    const roleIds = maps.flatMap((m) => (Array.isArray(m.role_id) ? m.role_id : [m.role_id])).filter(Boolean);
+    const roles = await db().collection("roles").find({ _id: { $in: roleIds } }, { session, projection: { role_name: 1 } }).toArray();
     return roles.map((r) => r.role_name).filter(Boolean);
   }
 
@@ -363,6 +366,40 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     }
   }
 
+  /**
+   * May this caller write to this client? A client-app session only to their own records — the
+   * same person's profiles under one master; portal callers are scoped by their own rules and
+   * always pass here. Gated by modes.own_records_only (audit logs, enforce refuses).
+   * @returns {Promise<{ allowed: boolean, reason?: string }>}
+   */
+  async function callerMayWriteClient({ userId, clientId } = {}) {
+    const settings = getSettings();
+    if (!isEvaluated(settings, "own_records_only") || !userId || !clientId) return { allowed: true };
+    let actor;
+    try {
+      actor = await resolveActor(userId);
+    } catch (err) {
+      onAudit({ kind: "own_records_error", client_id: clientId, message: err?.message });
+      return { allowed: true };
+    }
+    if (actor?.callerClass !== CALLER_CLASSES.CLIENT) return { allowed: true };
+    let own = [];
+    try {
+      const user = await db().collection("users").findOne({ _id: toId(userId) }, { projection: { client_id: 1 } });
+      if (user?.client_id) {
+        const master = await db().collection("masterchildclients").findOne({ child_client_ids: user.client_id }, { projection: { child_client_ids: 1 } });
+        own = (master?.child_client_ids?.length ? master.child_client_ids : [user.client_id]).map(String);
+      }
+    } catch (err) {
+      // A client session whose records cannot be read must not write anywhere.
+      onAudit({ kind: "own_records_error", client_id: clientId, message: err?.message });
+      return { allowed: !isEnforced(settings, "own_records_only"), reason: "unresolved" };
+    }
+    if (own.includes(String(clientId))) return { allowed: true };
+    onAudit({ kind: "own_records_only", client_id: clientId, user_id: String(userId) });
+    return { allowed: !isEnforced(settings, "own_records_only"), reason: "not_own_record" };
+  }
+
   /** The UCC was updated: nothing is pending any more. Never throws. */
   async function clearUccPending(clientId) {
     try {
@@ -374,5 +411,5 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     }
   }
 
-  return Object.freeze({ findActiveProfilesByPan, findExisting, attach, attachUser, resolveActor, sideFilterFor, evaluatePersonalEdit, goalContextFor, noteClientUccEdit, clearUccPending });
+  return Object.freeze({ findActiveProfilesByPan, findExisting, attach, attachUser, resolveActor, sideFilterFor, evaluatePersonalEdit, goalContextFor, noteClientUccEdit, clearUccPending, callerMayWriteClient });
 }

package/src/client-profile/settings.js

@@ -73,6 +73,7 @@ export const DEFAULT_CLIENT_PROFILE_SETTINGS = deepFreeze({
     mf_one_investor: MODES.OFF,
     detail_scope: MODES.OFF,
     ucc_followup: MODES.OFF,
+    own_records_only: MODES.OFF,
   },
   corporate_distributor_types: [],
   house_distributor_codes: [],
@@ -186,6 +187,7 @@ export const CLIENT_PROFILE_SETTING_DESCRIPTIONS = Object.freeze({
   "modes.goal_approval": "Hold partner-added goals until the client approves them.",
   "modes.resolve_by_pan": "Show an existing client instead of a duplicate error when a PAN is found.",
   "modes.mf_one_investor": "Refuse a second MF investor for a person who already has one (D9).",
+  "modes.own_records_only": "A client-app session may write only its own records (one person under one master); anything else is refused.",
   "modes.ucc_followup": "Flag a profile for a UCC update when its client changes UCC details in the app (never pushed by the client).",
   "modes.detail_scope": "A client's full record by id only for callers whose client list includes them; everyone else gets the limited card (R15).",
   "modes.linked_visibility": "Clients reached only through a secondary mapping or a linked user appear in lists, as the limited card.",