@i4e/invest4edu-access-core 0.42.0 → 0.42.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/client-profile/profile-service.js

@@ -128,7 +128,10 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
   async function roleNamesOf(userId, session) {
     const maps = await db().collection("userentitymappings").find({ user_id: userId, status: { $ne: 0 }, role_id: { $ne: null } }, { session, projection: { role_id: 1 } }).toArray();
     if (!maps.length) return [];
-    const roles = await db().collection("roles").find({ _id: { $in: maps.map((m) => m.role_id) } }, { session, projection: { role_name: 1 } }).toArray();
+    // role_id is an ARRAY on real mappings; `$in` must get the role ids themselves, not the arrays
+    // (an array inside `$in` only matches an equal array, so every caller read as role-less).
+    const roleIds = maps.flatMap((m) => (Array.isArray(m.role_id) ? m.role_id : [m.role_id])).filter(Boolean);
+    const roles = await db().collection("roles").find({ _id: { $in: roleIds } }, { session, projection: { role_name: 1 } }).toArray();
     return roles.map((r) => r.role_name).filter(Boolean);
   }