@i4e/invest4edu-access-core 0.42.1 → 0.43.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.42.1",
+  "version": "0.43.1",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/client-profile/profile-service.js

@@ -37,7 +37,7 @@ const UCC_RULES_TTL_MS = 60_000;
  *   distributors); without it an employee is never treated as already seeing a client.
  *   `toId` converts ids to the stored type (ObjectId); identity by default.
  */
-export function createClientProfileService({ getDb, getSettings, getSideContext = () => ({}), getVisibilitySets = null, getFieldPolicyIndex = () => new Map(), toId = (v) => v, onAudit = () => {}, emit = null, now = () => new Date() }) {
+export function createClientProfileService({ getDb, getSettings, getSideContext = () => ({}), getVisibilitySets = null, getFieldPolicyIndex = () => new Map(), toId = (v) => v, onAudit = () => {}, emit = null, now = () => new Date(), getSessionContext = () => null }) {
   const db = () => {
     const handle = getDb?.();
     if (!handle) throw new Error("client-profile service: no database handle");
@@ -56,10 +56,10 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
    * `mode` tells the caller whether to act on it: "enforce" → show the existing client instead
    * of creating; "audit" → carry on as before, the match was only reported.
    */
-  async function findExisting({ pan, profileType, session }) {
+  async function findExisting({ pan, profileType, distributorId = null, session }) {
     const settings = getSettings();
     if (!isEvaluated(settings, "resolve_by_pan")) return { profile: null, mode: "off" };
-    const profile = pickProfileOfType(await findActiveProfilesByPan(pan, { session }), profileType);
+    const profile = pickProfileOfType(await findActiveProfilesByPan(pan, { session }), profileType, { distributorId, settings, ctx: getSideContext() });
     const mode = isEnforced(settings, "resolve_by_pan") ? "enforce" : "audit";
     if (profile && mode === "audit") onAudit({ kind: "resolve_by_pan", client_id: profile._id, profile_type: profileType });
     return { profile, mode };
@@ -144,7 +144,15 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     if (!id) return null;
     const user = await db().collection("users").findOne({ _id: id }, { session, projection: { distributor_id: 1, client_id: 1, employee_id: 1, full_record_access: 1 } });
     if (!user) return null;
-    const roles = await roleNamesOf(id, session);
+    // The SESSION decides, not the stored roles: a person who is both a partner and a client has one
+    // user record, and their app login is pinned to the client role in its token while their
+    // portal login carries the partner role. The backend injects `getSessionContext` (its request's
+    // tenant context: the verified token's userId + roles — getTenantStore from
+    // @i4e/invest4edu-access-core/tenant-context, kept out of this module so browser code that
+    // imports client-profile never pulls in async_hooks); used when it is the user being resolved.
+    const ctx = getSessionContext?.() ?? null;
+    const sessionRoles = ctx && ctx.userId != null && String(ctx.userId) === String(userId) && Array.isArray(ctx.roles) && ctx.roles.length ? ctx.roles : null;
+    const roles = sessionRoles ?? await roleNamesOf(id, session);
     const capabilityMap = buildCapabilityMap(await db().collection("rolecapabilities").find({}, { session }).toArray());
     const isClientApp = Boolean(user.client_id) && roles.length > 0 && roles.every((r) => CLIENT_APP_ROLE_NAMES.includes(r));
     return {

package/src/client-profile/profiles.js

@@ -65,9 +65,25 @@ export function profileTypeForCaller(callerDistributor, settings) {
   return profileTypeFor(callerDistributor, settings);
 }
 
+/** Corporate profiles are one per corporate firm and never shared (settings.corporate). */
+function corporateSiloed(settings) {
+  return settings?.corporate?.one_profile_per_distributor !== false;
+}
+
+/** The side that owns a profile: its primary mapping, else its distributor_id. */
+function primarySideOfProfile(profile, ctx) {
+  return sideKeyOf((profile?.distributor_mappings ?? []).find((m) => m?.is_primary)?.distributor_id ?? profile?.distributor_id, ctx);
+}
+
 /** Of a person's active profiles, the one of this type (oldest first if the data has duplicates). */
-export function pickProfileOfType(profiles = [], profileType) {
-  const ofType = profiles.filter((p) => (p.profile_type ?? PROFILE_TYPES.MAIN) === profileType);
+export function pickProfileOfType(profiles = [], profileType, { distributorId = null, settings, ctx } = {}) {
+  let ofType = profiles.filter((p) => (p.profile_type ?? PROFILE_TYPES.MAIN) === profileType);
+  // A corporate profile belongs to ONE corporate firm: only that firm's own profile is "the existing
+  // one". Another firm (or a caller with no firm) finds nothing and creates its own.
+  if (profileType === PROFILE_TYPES.CORPORATE && corporateSiloed(settings)) {
+    const side = distributorId ? sideKeyOf(distributorId, ctx) : null;
+    ofType = side ? ofType.filter((p) => primarySideOfProfile(p, ctx) === side) : [];
+  }
   ofType.sort((a, b) => new Date(a.created_date ?? 0) - new Date(b.created_date ?? 0));
   return ofType[0] ?? null;
 }
@@ -90,9 +106,13 @@ export function attachDecision({ profile, actor = {}, via, at = new Date(), sett
   if (actor.callerClass === CALLER_CLASSES.PARTNER) {
     const side = sideKeyOf(actor.distributorId, ctx);
     if (side === DIRECT_SIDE) return { kind: "none", reason: "partner_without_firm" };
-    const primarySide = sideKeyOf((profile.distributor_mappings ?? []).find((m) => m?.is_primary)?.distributor_id ?? profile.distributor_id, ctx);
+    const primarySide = primarySideOfProfile(profile, ctx);
     const mapped = side === primarySide || (profile.distributor_mappings ?? []).some((m) => m && m.status !== "inactive" && sideKeyOf(m.distributor_id, ctx) === side);
     if (mapped) return { kind: "none", reason: "already_mapped" };
+    // A corporate profile is its firm's alone: no other firm is ever added to it.
+    if ((profile.profile_type ?? PROFILE_TYPES.MAIN) === PROFILE_TYPES.CORPORATE && corporateSiloed(settings)) {
+      return { kind: "none", reason: "corporate_silo" };
+    }
     return {
       kind: "mapping",
       reason: "new_side",

package/src/client-profile/settings.js

@@ -77,6 +77,12 @@ export const DEFAULT_CLIENT_PROFILE_SETTINGS = deepFreeze({
   },
   corporate_distributor_types: [],
   house_distributor_codes: [],
+  corporate: {
+    // Each corporate distributor holds its OWN profile of a person (one per corporate firm), and
+    // works on it alone: a PAN lookup never surfaces another firm's corporate profile, and no
+    // other firm is ever attached to one.
+    one_profile_per_distributor: true,
+  },
   primary: {
     lock_on_first_order: true,
     ignore_order_statuses: [],
@@ -192,6 +198,7 @@ export const CLIENT_PROFILE_SETTING_DESCRIPTIONS = Object.freeze({
   "modes.detail_scope": "A client's full record by id only for callers whose client list includes them; everyone else gets the limited card (R15).",
   "modes.linked_visibility": "Clients reached only through a secondary mapping or a linked user appear in lists, as the limited card.",
   corporate_distributor_types: "distributors.distributor_type values whose clients get a corporate profile.",
+  "corporate.one_profile_per_distributor": "Each corporate firm has its own, siloed profile of a person: no cross-firm lookup or attach.",
   house_distributor_codes: "Distributor codes treated as direct (InvestValue's own house distributors).",
   "primary.lock_on_first_order": "The first non-ignored order locks the primary distributor.",
   "primary.ignore_order_statuses": "Order statuses that do not count as first business (e.g. cancelled).",