@i4e/invest4edu-access-core 0.43.0 → 0.43.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.43.0",
+  "version": "0.43.1",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/client-profile/profile-service.js

@@ -37,7 +37,7 @@ const UCC_RULES_TTL_MS = 60_000;
  *   distributors); without it an employee is never treated as already seeing a client.
  *   `toId` converts ids to the stored type (ObjectId); identity by default.
  */
-export function createClientProfileService({ getDb, getSettings, getSideContext = () => ({}), getVisibilitySets = null, getFieldPolicyIndex = () => new Map(), toId = (v) => v, onAudit = () => {}, emit = null, now = () => new Date() }) {
+export function createClientProfileService({ getDb, getSettings, getSideContext = () => ({}), getVisibilitySets = null, getFieldPolicyIndex = () => new Map(), toId = (v) => v, onAudit = () => {}, emit = null, now = () => new Date(), getSessionContext = () => null }) {
   const db = () => {
     const handle = getDb?.();
     if (!handle) throw new Error("client-profile service: no database handle");
@@ -144,7 +144,15 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     if (!id) return null;
     const user = await db().collection("users").findOne({ _id: id }, { session, projection: { distributor_id: 1, client_id: 1, employee_id: 1, full_record_access: 1 } });
     if (!user) return null;
-    const roles = await roleNamesOf(id, session);
+    // The SESSION decides, not the stored roles: a person who is both a partner and a client has one
+    // user record, and their app login is pinned to the client role in its token while their
+    // portal login carries the partner role. The backend injects `getSessionContext` (its request's
+    // tenant context: the verified token's userId + roles — getTenantStore from
+    // @i4e/invest4edu-access-core/tenant-context, kept out of this module so browser code that
+    // imports client-profile never pulls in async_hooks); used when it is the user being resolved.
+    const ctx = getSessionContext?.() ?? null;
+    const sessionRoles = ctx && ctx.userId != null && String(ctx.userId) === String(userId) && Array.isArray(ctx.roles) && ctx.roles.length ? ctx.roles : null;
+    const roles = sessionRoles ?? await roleNamesOf(id, session);
     const capabilityMap = buildCapabilityMap(await db().collection("rolecapabilities").find({}, { session }).toArray());
     const isClientApp = Boolean(user.client_id) && roles.length > 0 && roles.every((r) => CLIENT_APP_ROLE_NAMES.includes(r));
     return {