@i4e/invest4edu-access-core 0.43.0 → 0.43.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.43.0",
+  "version": "0.43.2",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/client-profile/profile-service.js

@@ -37,7 +37,7 @@ const UCC_RULES_TTL_MS = 60_000;
  *   distributors); without it an employee is never treated as already seeing a client.
  *   `toId` converts ids to the stored type (ObjectId); identity by default.
  */
-export function createClientProfileService({ getDb, getSettings, getSideContext = () => ({}), getVisibilitySets = null, getFieldPolicyIndex = () => new Map(), toId = (v) => v, onAudit = () => {}, emit = null, now = () => new Date() }) {
+export function createClientProfileService({ getDb, getSettings, getSideContext = () => ({}), getVisibilitySets = null, getFieldPolicyIndex = () => new Map(), toId = (v) => v, onAudit = () => {}, emit = null, now = () => new Date(), getSessionContext = () => null }) {
   const db = () => {
     const handle = getDb?.();
     if (!handle) throw new Error("client-profile service: no database handle");
@@ -144,7 +144,15 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     if (!id) return null;
     const user = await db().collection("users").findOne({ _id: id }, { session, projection: { distributor_id: 1, client_id: 1, employee_id: 1, full_record_access: 1 } });
     if (!user) return null;
-    const roles = await roleNamesOf(id, session);
+    // The SESSION decides, not the stored roles: a person who is both a partner and a client has one
+    // user record, and their app login is pinned to the client role in its token while their
+    // portal login carries the partner role. The backend injects `getSessionContext` (its request's
+    // tenant context: the verified token's userId + roles — getTenantStore from
+    // @i4e/invest4edu-access-core/tenant-context, kept out of this module so browser code that
+    // imports client-profile never pulls in async_hooks); used when it is the user being resolved.
+    const ctx = getSessionContext?.() ?? null;
+    const sessionRoles = ctx && ctx.userId != null && String(ctx.userId) === String(userId) && Array.isArray(ctx.roles) && ctx.roles.length ? ctx.roles : null;
+    const roles = sessionRoles ?? await roleNamesOf(id, session);
     const capabilityMap = buildCapabilityMap(await db().collection("rolecapabilities").find({}, { session }).toArray());
     const isClientApp = Boolean(user.client_id) && roles.length > 0 && roles.every((r) => CLIENT_APP_ROLE_NAMES.includes(r));
     return {
@@ -411,5 +419,56 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     }
   }
 
-  return Object.freeze({ findActiveProfilesByPan, findExisting, attach, attachUser, resolveActor, sideFilterFor, evaluatePersonalEdit, goalContextFor, noteClientUccEdit, clearUccPending, callerMayWriteClient });
+  /**
+   * SEC-97 — the caller's access to ONE client, FAIL-CLOSED: `full` | `linked` | `none`. Unlike the
+   * read helpers above (which keep screens working when a lookup breaks), this is for
+   * authorisation: no user, no client, an unknown actor or any error → `none`. A client-app
+   * session reaches only its own records (same master).
+   */
+  async function clientAccessForUser({ userId, clientId, session } = {}) {
+    try {
+      const actor = userId ? await resolveActor(userId, { session }) : null;
+      const cid = toId(clientId);
+      if (!actor || !cid) return { level: ACCESS_LEVELS.NONE, actor };
+      const client = await db().collection(CLIENTS).findOne({ _id: cid }, { session });
+      if (!client) return { level: ACCESS_LEVELS.NONE, actor };
+      if (actor.callerClass === CALLER_CLASSES.CLIENT) {
+        const user = await db().collection("users").findOne({ _id: toId(userId) }, { session, projection: { client_id: 1 } });
+        if (!user?.client_id) return { level: ACCESS_LEVELS.NONE, actor };
+        const master = await db().collection("masterchildclients").findOne({ child_client_ids: user.client_id }, { session, projection: { child_client_ids: 1 } });
+        const own = (master?.child_client_ids?.length ? master.child_client_ids : [user.client_id]).map(String);
+        return { level: own.includes(String(cid)) ? ACCESS_LEVELS.FULL : ACCESS_LEVELS.NONE, actor };
+      }
+      const { userIds = [], sourceDistributorIds = [] } = (getVisibilitySets ? await getVisibilitySets(actor.userId) : null) ?? {};
+      const { level } = clientAccessFor(client, {
+        userIds: [...userIds, actor.userId],
+        sourceDistributorIds,
+        firmDistributorIds: firmIdsOf(actor, sourceDistributorIds),
+        fullRecordAccess: actor.fullRecordAccess,
+        houseDistributorIds: getSideContext().houseDistributorIds,
+      }, getSettings());
+      return { level, actor };
+    } catch (err) {
+      onAudit({ kind: "client_access_refused", client_id: clientId, message: err?.message });
+      return { level: ACCESS_LEVELS.NONE, actor: null };
+    }
+  }
+
+  /**
+   * SEC-96 — the firm a PAN lookup runs for. A PARTNER looks only within their own firm (theirs +
+   * the firms they are RM of, `getVisibilitySets`): any other requested id is replaced by their own
+   * firm, so a corporate can never reach another corporate's profile by naming its id. Anyone else
+   * keeps the firm they name (internal staff act on a partner's behalf).
+   */
+  async function lookupFirmFor({ userId, requestedDistributorId = null, session } = {}) {
+    if (!userId) return requestedDistributorId ?? null;
+    const actor = await resolveActor(userId, { session });
+    if (actor?.callerClass !== CALLER_CLASSES.PARTNER) return requestedDistributorId ?? null;
+    if (!requestedDistributorId) return actor.distributorId ?? null;
+    const { sourceDistributorIds = [] } = (getVisibilitySets ? await getVisibilitySets(actor.userId) : null) ?? {};
+    const allowed = firmIdsOf(actor, sourceDistributorIds).map(String);
+    return allowed.includes(String(requestedDistributorId)) ? requestedDistributorId : actor.distributorId ?? null;
+  }
+
+  return Object.freeze({ findActiveProfilesByPan, findExisting, attach, attachUser, resolveActor, sideFilterFor, evaluatePersonalEdit, goalContextFor, noteClientUccEdit, clearUccPending, callerMayWriteClient, clientAccessForUser, lookupFirmFor });
 }