@i4e/invest4edu-access-core 0.43.1 → 0.43.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.43.1",
+  "version": "0.43.3",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/client-profile/profile-service.js

@@ -76,7 +76,9 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     if (!isEvaluated(settings, "attach")) return { attached: false, kind: "none", reason: "mode_off" };
     const profile = await db().collection(CLIENTS).findOne(
       { _id: clientId },
-      { session, projection: { distributor_id: 1, distributor_mappings: 1, linked_users: 1 } },
+      // profile_type is what the corporate silo in attachDecision reads — without it every profile
+      // looked like a main one and another firm could be attached to a corporate profile.
+      { session, projection: { distributor_id: 1, distributor_mappings: 1, linked_users: 1, profile_type: 1 } },
     );
     const decision = attachDecision({ profile, actor, via, at: now(), settings, ctx: getSideContext(), stamps });
     if (decision.kind === "none") return { attached: false, ...decision };
@@ -419,5 +421,56 @@ export function createClientProfileService({ getDb, getSettings, getSideContext
     }
   }
 
-  return Object.freeze({ findActiveProfilesByPan, findExisting, attach, attachUser, resolveActor, sideFilterFor, evaluatePersonalEdit, goalContextFor, noteClientUccEdit, clearUccPending, callerMayWriteClient });
+  /**
+   * SEC-97 — the caller's access to ONE client, FAIL-CLOSED: `full` | `linked` | `none`. Unlike the
+   * read helpers above (which keep screens working when a lookup breaks), this is for
+   * authorisation: no user, no client, an unknown actor or any error → `none`. A client-app
+   * session reaches only its own records (same master).
+   */
+  async function clientAccessForUser({ userId, clientId, session } = {}) {
+    try {
+      const actor = userId ? await resolveActor(userId, { session }) : null;
+      const cid = toId(clientId);
+      if (!actor || !cid) return { level: ACCESS_LEVELS.NONE, actor };
+      const client = await db().collection(CLIENTS).findOne({ _id: cid }, { session });
+      if (!client) return { level: ACCESS_LEVELS.NONE, actor };
+      if (actor.callerClass === CALLER_CLASSES.CLIENT) {
+        const user = await db().collection("users").findOne({ _id: toId(userId) }, { session, projection: { client_id: 1 } });
+        if (!user?.client_id) return { level: ACCESS_LEVELS.NONE, actor };
+        const master = await db().collection("masterchildclients").findOne({ child_client_ids: user.client_id }, { session, projection: { child_client_ids: 1 } });
+        const own = (master?.child_client_ids?.length ? master.child_client_ids : [user.client_id]).map(String);
+        return { level: own.includes(String(cid)) ? ACCESS_LEVELS.FULL : ACCESS_LEVELS.NONE, actor };
+      }
+      const { userIds = [], sourceDistributorIds = [] } = (getVisibilitySets ? await getVisibilitySets(actor.userId) : null) ?? {};
+      const { level } = clientAccessFor(client, {
+        userIds: [...userIds, actor.userId],
+        sourceDistributorIds,
+        firmDistributorIds: firmIdsOf(actor, sourceDistributorIds),
+        fullRecordAccess: actor.fullRecordAccess,
+        houseDistributorIds: getSideContext().houseDistributorIds,
+      }, getSettings());
+      return { level, actor };
+    } catch (err) {
+      onAudit({ kind: "client_access_refused", client_id: clientId, message: err?.message });
+      return { level: ACCESS_LEVELS.NONE, actor: null };
+    }
+  }
+
+  /**
+   * SEC-96 — the firm a PAN lookup runs for. A PARTNER looks only within their own firm (theirs +
+   * the firms they are RM of, `getVisibilitySets`): any other requested id is replaced by their own
+   * firm, so a corporate can never reach another corporate's profile by naming its id. Anyone else
+   * keeps the firm they name (internal staff act on a partner's behalf).
+   */
+  async function lookupFirmFor({ userId, requestedDistributorId = null, session } = {}) {
+    if (!userId) return requestedDistributorId ?? null;
+    const actor = await resolveActor(userId, { session });
+    if (actor?.callerClass !== CALLER_CLASSES.PARTNER) return requestedDistributorId ?? null;
+    if (!requestedDistributorId) return actor.distributorId ?? null;
+    const { sourceDistributorIds = [] } = (getVisibilitySets ? await getVisibilitySets(actor.userId) : null) ?? {};
+    const allowed = firmIdsOf(actor, sourceDistributorIds).map(String);
+    return allowed.includes(String(requestedDistributorId)) ? requestedDistributorId : actor.distributorId ?? null;
+  }
+
+  return Object.freeze({ findActiveProfilesByPan, findExisting, attach, attachUser, resolveActor, sideFilterFor, evaluatePersonalEdit, goalContextFor, noteClientUccEdit, clearUccPending, callerMayWriteClient, clientAccessForUser, lookupFirmFor });
 }