abmp-npm 2.0.85 → 2.0.86

package/backend/association-expiry.js

@@ -2,6 +2,7 @@
 // cannot drift on what "expired" means. Deliberately free of Wix imports.
 
 const ASSOCIATION_EXPIRATION_FIELD = 'associationExpiration';
+const PAC_STAFF_MEMBERTYPE = 'PAC STAFF';
 const ASSOCIATION_TIME_ZONE = 'America/Denver';
 
 const EXPIRATION_DATE_PATTERN = /^(\d{4})-(\d{2})-(\d{2})/;
@@ -128,7 +129,20 @@ const isAssociationExpirationCurrent = (member, now) => {
   return expiration.getTime() >= getTodayInAssociationTimeZone(now).getTime();
 };
 
+// PAC staff accounts carry a rolling "expiration" equal to the date of the feed that last mentioned
+// them, so the association gate would lock a staff member out on any day the feed did not resend
+// them (ticket 13031107600). Staff are already excluded from the directory and have no public
+// profile; login is the one place the gate reaches them, and it should not.
+const isPacStaff = member =>
+  Array.isArray(member?.memberships) &&
+  member.memberships.some(membership => membership?.membertype === PAC_STAFF_MEMBERTYPE);
+
+const isLoginAllowedByExpiration = (member, now) =>
+  isPacStaff(member) || isAssociationExpirationCurrent(member, now);
+
 module.exports = {
+  isPacStaff,
+  isLoginAllowedByExpiration,
   parseExpirationToUtcDate,
   classifyAssociationExpiration,
   resolveAssociationExpiration,

package/backend/login/sso-methods.js

@@ -3,7 +3,7 @@ const { createHmac } = require('crypto');
 const axios = require('axios');
 const { decode } = require('jwt-js-decode');
 
-const { isAssociationExpirationCurrent } = require('../association-expiry');
+const { isLoginAllowedByExpiration } = require('../association-expiry');
 const { CONFIG_KEYS, SSO_TOKEN_AUTH_API_URL, LOGIN_REFUSAL_REASONS } = require('../consts');
 const { MEMBER_ACTIONS } = require('../daily-pull/consts');
 const { getCurrentMember } = require('../members-area-methods');
@@ -80,7 +80,7 @@ async function validateMemberToken(memberIdInput) {
       return invalidTokenResponse;
     }
 
-    if (!isAssociationExpirationCurrent(memberData)) {
+    if (!isLoginAllowedByExpiration(memberData)) {
       console.log(
         `[validateMemberToken] association membership expired for memberId ${memberData.memberId}`
       );

package/backend/members-data-methods.js

@@ -1,7 +1,7 @@
 const { COLLECTIONS } = require('../public/consts');
 const { isWixHostedImage, emailsMatch, normalizeEmail } = require('../public/Utils/sharedUtils');
 
-const { isAssociationExpirationCurrent } = require('./association-expiry');
+const { isLoginAllowedByExpiration } = require('./association-expiry');
 const { MEMBERSHIPS_TYPES, LOGIN_REFUSAL_REASONS } = require('./consts');
 const { createSiteContact } = require('./contacts-methods');
 const { MEMBER_ACTIONS } = require('./daily-pull/consts');
@@ -701,7 +701,7 @@ async function prepareMemberForSSOLogin(data) {
     if (!memberData) {
       throw new Error(`Member data not found for memberId ${memberId}`);
     }
-    if (!isAssociationExpirationCurrent(memberData)) {
+    if (!isLoginAllowedByExpiration(memberData)) {
       console.log(
         `[prepareMemberForSSOLogin] refusing login, association membership expired for memberId ${memberId}`
       );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abmp-npm",
-  "version": "2.0.85",
+  "version": "2.0.86",
   "main": "index.js",
   "files": [
     "index.js",