piper-utils 1.1.68 → 1.1.70

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "piper-utils",
-    "version": "1.1.68",
+    "version": "1.1.70",
     "description": "Utility library for Piper",
     "main": "bin/main.js",
     "scripts": {

package/src/database/dbUtils/partnerAccess/accessScope.js

@@ -2,25 +2,35 @@ import _ from 'lodash';
 import { ensurePartnerScope } from './accessContext.js';
 import { errorList } from '../../../requestResponse/errorCodes.js';
 
+// `requested` is the caller-supplied businessIds array (what the route extracts via
+// getRequestedBusinessIds(event)). Empty array = no explicit filter (back-compat path).
+// When non-empty it is intersected against the role's allowed set so a user can never
+// widen their scope past what their role permits by passing a query-string businessId.
+
 /**
  * Scope a WHERE clause to the partner's own business (partnerBusinessId).
  * Use for "mine" resources: deal, activity, application, template.
  *
- *   global   → deletes where.businessId (super sees everything)
- *   partner  → sets where.businessId = partnerBusinessId
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → requested ? [partnerBusinessId] ∩ requested : where.businessId = partnerBusinessId
  *              throws partnerNotConfigured if partnerBusinessId is missing
  *   standard → no-op (createFilters already handled)
  *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
  * @param {{ getPartnerById: Function }} deps
  */
-export async function scopeToOwnBusiness(where, access, { getPartnerById } = {}) {
+export async function scopeToOwnBusiness(where, access, requested = [], { getPartnerById } = {}) {
     if (!access) {
         throw errorList.unauthorized;
     }
     if (access.level === 'global') {
-        delete where.businessId;
+        if (requested.length) {
+            where.businessId = requested;
+        } else {
+            delete where.businessId;
+        }
         return;
     }
     if (access.level === 'partner') {
@@ -28,7 +38,11 @@ export async function scopeToOwnBusiness(where, access, { getPartnerById } = {})
         if (!access.partnerBusinessId) {
             throw errorList.partnerNotConfigured;
         }
-        where.businessId = access.partnerBusinessId;
+        if (requested.length) {
+            where.businessId = _.intersection([access.partnerBusinessId], requested);
+        } else {
+            where.businessId = access.partnerBusinessId;
+        }
         return;
     }
     // standard → no-op (createFilters already injected from JWT)
@@ -38,25 +52,32 @@ export async function scopeToOwnBusiness(where, access, { getPartnerById } = {})
  * Scope a WHERE clause to the partner's portfolio (businessIds array).
  * Use for "book" resources (future transaction lists, merchant inbox views).
  *
- *   global   → deletes where.businessId
- *   partner  → sets where.businessId = businessIds[]
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → requested ? businessIds ∩ requested : where.businessId = businessIds[]
+ *              (own business is intentionally excluded — book is portfolio only)
  *   standard → no-op
  *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
  * @param {{ getPartnerById: Function }} deps
  */
-export async function scopeToPartnerBook(where, access, { getPartnerById } = {}) {
+export async function scopeToPartnerBook(where, access, requested = [], { getPartnerById } = {}) {
     if (!access) {
         throw errorList.unauthorized;
     }
     if (access.level === 'global') {
-        delete where.businessId;
+        if (requested.length) {
+            where.businessId = requested;
+        } else {
+            delete where.businessId;
+        }
         return;
     }
     if (access.level === 'partner') {
         await ensurePartnerScope(access, { getPartnerById });
-        where.businessId = access.businessIds || [];
+        const allowed = access.businessIds || [];
+        where.businessId = requested.length ? _.intersection(allowed, requested) : allowed;
         return;
     }
     // standard → no-op
@@ -66,34 +87,42 @@ export async function scopeToPartnerBook(where, access, { getPartnerById } = {})
  * Scope to the union of partnerBusinessId + businessIds.
  * Use for tickets — partner sees own tickets + portfolio merchants' tickets.
  *
- *   global   → deletes where.businessId
- *   partner  → sets where.businessId = [partnerBusinessId, ...businessIds]
- *   standard → sets where.businessId = access.businessIds
+ *   global   → requested ? where.businessId = requested : deletes where.businessId
+ *   partner  → allowed = uniq([partnerBusinessId, ...businessIds]);
+ *              requested ? allowed ∩ requested : where.businessId = allowed
+ *   standard → allowed = businessIds;
+ *              requested ? allowed ∩ requested : where.businessId = allowed
  *              (explicitly handled here because ticket routes may not call
  *               createFilters before scoping, e.g. delete/resolve handlers)
  *
- * @param {object} where  - Sequelize WHERE clause to mutate.
- * @param {object} access - Access object from resolveAccess.
+ * @param {object} where     - Sequelize WHERE clause to mutate.
+ * @param {object} access    - Access object from resolveAccess.
+ * @param {string[]} [requested] - Explicit businessIds from the query string.
  * @param {{ getPartnerById: Function }} deps
  */
-export async function scopeToBookUnionOwn(where, access, { getPartnerById } = {}) {
+export async function scopeToBookUnionOwn(where, access, requested = [], { getPartnerById } = {}) {
     if (!access) {
         throw errorList.unauthorized;
     }
     if (access.level === 'global') {
-        delete where.businessId;
+        if (requested.length) {
+            where.businessId = requested;
+        } else {
+            delete where.businessId;
+        }
         return;
     }
     if (access.level === 'partner') {
         await ensurePartnerScope(access, { getPartnerById });
-        const ids = _.uniq(
+        const allowed = _.uniq(
             [access.partnerBusinessId, ...(access.businessIds || [])].filter(Boolean)
         );
-        where.businessId = ids;
+        where.businessId = requested.length ? _.intersection(allowed, requested) : allowed;
         return;
     }
     if (access.level === 'standard') {
-        where.businessId = access.businessIds;
+        const allowed = access.businessIds || [];
+        where.businessId = requested.length ? _.intersection(allowed, requested) : allowed;
         return;
     }
 }

package/src/database/dbUtils/partnerAccess/accessScope.test.js

@@ -0,0 +1,287 @@
+import {
+    scopeToOwnBusiness,
+    scopeToPartnerBook,
+    scopeToBookUnionOwn
+} from './accessScope.js';
+import { errorList } from '../../../requestResponse/errorCodes.js';
+
+// Why these tests exist
+// ---------------------
+// The three scope helpers were rewritten to accept an explicit `requested`
+// businessIds array from the caller's query string, and to intersect that
+// against the role's allowed set instead of unconditionally overwriting
+// where.businessId. The header "My Business" filter for super users depends
+// on the new intersection — these tests pin the contract.
+//
+// "requested" is what the route handler extracts via getRequestedBusinessIds(event)
+// and forwards. Empty array = no explicit filter (back-compat path).
+
+describe('accessScope helpers', () => {
+
+    describe('scopeToBookUnionOwn — global (super)', () => {
+        it('deletes where.businessId when no explicit filter is requested', async () => {
+            // Arrange — super with no header pick → caller sends nothing
+            const where = { businessId: 'pre-existing-set-by-createFilters', active: true };
+            const access = { level: 'global' };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, []);
+
+            // Assert — businessId stripped so the query is unconstrained;
+            // unrelated keys (active) survive
+            expect(where.businessId).toBeUndefined();
+            expect(where.active).toBe(true);
+        });
+
+        it('honors the requested businessIds when super passes them explicitly', async () => {
+            // Arrange — super picked business "X" in the header pill
+            const where = {};
+            const access = { level: 'global' };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, ['X']);
+
+            // Assert — backend respects the explicit filter (the symptom from
+            // the user-reported "Deals list doesn't filter to My Business" bug)
+            expect(where.businessId).toEqual(['X']);
+        });
+    });
+
+    describe('scopeToBookUnionOwn — partner', () => {
+        it('returns the full union when no explicit filter is requested', async () => {
+            // Arrange — partner with own=O and portfolio=[A, B]; pre-resolved scope
+            const where = {};
+            const access = {
+                level: 'partner',
+                partnerBusinessId: 'O',
+                businessIds: ['A', 'B']
+            };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, []);
+
+            // Assert — union preserved (own + portfolio, unique)
+            expect(where.businessId).toEqual(['O', 'A', 'B']);
+        });
+
+        it('intersects requested with the union when partner filters explicitly', async () => {
+            // Arrange — partner asks for A only, A is in portfolio
+            const where = {};
+            const access = {
+                level: 'partner',
+                partnerBusinessId: 'O',
+                businessIds: ['A', 'B']
+            };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, ['A']);
+
+            // Assert — only the requested+allowed entry survives
+            expect(where.businessId).toEqual(['A']);
+        });
+
+        it('returns empty when requested business is outside the partner union', async () => {
+            // Arrange — partner asks for Z which is not in own or portfolio
+            const where = {};
+            const access = {
+                level: 'partner',
+                partnerBusinessId: 'O',
+                businessIds: ['A', 'B']
+            };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, ['Z']);
+
+            // Assert — empty array → IN () → silent zero rows. Intentional;
+            // confirms a partner can't sneak past their scope via query param.
+            expect(where.businessId).toEqual([]);
+        });
+
+        it('lazy-loads partnerBusinessId/businessIds via getPartnerById on first call', async () => {
+            // Arrange — access is "fresh" (nulls), like resolveAccess hands out
+            const where = {};
+            const access = { level: 'partner', partnerId: 'p1', partnerBusinessId: null, businessIds: null };
+            const getPartnerById = jasmine.createSpy('getPartnerById').and.resolveTo({
+                partnerBusinessId: 'O',
+                businessIds: ['A']
+            });
+
+            // Act
+            await scopeToBookUnionOwn(where, access, [], { getPartnerById });
+
+            // Assert — DB hit happened and where.businessId is the resolved union
+            expect(getPartnerById).toHaveBeenCalledWith('p1');
+            expect(where.businessId).toEqual(['O', 'A']);
+        });
+    });
+
+    describe('scopeToBookUnionOwn — standard (merchant)', () => {
+        it('falls back to access.businessIds when no explicit filter is requested', async () => {
+            // Arrange — standard merchant has JWT businesses S1, S2
+            const where = {};
+            const access = { level: 'standard', businessIds: ['S1', 'S2'] };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, []);
+
+            // Assert
+            expect(where.businessId).toEqual(['S1', 'S2']);
+        });
+
+        it('intersects requested with JWT businesses when standard filters explicitly', async () => {
+            // Arrange — merchant asks for S1 (in their JWT)
+            const where = {};
+            const access = { level: 'standard', businessIds: ['S1', 'S2'] };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, ['S1']);
+
+            // Assert
+            expect(where.businessId).toEqual(['S1']);
+        });
+
+        it('returns empty when standard asks for a business outside their JWT', async () => {
+            // Arrange — IDOR attempt: merchant on S1 asks for someone else's business "X"
+            const where = {};
+            const access = { level: 'standard', businessIds: ['S1', 'S2'] };
+
+            // Act
+            await scopeToBookUnionOwn(where, access, ['X']);
+
+            // Assert — empty result, no cross-tenant leak
+            expect(where.businessId).toEqual([]);
+        });
+    });
+
+    describe('scopeToBookUnionOwn — defensive', () => {
+        it('throws unauthorized when access is null', async () => {
+            // Arrange — never expected to happen, but guard rather than corrupt the query
+            let thrown;
+
+            // Act
+            try {
+                await scopeToBookUnionOwn({}, null, []);
+            } catch (e) {
+                thrown = e;
+            }
+
+            // Assert
+            expect(thrown).toBe(errorList.unauthorized);
+        });
+    });
+
+    describe('scopeToOwnBusiness', () => {
+        it('sets where.businessId to partnerBusinessId for partners (no explicit filter)', async () => {
+            // Arrange
+            const where = {};
+            const access = { level: 'partner', partnerBusinessId: 'O', businessIds: ['A'] };
+
+            // Act
+            await scopeToOwnBusiness(where, access, []);
+
+            // Assert — own resource scope is single-value, not union
+            expect(where.businessId).toBe('O');
+        });
+
+        it('intersects requested with the partner own businessId', async () => {
+            // Arrange — partner asks for "O" (their own) — valid
+            const where = {};
+            const access = { level: 'partner', partnerBusinessId: 'O', businessIds: ['A'] };
+
+            // Act
+            await scopeToOwnBusiness(where, access, ['O']);
+
+            // Assert — intersection ['O'] ∩ ['O'] = ['O']
+            expect(where.businessId).toEqual(['O']);
+        });
+
+        it('returns empty when requested business is not the partner own', async () => {
+            // Arrange — partner asks for portfolio business "A" but this is the OWN scope
+            const where = {};
+            const access = { level: 'partner', partnerBusinessId: 'O', businessIds: ['A'] };
+
+            // Act
+            await scopeToOwnBusiness(where, access, ['A']);
+
+            // Assert — own scope rejects even valid-for-them businesses outside "own"
+            expect(where.businessId).toEqual([]);
+        });
+
+        it('throws partnerNotConfigured when partnerBusinessId is missing', async () => {
+            // Arrange — bad partner setup: portfolio set but no own businessId.
+            // Threw originally too, but now after the new requested param flows through.
+            const where = {};
+            const access = { level: 'partner', partnerBusinessId: null, businessIds: ['A'] };
+            let thrown;
+
+            // Act
+            try {
+                await scopeToOwnBusiness(where, access, []);
+            } catch (e) {
+                thrown = e;
+            }
+
+            // Assert
+            expect(thrown).toBe(errorList.partnerNotConfigured);
+        });
+
+        it('global with explicit request → where.businessId = requested', async () => {
+            // Arrange
+            const where = {};
+
+            // Act
+            await scopeToOwnBusiness(where, { level: 'global' }, ['X']);
+
+            // Assert
+            expect(where.businessId).toEqual(['X']);
+        });
+
+        it('global with no request → where.businessId deleted', async () => {
+            // Arrange
+            const where = { businessId: 'stale' };
+
+            // Act
+            await scopeToOwnBusiness(where, { level: 'global' }, []);
+
+            // Assert
+            expect(where.businessId).toBeUndefined();
+        });
+    });
+
+    describe('scopeToPartnerBook', () => {
+        it('returns full portfolio for partners with no explicit request', async () => {
+            // Arrange
+            const where = {};
+            const access = { level: 'partner', partnerBusinessId: 'O', businessIds: ['A', 'B'] };
+
+            // Act
+            await scopeToPartnerBook(where, access, []);
+
+            // Assert — book is portfolio only (no own)
+            expect(where.businessId).toEqual(['A', 'B']);
+        });
+
+        it('intersects requested with portfolio (excludes partner own)', async () => {
+            // Arrange — partner asks for "O" (own) and "A" (portfolio)
+            const where = {};
+            const access = { level: 'partner', partnerBusinessId: 'O', businessIds: ['A', 'B'] };
+
+            // Act
+            await scopeToPartnerBook(where, access, ['O', 'A']);
+
+            // Assert — book scope drops "own" even when explicitly requested
+            expect(where.businessId).toEqual(['A']);
+        });
+
+        it('global no request → deletes where.businessId', async () => {
+            // Arrange
+            const where = { businessId: 'stale' };
+
+            // Act
+            await scopeToPartnerBook(where, { level: 'global' }, []);
+
+            // Assert
+            expect(where.businessId).toBeUndefined();
+        });
+    });
+});

package/src/database/dbUtils/partnerAccess/createAccessHelpers.js

@@ -1,38 +1,38 @@
-import { ensurePartnerScope } from './accessContext.js';
-import { scopeToOwnBusiness, scopeToPartnerBook, scopeToBookUnionOwn } from './accessScope.js';
-import {
-    assertCanWriteOwnBusiness,
-    assertCanWriteBookBusiness,
-    assertCanWriteBookUnionOwn,
-    stampOwnBusinessId
-} from './accessWrites.js';
-
-/**
- * Factory that pre-binds getPartnerById into all scope/assert/stamp helpers.
- * Bind once at module level, then call without repeating the injection:
- *
- *   import { createAccessHelpers } from 'piper-utils';
- *   import { getPartnerById } from '../partner/partner.js';
- *
- *   const {
- *       scopeToOwnBusiness,
- *       stampOwnBusinessId,
- *       assertCanWriteOwnBusiness
- *   } = createAccessHelpers({ getPartnerById });
- *
- * @param {{ getPartnerById: Function }} deps
- * @returns {object} Pre-bound helpers.
- */
-export function createAccessHelpers({ getPartnerById }) {
-    const deps = { getPartnerById };
-    return {
-        ensurePartnerScope: (access) => ensurePartnerScope(access, deps),
-        scopeToOwnBusiness: (where, access) => scopeToOwnBusiness(where, access, deps),
-        scopeToPartnerBook: (where, access) => scopeToPartnerBook(where, access, deps),
-        scopeToBookUnionOwn: (where, access) => scopeToBookUnionOwn(where, access, deps),
-        assertCanWriteOwnBusiness: (access, businessId) => assertCanWriteOwnBusiness(access, businessId, deps),
-        assertCanWriteBookBusiness: (access, businessId) => assertCanWriteBookBusiness(access, businessId, deps),
-        assertCanWriteBookUnionOwn: (access, businessId) => assertCanWriteBookUnionOwn(access, businessId, deps),
-        stampOwnBusinessId: (access, body) => stampOwnBusinessId(access, body, deps)
-    };
-}
+import { ensurePartnerScope } from './accessContext.js';
+import { scopeToOwnBusiness, scopeToPartnerBook, scopeToBookUnionOwn } from './accessScope.js';
+import {
+    assertCanWriteOwnBusiness,
+    assertCanWriteBookBusiness,
+    assertCanWriteBookUnionOwn,
+    stampOwnBusinessId
+} from './accessWrites.js';
+
+/**
+ * Factory that pre-binds getPartnerById into all scope/assert/stamp helpers.
+ * Bind once at module level, then call without repeating the injection:
+ *
+ *   import { createAccessHelpers } from 'piper-utils';
+ *   import { getPartnerById } from '../partner/partner.js';
+ *
+ *   const {
+ *       scopeToOwnBusiness,
+ *       stampOwnBusinessId,
+ *       assertCanWriteOwnBusiness
+ *   } = createAccessHelpers({ getPartnerById });
+ *
+ * @param {{ getPartnerById: Function }} deps
+ * @returns {object} Pre-bound helpers.
+ */
+export function createAccessHelpers({ getPartnerById }) {
+    const deps = { getPartnerById };
+    return {
+        ensurePartnerScope: (access) => ensurePartnerScope(access, deps),
+        scopeToOwnBusiness: (where, access, requested) => scopeToOwnBusiness(where, access, requested, deps),
+        scopeToPartnerBook: (where, access, requested) => scopeToPartnerBook(where, access, requested, deps),
+        scopeToBookUnionOwn: (where, access, requested) => scopeToBookUnionOwn(where, access, requested, deps),
+        assertCanWriteOwnBusiness: (access, businessId) => assertCanWriteOwnBusiness(access, businessId, deps),
+        assertCanWriteBookBusiness: (access, businessId) => assertCanWriteBookBusiness(access, businessId, deps),
+        assertCanWriteBookUnionOwn: (access, businessId) => assertCanWriteBookUnionOwn(access, businessId, deps),
+        stampOwnBusinessId: (access, body) => stampOwnBusinessId(access, body, deps)
+    };
+}