@7365admin1/core 3.134.0 → 3.135.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/core
 
+## 3.135.0
+
+### Minor Changes
+
+- ab7ea6f: Organisation roles used per site: Members -> Site access also offers the organisation's service roles (no site); every row it writes is stamped `createdBy`, which `siteInvitedPins` reads as "placed at this site", so such a row reaches that site only. Assign Role stamps the same when it gives an organisation role to a site-pinned membership. `GET /roles?scope=organisation` lists only roles with no site (and never self-heals).
+
 ## 3.134.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -327,7 +327,7 @@ declare function useRoleRepo(): {
     getRoleByUserId: (value: string | ObjectId) => Promise<TRole | null>;
     getRoleById: (_id: string | ObjectId) => Promise<TRole | null>;
     getRoleByName: (name: string, type?: string) => Promise<TRole | null>;
-    getRoles: ({ search, page, limit, sort, type, org, site, }: {
+    getRoles: ({ search, page, limit, sort, type, org, site, scope, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
@@ -335,6 +335,8 @@ declare function useRoleRepo(): {
         type?: string | undefined;
         org: string | ObjectId;
         site?: string | ObjectId | undefined;
+        /** "organisation": roles with no site only (ignored when `site` is given) */
+        scope?: string | undefined;
     }) => Promise<{}>;
     getActiveByTypeOrg: (type: string, org: string | ObjectId) => Promise<TRole[]>;
     updateRole: (_id: string | ObjectId, value: TMiniRole, session?: ClientSession) => Promise<ObjectId>;
@@ -505,7 +507,7 @@ declare function useMemberRepo(): {
     updateMemberStatus: (_id: string | ObjectId, value: TMemberUpdateStatus) => Promise<number>;
     countByOrg: (org: string | ObjectId) => Promise<number | TMember>;
     countUserMembershipById: (user: string | ObjectId) => Promise<number | TMember>;
-    updateRoleById: (_id: string | ObjectId, role: string | ObjectId) => Promise<number>;
+    updateRoleById: (_id: string | ObjectId, role: string | ObjectId, createdBy?: string | ObjectId) => Promise<number>;
     reassignRoles: (reassignments: Array<{
         memberId: string;
         roleId: string;
@@ -3235,6 +3237,13 @@ declare function pinKey(org: unknown, site: unknown): string;
  * row to test (the usual case). Staging, 2026-09-28: 4 of 168 pinned
  * org-level-role memberships match, so the stray-`siteId` rule is untouched
  * for the rest.
+ *
+ * Also confined (owner request 2026-09-30, organisation roles used per site): a
+ * pinned row somebody ELSE wrote - `createdBy` set and not the member. Only
+ * Members -> Site access writes that (`member-site-access.service`); the one
+ * other writer, the org owner's own row at onboarding, has `createdBy` = the
+ * owner and no site. So "the owner placed this person at this site" narrows
+ * exactly like "this person was invited to this site".
  */
 declare function siteInvitedPins(db: Db, userId: string, memberships: Array<Record<string, any>>): Promise<Set<string>>;
 /**

package/dist/index.js

@@ -5440,7 +5440,7 @@ function useMemberRepo() {
       throw error;
     }
   }
-  async function updateRoleById(_id, role) {
+  async function updateRoleById(_id, role, createdBy) {
     try {
       _id = new import_mongodb14.ObjectId(_id);
     } catch (error) {
@@ -5456,6 +5456,9 @@ function useMemberRepo() {
         role,
         updatedAt: /* @__PURE__ */ new Date()
       };
+      if (createdBy && import_mongodb14.ObjectId.isValid(String(createdBy))) {
+        updateValue.createdBy = new import_mongodb14.ObjectId(String(createdBy));
+      }
       const res = await collection.updateOne({ _id }, { $set: updateValue });
       if (res.modifiedCount === 0) {
         throw new import_node_server_utils15.InternalServerError("Unable to update feedback status.");
@@ -9928,11 +9931,27 @@ async function siteInvitedPins(db2, userId, memberships) {
   const keys = /* @__PURE__ */ new Set();
   if (!pinned.length || !import_mongodb26.ObjectId.isValid(userId))
     return keys;
+  const both3 = (ids2) => [...new Set(ids2.map(String))].flatMap((v) => [v, new import_mongodb26.ObjectId(v)]);
+  const wanted = new Set(pinned.map((m) => pinKey(m.org, m.siteId)));
+  const placed = await db2.collection("members").find(
+    {
+      user: new import_mongodb26.ObjectId(userId),
+      status: { $ne: "deleted" },
+      org: { $in: both3(pinned.map((m) => m.org)) },
+      siteId: { $in: both3(pinned.map((m) => m.siteId)) },
+      createdBy: { $type: "objectId", $ne: new import_mongodb26.ObjectId(userId) }
+    },
+    { projection: { org: 1, siteId: 1 } }
+  ).toArray();
+  for (const row of placed) {
+    const key = pinKey(row.org, row.siteId);
+    if (wanted.has(key))
+      keys.add(key);
+  }
   const user = await db2.collection("users").findOne({ _id: new import_mongodb26.ObjectId(userId) }, { projection: { email: 1 } });
   const email = String(user?.email ?? "").trim();
   if (!email)
     return keys;
-  const both3 = (ids2) => [...new Set(ids2.map(String))].flatMap((v) => [v, new import_mongodb26.ObjectId(v)]);
   const invites = await db2.collection("verifications").find(
     {
       email,
@@ -9948,7 +9967,6 @@ async function siteInvitedPins(db2, userId, memberships) {
       collation: { locale: "en", strength: 2 }
     }
   ).toArray();
-  const wanted = new Set(pinned.map((m) => pinKey(m.org, m.siteId)));
   for (const invite of invites) {
     const key = pinKey(invite.metadata?.org, invite.metadata?.siteId);
     if (wanted.has(key))
@@ -25792,7 +25810,8 @@ function useRoleRepo() {
     sort = {},
     type = "",
     org = "",
-    site = ""
+    site = "",
+    scope = ""
   }) {
     page2 = page2 > 0 ? page2 - 1 : 0;
     if (org && typeof org === "string" && org.length === 24) {
@@ -25814,6 +25833,9 @@ function useRoleRepo() {
     if (site) {
       query2.$or = [{ site }, { site: "" }, { site: null }];
       cacheOptions.site = site.toString();
+    } else if (scope === "organisation") {
+      query2.site = { $in: ["", null] };
+      cacheOptions.scope = scope;
     }
     sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
     cacheOptions.sort = JSON.stringify(sort);
@@ -28250,7 +28272,9 @@ function useRoleController() {
       limit: import_joi28.default.number().integer().min(1).max(100).allow("", null).default(10),
       type: import_joi28.default.string().optional().allow("", null),
       org: import_joi28.default.string().hex().optional().allow("", null),
-      site: import_joi28.default.string().hex().optional().allow("", null)
+      site: import_joi28.default.string().hex().optional().allow("", null),
+      // "organisation": only the roles with no site (Organization app, service roles made once)
+      scope: import_joi28.default.string().valid("organisation").optional().allow("", null)
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2);
@@ -28265,18 +28289,19 @@ function useRoleController() {
     const type = req.query.type ?? "";
     const org = req.query.org ?? "";
     const site = req.query.site ?? "";
+    const scope = req.query.scope ?? "";
     try {
       if (org) {
         await requireOrgReach(req, org);
       }
-      let data = await _getRoles({ search, page: page2, limit, type, org, site });
-      const listIsWholeOrg = org && !search && !site && page2 === 1;
+      let data = await _getRoles({ search, page: page2, limit, type, org, site, scope });
+      const listIsWholeOrg = org && !search && !site && !scope && page2 === 1;
       const listed = data?.items;
       if (listIsWholeOrg && listed?.length === 0) {
         const seeded = await healDefaultRoles(org).catch(() => 0);
         if (seeded > 0) {
           try {
-            data = await _getRoles({ search, page: page2, limit, type, org, site });
+            data = await _getRoles({ search, page: page2, limit, type, org, site, scope });
           } catch (error2) {
             import_node_server_utils71.logger.log({ level: "error", message: error2.message });
           }
@@ -28724,7 +28749,8 @@ function useMemberService() {
         }
       }
     }
-    await _updateRoleById(id, role);
+    const placedBy = member.siteId && !newRole?.site && callerId5 && import_mongodb60.ObjectId.isValid(callerId5) && String(member.user ?? "") !== callerId5 ? callerId5 : void 0;
+    await _updateRoleById(id, role, placedBy);
     return { message: "Member role updated successfully." };
   }
   async function updateSiteById(id, siteId, siteName) {
@@ -28772,6 +28798,7 @@ function useMemberService() {
 var import_node_server_utils73 = require("@7365admin1/node-server-utils");
 var import_mongodb61 = require("mongodb");
 var EXCLUDED_TYPES = ["resident", PLATFORM_STAFF_MEMBER_TYPE];
+var ORG_ROLE_EXCLUDED = [...EXCLUDED_TYPES, "organization"];
 var both = (id) => [id, new import_mongodb61.ObjectId(id)];
 function useMemberSiteAccessService() {
   const { add, updateMemberStatus, updateRoleById } = useMemberRepo();
@@ -28811,10 +28838,13 @@ function useMemberSiteAccessService() {
     const roles = await db2().collection("roles").find({
       $or: [
         { _id: { $in: roleIds.map((r) => new import_mongodb61.ObjectId(r)) } },
-        { org: { $in: both(org) }, site: { $in: [...sites.keys()].flatMap(both) }, status: "active" }
+        { org: { $in: both(org) }, site: { $in: [...sites.keys()].flatMap(both) }, status: "active" },
+        // organisation-level service roles (no site; never the org-console type)
+        { org: { $in: both(org) }, site: { $in: ["", null] }, status: "active", type: { $nin: ORG_ROLE_EXCLUDED } }
       ]
     }).project({ name: 1, type: 1, site: 1, org: 1, status: 1 }).toArray();
     const byId = new Map(roles.map((r) => [String(r._id), r]));
+    const orgRoles = roles.filter((r) => !String(r.site ?? "") && String(r.org ?? "") === org && r.status === "active" && !ORG_ROLE_EXCLUDED.includes(r.type)).map((r) => ({ _id: String(r._id), name: r.name ?? "", type: r.type ?? "", scope: "organisation" })).sort((a, b) => a.name.localeCompare(b.name));
     const view = (m) => ({
       _id: String(m._id),
       role: String(m.role ?? ""),
@@ -28828,7 +28858,7 @@ function useMemberSiteAccessService() {
         ...s,
         membership: here[0] ?? null,
         memberships: here,
-        roles: roles.filter((r) => String(r.site ?? "") === s.site && String(r.org ?? "") === org && r.status === "active" && !EXCLUDED_TYPES.includes(r.type)).map((r) => ({ _id: String(r._id), name: r.name ?? "", type: r.type ?? "" }))
+        roles: roles.filter((r) => String(r.site ?? "") === s.site && String(r.org ?? "") === org && r.status === "active" && !EXCLUDED_TYPES.includes(r.type)).map((r) => ({ _id: String(r._id), name: r.name ?? "", type: r.type ?? "", scope: "site" })).concat(orgRoles)
       };
     }).sort((a, b) => a.name.localeCompare(b.name));
     const orgWide = members.filter((m) => !String(m.siteId ?? "")).map(view);
@@ -28854,7 +28884,7 @@ function useMemberSiteAccessService() {
         throw new import_node_server_utils73.BadRequestError("A site is listed twice.");
       seen2.add(choice.site);
       if (!row.roles.some((r) => r._id === choice.role)) {
-        throw new import_node_server_utils73.BadRequestError(`Choose a role created for ${row.name || "that site"}.`);
+        throw new import_node_server_utils73.BadRequestError(`Choose a role created for ${row.name || "that site"}, or one of the organisation's service roles.`);
       }
     }
     const userDoc = await db2().collection("users").findOne({ _id: new import_mongodb61.ObjectId(user) }, { projection: { email: 1, name: 1 } });
@@ -28868,10 +28898,11 @@ function useMemberSiteAccessService() {
       const choice = sites.find((c) => c.site === row.site);
       const role = choice ? row.roles.find((r) => r._id === choice.role) : null;
       const keep = role ? row.memberships.find((m) => m.type === role.type) : void 0;
-      if (role && keep && keep.role !== role._id) {
+      if (role && keep && (keep.role !== role._id || role.scope === "organisation")) {
         reroles.push(async () => {
-          await updateRoleById(keep._id, role._id);
-          applied.changed.push(row.site);
+          await updateRoleById(keep._id, role._id, actor);
+          if (keep.role !== role._id)
+            applied.changed.push(row.site);
         });
       } else if (role && !keep) {
         adds.push(async () => {
@@ -28880,7 +28911,7 @@ function useMemberSiteAccessService() {
             { projection: { _id: 1 } }
           );
           if (old) {
-            await updateRoleById(old._id, role._id);
+            await updateRoleById(old._id, role._id, actor);
             await updateMemberStatus(old._id, { status: suspended ? "suspended" : "active" });
           } else {
             await add({
@@ -28894,6 +28925,8 @@ function useMemberSiteAccessService() {
               siteId: row.site,
               siteName: row.name,
               dateInvited: (/* @__PURE__ */ new Date()).toISOString(),
+              // "placed at this site by the editor": confines an organisation role to it (siteInvitedPins)
+              createdBy: actor,
               ...suspended ? { status: "suspended" } : {}
             });
           }