@7365admin1/core 3.55.0 → 3.56.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @iservice365/core
 
+## 3.56.0
+
+### Minor Changes
+
+- dc09517: Separate Seven365's roles from a client's, and enforce it on the server
+
+  `role.controller.ts requireRoleOrg` sends every role with no `org` to the staff
+  console gate, on the assumption that org-less means "a platform role". It does
+  not. A role with `type: "organization"` and no `org` is a TEMPLATE that clients
+  are invited with — "Org Owner" is one document behind 119 live members and 320
+  invitations on staging — and the console could rewrite it.
+
+  On 2026-09-07 it did. The console's role editor renders `useAdminPermission`,
+  the eleven PLATFORM resources, and the save wrote all 34 of those strings onto
+  that template. An empty permission list means "everything"
+  (`console-permission.util.ts consoleRoleAllowsAll`), so the role granted
+  everything right up to the moment it held a non-empty list — and the list it
+  then held contained no client module at all. Every holder, in every client, lost
+  every module at once.
+
+  `role-scope.util.ts` adds the missing distinction — platform (`type: "admin"`),
+  client template (no `org`), client (`org` set) — and two refusals built on it:
+
+  - the four role WRITES refuse a shared client template outright. Reads are
+    untouched: 119 members read that role on every session, and refusing them is
+    the same outage from the other direction.
+  - `createRole`, `updateRole` and `updatePermissionsById` refuse a console
+    permission string being ADDED to a role that is not a platform role. Strings
+    already stored pass through, so no save that works today begins to fail —
+    including the 114 org roles whose `subscriptions:*` grants are a
+    resource-NAME collision with the console's, not a platform grant.
+
+  No document is written, migrated or classified. `tools/role-scope-lockout-check`
+  measures the change from the account side, per account type, the way org-api
+  #470 does for site scoping: 400 staging accounts across 12 types, **zero
+  refusals in every type**, and zero roles that could no longer be re-saved.
+
 ## 3.55.0
 
 ### Minor Changes