@7365admin1/core 3.55.0 → 3.57.0

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # @iservice365/core
 
+## 3.57.0
+
+### Minor Changes
+
+- 4b1f024: **A new client organisation is now created with its own owner roles.**
+
+  Measured on staging: of 195 live organisations, **74 hold not one role**, and not
+  one of those 74 has a subscription. The paid signup path
+  (`subscription.service.ts createOrgSubscription`) has always seeded two roles
+  named `owner` with `permissions: ["*"]`; the paths that actually create clients
+  today seeded nothing:
+
+  - `POST /organizations` — the Seven365 console creating a client
+  - `POST /organizations/onboarding` — step 1 of the client wizard
+  - `POST /customers` — `customer.service.ts createCustomer`
+
+  An organisation with no role of its own has nothing to invite anybody with,
+  which is why the console's invite picker offers the ORG-LESS templates instead:
+  the shared documents that one console save took every client's modules away with.
+
+  Those three paths now seed the same two roles the paid path already does, from a
+  single definition in `utils/org-default-roles.util.ts`. `subscription.service.ts`
+  is unchanged.
+
+  **NEW ORGANISATIONS ONLY.** Nothing is backfilled, migrated or rewritten. The
+  helper is only ever handed an id that was inserted a moment earlier, and it
+  returns no roles at all when it is handed no organisation — so it cannot produce
+  another org-less shared template. Existing organisations, roles, members and
+  users are untouched, asserted byte-for-byte in
+  `test/e2e/org-default-roles.e2e.test.mjs`.
+
+  `["*"]` is deliberate: it means everything, so a new client is never locked out
+  of anything, and no per-vertical permission catalogue is mirrored server-side to
+  drift out of date with the frontend's.
+
+  Seeding never fails the request that created the organisation. The two
+  controller paths do not run in a transaction, so a failed role insert is logged
+  and the organisation is returned exactly as those endpoints returned it before
+  this change.
+
+## 3.56.0
+
+### Minor Changes
+
+- dc09517: Separate Seven365's roles from a client's, and enforce it on the server
+
+  `role.controller.ts requireRoleOrg` sends every role with no `org` to the staff
+  console gate, on the assumption that org-less means "a platform role". It does
+  not. A role with `type: "organization"` and no `org` is a TEMPLATE that clients
+  are invited with — "Org Owner" is one document behind 119 live members and 320
+  invitations on staging — and the console could rewrite it.
+
+  On 2026-09-07 it did. The console's role editor renders `useAdminPermission`,
+  the eleven PLATFORM resources, and the save wrote all 34 of those strings onto
+  that template. An empty permission list means "everything"
+  (`console-permission.util.ts consoleRoleAllowsAll`), so the role granted
+  everything right up to the moment it held a non-empty list — and the list it
+  then held contained no client module at all. Every holder, in every client, lost
+  every module at once.
+
+  `role-scope.util.ts` adds the missing distinction — platform (`type: "admin"`),
+  client template (no `org`), client (`org` set) — and two refusals built on it:
+
+  - the four role WRITES refuse a shared client template outright. Reads are
+    untouched: 119 members read that role on every session, and refusing them is
+    the same outage from the other direction.
+  - `createRole`, `updateRole` and `updatePermissionsById` refuse a console
+    permission string being ADDED to a role that is not a platform role. Strings
+    already stored pass through, so no save that works today begins to fail —
+    including the 114 org roles whose `subscriptions:*` grants are a
+    resource-NAME collision with the console's, not a platform grant.
+
+  No document is written, migrated or classified. `tools/role-scope-lockout-check`
+  measures the change from the account side, per account type, the way org-api
+  #470 does for site scoping: 400 staging accounts across 12 types, **zero
+  refusals in every type**, and zero roles that could no longer be re-saved.
+
 ## 3.55.0
 
 ### Minor Changes