@7365admin1/core 3.56.0 → 3.58.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # @iservice365/core
 
+## 3.58.0
+
+### Minor Changes
+
+- f20014d: Allow a Seven365 platform admin to restore a shared client role template to allow-all.
+
+  The role-scope guard refuses every write to an org-less client template. That is correct for
+  preventing the 2026-09-07 outage and it left no way to repair one: "Org Owner" still holds the 34
+  platform permission strings and the guard refuses the write that would give its members their
+  modules back.
+
+  `refuseSharedClientTemplate` now takes the permission list the write would store and permits it when
+  that list MEANS EVERYTHING (`["*"]` or `[]`). Every other list stays refused with the same message,
+  including the 34 strings and including a hand-built superset — a template has no editor that draws
+  the right catalogue, and an equal-set write is the broken state being re-saved. The restore is only
+  reachable after the existing staff console check, and is recorded with actor, role and before/after.
+
+## 3.57.0
+
+### Minor Changes
+
+- 4b1f024: **A new client organisation is now created with its own owner roles.**
+
+  Measured on staging: of 195 live organisations, **74 hold not one role**, and not
+  one of those 74 has a subscription. The paid signup path
+  (`subscription.service.ts createOrgSubscription`) has always seeded two roles
+  named `owner` with `permissions: ["*"]`; the paths that actually create clients
+  today seeded nothing:
+
+  - `POST /organizations` — the Seven365 console creating a client
+  - `POST /organizations/onboarding` — step 1 of the client wizard
+  - `POST /customers` — `customer.service.ts createCustomer`
+
+  An organisation with no role of its own has nothing to invite anybody with,
+  which is why the console's invite picker offers the ORG-LESS templates instead:
+  the shared documents that one console save took every client's modules away with.
+
+  Those three paths now seed the same two roles the paid path already does, from a
+  single definition in `utils/org-default-roles.util.ts`. `subscription.service.ts`
+  is unchanged.
+
+  **NEW ORGANISATIONS ONLY.** Nothing is backfilled, migrated or rewritten. The
+  helper is only ever handed an id that was inserted a moment earlier, and it
+  returns no roles at all when it is handed no organisation — so it cannot produce
+  another org-less shared template. Existing organisations, roles, members and
+  users are untouched, asserted byte-for-byte in
+  `test/e2e/org-default-roles.e2e.test.mjs`.
+
+  `["*"]` is deliberate: it means everything, so a new client is never locked out
+  of anything, and no per-vertical permission catalogue is mirrored server-side to
+  drift out of date with the frontend's.
+
+  Seeding never fails the request that created the organisation. The two
+  controller paths do not run in a transaction, so a failed role insert is logged
+  and the organisation is returned exactly as those endpoints returned it before
+  this change.
+
 ## 3.56.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -11713,7 +11713,7 @@ declare function MHidAmicoIdentity(value: THidAmicoIdentity): {
     member: ObjectId | undefined;
     serviceProvider: ObjectId | undefined;
     visitor: ObjectId | undefined;
-    type: "admin" | "resident" | "contractor" | "visitor" | "unknown" | "staff";
+    type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
     status: "deleted" | "active" | "inactive";
     metadata: Record<string, unknown>;
     createdAt: string | Date;
@@ -11825,7 +11825,7 @@ declare function useHidAmicoRepo(): {
         member: ObjectId | undefined;
         serviceProvider: ObjectId | undefined;
         visitor: ObjectId | undefined;
-        type: "admin" | "resident" | "contractor" | "visitor" | "unknown" | "staff";
+        type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;
@@ -12229,7 +12229,7 @@ declare function useHidAmicoService(): {
         member: bson.ObjectId | undefined;
         serviceProvider: bson.ObjectId | undefined;
         visitor: bson.ObjectId | undefined;
-        type: "admin" | "resident" | "contractor" | "visitor" | "unknown" | "staff";
+        type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;