@7365admin1/core 3.57.0 → 3.58.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @iservice365/core
 
+## 3.58.0
+
+### Minor Changes
+
+- f20014d: Allow a Seven365 platform admin to restore a shared client role template to allow-all.
+
+  The role-scope guard refuses every write to an org-less client template. That is correct for
+  preventing the 2026-09-07 outage and it left no way to repair one: "Org Owner" still holds the 34
+  platform permission strings and the guard refuses the write that would give its members their
+  modules back.
+
+  `refuseSharedClientTemplate` now takes the permission list the write would store and permits it when
+  that list MEANS EVERYTHING (`["*"]` or `[]`). Every other list stays refused with the same message,
+  including the 34 strings and including a hand-built superset — a template has no editor that draws
+  the right catalogue, and an equal-set write is the broken state being re-saved. The restore is only
+  reachable after the existing staff console check, and is recorded with actor, role and before/after.
+
 ## 3.57.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -11713,7 +11713,7 @@ declare function MHidAmicoIdentity(value: THidAmicoIdentity): {
     member: ObjectId | undefined;
     serviceProvider: ObjectId | undefined;
     visitor: ObjectId | undefined;
-    type: "admin" | "resident" | "contractor" | "visitor" | "unknown" | "staff";
+    type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
     status: "deleted" | "active" | "inactive";
     metadata: Record<string, unknown>;
     createdAt: string | Date;
@@ -11825,7 +11825,7 @@ declare function useHidAmicoRepo(): {
         member: ObjectId | undefined;
         serviceProvider: ObjectId | undefined;
         visitor: ObjectId | undefined;
-        type: "admin" | "resident" | "contractor" | "visitor" | "unknown" | "staff";
+        type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;
@@ -12229,7 +12229,7 @@ declare function useHidAmicoService(): {
         member: bson.ObjectId | undefined;
         serviceProvider: bson.ObjectId | undefined;
         visitor: bson.ObjectId | undefined;
-        type: "admin" | "resident" | "contractor" | "visitor" | "unknown" | "staff";
+        type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;

package/dist/index.js

@@ -19331,9 +19331,14 @@ function requireNoPlatformGrant(role, next) {
     "These are Seven365 console permissions and cannot be granted on a client role: " + added.join(", ")
   );
 }
-function refuseSharedClientTemplate(role) {
+function permissionsMeanEverything(permissions) {
+  return !permissions?.length || permissions.includes("*");
+}
+function refuseSharedClientTemplate(role, next) {
   if (roleScope(role) !== "client-template")
-    return;
+    return false;
+  if (Array.isArray(next) && permissionsMeanEverything(next))
+    return true;
   throw new import_node_server_utils45.UnauthorizedError(
     "This role is shared by every client that was invited with it and cannot be changed here."
   );
@@ -19353,9 +19358,16 @@ async function requireRoleRead(req, roleId, org) {
     return;
   await requireRoleOrg(req, org);
 }
-async function requireRoleWrite(req, role) {
-  refuseSharedClientTemplate(role);
+async function requireRoleWrite(req, role, next) {
+  const isTemplateRestore = refuseSharedClientTemplate(role, next);
   await requireRoleOrg(req, role?.org);
+  return isTemplateRestore;
+}
+function logTemplateRestore(req, roleId, before, after) {
+  import_node_server_utils46.logger.log({
+    level: "warn",
+    message: `SHARED CLIENT TEMPLATE RESTORED TO ALLOW-ALL. actor=${callerId(req) || "unknown"} role=${roleId} before=${(before ?? []).length} permission(s) after=${JSON.stringify(after)}`
+  });
 }
 function useRoleController() {
   const {
@@ -19501,9 +19513,11 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new import_node_server_utils46.NotFoundError("Role not found.");
-      await requireRoleWrite(req, existing);
+      const isRestore = await requireRoleWrite(req, existing, permissions);
       requireNoPlatformGrant(existing, permissions);
       const role = await _updateRole(_id, { name, permissions });
+      if (isRestore)
+        logTemplateRestore(req, _id, existing?.permissions, permissions);
       res.json({ message: "Successfully updated role.", data: { role } });
       return;
     } catch (error2) {
@@ -19530,9 +19544,11 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new import_node_server_utils46.NotFoundError("Role not found.");
-      await requireRoleWrite(req, existing);
+      const isRestore = await requireRoleWrite(req, existing, permissions);
       requireNoPlatformGrant(existing, permissions);
       await _updatePermissionsById(_id, permissions);
+      if (isRestore)
+        logTemplateRestore(req, _id, existing?.permissions, permissions);
       res.json({ message: "Successfully updated role permissions." });
       return;
     } catch (error2) {