@7365admin1/core 3.57.0 → 3.58.0

package/dist/index.mjs

@@ -18735,9 +18735,14 @@ function requireNoPlatformGrant(role, next) {
     "These are Seven365 console permissions and cannot be granted on a client role: " + added.join(", ")
   );
 }
-function refuseSharedClientTemplate(role) {
+function permissionsMeanEverything(permissions) {
+  return !permissions?.length || permissions.includes("*");
+}
+function refuseSharedClientTemplate(role, next) {
   if (roleScope(role) !== "client-template")
-    return;
+    return false;
+  if (Array.isArray(next) && permissionsMeanEverything(next))
+    return true;
   throw new UnauthorizedError4(
     "This role is shared by every client that was invited with it and cannot be changed here."
   );
@@ -18757,9 +18762,16 @@ async function requireRoleRead(req, roleId, org) {
     return;
   await requireRoleOrg(req, org);
 }
-async function requireRoleWrite(req, role) {
-  refuseSharedClientTemplate(role);
+async function requireRoleWrite(req, role, next) {
+  const isTemplateRestore = refuseSharedClientTemplate(role, next);
   await requireRoleOrg(req, role?.org);
+  return isTemplateRestore;
+}
+function logTemplateRestore(req, roleId, before, after) {
+  logger25.log({
+    level: "warn",
+    message: `SHARED CLIENT TEMPLATE RESTORED TO ALLOW-ALL. actor=${callerId(req) || "unknown"} role=${roleId} before=${(before ?? []).length} permission(s) after=${JSON.stringify(after)}`
+  });
 }
 function useRoleController() {
   const {
@@ -18905,9 +18917,11 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new NotFoundError14("Role not found.");
-      await requireRoleWrite(req, existing);
+      const isRestore = await requireRoleWrite(req, existing, permissions);
       requireNoPlatformGrant(existing, permissions);
       const role = await _updateRole(_id, { name, permissions });
+      if (isRestore)
+        logTemplateRestore(req, _id, existing?.permissions, permissions);
       res.json({ message: "Successfully updated role.", data: { role } });
       return;
     } catch (error2) {
@@ -18934,9 +18948,11 @@ function useRoleController() {
       const existing = await _getRoleById(_id);
       if (!existing)
         throw new NotFoundError14("Role not found.");
-      await requireRoleWrite(req, existing);
+      const isRestore = await requireRoleWrite(req, existing, permissions);
       requireNoPlatformGrant(existing, permissions);
       await _updatePermissionsById(_id, permissions);
+      if (isRestore)
+        logTemplateRestore(req, _id, existing?.permissions, permissions);
       res.json({ message: "Successfully updated role permissions." });
       return;
     } catch (error2) {