@7365admin1/core 3.61.0 → 3.62.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @iservice365/core
 
+## 3.62.0
+
+### Minor Changes
+
+- 2ff23f3: Seed an "Administrator" role alongside the two owner roles when an organisation is created, so a client has a role it can actually give a colleague on day one. Its thirteen permissions are the people-management cluster 73-82% of live client roles already carry (members, invitations, roles). The paid signup path now uses the same shared helper instead of describing its two roles inline.
+- 8d75fe0: Add `organizations.modules` — the catalogue modules Seven365 has enabled for a client — with a staff-gated `updateModules` handler and a console audit row. Absent and empty both mean EVERYTHING, and the helper fails open on anything it cannot read, so no existing organisation changes. It narrows what a role editor OFFERS and authorises nothing.
+
+### Patch Changes
+
+- b0c9f27: Publishing the platform Terms and Privacy Policy is now restricted to the Seven365 OWNER, not any staff account. Owner decision 9 said owner-only; the suspend half was built and this half was not, and because an empty permission list passes every console grant, any staff role that had never been ticked could publish Terms binding every client.
+
 ## 3.61.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -716,6 +716,17 @@ type TOrg = {
     description?: string;
     type: string;
     nature: string;
+    /**
+     * The catalogue module keys Seven365 has enabled for this client, or absent.
+     *
+     * ABSENT AND EMPTY BOTH MEAN EVERYTHING - see `org-modules.util.ts`. Every
+     * organisation that exists today has no such field, so any other reading of
+     * absent would empty the role catalogue for all of them on deploy.
+     *
+     * It DRAWS, it does not AUTHORISE. Nothing on the server reads it to decide a
+     * request; it narrows what a role editor OFFERS.
+     */
+    modules?: string[];
     email?: string;
     contact?: string;
     /** Chosen by the owner while creating the organisation. */
@@ -817,6 +828,7 @@ declare function useOrgController(): {
     getOrgsByEmail: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAdminOrgForResident: (_req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    updateModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
 
 /**
@@ -12988,6 +13000,15 @@ declare enum ConsoleAuditAction {
     CLIENT_CREATED = "client.created",
     CLIENT_SUSPENDED = "client.suspended",
     CLIENT_REACTIVATED = "client.reactivated",
+    /**
+     * Seven365 staff changing which catalogue modules a client is offered.
+     *
+     * Recorded because it is a commercial decision about a paying client that
+     * somebody has to be able to answer for later, even though it grants and
+     * revokes nothing by itself (`org-modules.util.ts` - it narrows what a role
+     * editor OFFERS, and the server re-decides every request regardless).
+     */
+    CLIENT_MODULES_CHANGED = "client.modules-changed",
     PROMO_CODE_CREATED = "promo-code.created",
     PROMO_CODE_UPDATED = "promo-code.updated",
     PROMO_CODE_STATUS_CHANGED = "promo-code.status-changed",