@7365admin1/core 3.62.1-staging.277 → 3.62.1-staging.279

package/.changeset/role-module-ceiling.md

@@ -0,0 +1,16 @@
+---
+"@7365admin1/core": minor
+---
+
+Enforce the organisation's module ceiling on every role write (R1 tier three).
+
+A role can no longer be granted a permission whose module Seven365 never gave
+the organisation, nor one the organisation never gave the site. Applied to all
+four write paths — `role.controller` create / update / updatePermissionsById and
+`role-v2.controller` create — because `/api/roles/v2` is a separate mount and
+gating one leaves the rule reachable by adding `/v2` to the URL.
+
+Only what a write ADDS is tested, so a role that predates the module list can
+still be renamed and can still have a permission removed. Absent and empty
+module lists still mean everything at every tier, so this is inert for all 168
+live organisations until Seven365 sets a list.

package/.changeset/site-module-allowlist.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Tier two of the module cascade: `sites.metadata.modules`, the modules a site offers, plus `PATCH /sites/:id/modules` for the organisation to set it. The write refuses any key Seven365 never gave the organisation (owner requirement R1); the read fails open at every tier, so absent and empty both mean "everything the organisation has" and no site or role editor changes until somebody sets a list.

package/dist/index.d.ts

@@ -2126,6 +2126,8 @@ declare enum SiteCategories {
     HOSPITALITY = "hospitality"
 }
 type TSiteMetadata = {
+    /** Tier two of the module cascade — see `site-modules.util.ts`. */
+    modules?: string[];
     block?: number;
     guardPosts?: number;
     gracePeriod?: number;
@@ -2310,6 +2312,7 @@ declare function useSiteController(): {
     updateSiteBlock: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     deleteSite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    updateSiteModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateGuardPostsById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     siteInformation: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllSitesForResidentCreation: (req: Request, res: Response, next: NextFunction) => Promise<void>;