@7365admin1/core 3.64.5-staging.297 → 3.64.5-staging.298

package/.changeset/module-gate-server.md

@@ -0,0 +1,35 @@
+---
+"@7365admin1/core": minor
+---
+
+Module gate, server step: the deny-list endpoint, the impact preview, and
+acknowledge-before-save. Everything ships inert and fails open.
+
+- `useMemberController().getModulesByUserIdType` (for
+  `GET /api/members/user/:id/app/:type/modules?org=&site=`) answers
+  `{ denied: string[] }` for the membership `getByUserIdType` answers with. It
+  is the same self-or-staff guard. It answers `[]` for no list, an empty list,
+  a resident, Seven365 staff, a site of another organisation, any lookup
+  error, and `MODULE_LIST_GATE=off`. `ALWAYS_ALLOWED` is never denied.
+- A saved list is enforced only once it has been saved through the
+  acknowledged preview. The marker is the save's own append-only console-audit
+  row (`gateListHash`). A list saved earlier, or changed any other way, behaves
+  as absent. No field is added to any organisation or site.
+- `useOrgController().previewOrgModules` and
+  `useSiteController().previewSiteModules` (for
+  `POST /api/organizations/:id/modules/preview` and
+  `POST /api/sites/:id/modules/preview`) return who would lose what. They are
+  read-only and never go through `GET /api/roles`.
+- `updateModules` and `updateSiteModules` accept `acknowledgeImpact`. A save
+  that takes a module away from somebody is refused with 409 until it is
+  acknowledged. An empty list restores everything and never needs it. Site
+  saves are now recorded in the console audit (`site.modules-changed`).
+- `filterByAccess` (Q7) runs at the top of the notification `send()`. It is
+  `NOTIFY_ACCESS_FILTER=log` by default: it logs who would be filtered and
+  still sends to everyone. It is exported so API-core's own sender can call it.
+- `moduleDeniedForCaller` (Q3) is the server-refusal primitive. It is
+  `MODULE_GATE_MODE=log` by default and never refuses. `enforce` refuses only
+  the keys in `MODULE_GATE_ENFORCE_KEYS`. Work stamped (`at`) before the
+  acknowledged save is accepted.
+- `MODULE_LIST_GATE` (code default `on`) switches all of the above off at
+  once.