@7365admin1/core 3.64.5-staging.310 → 3.64.5-staging.311

package/.changeset/client-invite-modules-own-owner-role.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Invite Client: Seven365 staff can choose a new client's modules (`modules` on `POST /api/auth/invite/user`, console `organizations` permission). Onboarding from that invitation stores the list on the organisation and records the save row that makes the module gate enforce it. A new-client invitation no longer carries a shared template role, so the owner holds the organisation's own seeded owner role.

package/dist/index.d.ts

@@ -11194,6 +11194,8 @@ type TVerificationMetadataV2 = {
     invitedByName?: string;
     /** True when the sender was a property management company — those need approval. */
     invitedByPropertyManagement?: boolean;
+    /** A new client's modules, chosen by Seven365 on Invite Client. */
+    modules?: string[];
 };
 /**
  * The one-time code an invitee types to prove they own the mailbox, held on the

package/dist/index.js

@@ -30081,7 +30081,9 @@ function useVerificationController() {
       name: import_joi28.default.string().optional().allow("", null),
       org: import_joi28.default.string().hex().optional().allow("", null),
       siteId: import_joi28.default.string().hex().optional().allow("", null),
-      siteName: import_joi28.default.string().optional().allow("", null)
+      siteName: import_joi28.default.string().optional().allow("", null),
+      // The modules Seven365 gives a NEW client (the console's Invite Client).
+      modules: modulesSchema.optional()
     });
     const { error, value } = validation.validate(payload);
     if (error) {
@@ -30096,12 +30098,24 @@ function useVerificationController() {
       const {
         email,
         app,
-        role,
         name,
         org,
         siteId,
-        siteName
+        siteName,
+        modules
       } = value;
+      const newClient = !org && !app.includes(PLATFORM_STAFF_MEMBER_TYPE);
+      const role = newClient ? "" : value.role;
+      let clientModules;
+      if (modules !== void 0) {
+        const invitedBy = await requireConsolePermission(req, "organizations");
+        if (!newClient || app.length !== 1) {
+          throw new import_node_server_utils66.BadRequestError(
+            "Modules can only be chosen when inviting a new client, one application at a time."
+          );
+        }
+        clientModules = { modules: normaliseModules(modules), invitedBy };
+      }
       await requireInviteReach(req, org, app, role);
       const verificationIds = await _createSimpleUserInvite({
         email,
@@ -30111,7 +30125,8 @@ function useVerificationController() {
           name,
           org,
           siteId,
-          siteName
+          siteName,
+          ...clientModules
         }
       });
       const responseBody = {
@@ -31899,6 +31914,7 @@ function useOrgController() {
       let invitedFrom = null;
       let invitedRole = null;
       let inviteAlreadyComplete = false;
+      let invitedModules = null;
       let self = null;
       if (inviteId) {
         const [invite, caller] = await Promise.all([
@@ -31911,6 +31927,11 @@ function useOrgController() {
           invitedFrom = String(invite._id);
           invitedRole = invite.metadata?.role ? String(invite.metadata.role) : null;
           inviteAlreadyComplete = invite.status === "complete" /* COMPLETE */;
+          const chosen = normaliseModules(invite.metadata?.modules);
+          const invitedBy = invite.metadata?.invitedBy;
+          if (chosen.length && invitedBy && invite.metadata?.app === body.nature) {
+            invitedModules = { modules: chosen, invitedBy: String(invitedBy) };
+          }
         } else {
           import_node_server_utils71.logger.log({
             level: "warn",
@@ -31926,7 +31947,29 @@ function useOrgController() {
           );
         }
       }
-      const _id = await _add({ ...body, createdBy, invitedFrom, invitedRole });
+      const _id = await _add({
+        ...body,
+        createdBy,
+        invitedFrom,
+        invitedRole,
+        ...invitedModules && { modules: invitedModules.modules }
+      });
+      if (invitedModules) {
+        await recordConsoleAction({
+          action: "client.modules-changed" /* CLIENT_MODULES_CHANGED */,
+          actor: invitedModules.invitedBy,
+          org: String(_id),
+          target: String(_id).toLowerCase(),
+          targetType: "organization" /* ORGANIZATION */,
+          after: pickAuditFields("client.modules-changed" /* CLIENT_MODULES_CHANGED */, {
+            modules: invitedModules.modules.join(", "),
+            moduleCount: invitedModules.modules.length,
+            gateListHash: moduleListHash(invitedModules.modules),
+            acknowledged: false,
+            impactMemberCount: 0
+          })
+        });
+      }
       if (invitedFrom && !inviteAlreadyComplete) {
         try {
           await useVerificationRepoV2().updateStatusById(