@7365admin1/core 3.64.5 → 3.65.1

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @iservice365/core
 
+## 3.65.1
+
+### Patch Changes
+
+- 69714b4: Role writes: a site's own module list narrows a role only when the site belongs to the role's organisation. A service provider's role at a client's site is no longer refused modules the client switched off for that site — matching what the role editor now offers.
+
+## 3.65.0
+
+### Minor Changes
+
+- c4dc50b: Module gate, server step: the deny-list endpoint, the impact preview, and
+  acknowledge-before-save. Everything ships inert and fails open.
+
+  - `useMemberController().getModulesByUserIdType` (for
+    `GET /api/members/user/:id/app/:type/modules?org=&site=`) answers
+    `{ denied: string[] }` for the membership `getByUserIdType` answers with. It
+    is the same self-or-staff guard. It answers `[]` for no list, an empty list,
+    a resident, Seven365 staff, a site of another organisation, any lookup
+    error, and `MODULE_LIST_GATE=off`. `ALWAYS_ALLOWED` is never denied.
+  - A saved list is enforced only once it has been saved through the
+    acknowledged preview. The marker is the save's own append-only console-audit
+    row (`gateListHash`). A list saved earlier, or changed any other way, behaves
+    as absent. No field is added to any organisation or site.
+  - `useOrgController().previewOrgModules` and
+    `useSiteController().previewSiteModules` (for
+    `POST /api/organizations/:id/modules/preview` and
+    `POST /api/sites/:id/modules/preview`) return who would lose what. They are
+    read-only and never go through `GET /api/roles`.
+  - `updateModules` and `updateSiteModules` accept `acknowledgeImpact`. A save
+    that takes a module away from somebody is refused with 409 until it is
+    acknowledged. An empty list restores everything and never needs it. Site
+    saves are now recorded in the console audit (`site.modules-changed`).
+  - `filterByAccess` (Q7) runs at the top of the notification `send()`. It is
+    `NOTIFY_ACCESS_FILTER=log` by default: it logs who would be filtered and
+    still sends to everyone. It is exported so API-core's own sender can call it.
+  - `moduleDeniedForCaller` (Q3) is the server-refusal primitive. It is
+    `MODULE_GATE_MODE=log` by default and never refuses. `enforce` refuses only
+    the keys in `MODULE_GATE_ENFORCE_KEYS`. Work stamped (`at`) before the
+    acknowledged save is accepted.
+  - `MODULE_LIST_GATE` (code default `on`) switches all of the above off at
+    once.
+
+### Patch Changes
+
+- c993ee4: POST /api/members/direct refuses (400) a role that belongs to a different organisation, unless the caller already holds that role in the organisation being joined.
+- 74f228f: POST /api/members/direct: adding yourself now needs a role you may give yourself - Seven365 staff, the organisation's owner, a role you already hold there, or the role your own invitation offers. Enrolling somebody else is unchanged.
+- ae42c1c: GET /api/organizations/id/:id returns the whole organisation record only to a caller with a relationship to it (member, invitee, owner, Seven365 staff, an active resident of one of its sites, or an engaged service provider). Everyone else gets the name-only record the anonymous lookup already returns. It never answers 401/403.
+- 7363b8d: Site Settings saves are no longer refused because the client has one resident-app
+  switch turned off. A save is refused only when it would turn ON a resident-app
+  switch that the site has stored as off and the client has switched off.
+- 9d1a0f0: PATCH /api/users/field/:id (and v2): on your own account you may change only name, contact, nric, dateOfBirth, profile and gender, and defaultOrg to an organisation you reach. status, email and plateNumber are staff-only.
+
 ## 3.64.5
 
 ### Patch Changes