@7365admin1/core 3.68.3-staging.315 → 3.68.3-staging.317

package/.changeset/client-invite-owner-role-permissions.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Invite Client: Seven365 staff choose the new client owner's role permissions with the modules (`permissions` on `POST /api/auth/invite/user`, only with `modules`, each inside them, never a console permission). Onboarding writes them on the client's own application owner role and records it as the organisation's `invitedRole`, so the owner's application membership gets exactly that role. Role writes for that application in that organisation stay within it (`*`/empty becomes the grant; wider strings are refused; Seven365 staff are not capped). Clients invited before this are unchanged. Kill switch: `CLIENT_INVITE_OWNER_PERMISSIONS=off`.

package/.changeset/member-list-site-scope.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+`GET /api/members?org=` lists only the sites a caller is pinned to when the caller holds no organisation-wide membership or organisation-level role there; a `siteId` outside those sites is refused. Organisation-wide members, owners/invitees and Seven365 staff are unchanged; a resident-only caller lists no staff.

package/dist/index.d.ts

@@ -442,13 +442,15 @@ declare function useMemberRepo(): {
     getByUserIdType: (user: string | ObjectId, type: string) => Promise<TMember>;
     getByRoleId: (role: string | ObjectId) => Promise<any>;
     getAssignedByRoleId: (role: string | ObjectId) => Promise<TMember[]>;
-    getAll: ({ search, page, limit, user, org, siteId, type, status, }: {
+    getAll: ({ search, page, limit, user, org, siteId, siteIds, type, status, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
         user?: string | ObjectId | undefined;
         org?: string | ObjectId | undefined;
         siteId?: string | ObjectId | undefined;
+        /** Restrict to these sites (the caller's pinned sites); `[]` lists nothing. */
+        siteIds?: string[] | undefined;
         type: string;
         status: string;
     }) => Promise<{
@@ -11307,6 +11309,8 @@ type TVerificationMetadataV2 = {
     invitedByPropertyManagement?: boolean;
     /** A new client's modules, chosen by Seven365 on Invite Client. */
     modules?: string[];
+    /** The new client owner's permissions in that application, chosen with the modules. */
+    permissions?: string[];
 };
 /**
  * The one-time code an invitee types to prove they own the mailbox, held on the