@7365admin1/core 3.68.3-staging.316 → 3.68.3-staging.317

package/.changeset/client-invite-owner-role-permissions.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Invite Client: Seven365 staff choose the new client owner's role permissions with the modules (`permissions` on `POST /api/auth/invite/user`, only with `modules`, each inside them, never a console permission). Onboarding writes them on the client's own application owner role and records it as the organisation's `invitedRole`, so the owner's application membership gets exactly that role. Role writes for that application in that organisation stay within it (`*`/empty becomes the grant; wider strings are refused; Seven365 staff are not capped). Clients invited before this are unchanged. Kill switch: `CLIENT_INVITE_OWNER_PERMISSIONS=off`.

package/dist/index.d.ts

@@ -11309,6 +11309,8 @@ type TVerificationMetadataV2 = {
     invitedByPropertyManagement?: boolean;
     /** A new client's modules, chosen by Seven365 on Invite Client. */
     modules?: string[];
+    /** The new client owner's permissions in that application, chosen with the modules. */
+    permissions?: string[];
 };
 /**
  * The one-time code an invitee types to prove they own the mailbox, held on the