@7365admin1/core 3.70.0 → 3.72.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/core
 
+## 3.72.0
+
+### Minor Changes
+
+- e38cc35: Invite Client: Seven365 staff choose the new client owner's role permissions with the modules (`permissions` on `POST /api/auth/invite/user`, only with `modules`, each inside them, never a console permission). Onboarding writes them on the client's own application owner role and records it as the organisation's `invitedRole`, so the owner's application membership gets exactly that role. Role writes for that application in that organisation stay within it (`*`/empty becomes the grant; wider strings are refused; Seven365 staff are not capped). Clients invited before this are unchanged. Kill switch: `CLIENT_INVITE_OWNER_PERMISSIONS=off`.
+
+## 3.71.0
+
+### Minor Changes
+
+- b9aff41: `GET /api/members?org=` lists only the sites a caller is pinned to when the caller holds no organisation-wide membership or organisation-level role there; a `siteId` outside those sites is refused. Organisation-wide members, owners/invitees and Seven365 staff are unchanged; a resident-only caller lists no staff.
+
 ## 3.70.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -440,13 +440,15 @@ declare function useMemberRepo(): {
     getByUserIdType: (user: string | ObjectId, type: string) => Promise<TMember>;
     getByRoleId: (role: string | ObjectId) => Promise<any>;
     getAssignedByRoleId: (role: string | ObjectId) => Promise<TMember[]>;
-    getAll: ({ search, page, limit, user, org, siteId, type, status, }: {
+    getAll: ({ search, page, limit, user, org, siteId, siteIds, type, status, }: {
         search?: string | undefined;
         page?: number | undefined;
         limit?: number | undefined;
         user?: string | ObjectId | undefined;
         org?: string | ObjectId | undefined;
         siteId?: string | ObjectId | undefined;
+        /** Restrict to these sites (the caller's pinned sites); `[]` lists nothing. */
+        siteIds?: string[] | undefined;
         type: string;
         status: string;
     }) => Promise<{
@@ -11192,6 +11194,8 @@ type TVerificationMetadataV2 = {
     invitedByPropertyManagement?: boolean;
     /** A new client's modules, chosen by Seven365 on Invite Client. */
     modules?: string[];
+    /** The new client owner's permissions in that application, chosen with the modules. */
+    permissions?: string[];
 };
 /**
  * The one-time code an invitee types to prove they own the mailbox, held on the