@7365admin1/core 3.72.1-staging.319 → 3.72.1-staging.321

package/.changeset/client-invite-service365.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": minor
+---
+
+Invite Client for a Property Management or real estate developer client can carry the Service365 resident app modules; onboarding writes them on the organisation

package/.changeset/people-create-reach-enforce.md

@@ -0,0 +1,5 @@
+---
+"@7365admin1/core": patch
+---
+
+Enforce the reach check on `POST /api/people` by default: a signed-in caller can only create a person at a site (or organisation) they belong to or serve. `PEOPLE_CREATE_REACH_MODE=log` switches back to counting without refusing.

package/dist/index.d.ts

@@ -11378,6 +11378,8 @@ type TVerificationMetadataV2 = {
     modules?: string[];
     /** The new client owner's permissions in that application, chosen with the modules. */
     permissions?: string[];
+    /** A Property Management client's Service365 resident app switches, chosen with the modules. */
+    residentAppModules?: Record<string, boolean>;
 };
 /**
  * The one-time code an invitee types to prove they own the mailbox, held on the

package/dist/index.js

@@ -24452,6 +24452,44 @@ function useMemberController() {
 // src/controllers/verification.controller.ts
 var import_node_server_utils67 = require("@7365admin1/node-server-utils");
 var import_joi28 = __toESM(require("joi"));
+
+// src/utils/resident-app-modules.util.ts
+var RESIDENT_APP_NATURES = Object.freeze([
+  "property_management_agency",
+  "real_estate_developer"
+]);
+function effectiveResidentAppModules(orgModules, siteModules) {
+  const org = asModules(orgModules);
+  const site = asModules(siteModules);
+  const effective = {};
+  for (const key of residentAppModuleKeys) {
+    effective[key] = org[key] !== false && site[key] !== false;
+  }
+  return effective;
+}
+function residentAppModulesAboveCeiling(orgModules, requested, stored) {
+  const org = asModules(orgModules);
+  const wanted = asModules(requested);
+  const had = asModules(stored);
+  return residentAppModuleKeys.filter(
+    (key) => org[key] === false && wanted[key] === true && had[key] === false
+  );
+}
+function residentAppModulesAboveCeilingMessage(rejected) {
+  return `This client has not been given ${rejected.join(", ")} in the resident app, so a site cannot switch it on. Ask Seven365 to add it to the organisation first.`;
+}
+function withoutDerivedSiteMetadata(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return metadata;
+  }
+  const { residentAppModulesEffective: _derived, ...stored } = metadata;
+  return stored;
+}
+function asModules(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+// src/controllers/verification.controller.ts
 var withoutEmail = (payload) => JSON.stringify({ ...payload, email: payload?.email ? "[redacted]" : void 0 });
 function callerId2(req) {
   const user = req.user;
@@ -24533,7 +24571,11 @@ function useVerificationController() {
       modules: modulesSchema.optional(),
       // The new client owner's permissions in that application, chosen with
       // the modules (owner, 2026-09-15). Only accepted together with modules.
-      permissions: permissionsSchema.optional()
+      permissions: permissionsSchema.optional(),
+      // The Service365 resident app switches for a Property Management (or
+      // real estate developer) client, same shape the Client details card saves
+      // to `organizations.residentAppModules`. Only accepted with modules.
+      residentAppModules: residentAppModulesSchema.optional()
     });
     const { error, value } = validation.validate(payload);
     if (error) {
@@ -24553,7 +24595,8 @@ function useVerificationController() {
         siteId,
         siteName,
         modules,
-        permissions
+        permissions,
+        residentAppModules
       } = value;
       const newClient = !org && !app.includes(PLATFORM_STAFF_MEMBER_TYPE);
       const role = newClient ? "" : value.role;
@@ -24583,6 +24626,14 @@ function useVerificationController() {
         }
         clientModules.permissions = chosen;
       }
+      if (residentAppModules !== void 0) {
+        if (!clientModules || !RESIDENT_APP_NATURES.includes(app[0])) {
+          throw new import_node_server_utils67.BadRequestError(
+            "Service365 resident app modules can only be chosen with the modules of a new Property Management client."
+          );
+        }
+        clientModules.residentAppModules = residentAppModules;
+      }
       await requireInviteReach(req, org, app, role);
       const verificationIds = await _createSimpleUserInvite({
         email,
@@ -26399,10 +26450,12 @@ function useOrgController() {
           const invitedBy = invite.metadata?.invitedBy;
           if (chosen.length && invitedBy && invite.metadata?.app === body.nature) {
             const permissions = clientInviteOwnerPermissionsOn() ? normalisePermissions(invite.metadata?.permissions) : [];
+            const residentApp = RESIDENT_APP_NATURES.includes(body.nature) ? residentAppModulesSchema.validate(invite.metadata?.residentAppModules) : null;
             invitedModules = {
               modules: chosen,
               invitedBy: String(invitedBy),
-              permissions: permissionsOutsideModules(permissions, chosen).length ? [] : permissions
+              permissions: permissionsOutsideModules(permissions, chosen).length ? [] : permissions,
+              ...residentApp?.value && !residentApp.error ? { residentAppModules: residentApp.value } : {}
             };
           }
         } else {
@@ -26425,7 +26478,10 @@ function useOrgController() {
         createdBy,
         invitedFrom,
         invitedRole,
-        ...invitedModules && { modules: invitedModules.modules }
+        ...invitedModules && { modules: invitedModules.modules },
+        ...invitedModules?.residentAppModules && {
+          residentAppModules: invitedModules.residentAppModules
+        }
       });
       if (invitedModules) {
         await recordConsoleAction({
@@ -26439,7 +26495,10 @@ function useOrgController() {
             moduleCount: invitedModules.modules.length,
             gateListHash: moduleListHash(invitedModules.modules),
             acknowledged: false,
-            impactMemberCount: 0
+            impactMemberCount: 0,
+            ...invitedModules.residentAppModules && {
+              residentAppModulesOff: Object.keys(invitedModules.residentAppModules).filter((key) => invitedModules.residentAppModules[key] === false).join(", ")
+            }
           })
         });
       }
@@ -35042,40 +35101,6 @@ function useSiteService() {
 
 // src/controllers/site.controller.ts
 var import_node_server_utils109 = require("@7365admin1/node-server-utils");
-
-// src/utils/resident-app-modules.util.ts
-function effectiveResidentAppModules(orgModules, siteModules) {
-  const org = asModules(orgModules);
-  const site = asModules(siteModules);
-  const effective = {};
-  for (const key of residentAppModuleKeys) {
-    effective[key] = org[key] !== false && site[key] !== false;
-  }
-  return effective;
-}
-function residentAppModulesAboveCeiling(orgModules, requested, stored) {
-  const org = asModules(orgModules);
-  const wanted = asModules(requested);
-  const had = asModules(stored);
-  return residentAppModuleKeys.filter(
-    (key) => org[key] === false && wanted[key] === true && had[key] === false
-  );
-}
-function residentAppModulesAboveCeilingMessage(rejected) {
-  return `This client has not been given ${rejected.join(", ")} in the resident app, so a site cannot switch it on. Ask Seven365 to add it to the organisation first.`;
-}
-function withoutDerivedSiteMetadata(metadata) {
-  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
-    return metadata;
-  }
-  const { residentAppModulesEffective: _derived, ...stored } = metadata;
-  return stored;
-}
-function asModules(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-
-// src/controllers/site.controller.ts
 var import_joi51 = __toESM(require("joi"));
 var import_mongodb74 = require("mongodb");
 async function requireSiteWrite(req, siteId) {
@@ -57210,7 +57235,7 @@ var import_node_server_utils149 = require("@7365admin1/node-server-utils");
 var import_node_server_utils150 = require("@7365admin1/node-server-utils");
 
 // src/utils/people-create-gate.util.ts
-var PEOPLE_CREATE_REACH_MODE_DEFAULT = "log";
+var PEOPLE_CREATE_REACH_MODE_DEFAULT = "enforce";
 function peopleCreateReachMode(env2 = process.env) {
   return gateMode(
     env2.PEOPLE_CREATE_REACH_MODE,