@7365admin1/layer-common 3.2.2-staging.196 → 3.2.2-staging.198

package/components/HidReaderForm.vue

@@ -153,6 +153,13 @@ const props = defineProps({
     type: Boolean,
     default: false,
   },
+  // The site this reader belongs to. Passed down from HidReaderManagement,
+  // which already has it as a prop from the page's route. Reader discovery is
+  // authorized against it server-side.
+  site: {
+    type: String,
+    default: "",
+  },
 });
 
 const emit = defineEmits<{
@@ -236,6 +243,7 @@ async function connectReader() {
       baseUrl: draft.baseUrl.trim(),
       username: draft.username.trim(),
       password: draft.password,
+      site: props.site,
     });
     const nestedData = response?.data;
     const data = typeof nestedData === "object" && nestedData !== null

package/components/HidReaderManagement.vue

@@ -111,6 +111,7 @@
       :mode="selectedReader ? 'edit' : 'add'"
       :reader="selectedReader"
       :loading="saving"
+      :site="site"
       @submit="saveReader"
     />
 

package/components/QrTemplate/PrintDialog.vue

@@ -815,6 +815,10 @@ const props = defineProps<{
   start: any;
 }>();
 
+// Relative import, never Nuxt auto-import: this layer's `utils/` are auto-imported
+// into the consuming apps but not reliably into the layer's own components.
+import { pickRouteName } from "../../utils/route-name";
+
 const route = useRoute();
 const router = useRouter();
 const emit = defineEmits(["update:close"]);
@@ -990,12 +994,25 @@ const closeDialog = async (type?: string, tabType?: string) => {
       dialogType.value = "generate";
       generatePass.value = true;
     } else {
-      router.push({
-        name: "keys-visitor-pass-add",
-        query: {
-          site: route.params.site as string,
-        },
-      });
+      // Two faults here. The name is only correct in an app whose keys pages
+      // sit at the root - every consumer that renders this dialog nests them
+      // under [org]/[site], so `router.push` threw on an unknown name and the
+      // dialog's Generate action died. And `org` / `site` are PATH params on
+      // the destination, so sending `site` as a query left both unfilled.
+      const passAdd = pickRouteName(
+        router,
+        "org-site-keys-visitor-pass-add",
+        "keys-visitor-pass-add"
+      );
+      if (passAdd) {
+        router.push({
+          name: passAdd,
+          params: {
+            org: route.params.org as string,
+            site: route.params.site as string,
+          },
+        });
+      }
     }
     resetPrintState();
     snackbarStartRange.value = false;

package/components/ServiceProviderMain.vue

@@ -16,14 +16,16 @@
     -->
     <PageHeader title="Service Providers">
       <template #actions>
+        <!--
+          `showBillingButton` defaults to true, so this button rendered in every
+          app that mounts this screen - but only property-management has a
+          service-provider-mgmt/billing page, so everywhere else the click threw
+          on an unknown route name. Render it only where the page exists.
+        -->
         <AppButton
-          v-if="showBillingButton"
+          v-if="showBillingButton && billingRouteName"
           variant="ghost"
-          @click="
-            useRouter().push({
-              name: 'org-site-service-provider-mgmt-billing',
-            })
-          "
+          @click="useRouter().push({ name: billingRouteName })"
         >
           Billing
         </AppButton>
@@ -656,6 +658,7 @@ import useUser from "../composables/useUser";
 import useVerification from "../composables/useVerification";
 // import useRole from "../composables/useRole";
 import { errorConverter } from "../utils/data";
+import { pickRouteName } from "../utils/route-name";
 
 type ListTab = "active" | "pending" | "inactive";
 
@@ -734,6 +737,14 @@ const props = defineProps({
   },
 });
 
+// Only property-management contributes a service-provider-mgmt/billing page;
+// null in every other consumer, which hides the button instead of throwing.
+const billingRouteName = pickRouteName(
+  useRouter(),
+  "org-site-service-provider-mgmt-billing",
+  "service-provider-mgmt-billing"
+);
+
 const headers = [
   {
     title: "Company name",

package/components/WorkOrder/Main.vue

@@ -208,6 +208,9 @@
 
 <script setup lang="ts">
 import { useTheme } from "vuetify";
+// Relative import, never Nuxt auto-import: this layer's `utils/` are auto-imported
+// into the consuming apps but not reliably into the layer's own components.
+import { pickRouteName } from "../../utils/route-name";
 const emit = defineEmits(["click:create", "update:pagination"]);
 
 const props = defineProps({
@@ -363,14 +366,23 @@ function handleRowClick(row: any) {
   const org = useRoute().params.org || "defaultOrg";
   const site = useRoute().params.site || "defaultSite";
   const id = row._id;
-  useRouter().push({
-    name: "work-order-details",
-    params: {
-      org,
-      site,
-      id,
-    },
-  });
+  // `work-order-details` is not a route in any consuming app; the detail screen
+  // is `pages/[org]/[site]/work-orders/[id].vue` -> `org-site-work-orders-id`.
+  const details = pickRouteName(
+    useRouter(),
+    "org-site-work-orders-id",
+    "work-orders-id"
+  );
+  if (details) {
+    useRouter().push({
+      name: details,
+      params: {
+        org,
+        site,
+        id,
+      },
+    });
+  }
 }
 
 function resetWorkOrderForm() {

package/composables/useHidAmico.ts

@@ -90,6 +90,23 @@ export type HidSipAccountData = {
   provisionedAt: string;
 };
 
+/**
+ * True only for the specific validation error an API that predates core #1878
+ * returns when the discover body carries `site`. Deliberately narrow: after
+ * #1878 `site` is required, so this message can no longer be produced and the
+ * fallback below can never hide a real authorization refusal.
+ */
+export function isUnknownSiteFieldError(error: unknown): boolean {
+  const record = typeof error === "object" && error !== null
+    ? error as Record<string, unknown>
+    : {};
+  const data = typeof record.data === "object" && record.data !== null
+    ? record.data as Record<string, unknown>
+    : {};
+  const message = String(data.message || record.message || "");
+  return message.includes("\"site\"") && message.includes("not allowed");
+}
+
 export default function useHidAmico() {
   const basePath = "/api/access-management/hid";
 
@@ -260,11 +277,28 @@ export default function useHidAmico() {
     );
   }
 
-  function discoverReader(payload: Pick<HidReaderPayload, "baseUrl" | "username" | "password">) {
-    return useNuxtApp().$api<Record<string, unknown>>(`${basePath}/readers/discover`, {
-      method: "POST",
-      body: payload,
-    });
+  async function discoverReader(
+    payload: Pick<HidReaderPayload, "baseUrl" | "username" | "password" | "site">,
+  ) {
+    const post = (body: Record<string, unknown>) =>
+      useNuxtApp().$api<Record<string, unknown>>(`${basePath}/readers/discover`, {
+        method: "POST",
+        body,
+      });
+
+    try {
+      return await post(payload as Record<string, unknown>);
+    } catch (error: unknown) {
+      // The discover endpoint only started accepting (and requiring) `site` in
+      // core #1878. An API that predates it validates the body with Joi's
+      // default allowUnknown:false and answers `"site" is not allowed`, so the
+      // web layer would break the moment it shipped ahead of the API. Retry once
+      // without `site` so both API versions work.
+      // ponytail: remove this fallback once core #1878 is deployed everywhere.
+      if (!isUnknownSiteFieldError(error)) throw error;
+      const { site: _site, ...legacy } = payload;
+      return await post(legacy as Record<string, unknown>);
+    }
   }
 
   function getUserPinStatus(readerId: string, hidUserId: string | number) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "3.2.2-staging.196",
+  "version": "3.2.2-staging.198",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/pages/require-customer.vue

@@ -36,6 +36,10 @@
 </template>
 
 <script setup lang="ts">
+// Relative import, never Nuxt auto-import: this layer's `utils/` are auto-imported
+// into the consuming apps but not reliably into the layer's own components.
+import { pickRouteName } from "../utils/route-name";
+
 definePageMeta({
   layout: "plain",
 });
@@ -53,9 +57,19 @@ authenticate();
 const { currentUser } = useLocalAuth();
 
 function createCustomer() {
-  if (APP_NAME.toLowerCase() === "org") {
+  // The org app's page is `pages/org/[organization]/customers/add.vue`, whose
+  // route name is `org-organization-customers-add` - singular. The plural spelt
+  // here matched nothing, so the only way off this dead-end page threw. The
+  // `hasRoute` check also keeps a mis-set APP_NAME from taking this branch in an
+  // app that has no such page; that app falls through to the cross-app URL.
+  const customerAdd = pickRouteName(
+    useRouter(),
+    "org-organization-customers-add",
+    "organizations-customers-add"
+  );
+  if (APP_NAME.toLowerCase() === "org" && customerAdd) {
     navigateTo({
-      name: "org-organizations-customers-add",
+      name: customerAdd,
       params: { organization: currentUser.value?.defaultOrg },
     });
   } else {

package/utils/hid-discover.test.ts

@@ -0,0 +1,102 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import test from "node:test";
+
+import useHidAmico, { isUnknownSiteFieldError } from "../composables/useHidAmico.ts";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+type Call = { url: string; body: Record<string, unknown> };
+
+/**
+ * The composable calls the Nuxt auto-import `useNuxtApp().$api(...)`. Install a
+ * stub for it so the request body can be read without a Nuxt app.
+ */
+function stubApi(handler: (call: Call) => unknown) {
+  const calls: Call[] = [];
+  (globalThis as Record<string, unknown>).useNuxtApp = () => ({
+    $api: (url: string, options: { body: Record<string, unknown> }) => {
+      const call = { url, body: options.body };
+      calls.push(call);
+      return Promise.resolve(handler(call));
+    },
+  });
+  return calls;
+}
+
+function fetchError(message: string) {
+  return Object.assign(new Error("400 Bad Request"), { data: { message } });
+}
+
+test("discoverReader sends site in the request body", async () => {
+  const calls = stubApi(() => ({ data: { deviceId: "D1", portals: [] } }));
+
+  await useHidAmico().discoverReader({
+    baseUrl: "https://reader.example",
+    username: "operator",
+    password: "secret",
+    site: "0123456789abcdef01234567",
+  });
+
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].url, "/api/access-management/hid/readers/discover");
+  assert.equal(calls[0].body.site, "0123456789abcdef01234567");
+  assert.equal(calls[0].body.baseUrl, "https://reader.example");
+});
+
+test("discoverReader retries without site when the API predates core #1878", async () => {
+  const calls = stubApi((call) => {
+    if ("site" in call.body) throw fetchError('"site" is not allowed');
+    return { data: { deviceId: "D1", portals: [] } };
+  });
+
+  const response = await useHidAmico().discoverReader({
+    baseUrl: "https://reader.example",
+    username: "operator",
+    password: "secret",
+    site: "0123456789abcdef01234567",
+  });
+
+  assert.equal(calls.length, 2);
+  assert.equal("site" in calls[1].body, false);
+  assert.equal(calls[1].body.baseUrl, "https://reader.example");
+  assert.deepEqual(response, { data: { deviceId: "D1", portals: [] } });
+});
+
+test("discoverReader does not retry a real refusal", async () => {
+  const calls = stubApi(() => {
+    throw fetchError("You are not authorized to manage readers for this site.");
+  });
+
+  await assert.rejects(
+    useHidAmico().discoverReader({
+      baseUrl: "https://reader.example",
+      username: "operator",
+      password: "secret",
+      site: "0123456789abcdef01234567",
+    }),
+  );
+  assert.equal(calls.length, 1);
+});
+
+test("isUnknownSiteFieldError only matches the unknown-key message", () => {
+  assert.equal(isUnknownSiteFieldError(fetchError('"site" is not allowed')), true);
+  assert.equal(isUnknownSiteFieldError(new Error('"site" is not allowed')), true);
+  assert.equal(isUnknownSiteFieldError(fetchError('"site" is required')), false);
+  assert.equal(isUnknownSiteFieldError(fetchError('"baseUrl" is not allowed')), false);
+  assert.equal(isUnknownSiteFieldError(fetchError("Unauthorized")), false);
+  assert.equal(isUnknownSiteFieldError(null), false);
+});
+
+test("the reader form takes site as a prop and puts it in the discover call", () => {
+  const source = readFileSync(join(root, "components", "HidReaderForm.vue"), "utf8");
+  assert.match(source, /site:\s*\{\s*type:\s*String/);
+  assert.match(source, /discoverReader\(\{[\s\S]*?site:\s*props\.site[\s\S]*?\}\)/);
+});
+
+test("reader management passes its site prop down to the form", () => {
+  const source = readFileSync(join(root, "components", "HidReaderManagement.vue"), "utf8");
+  assert.match(source, /<HidReaderForm[\s\S]*?:site="site"[\s\S]*?\/>/);
+});

package/utils/route-name.test.ts

@@ -0,0 +1,85 @@
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "node:test";
+
+import { pickRouteName } from "./route-name.ts";
+
+const routerWith = (...names: string[]) => ({
+  hasRoute: (name: string) => names.includes(name),
+});
+
+test("picks the first candidate this app actually has", () => {
+  const router = routerWith("org-site-keys-visitor-pass-add");
+  assert.equal(
+    pickRouteName(router, "org-site-keys-visitor-pass-add", "keys-visitor-pass-add"),
+    "org-site-keys-visitor-pass-add"
+  );
+});
+
+test("falls through to a later candidate for a flatter app", () => {
+  const router = routerWith("keys-visitor-pass-add");
+  assert.equal(
+    pickRouteName(router, "org-site-keys-visitor-pass-add", "keys-visitor-pass-add"),
+    "keys-visitor-pass-add"
+  );
+});
+
+test("candidate order wins when an app has both", () => {
+  const router = routerWith("keys-visitor-pass-add", "org-site-keys-visitor-pass-add");
+  assert.equal(
+    pickRouteName(router, "org-site-keys-visitor-pass-add", "keys-visitor-pass-add"),
+    "org-site-keys-visitor-pass-add"
+  );
+});
+
+test("null when the app has no such page - the caller hides the control", () => {
+  assert.equal(pickRouteName(routerWith("org-site-work-orders"), "org-site-work-orders-id"), null);
+  assert.equal(pickRouteName(routerWith()), null);
+});
+
+// The five names two app-side audits found dead. Each is now resolved through
+// `pickRouteName`, so none may reappear as a literal anywhere in the layer.
+// `organizations-create` is deliberately absent: it is real in web-app-org and
+// is only reached there, so it was never dead.
+const DEAD_NAMES = [
+  "keys-visitor-pass-add",
+  "org-organizations-customers-add",
+  "work-order-details",
+  "org-site-service-provider-mgmt-billing",
+];
+
+function sourceFiles(dir: string, out: string[] = []): string[] {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) sourceFiles(path, out);
+    else if (/\.(vue|ts)$/.test(entry.name)) out.push(path);
+  }
+  return out;
+}
+
+test("no dead route name survives as a literal in the layer", () => {
+  const root = fileURLToPath(new URL("..", import.meta.url));
+  const files = ["components", "pages", "layouts", "composables", "middleware", "plugins"]
+    .flatMap((d) => sourceFiles(join(root, d)))
+    .filter((f) => !f.endsWith(".test.ts"));
+
+  assert.ok(files.length > 100, `expected to scan the layer, scanned ${files.length} files`);
+
+  const offenders: string[] = [];
+  for (const file of files) {
+    const source = readFileSync(file, "utf8");
+    for (const dead of DEAD_NAMES) {
+      // Only a `name:` BINDING counts. The same string also appears as a bare
+      // argument in a `pickRouteName(...)` candidate list, which is the fix, not
+      // the fault. Plain string matching on purpose - a backslash class inside a
+      // template literal silently loses its escape and matches nothing.
+      const bound = [`"${dead}"`, `'${dead}'`].some(
+        (quoted) => source.includes(`name: ${quoted}`) || source.includes(`name:${quoted}`)
+      );
+      if (bound) offenders.push(`${file.slice(root.length)} -> ${dead}`);
+    }
+  }
+  assert.deepEqual(offenders, [], `dead route names still bound:\n${offenders.join("\n")}`);
+});

package/utils/route-name.ts

@@ -0,0 +1,24 @@
+/**
+ * Pick the route name the RUNNING app actually has.
+ *
+ * This layer is extended by apps whose pages sit at different depths, so the
+ * same screen has a different Nuxt route name in each of them - the service
+ * apps produce `org-site-keys-visitor-pass-add` from
+ * `pages/[org]/[site]/keys/visitor/pass/add.vue`, while a flatter app would
+ * produce `keys-visitor-pass-add`. A literal name hard-coded in the layer is
+ * therefore correct in some consumers and throws in the rest, because
+ * `router.push({ name })` on an unknown name is a hard error.
+ *
+ * Pass the candidates most-specific-first. Returns the first one this app has,
+ * or `null` when it has none - and `null` means "this app has no such page",
+ * which is the caller's cue to hide the control rather than navigate somewhere
+ * wrong.
+ *
+ * ponytail: vue-router's own `hasRoute`, no name table to keep in sync.
+ */
+export function pickRouteName(
+  router: { hasRoute: (name: string) => boolean },
+  ...candidates: string[]
+): string | null {
+  return candidates.find((name) => router.hasRoute(name)) ?? null;
+}