@7365admin1/layer-common 3.2.8-staging.214 → 3.2.8-staging.216

package/components/DashboardMain.vue

@@ -1343,27 +1343,41 @@ const { userAppRole } = useLocalSetup();
 const { downloadPDF } = usePDFDownload();
 const route = useRoute();
 
+// Each app spells its own resources, and the three that render this dashboard
+// disagree: work orders are `work_orders` in `-security`, `workOrder` in
+// `-property-management` and `work_order` in this layer's `useCleaningPermission`;
+// visitors are `visitor-mgmt` in `-security` and `visitorManagement` in
+// `-property-management`. A widget asking for one spelling is invisible to a role
+// granted another, so every spelling in use is listed. One canonical vocabulary
+// would let all of these collapse back to a single string -- that is a
+// cross-repo change, not one this component can make.
+const WORK_ORDER_SEE_ALL = [
+  "work_orders:see-all-work-orders",
+  "workOrder:see-all-work-orders",
+  "work_order:see-all-work-orders",
+];
+
 const propertyWidgetPermissions: Record<string, string[]> = {
-  workOrders: ["work_orders:see-all-work-orders"],
+  workOrders: WORK_ORDER_SEE_ALL,
   incidents: ["incident-reports:see-incident-reports"],
-  visitors: ["visitor-mgmt:see-all-visitor"],
+  visitors: ["visitor-mgmt:see-all-visitor", "visitorManagement:see-all-visitor"],
   facilityBookings: ["facility-booking-mgmt:see-all-facility-booking"],
-  activity: ["work_orders:see-all-work-orders"],
+  activity: WORK_ORDER_SEE_ALL,
   upcomingEvents: ["event-mgmt:see-all-event"],
   todayReminders: ["event-mgmt:see-all-event"],
   todayAttentions: [
     "incident-reports:see-incident-reports",
     "facility-booking-mgmt:see-all-facility-booking",
   ],
-  workOrderStatus: ["work_orders:see-all-work-orders"],
+  workOrderStatus: WORK_ORDER_SEE_ALL,
   feedbacks: ["feedbacks:see-all-feedback"],
   activePatrol: ["virtual-patrol:see-all-virtual-patrol-logs"],
 };
 
 const moduleWidgetPermissions: Record<string, string[]> = {
-  openWorkOrder: ["work_orders:see-all-work-orders"],
-  workOrders: ["work_orders:see-all-work-orders"],
-  activity: ["work_orders:see-all-work-orders"],
+  openWorkOrder: WORK_ORDER_SEE_ALL,
+  workOrders: WORK_ORDER_SEE_ALL,
+  activity: WORK_ORDER_SEE_ALL,
   taskSchedule: [
     "cleaning-schedule-mgmt:see-all-schedules",
     "schedule-task-mgmt:see-all-schedule-tasks",
@@ -1406,7 +1420,12 @@ function canViewWidget(key: string) {
     ? propertyWidgetPermissions[key]
     : moduleWidgetPermissions[key];
 
-  if (!permissions) return true;
+  // Fail closed. This used to return `true` while `userAppRole` was still
+  // unresolved, so the dashboard drew every widget and then took some away --
+  // and if the role fetch failed outright it drew every widget permanently.
+  // Every other gate in this package returns `false` without a role; this one
+  // now agrees with them.
+  if (!permissions) return false;
   if (permissions.includes("*")) return true;
 
   if (

package/composables/useBulletinBoardPermission.ts

@@ -2,7 +2,12 @@ import { useCommonPermissions } from "./useCommonPermission";
 
 export function useBulletinBoardPermission() {
   const { hasPermission } = usePermission();
-  const { bulletinBoardPermissions: permissions } = useCommonPermissions();
+  // Same nesting rule as every other permission composable: `hasPermission`
+  // reads `catalogue[resource][action]`, and `bulletinBoardPermissions` is a
+  // flat `{action: ...}` map. Unwrapped, `catalogue["bulletin-board"]` was
+  // undefined and all five gates were reachable only through `"*"`.
+  const { bulletinBoardPermissions } = useCommonPermissions();
+  const permissions: TPermissions = { "bulletin-board": bulletinBoardPermissions };
 
   const { userAppRole } = useLocalSetup();
 

package/composables/useSettingsPermission.ts

@@ -2,7 +2,13 @@ import { useCommonPermissions } from "./useCommonPermission";
 
 export function useSettingsPermission() {
   const { hasPermission } = usePermission();
-  const { siteSettingsPermissions: permissions } = useCommonPermissions();
+  // `hasPermission` looks the action up as `catalogue[resource][action]`, so the
+  // catalogue has to be nested by resource. `siteSettingsPermissions` is a flat
+  // `{action: ...}` map, so passing it straight through made
+  // `catalogue["site-settings"]` undefined and every check below fell through to
+  // `false` -- only the `"*"` short-circuit could ever open a panel.
+  const { siteSettingsPermissions } = useCommonPermissions();
+  const permissions: TPermissions = { "site-settings": siteSettingsPermissions };
   const { userAppRole } = useLocalSetup();
 
   const canManageSiteInformation = computed(() => {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "3.2.8-staging.214",
+  "version": "3.2.8-staging.216",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -35,7 +35,7 @@
     "build": "nuxt build .playground",
     "generate": "nuxt generate .playground",
     "preview": "nuxt preview .playground",
-    "test": "esbuild composables/useVisitorSocket.ts --format=esm --outfile=test/.build/useVisitorSocket.mjs --log-level=error && node --test \"test/*.test.mjs\" && yarn test:units",
+    "test": "esbuild composables/useVisitorSocket.ts --format=esm --outfile=test/.build/useVisitorSocket.mjs --log-level=error && node --experimental-strip-types --test \"test/*.test.mjs\" && yarn test:units",
     "test:units": "node --experimental-strip-types --test \"utils/*.test.ts\"",
     "release": "yarn run build && changeset publish"
   },