npm - @7365admin1/layer-common - Versions diffs - 4.0.1 → 4.0.3-staging.220 - Mend

@7365admin1/layer-common 4.0.1 → 4.0.3-staging.220

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (41) hide show

package/CHANGELOG.md +101 -0
package/components/AccessCardQrTagging.vue +0 -4
package/components/AccessManagement.vue +0 -4
package/components/BuildingManagement/buildings.vue +0 -4
package/components/BulletinBoardManagement.vue +0 -3
package/components/CameraForm.vue +2 -5
package/components/CameraMain.vue +3 -6
package/components/ClientDetailForm.vue +65 -5
package/components/ClientMain.vue +201 -59
package/components/DashboardMain.vue +27 -8
package/components/DocumentManagement.vue +0 -4
package/components/HidAccessLogDashboard.vue +114 -34
package/components/HidReaderManagement.vue +34 -11
package/components/HidReaderUserRoster.vue +376 -0
package/components/HidUserEnrollment.vue +6 -0
package/components/HidUserMapping.vue +583 -0
package/components/IncidentReport/Authorities.vue +0 -4
package/components/IncidentReport/IncidentInformation.vue +0 -4
package/components/IncidentReport/IncidentInformationDownload.vue +0 -4
package/components/IncidentReport/affectedEntities.vue +0 -4
package/components/MemberMain.vue +20 -2
package/components/RolePermissionFormCreate.vue +6 -1
package/components/RolePermissionFormPreviewUpdate.vue +22 -11
package/components/RolePermissionMain.vue +39 -4
package/components/VehicleManagement.vue +0 -4
package/components/VisitorManagement.vue +0 -3
package/components/VisitorsReportPreview.vue +0 -3
package/composables/useBulletinBoardPermission.ts +6 -1
package/composables/useConsoleTier.ts +73 -0
package/composables/useHidAmico.ts +18 -1
package/composables/useHidNavigation.ts +8 -1
package/composables/useMember.ts +0 -5
package/composables/useSettingsPermission.ts +7 -1
package/package.json +2 -2
package/pages/[org]/[site]/access-mgmt/hid-user-mapping/index.vue +23 -0
package/pages/[org]/[site]/access-mgmt/hid-users/index.vue +1 -1
package/utils/client-subscription.test.ts +95 -0
package/utils/console-tier.test.ts +87 -0
package/utils/console-tier.ts +67 -0
package/utils/data.test.ts +84 -0
package/utils/data.ts +92 -0

package/components/ClientMain.vue CHANGED Viewed

@@ -56,7 +56,15 @@
       <div class="table-card">
         <!-- Toolbar row -->
-        <div v-if="savedNote" class="saved-note" role="status">
+        <!-- Confirmations AND failures. A suspend that the server refused used
+             to reach `console.error` and nothing else, so the control read as
+             one that quietly did nothing. -->
+        <div
+          v-if="savedNote"
+          class="saved-note"
+          :class="{ 'saved-note-error': noteIsError }"
+          :role="noteIsError ? 'alert' : 'status'"
+        >
           {{ savedNote }}
           <button class="saved-note-close" @click="savedNote = ''">&times;</button>
         </div>
@@ -266,27 +274,74 @@
       </div>
     </div>
-    <!-- ===== SUSPEND CONFIRMATION DIALOG ===== -->
-    <div v-if="confirmSuspendItem" class="overlay" @click.self="cancelSuspend">
+    <!--
+      SUSPEND / REACTIVATE CONFIRMATION.
+      One dialog for both directions, because one endpoint serves both. The
+      suspend wording says what actually happens in the owner's own terms
+      (owner decision 4) rather than "are you sure": the people who lose access
+      are not only the client's office staff, and the two things a person most
+      needs to know before pressing it are that nothing is deleted and that it
+      can be undone. Reactivating needs no warning, but it still confirms - it
+      is a real change to who can sign in.
+    -->
+    <div v-if="confirmItem" class="overlay" @click.self="cancelConfirm">
       <div class="confirm-box">
-        <h3 class="confirm-title">Suspend account</h3>
-        <p class="confirm-text">
-          Are you sure you want to suspend <strong>{{ confirmSuspendItem?.name }}</strong>'s account?
-        </p>
+        <template v-if="confirmAction === 'suspended'">
+          <h3 class="confirm-title">Suspend {{ confirmItem?.name }}?</h3>
+          <p class="confirm-text">
+            Everyone who belongs to this client will be blocked from signing in
+            &mdash; their staff, their residents and their guards.
+          </p>
+          <p class="confirm-text">
+            Nothing is deleted. All of their data is kept.
+          </p>
+          <p class="confirm-text">
+            You can reactivate them at any time and they get straight back in.
+          </p>
+        </template>
+        <template v-else>
+          <h3 class="confirm-title">Reactivate {{ confirmItem?.name }}?</h3>
+          <p class="confirm-text">
+            Their staff, residents and guards will be able to sign in again.
+          </p>
+        </template>
+        <p v-if="confirmError" class="confirm-error" role="alert">{{ confirmError }}</p>
         <div class="confirm-actions">
-          <button class="btn-cancel" @click="cancelSuspend">Cancel</button>
-          <button class="btn-confirm-danger" :disabled="confirmSuspendLoading" @click="confirmSuspend">
-            <span v-if="confirmSuspendLoading" class="spinner spinner-light" />
-            <span v-else>Suspend</span>
+          <button class="btn-cancel" :disabled="confirmLoading" @click="cancelConfirm">Cancel</button>
+          <button
+            :class="confirmAction === 'suspended' ? 'btn-confirm-danger' : 'btn-confirm'"
+            :disabled="confirmLoading"
+            @click="runConfirm"
+          >
+            <span v-if="confirmLoading" class="spinner spinner-light" />
+            <span v-else>{{ confirmAction === 'suspended' ? 'Suspend' : 'Reactivate' }}</span>
           </button>
         </div>
       </div>
     </div>
+    <!--
+      THE ROW MENU CARRIES ITS OWN THEME CLASS.
+      It teleports to `<body>`, which is OUTSIDE the `v-application` element
+      Vuetify puts `v-theme--light` / `v-theme--dark` on - and every design
+      token in `tokens.css` is declared under `[class*="v-theme--"]`. So
+      `background: var(--card)` resolved to NOTHING and the menu drew with a
+      fully transparent background: measured `rgba(0, 0, 0, 0)` in both themes,
+      with the table's own text showing straight through the menu items. Its
+      border, ink and hover were dead for the same reason. Naming the theme on
+      the element itself brings all of them back without moving the teleport,
+      which is what keeps the menu clear of the table's `overflow`.
+    -->
     <Teleport to="body">
       <div
         v-if="openMenuId"
         class="dropdown"
+        :class="`v-theme--${currentTheme}`"
         :style="{ top: menuPos.top + 'px', left: menuPos.left + 'px' }"
       >
         <button class="dd-item" @click="viewClient(activeMenuItem)">
@@ -295,20 +350,29 @@
         <button class="dd-item" @click="openSubscription(activeMenuItem)">
           {{ activeMenuItem?.sub?.state === 'none' ? 'Set up subscription' : 'Edit subscription' }}
         </button>
-        <button
-          v-if="activeMenuItem?.status === 'suspended'"
-          class="dd-item"
-          @click="activateClient(activeMenuItem)"
-        >
-          Activate
-        </button>
-        <button
-          v-else
-          class="dd-item danger"
-          @click="askSuspend(activeMenuItem)"
-        >
-          Suspend
-        </button>
+        <!--
+          OWNER ONLY (owner decision 9). Ordinary Seven365 staff may view
+          clients and set up subscriptions; only the owner may stop a client's
+          people signing in. The server decides this again on every call -
+          `requirePlatformOwner` reads the session, not anything the browser
+          sends - so this hides a control it does not guard.
+        -->
+        <template v-if="isOwner">
+          <button
+            v-if="activeMenuItem?.status === 'suspended'"
+            class="dd-item"
+            @click="askConfirm(activeMenuItem, 'active')"
+          >
+            Reactivate
+          </button>
+          <button
+            v-else
+            class="dd-item danger"
+            @click="askConfirm(activeMenuItem, 'suspended')"
+          >
+            Suspend
+          </button>
+        </template>
       </div>
     </Teleport>
   </div>
@@ -319,6 +383,8 @@ import { computed, nextTick, onMounted, onUnmounted, ref, watch } from 'vue'
 import useOrg from '../composables/useOrg'
 import useVerification from '../composables/useVerification'
 import useRole from '../composables/useRole'
+import useConsoleTier from '../composables/useConsoleTier'
+import useThemePreference from '../composables/useThemePreference'
 import useUtils from '../composables/useUtils'
 import InvitationClientForm from './InvitationClientForm.vue'
 import ClientDetailForm from './ClientDetailForm.vue'
@@ -335,6 +401,10 @@ const { getOrganizationsWithSubscription, updateStatus } = useOrg()
 const { getVerifications, cancelUserInvitation } = useVerification()
 const { getCustomerSites: getCustomerSitesByOrgId } = useCustomerSite()
 const { getRoleById } = useRole()
+// Owner decision 9. Only decides what is DRAWN - see `utils/console-tier.ts`.
+const { isOwner, load: loadConsoleTier } = useConsoleTier()
+// Only for the teleported menu - see the comment above the Teleport.
+const { current: currentTheme } = useThemePreference()
 // The same helper the admin app's Organizations list uses to print a nature,
 // so both screens say the value the same way while both exist.
 const { formatNature } = useUtils()
@@ -378,9 +448,12 @@ const selectedClient  = ref<any>(null)
 const subscriptionClient = ref<any>(null)
 const savedNote          = ref('')
-/* suspend confirmation */
-const confirmSuspendItem    = ref<any>(null)
-const confirmSuspendLoading = ref(false)
+/* suspend / reactivate confirmation */
+const confirmItem    = ref<any>(null)
+const confirmAction  = ref<'active' | 'suspended'>('suspended')
+const confirmLoading = ref(false)
+const confirmError   = ref('')
+const noteIsError    = ref(false)
 /* ── COMPUTED ── */
 const pageRange = computed(() => {
@@ -409,37 +482,35 @@ function parseTotalItems(pageRangeStr: string, fallback: number): number {
   return match ? Number(match[1]) : fallback
 }
-async function suspendClient(item: any) {
-  try {
-    await updateStatus(item._id, "suspended")
-    closeMenu()
-    await fetchData()
-  } catch (err) {
-    console.error(err)
-  }
+/**
+ * Say what went wrong, in the words the API used where it gave any.
+ *
+ * `updateStatus` is owner-gated on the server, so the refusal an ordinary
+ * staff member gets here is a real, expected answer - not a crash. It used to
+ * land in `console.error`, which meant pressing Suspend looked exactly like
+ * pressing nothing.
+ */
+function apiMessage(err: any, fallback: string) {
+  return err?.response?._data?.message ?? err?.data?.message ?? fallback
 }
-async function activateClient(item: any) {
-  try {
-    await updateStatus(item._id, "active")
-    closeMenu()
-    await fetchData()
-  } catch (err) {
-    console.error(err)
-  }
+function showNote(text: string, isError = false) {
+  savedNote.value  = text
+  noteIsError.value = isError
 }
 /* ── SUBSCRIPTION ── */
 function openSubscription(item: any) {
   if (!item?._id) return
   savedNote.value = ''
+  noteIsError.value = false
   subscriptionClient.value = item
   closeMenu()
 }
 async function onSubscriptionSaved(message: string) {
   subscriptionClient.value = null
-  savedNote.value = message
+  showNote(message)
   // The list derives every subscription state from the record itself, so
   // re-reading it is all that is needed for the row to tell the truth again.
   await fetchData()
@@ -453,25 +524,57 @@ async function onSubscriptionSaved(message: string) {
   }
 }
-/* ── SUSPEND CONFIRMATION ── */
-function askSuspend(item: any) {
-  confirmSuspendItem.value = item
+/* ── SUSPEND / REACTIVATE CONFIRMATION ── */
+function askConfirm(item: any, action: 'active' | 'suspended') {
+  if (!item?._id) return
+  confirmItem.value   = item
+  confirmAction.value = action
+  confirmError.value  = ''
   closeMenu()
 }
-function cancelSuspend() {
-  if (confirmSuspendLoading.value) return
-  confirmSuspendItem.value = null
+function cancelConfirm() {
+  if (confirmLoading.value) return
+  confirmItem.value  = null
+  confirmError.value = ''
 }
-async function confirmSuspend() {
-  if (!confirmSuspendItem.value) return
-  confirmSuspendLoading.value = true
+async function runConfirm() {
+  const item   = confirmItem.value
+  const action = confirmAction.value
+  if (!item?._id) return
+  confirmLoading.value = true
+  confirmError.value   = ''
   try {
-    await suspendClient(confirmSuspendItem.value)
-    confirmSuspendItem.value = null
+    await updateStatus(item._id, action)
+    confirmItem.value = null
+    // The row's state is derived from the record, never held here, so
+    // re-reading the list is the whole update - `describeClientSubscription`
+    // then reports "Suspended" from the subscription status the endpoint
+    // writes alongside the organisation's. The client also moves to the tab
+    // that matches its new status, which is why it leaves this one.
+    await fetchData()
+    showNote(
+      action === 'suspended'
+        ? `${item.name} is suspended. Their staff, residents and guards can no longer sign in, and all their data is kept.`
+        : `${item.name} is active again. Their staff, residents and guards can sign in.`,
+    )
+  } catch (err: any) {
+    // Stays on the dialog. Closing it and dropping a banner would read as
+    // "done, with a note"; the action did not happen and the person is still
+    // standing in front of the decision.
+    confirmError.value = apiMessage(
+      err,
+      action === 'suspended'
+        ? 'Could not suspend this client. Only the Seven365 owner may suspend a client.'
+        : 'Could not reactivate this client. Only the Seven365 owner may reactivate a client.',
+    )
   } finally {
-    confirmSuspendLoading.value = false
+    confirmLoading.value = false
   }
 }
@@ -574,8 +677,8 @@ function cancelView() {
 }
 async function submitClient() {
-  // await update API
+  // `ClientDetailForm` has already saved by the time it emits - this closes the
+  // drawer and re-reads the row so the list shows what was saved.
   viewMode.value = 'table'
   fetchData()
 }
@@ -672,6 +775,9 @@ async function cancelInvite(item: any) {
 }
 onMounted(() => {
+  // Not awaited: the list is the screen, and the tier only adds or removes two
+  // menu items on a menu nobody has opened yet.
+  loadConsoleTier()
   fetchData()
   document.addEventListener('click', handleOutsideClick)
   document.addEventListener('scroll', closeMenu, true)
@@ -1170,4 +1276,40 @@ tbody td { vertical-align: middle; }
 }
 .btn-confirm-danger:hover:not(:disabled) { background: var(--err); }
 .btn-confirm-danger:disabled { opacity: 0.7; cursor: not-allowed; }
+/* Reactivating is an ordinary action, so it is not dressed as a destructive
+   one. Same box as the danger button so the dialog does not jump between the
+   two directions. */
+.btn-confirm {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  min-width: 78px;
+  padding: 8px 16px;
+  font-size: 13px;
+  font-weight: 500;
+  border: none;
+  border-radius: 8px;
+  background: var(--accent-strong);
+  color: var(--on-accent-strong);
+  cursor: pointer;
+}
+.btn-confirm:disabled { opacity: 0.7; cursor: not-allowed; }
+.btn-cancel:disabled { opacity: 0.7; cursor: not-allowed; }
+/* The refusal, on the dialog it belongs to. `--err` on `--err-bg`, not a bare
+   red on the card. */
+.confirm-error {
+  margin-bottom: 16px;
+  padding: 9px 12px;
+  border-radius: 8px;
+  background: var(--err-bg);
+  color: var(--err);
+  font-size: 13px;
+  font-weight: 500;
+  line-height: 1.45;
+}
+.saved-note-error {
+  background: var(--err-bg);
+  color: var(--err);
+}
 </style>

package/components/DashboardMain.vue CHANGED Viewed

@@ -1343,27 +1343,41 @@ const { userAppRole } = useLocalSetup();
 const { downloadPDF } = usePDFDownload();
 const route = useRoute();
+// Each app spells its own resources, and the three that render this dashboard
+// disagree: work orders are `work_orders` in `-security`, `workOrder` in
+// `-property-management` and `work_order` in this layer's `useCleaningPermission`;
+// visitors are `visitor-mgmt` in `-security` and `visitorManagement` in
+// `-property-management`. A widget asking for one spelling is invisible to a role
+// granted another, so every spelling in use is listed. One canonical vocabulary
+// would let all of these collapse back to a single string -- that is a
+// cross-repo change, not one this component can make.
+const WORK_ORDER_SEE_ALL = [
+  "work_orders:see-all-work-orders",
+  "workOrder:see-all-work-orders",
+  "work_order:see-all-work-orders",
+];
 const propertyWidgetPermissions: Record<string, string[]> = {
-  workOrders: ["work_orders:see-all-work-orders"],
+  workOrders: WORK_ORDER_SEE_ALL,
   incidents: ["incident-reports:see-incident-reports"],
-  visitors: ["visitor-mgmt:see-all-visitor"],
+  visitors: ["visitor-mgmt:see-all-visitor", "visitorManagement:see-all-visitor"],
   facilityBookings: ["facility-booking-mgmt:see-all-facility-booking"],
-  activity: ["work_orders:see-all-work-orders"],
+  activity: WORK_ORDER_SEE_ALL,
   upcomingEvents: ["event-mgmt:see-all-event"],
   todayReminders: ["event-mgmt:see-all-event"],
   todayAttentions: [
     "incident-reports:see-incident-reports",
     "facility-booking-mgmt:see-all-facility-booking",
   ],
-  workOrderStatus: ["work_orders:see-all-work-orders"],
+  workOrderStatus: WORK_ORDER_SEE_ALL,
   feedbacks: ["feedbacks:see-all-feedback"],
   activePatrol: ["virtual-patrol:see-all-virtual-patrol-logs"],
 };
 const moduleWidgetPermissions: Record<string, string[]> = {
-  openWorkOrder: ["work_orders:see-all-work-orders"],
-  workOrders: ["work_orders:see-all-work-orders"],
-  activity: ["work_orders:see-all-work-orders"],
+  openWorkOrder: WORK_ORDER_SEE_ALL,
+  workOrders: WORK_ORDER_SEE_ALL,
+  activity: WORK_ORDER_SEE_ALL,
   taskSchedule: [
     "cleaning-schedule-mgmt:see-all-schedules",
     "schedule-task-mgmt:see-all-schedule-tasks",
@@ -1406,7 +1420,12 @@ function canViewWidget(key: string) {
     ? propertyWidgetPermissions[key]
     : moduleWidgetPermissions[key];
-  if (!permissions) return true;
+  // Fail closed. This used to return `true` while `userAppRole` was still
+  // unresolved, so the dashboard drew every widget and then took some away --
+  // and if the role fetch failed outright it drew every widget permanently.
+  // Every other gate in this package returns `false` without a role; this one
+  // now agrees with them.
+  if (!permissions) return false;
   if (permissions.includes("*")) return true;
   if (

package/components/DocumentManagement.vue CHANGED Viewed

@@ -610,10 +610,6 @@
 // into the consuming apps but not reliably into the layer's own components.
 import { readListPage } from "../utils/list-page";
-definePageMeta({
-  middleware: ["01-auth", "02-org"],
-  memberOnly: true,
-});
 const props = defineProps({
   headers: {
     type: Array as PropType<Array<Record<string, any>>>,