@7365admin1/layer-common 4.0.1 → 4.0.3-staging.220

package/components/RolePermissionFormPreviewUpdate.vue

@@ -99,15 +99,12 @@
             </div>
           </v-col>
 
-          <v-col v-if="edit" cols="12" class="my-2">
-            <v-row no-gutters>
-              <v-col cols="12" class="text-center">
-                <span class="role-perm__error">{{ message }}</span>
-              </v-col>
-            </v-row>
-          </v-col>
-
-          <v-col cols="12" class="my-2">
+          <!--
+            One message, once. This block used to appear twice -- inside
+            `v-if="edit"` and again unconditionally -- so a refused save printed
+            the server's sentence back to back.
+          -->
+          <v-col v-if="message" cols="12" class="my-2">
             <v-row no-gutters>
               <v-col cols="12" class="text-center">
                 <span class="role-perm__error">{{ message }}</span>
@@ -122,7 +119,7 @@
       <AppButton v-if="!edit" variant="ghost" @click="emit('cancel')">Close</AppButton>
       <AppButton v-else variant="ghost" @click="edit = false">Cancel</AppButton>
 
-      <AppButton v-if="!edit" :disabled="disable" @click="edit = true">Edit</AppButton>
+      <AppButton v-if="!edit && canUpdateRole" :disabled="disable" @click="edit = true">Edit</AppButton>
       <AppButton v-else :disabled="Boolean(errorMessages) || disable" @click="submit()">
         Submit
       </AppButton>
@@ -159,6 +156,15 @@ const props = defineProps({
     type: Array as PropType<string[]>,
     default: () => [],
   },
+  // "Update role". This dialog had no permission prop at all, so it showed Edit
+  // to everyone -- including on the seeded platform-owner role -- and the
+  // `canUpdateRole` the apps have been passing to `RolePermissionMain` in good
+  // faith did nothing. `RolePermissionMain` is the only thing that renders this
+  // dialog and always passes it, so the default is closed.
+  canUpdateRole: {
+    type: Boolean,
+    default: false,
+  },
 });
 
 const validForm = ref(false);
@@ -282,7 +288,12 @@ async function submit() {
     await updatePermissionById(props.id, definedModel.value);
     emit("success");
   } catch (error: any) {
-    message.value = error.response._data.message;
+    // `error.response` is undefined on a network or timeout failure, so the old
+    // unguarded chain threw inside its own catch: nothing was shown, the button
+    // came back enabled, and the save looked like it had simply been ignored.
+    message.value =
+      error?.response?._data?.message ??
+      "Could not save this role. Please check your connection and try again.";
   } finally {
     disable.value = false;
   }

package/components/RolePermissionMain.vue

@@ -42,12 +42,13 @@
 
       <v-data-table
           :headers="props.headers"
-          :items="items"
+          :items="visibleItems"
           item-value="_id"
           items-per-page="20"
           fixed-header
           hide-default-footer
           hide-default-header
+          :no-data-text="emptyText"
           @click:row="tableRowClickHandler"
           style="max-height: calc(100vh - (180px))"
         >
@@ -102,6 +103,7 @@
         v-model:edit="edit"
         :name="name"
         :id="roleId"
+        :can-update-role="props.canUpdateRole"
         :web-only-resources="props.webOnlyResources"
       />
     </v-dialog>
@@ -245,13 +247,18 @@ const props = defineProps({
     type: Boolean,
     default: false,
   },
+  // "See all roles". Defaults to `true` because nine of the ten pages that
+  // render this component do not pass it, and until now nothing read it at all
+  // -- so `true` is exactly what those pages have always had. The one page that
+  // does pass it now gets a gate that works.
   canViewRole: {
     type: Boolean,
-    default: false,
+    default: true,
   },
+  // "See role details" -- opening a role. Same reasoning as `canViewRole`.
   canViewByRole: {
     type: Boolean,
-    default: false,
+    default: true,
   },
   canDeleteRole: {
     type: Boolean,
@@ -281,6 +288,7 @@ const {
   data: getRoleReq,
   refresh: getRoles,
   status: getRoleReqStatus,
+  error: getRoleReqError,
 } = useLazyAsyncData(
   "roles-permissions-get-all",
   () =>
@@ -305,7 +313,33 @@ watchEffect(() => {
   }
 });
 
+// "See all roles". Without it the list is not drawn at all, and `emptyText`
+// below says so rather than leaving a blank table to be read as a failure.
+const visibleItems = computed(() => (props.canViewRole ? items.value : []));
+
+/**
+ * SAY WHY THE TABLE IS EMPTY. "No data available" was shown for three
+ * different situations -- you may not see roles, the request failed, and this
+ * organisation genuinely has none -- so a refusal was indistinguishable from an
+ * empty list and neither was distinguishable from a broken screen.
+ */
+const emptyText = computed(() => {
+  if (!props.canViewRole) return "You do not have permission to view roles.";
+  const status = (getRoleReqError.value as any)?.response?.status
+    ?? (getRoleReqError.value as any)?.statusCode;
+  if (status === 401 || status === 403) {
+    return "You do not have permission to view the roles for this organisation.";
+  }
+  if (getRoleReqError.value) {
+    return "Could not load roles. Please refresh to try again.";
+  }
+  return "No roles have been created yet.";
+});
+
 function tableRowClickHandler(_: any, data: any) {
+  // "See role details". Ungated until now, which is why granting or withholding
+  // it changed nothing.
+  if (!props.canViewByRole) return;
   previewDialog.value = true;
   roleId.value = data.item._id;
 }
@@ -348,7 +382,8 @@ const { getRoleById: _getRoleById, deleteRole } = useRole();
 
 const { data: role, refresh: getRoleById } = useLazyAsyncData(
   "role-permissions-get-by-id",
-  () => _getRoleById(roleId.value)
+  () => _getRoleById(roleId.value),
+  { immediate: false }
 );
 
 watchEffect(() => {

package/components/VehicleManagement.vue

@@ -167,10 +167,6 @@
 import useUtils from '../composables/useUtils';
 import useVehicle from '../composables/useVehicle';
 
-definePageMeta({
-  middleware: ["01-auth", "02-org"],
-  memberOnly: true,
-})
 
 
 const props = defineProps({

package/components/VisitorManagement.vue

@@ -1226,9 +1226,6 @@
 import moment from "moment-timezone";
 import QRCode from "qrcode";
 
-definePageMeta({
-  middleware: ["01-auth", "02-org"],
-});
 
 const { downloadPDF } = usePDFDownload();
 

package/components/VisitorsReportPreview.vue

@@ -115,9 +115,6 @@ import useUtils from '../composables/useUtils';
 import useSite from '../composables/useSite';
 
 
-definePageMeta({
-    middleware: ["01-auth", "02-org"],
-});
 
 
 const props = defineProps({

package/composables/useBulletinBoardPermission.ts

@@ -2,7 +2,12 @@ import { useCommonPermissions } from "./useCommonPermission";
 
 export function useBulletinBoardPermission() {
   const { hasPermission } = usePermission();
-  const { bulletinBoardPermissions: permissions } = useCommonPermissions();
+  // Same nesting rule as every other permission composable: `hasPermission`
+  // reads `catalogue[resource][action]`, and `bulletinBoardPermissions` is a
+  // flat `{action: ...}` map. Unwrapped, `catalogue["bulletin-board"]` was
+  // undefined and all five gates were reachable only through `"*"`.
+  const { bulletinBoardPermissions } = useCommonPermissions();
+  const permissions: TPermissions = { "bulletin-board": bulletinBoardPermissions };
 
   const { userAppRole } = useLocalSetup();
 

package/composables/useConsoleTier.ts

@@ -0,0 +1,73 @@
+import { computed } from "vue";
+import { useCookie, useRuntimeConfig, useState } from "#app";
+
+import useMember from "./useMember";
+import useRole from "./useRole";
+import { consoleTier, type TConsoleTier } from "../utils/console-tier";
+
+/**
+ * WHICH SEVEN365 TIER THE SIGNED-IN PERSON IS - fetched once, shared, and
+ * used ONLY to decide what to draw.
+ *
+ * The rule lives in `utils/console-tier.ts` and mirrors the server's
+ * `isPlatformOwner`. Read that file for why `role.default` is the marker, and
+ * for the honest limit: the server re-decides this on every write from the
+ * session, so a browser that flips this boolean gets a visible button and a
+ * 401. Nothing here is a permission check.
+ *
+ * Both requests hit endpoints the console already uses, so no new API surface
+ * and no proxy rule was needed:
+ *
+ *   GET /api/members/user/:user/app/admin   the Seven365 staff membership
+ *   GET /api/roles/id/:role                 that membership's role document
+ *
+ * `admin` is the membership type deliberately, not the org app's own `APP`.
+ * A Seven365 person can also hold an ordinary organisation membership - and on
+ * staging that one carries a role merely NAMED "Super Admin" - so asking for
+ * the org membership would read the wrong row and answer the wrong tier.
+ */
+export default function useConsoleTier() {
+  const { cookieConfig } = useRuntimeConfig().public;
+
+  const tier = useState<TConsoleTier>("consoleTier", () => "none");
+  // Separate from `tier` because "not looked yet" and "looked, not staff" are
+  // both `none` on the glass but only one of them should be re-tried.
+  const resolved = useState<boolean>("consoleTierResolved", () => false);
+
+  const { getByUserIdType } = useMember();
+  const { getRoleById } = useRole();
+
+  async function load(force = false): Promise<TConsoleTier> {
+    if (resolved.value && !force) return tier.value;
+
+    const user = useCookie("user", cookieConfig).value as string | null;
+
+    try {
+      if (!user) {
+        tier.value = "none";
+        return tier.value;
+      }
+
+      const member = await getByUserIdType(user, "admin");
+      const role = member?.role ? await getRoleById(member.role as string) : null;
+
+      tier.value = consoleTier(member, role);
+    } catch {
+      // Fails closed. A 404 here is the ordinary answer for somebody who is
+      // not Seven365 staff at all, so it is not worth a console error.
+      tier.value = "none";
+    } finally {
+      resolved.value = true;
+    }
+
+    return tier.value;
+  }
+
+  return {
+    tier,
+    resolved,
+    isOwner: computed(() => tier.value === "owner"),
+    isStaff: computed(() => tier.value === "owner" || tier.value === "staff"),
+    load,
+  };
+}

package/composables/useHidAmico.ts

@@ -101,6 +101,14 @@ type HidFacialEnrollmentResult = {
   errors?: Array<{ code?: number; message?: string }>;
 };
 
+export type HidFacialSyncResult = {
+  readerId: string;
+  facialDetected: number;
+  syncedCount: number;
+  unmappedCount: number;
+  message: string;
+};
+
 export type HidPhysicalCardType = "pacs" | "csn";
 
 export type HidPhysicalCard = {
@@ -191,6 +199,13 @@ export default function useHidAmico() {
     });
   }
 
+  function syncReaderFacialData(readerId: string) {
+    return useNuxtApp().$api<{ data: HidFacialSyncResult }>(
+      `${basePath}/readers/${readerId}/facial-sync`,
+      { method: "POST" },
+    );
+  }
+
   function configureReaderIntegration(readerId: string) {
     return useNuxtApp().$api<HidApiRecord>(`${basePath}/readers/${readerId}/configure`, {
       method: "POST",
@@ -254,6 +269,7 @@ export default function useHidAmico() {
     limit?: number;
     search?: string;
     status?: "mapped" | "unmapped" | "";
+    includeVisitors?: boolean;
   } = {}) {
     return useNuxtApp().$api<HidCollectionResponse>(`${basePath}/readers/${readerId}/users`, {
       method: "GET",
@@ -267,7 +283,7 @@ export default function useHidAmico() {
     search?: string;
     status?: "authorized" | "not_authorized" | "unknown" | "";
     method?: "facial" | "qr_code" | "id_password" | "pin" | "card" | "";
-    tab?: "resident" | "visitor" | "administrator";
+    tab?: "all" | "unmapped" | "mapped" | "resident" | "visitor" | "administrator";
   } = {}) {
     return useNuxtApp().$api<HidCollectionResponse>(`${basePath}/readers/${readerId}/access-logs`, {
       method: "GET",
@@ -499,6 +515,7 @@ export default function useHidAmico() {
     deleteReader,
     testReader,
     syncReader,
+    syncReaderFacialData,
     configureReaderIntegration,
     setReaderMonitor,
     setReaderOperatingMode,

package/composables/useHidNavigation.ts

@@ -23,12 +23,19 @@ export default function useHidNavigation() {
           },
         },
         {
-          title: "HID Users",
+          title: "HID Reader Users",
           route: {
             name: "org-site-access-mgmt-hid-users",
             params: { org, site },
           },
         },
+        {
+          title: "HID User Mapping",
+          route: {
+            name: "org-site-access-mgmt-hid-user-mapping",
+            params: { org, site },
+          },
+        },
         {
           title: "HID Cards",
           route: {

package/composables/useMember.ts

@@ -28,10 +28,6 @@ export default function useMember() {
   function getAllByUserId(user: string) {
     return useNuxtApp().$api<TMember>(`/api/members/users/${user}`);
   }
-  function getByMemberId(user: string) {
-    return useNuxtApp().$api<TMember>(`/api//user/${user}`);
-  }
-
   function getByUserIdType(user: string, type: string) {
     return useNuxtApp().$api<TMember>(`/api/members/user/${user}/app/${type}`);
   }
@@ -165,7 +161,6 @@ export default function useMember() {
     createUserByVerification,
     createMemberInvite,
     getByUserIdType,
-    getByMemberId,
     updateMemberStatus,
     updateMemberRole,
     createMemberDirect,

package/composables/useSettingsPermission.ts

@@ -2,7 +2,13 @@ import { useCommonPermissions } from "./useCommonPermission";
 
 export function useSettingsPermission() {
   const { hasPermission } = usePermission();
-  const { siteSettingsPermissions: permissions } = useCommonPermissions();
+  // `hasPermission` looks the action up as `catalogue[resource][action]`, so the
+  // catalogue has to be nested by resource. `siteSettingsPermissions` is a flat
+  // `{action: ...}` map, so passing it straight through made
+  // `catalogue["site-settings"]` undefined and every check below fell through to
+  // `false` -- only the `"*"` short-circuit could ever open a panel.
+  const { siteSettingsPermissions } = useCommonPermissions();
+  const permissions: TPermissions = { "site-settings": siteSettingsPermissions };
   const { userAppRole } = useLocalSetup();
 
   const canManageSiteInformation = computed(() => {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.0.1",
+  "version": "4.0.3-staging.220",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -35,7 +35,7 @@
     "build": "nuxt build .playground",
     "generate": "nuxt generate .playground",
     "preview": "nuxt preview .playground",
-    "test": "esbuild composables/useVisitorSocket.ts --format=esm --outfile=test/.build/useVisitorSocket.mjs --log-level=error && node --test \"test/*.test.mjs\" && yarn test:units",
+    "test": "esbuild composables/useVisitorSocket.ts --format=esm --outfile=test/.build/useVisitorSocket.mjs --log-level=error && node --experimental-strip-types --test \"test/*.test.mjs\" && yarn test:units",
     "test:units": "node --experimental-strip-types --test \"utils/*.test.ts\"",
     "release": "yarn run build && changeset publish"
   },

package/pages/[org]/[site]/access-mgmt/hid-user-mapping/index.vue

@@ -0,0 +1,23 @@
+<template>
+  <v-container fluid>
+    <HidEnabledGate
+      :site="siteId"
+      :org="orgId"
+      message="Enable HID as a service for this site before mapping HID users."
+    >
+      <HidUserMapping :site="siteId" />
+    </HidEnabledGate>
+  </v-container>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: "default",
+  middleware: ["01-auth", "02-org"],
+  memberOnly: true,
+});
+
+const route = useRoute();
+const siteId = computed(() => String(route.params.site ?? ""));
+const orgId = computed(() => String(route.params.org ?? ""));
+</script>

package/pages/[org]/[site]/access-mgmt/hid-users/index.vue

@@ -5,7 +5,7 @@
       :org="orgId"
       message="Enable HID as a service for this site before managing HID users."
     >
-      <HidUserEnrollment :site="siteId" />
+      <HidReaderUserRoster :site="siteId" />
     </HidEnabledGate>
   </v-container>
 </template>

package/utils/client-subscription.test.ts

@@ -143,3 +143,98 @@ test("a billing cycle the screen does not know is shown, not swallowed", () => {
     "Yearly",
   );
 });
+
+/* ── SUSPEND / REACTIVATE, THE STATE THE LIST HAS TO SHOW AFTERWARDS ──────
+ *
+ * `PATCH /api/organizations/:id/status` (core `organization.controller.ts`
+ * `updateStatus`) writes BOTH `organizations.status` and the organisation's
+ * subscription status - the second one so the hourly sync job agrees rather
+ * than undoing the decision an hour later. So after the list is re-read, a
+ * suspended client arrives with both set, and this is what the row then says.
+ * Nothing in the screen holds a second copy of that state.
+ */
+
+/** Exactly what `updateStatus` leaves behind, applied to a list row. */
+function afterStatusChange(org: Record<string, any>, status: "active" | "suspended") {
+  return {
+    ...org,
+    status,
+    subscription: org.subscription?._id
+      ? { ...org.subscription, status }
+      : org.subscription,
+  };
+}
+
+test("suspending a client makes the row say Suspended", () => {
+  const before = orgWithSub({});
+  assert.equal(describeClientSubscription(before, NOW).state, "active");
+
+  const after = afterStatusChange(before, "suspended");
+  const v = describeClientSubscription(after, NOW);
+
+  assert.equal(v.state, "suspended");
+  assert.equal(v.label, "Suspended");
+  // Suspension is a decision somebody took, not a thing needing attention.
+  assert.equal(v.needsAttention, false);
+  // The dates are untouched - "data is kept" is visible, not just claimed.
+  assert.equal(v.billingCycle, describeClientSubscription(before, NOW).billingCycle);
+  assert.equal(v.start, describeClientSubscription(before, NOW).start);
+  assert.equal(v.end, describeClientSubscription(before, NOW).end);
+});
+
+test("reactivating puts the row back exactly where it was", () => {
+  const before = orgWithSub({});
+  const round = afterStatusChange(afterStatusChange(before, "suspended"), "active");
+
+  assert.deepEqual(
+    describeClientSubscription(round, NOW),
+    describeClientSubscription(before, NOW),
+  );
+});
+
+test("a complimentary client suspends and reactivates the same way", () => {
+  // All 11 production clients are complimentary, so this is the case that
+  // actually happens - and `billingMode` must survive the round trip.
+  const before = orgWithSub({ billingMode: "complimentary" });
+  assert.equal(describeClientSubscription(before, NOW).state, "complimentary");
+
+  assert.equal(
+    describeClientSubscription(afterStatusChange(before, "suspended"), NOW).state,
+    "suspended",
+  );
+  assert.equal(
+    describeClientSubscription(afterStatusChange(before, "active"), NOW).state,
+    "complimentary",
+  );
+});
+
+test("a client with NO subscription document still suspends", () => {
+  // `updateStatus` writes the organisation's status either way and only
+  // touches a subscription if one exists. This row has none, so the
+  // subscription column keeps saying so - the ORGANISATION's status is what
+  // moved it to the Suspended tab, and that is the honest reading of the
+  // record. The list is fetched per tab, so the row is on the tab that matches.
+  const before = { _id: "o-1", name: "A Client", status: "active", subscription: {} };
+  const after = afterStatusChange(before, "suspended");
+
+  assert.equal(after.status, "suspended");
+  assert.equal(describeClientSubscription(after, NOW).state, "none");
+  assert.equal(describeClientSubscription(after, NOW).label, "No subscription set up");
+});
+
+test("suspending does not clear an end date that had already passed", () => {
+  // Owner decision 8's flag and a suspension are different things, and the
+  // flag is derived at read time - suspending must not hide the fact that the
+  // subscription had run out, because reactivating brings it straight back.
+  const overdue = orgWithSub({ nextBillingDate: "2026-01-01T00:00:00.000Z" });
+  assert.equal(describeClientSubscription(overdue, NOW).needsAttention, true);
+
+  assert.equal(
+    describeClientSubscription(afterStatusChange(overdue, "suspended"), NOW).state,
+    "suspended",
+  );
+  assert.equal(
+    describeClientSubscription(afterStatusChange(overdue, "active"), NOW).needsAttention,
+    true,
+  );
+});

package/utils/console-tier.test.ts

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { consoleTier } from "./console-tier.ts";
+
+/** The seeded platform-staff role - `user.service.ts createDefaultUser()`. */
+const OWNER_ROLE = {
+  _id: "r-owner",
+  name: "Super Admin",
+  type: "admin",
+  default: true,
+  permissions: [],
+};
+
+/** A role made through the admin app. `default` is not in its Joi schema. */
+const STAFF_ROLE = {
+  _id: "r-staff",
+  name: "Operations",
+  type: "admin",
+  permissions: ["organization:read"],
+};
+
+const ADMIN_MEMBER = { _id: "m-1", user: "u-1", type: "admin", role: "r-owner" };
+
+test("the owner is an admin member on an admin role marked default", () => {
+  assert.equal(consoleTier(ADMIN_MEMBER, OWNER_ROLE), "owner");
+});
+
+test("ordinary Seven365 staff are admin, but their role is not the default one", () => {
+  assert.equal(consoleTier(ADMIN_MEMBER, STAFF_ROLE), "staff");
+  // The absence of the field, not just `false`, is the ordinary case: the admin
+  // app's create-role form cannot send it at all.
+  assert.equal(consoleTier(ADMIN_MEMBER, { ...STAFF_ROLE, default: false }), "staff");
+});
+
+test("BOTH halves are required - a role name proves nothing", () => {
+  // Staging carries an ordinary ORGANISATION role merely NAMED "Super Admin",
+  // and `web-app-org/pages/index.vue` gated the whole console on that name.
+  // That row must not reach owner, or staff, on the strength of its name.
+  const impostor = { _id: "r-x", name: "Super Admin", type: "organization", default: true };
+  assert.equal(consoleTier(ADMIN_MEMBER, impostor), "none");
+
+  // ...and an admin-typed role held through a non-admin membership is not
+  // staff either. `isSuperAdmin` requires `members.type === "admin"` too.
+  assert.equal(consoleTier({ ...ADMIN_MEMBER, type: "organization" }, OWNER_ROLE), "none");
+});
+
+test("`default` is only honoured when it is exactly true", () => {
+  // A truthy-but-not-true value is not what `createDefaultUser` writes, and the
+  // server compares with `===`. Drawing an owner control off `"true"` or `1`
+  // would show a button the server then refuses.
+  for (const value of ["true", 1, {}, "yes"]) {
+    assert.equal(
+      consoleTier(ADMIN_MEMBER, { ...STAFF_ROLE, default: value }),
+      "staff",
+      JSON.stringify(value),
+    );
+  }
+});
+
+test("anything unproven is `none` - this fails closed", () => {
+  const unproven: Array<[any, any]> = [
+    [null, OWNER_ROLE],
+    [undefined, OWNER_ROLE],
+    [{}, OWNER_ROLE],
+    [ADMIN_MEMBER, null], // the role request failed
+    [ADMIN_MEMBER, undefined],
+    [ADMIN_MEMBER, {}],
+    [null, null],
+    // An error body answered instead of a record. `member.controller.ts`
+    // answers `NotFoundError` as JSON, so this is a real wire shape.
+    [{ status: "error", message: "Member not found." }, OWNER_ROLE],
+  ];
+
+  for (const [member, role] of unproven) {
+    assert.equal(consoleTier(member, role), "none", JSON.stringify([member, role]));
+  }
+});
+
+test("a deleted staff membership is not staff", () => {
+  // `isSuperAdmin` excludes it server-side; the endpoint the browser reads does
+  // not, so it is excluded here to keep the two answers the same.
+  assert.equal(
+    consoleTier({ ...ADMIN_MEMBER, status: "deleted" }, OWNER_ROLE),
+    "none",
+  );
+});