@7365admin1/layer-common 4.0.3-staging.235 → 4.0.3-staging.236

package/composables/useLocalSetup.ts

@@ -1,12 +1,38 @@
 export function useLocalSetup() {
   const userAppRole = useState<TRole | null>("userAppRole", () => null);
 
+  // Where the `userAppRole` lookup has got to. `userAppRole` on its own cannot
+  // say this, and conflating the two states below is what caused both halves of
+  // the permission bug:
+  //
+  //   "idle" | "loading" -- nobody has resolved a role yet, or one is in
+  //                         flight. NOT an answer. A gate read here must not
+  //                         grant, and an app that cares should render a
+  //                         loading state rather than guess.
+  //   "resolved"         -- the lookup finished. `userAppRole` is either the
+  //                         role, or `null` because this account genuinely
+  //                         holds no member document for this app. Seven365
+  //                         staff-console accounts and residents never hold
+  //                         one, and "no role" is the correct final answer for
+  //                         them -- not a failure, and not a reason to redirect.
+  //
+  // A failed request drops back to "idle", never to "resolved", so a transient
+  // blip retries on the next navigation instead of denying for the whole session.
+  const userAppRoleStatus = useState<"idle" | "loading" | "resolved">(
+    "userAppRoleStatus",
+    () => "idle"
+  );
+
+  const isAppRoleResolved = computed(() => userAppRoleStatus.value === "resolved");
+
   const id = useState<string | null>("memberShipOrgId", () => null);
 
   const orgNature = useState<string>("orgNature", () => "");
 
   return {
     userAppRole,
+    userAppRoleStatus,
+    isAppRoleResolved,
     id,
     orgNature,
   };

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.0.3-staging.235",
+  "version": "4.0.3-staging.236",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/plugins/secure-member.client.ts

@@ -4,20 +4,82 @@ const hexSchema = z
   .string()
   .regex(/^[0-9a-fA-F]{24}$/, "Invalid organization ID");
 
+function statusOf(error: any) {
+  return error?.statusCode ?? error?.status ?? error?.response?.status;
+}
+
 export default defineNuxtPlugin(() => {
   const router = useRouter();
   const { getByUserType } = useMember();
   const { getRoleById } = useRole();
   const { getById } = useOrg();
 
-  const { userAppRole, id, orgNature } = useLocalSetup();
+  const { userAppRole, userAppRoleStatus, id, orgNature } = useLocalSetup();
+
+  // Resolved once per signed-in session, not once per navigation. Keyed by the
+  // user cookie so signing in as somebody else re-resolves.
+  let resolvedFor: string | null = null;
+  let inFlight: Promise<void> | null = null;
+  let hasMemberDocument = false;
+
+  // Deliberately never redirects and never throws.
+  //
+  // `GET /api/members/user/:id/app/:type` returns 404 for any account holding no
+  // member document for this app -- the Seven365 staff console and residents
+  // both do -- and that is a real answer ("no organisation role"), not an error.
+  // Treating it as an error is what would bounce those accounts off their own
+  // pages; leaving it unanswered is what let gates fail open.
+  async function resolveAppRole(userId: string) {
+    if (resolvedFor === userId) return;
+    if (inFlight) return inFlight;
+
+    userAppRoleStatus.value = "loading";
+    inFlight = run(userId).finally(() => {
+      inFlight = null;
+    });
+    return inFlight;
+  }
+
+  async function run(userId: string) {
+    const APP = useRuntimeConfig().public.APP;
+
+    try {
+      // The org query is not sent: the endpoint keys on user + app type only, so
+      // the role does not depend on which organisation is in the current route.
+      const member = await getByUserType(userId, APP);
+      hasMemberDocument = true;
+      id.value = member.org ?? "";
+      userAppRole.value = member.role ? await getRoleById(member.role) : null;
+    } catch (error) {
+      userAppRole.value = null;
+      hasMemberDocument = false;
+      // Anything that is not a 404 is transient. Stay unresolved so the next
+      // navigation tries again rather than denying for the rest of the session.
+      if (statusOf(error) !== 404) {
+        userAppRoleStatus.value = "idle";
+        return;
+      }
+    }
+
+    resolvedFor = userId;
+    userAppRoleStatus.value = "resolved";
+  }
 
   router.beforeEach(async (to) => {
+    const userId = useCookie("user").value ?? "";
+
+    // Resolve for EVERY authenticated route, not only `memberOnly` ones. Gates
+    // are read on pages that carry no such flag -- the staff console cannot
+    // carry it at all, it has no organisation in the route -- and until this
+    // ran there the role stayed null for the life of the page: gates that
+    // default open granted everything, gates that fail closed denied everything.
+    // Awaited, so no gate is ever evaluated against an unresolved role.
+    if (userId) await resolveAppRole(userId);
+
     const isMember = to.meta?.memberOnly;
 
     if (!isMember) return;
 
-    const APP = useRuntimeConfig().public.APP;
     const org =
       (to.params.org as string) || (to.params.organization as string) || "";
 
@@ -25,27 +87,19 @@ export default defineNuxtPlugin(() => {
       return { name: "require-organization-membership" };
     }
 
-    const userId = useCookie("user").value ?? "";
     if (!userId) return { name: "index" };
 
-    try {
-      const userMemberData = await getByUserType(userId, APP, org);
-      id.value = userMemberData.org ?? "";
-
-      const [orgResult, roleResult] = await Promise.allSettled([
-        getById(org),
-        userMemberData.role ? getRoleById(userMemberData.role) : null,
-      ]);
-
-      if (orgResult.status === "fulfilled" && orgResult.value) {
-        orgNature.value = orgResult.value.nature ?? "";
-      }
+    // Same bounce as before for an account with no member document. Gated on a
+    // finished lookup so a failed request no longer throws the user out.
+    if (userAppRoleStatus.value === "resolved" && !hasMemberDocument) {
+      return { name: "index" };
+    }
 
-      if (roleResult.status === "fulfilled" && roleResult.value) {
-        userAppRole.value = roleResult.value;
-      }
+    try {
+      const orgResult = await getById(org);
+      if (orgResult) orgNature.value = orgResult.nature ?? "";
     } catch (error) {
-      return { name: "index" };
+      // Cosmetic only, and it never blocked navigation before either.
     }
   });
 });