@7365admin1/layer-common 4.0.4-staging.243 → 4.1.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @iservice365/layer-common
 
+## 4.1.1
+
+### Patch Changes
+
+- df2fede: Fix the Service Providers gate: check the permission the estate actually stores
+
+  `useServiceProviderPermission` shipped in 4.0.3 asking for
+  `service-provider:<action>`. Measured read-only against the staging `roles`
+  collection on 2026-08-26, that spelling is held by **0 of 428 roles**, while
+  `service-provider-mgmt:add-service-provider`, `:invite-service-provider` and
+  `:view-service-providers` are held by **79 roles each**. Every role except the 71
+  holding `*` was refused, on any consumer that does not bind the three props.
+
+  The gate now checks `service-provider-mgmt` -- the canonical resource in
+  `constants/permissions.ts`, the one the server reads in
+  `notification-category.util.ts`, and the one `-property-management`'s own
+  `useLocalPermission` has always checked. The view gate accepts both
+  `view-service-providers` (what the 79 roles store today) and
+  `see-all-service-providers` (canonical), so no role migration is needed for this
+  fix to work and none is invalidated later.
+
+  No permission key is renamed or invented, and no role document changes.
+
+## 4.1.0
+
+### Minor Changes
+
+- a45deb4: Add a canonical permission catalogue and a test that fails when the UI and the server stop agreeing
+
+  `constants/permissions.ts` exports the canonical spelling of every permission the estate uses, typed so a misspelt string is a build error rather than a check that is silently false forever, plus a map from each legacy spelling (four for work orders, two each for visitors, bulletin boards, buildings and service providers) to its canonical form.
+
+  Additive only: no gate is rewired and no existing check changes the string it asks for. `test/permission-vocabulary.test.mjs` fails when a new string appears in this package, or when the server's enforced set — snapshotted in `test/fixtures/server-permissions.json` by `tools/refresh-server-permissions.mjs` — contains something the catalogue has no name for.
+
 ## 4.0.3
 
 ### Patch Changes
@@ -280,11 +313,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-        GET /api/members/user/:user/app/admin    the Seven365 staff membership
-        GET /api/roles/id/:role                  that membership's role document
+            GET /api/members/user/:user/app/admin    the Seven365 staff membership
+            GET /api/roles/id/:role                  that membership's role document
 
-        owner  = member.type === "admin" && role.type === "admin" && role.default === true
-        staff  = member.type === "admin" && role.type === "admin"
+            owner  = member.type === "admin" && role.type === "admin" && role.default === true
+            staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.0.4-staging.243",
+  "version": "4.1.1",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",