@7365admin1/layer-common 4.1.1 → 4.1.2-staging.245

package/composables/useBulletinBoardPermission.ts

@@ -7,40 +7,88 @@ export function useBulletinBoardPermission() {
   // flat `{action: ...}` map. Unwrapped, `catalogue["bulletin-board"]` was
   // undefined and all five gates were reachable only through `"*"`.
   const { bulletinBoardPermissions } = useCommonPermissions();
-  const permissions: TPermissions = { "bulletin-board": bulletinBoardPermissions };
+
+  // This layer shipped asking for `bulletin-board:<action>` only. Measured
+  // read-only against the staging `roles` collection on 2026-08-26 (428 roles,
+  // 71 of them holding `*`), that resource is held by 8-9 roles, while the
+  // `-mgmt` spelling of the same five actions is held by 80-82:
+  //
+  //   bulletin-board:add-bulletin-board                8   -mgmt: 82
+  //   bulletin-board:see-all-bulletin-boards           9   -mgmt: 3
+  //                                                        -mgmt (singular): 80
+  //   bulletin-board:see-bulletin-board-details        8   -mgmt: 82
+  //   bulletin-board:update-bulletin-board             8   -mgmt: 81
+  //   bulletin-board:delete-bulletin-board             8   -mgmt: 81
+  //
+  // `-hygiene`, `-security` and `-pest-control` leave
+  // `canViewBulletinBoardDetails` unbound on `BulletinBoardManagement`, so this
+  // composable is what gates their sidebar-linked bulletin board page, and the
+  // ~74 roles holding the right under `bulletin-board-mgmt` were refused.
+  //
+  // Both resources are accepted rather than swapped, so the gate is correct
+  // before AND after any role migration and needs none to work. No permission
+  // key is renamed or invented and no role document changes -- renaming a key
+  // without migrating the roles that store it is what left the pest-control
+  // work-order gate stranding 92 roles. Every string below is canonical or a
+  // recorded entry in `LEGACY_PERMISSION_ALIASES`.
+  const permissions: TPermissions = {
+    "bulletin-board": bulletinBoardPermissions,
+    "bulletin-board-mgmt": {
+      ...bulletinBoardPermissions,
+      // `-property-management` and the security mobile app say "board"
+      // singular; that is the spelling 80 roles were actually granted.
+      "see-all-bulletin-board": bulletinBoardPermissions["see-all-bulletin-boards"],
+    },
+  };
 
   const { userAppRole } = useLocalSetup();
 
+  // Every gate fails closed while the role is still resolving: `userAppRole` is
+  // null on the first tick and a null role must never read as "allowed".
   const canViewBulletinBoard = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
-    return hasPermission(userAppRole.value, permissions, "bulletin-board", "see-all-bulletin-boards");
+    return (
+      hasPermission(userAppRole.value, permissions, "bulletin-board", "see-all-bulletin-boards") ||
+      hasPermission(userAppRole.value, permissions, "bulletin-board-mgmt", "see-all-bulletin-boards") ||
+      hasPermission(userAppRole.value, permissions, "bulletin-board-mgmt", "see-all-bulletin-board")
+    );
   });
 
   const canCreateBulletinBoard = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
-    return hasPermission(userAppRole.value, permissions, "bulletin-board", "add-bulletin-board");
+    return (
+      hasPermission(userAppRole.value, permissions, "bulletin-board", "add-bulletin-board") ||
+      hasPermission(userAppRole.value, permissions, "bulletin-board-mgmt", "add-bulletin-board")
+    );
   });
 
   const canUpdateBulletinBoard = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
-    return hasPermission(userAppRole.value, permissions, "bulletin-board", "update-bulletin-board");
+    return (
+      hasPermission(userAppRole.value, permissions, "bulletin-board", "update-bulletin-board") ||
+      hasPermission(userAppRole.value, permissions, "bulletin-board-mgmt", "update-bulletin-board")
+    );
   });
 
   const canViewBulletinBoardDetails = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
-    return hasPermission(userAppRole.value, permissions, "bulletin-board", "see-bulletin-board-details");
+    return (
+      hasPermission(userAppRole.value, permissions, "bulletin-board", "see-bulletin-board-details") ||
+      hasPermission(userAppRole.value, permissions, "bulletin-board-mgmt", "see-bulletin-board-details")
+    );
   });
 
-
-
   const canDeleteBulletinBoard = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
-    return hasPermission(userAppRole.value, permissions, "bulletin-board", "delete-bulletin-board");
+    return (
+      hasPermission(userAppRole.value, permissions, "bulletin-board", "delete-bulletin-board") ||
+      hasPermission(userAppRole.value, permissions, "bulletin-board-mgmt", "delete-bulletin-board")
+    );
   });
 
   return {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.1.1",
+  "version": "4.1.2-staging.245",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",