@7365admin1/layer-common 4.111.0 → 4.112.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.112.0
+
+### Minor Changes
+
+- 9350b17: Robots: "Open HERO Fleet Core" button (`RobotFleetCoreButton`, in the site robots header) for Super Admin and Property Management. Shown only when `GET /api/robots/fleet-core/session?check=1` answers 200; on click it opens a new tab, fetches the one-hour sign-in pass and points the tab at the console (`https://…/#token=…` only). Web only.
+
 ## 4.111.0
 
 ### Minor Changes
@@ -3080,11 +3086,11 @@ Monthly report: a month that had patrols opens the list of that month's patrol r
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                                                GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                                                GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                                  GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                                  GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                                                owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                                                staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                                  owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                                  staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/Robot/FleetCoreButton.vue

@@ -0,0 +1,48 @@
+<template>
+  <!--
+    "Open HERO Fleet Core" (web only, owner 2026-10-09: Super Admin + Property
+    Management). Shown only when the server says this account may open the
+    console (`?check=1` answered 200) - 404 where Fleet Core is not set up and
+    403 for everyone else keep it hidden. The pass is fetched on click only.
+  -->
+  <v-btn
+    v-if="available"
+    size="small"
+    variant="tonal"
+    color="primary"
+    prepend-icon="mdi-open-in-new"
+    :loading="opening"
+    @click="open"
+  >
+    Open HERO Fleet Core
+  </v-btn>
+  <span v-if="failed" class="hero-tag hero-tag--neutral" role="status">Could not open HERO Fleet Core. Try again.</span>
+</template>
+
+<script setup lang="ts">
+import { onMounted, ref } from "vue";
+import { openFleetCoreConsole } from "../../utils/robot-fleet-core";
+
+const { getFleetCoreSession } = useRobots();
+const available = ref(false);
+const opening = ref(false);
+const failed = ref(false);
+
+onMounted(async () => {
+  try {
+    available.value = (await getFleetCoreSession({ check: true }))?.available === true;
+  } catch {
+    available.value = false;
+  }
+});
+
+async function open() {
+  opening.value = true;
+  failed.value = false;
+  failed.value = !(await openFleetCoreConsole(
+    () => getFleetCoreSession(),
+    () => window.open("", "_blank") as any,
+  ));
+  opening.value = false;
+}
+</script>

package/components/Robot/SiteHeader.vue

@@ -35,6 +35,7 @@
     </div>
     <span class="hero-head__spacer" />
     <div class="hero-header__right">
+      <RobotFleetCoreButton />
       <RobotLiveIndicator :connected="connected" />
       <span class="hero-tag hero-tag--neutral">{{ role }}</span>
     </div>
@@ -45,6 +46,7 @@
 <script setup lang="ts">
 import RobotMark from "./Mark.vue";
 import RobotLiveIndicator from "./LiveIndicator.vue";
+import RobotFleetCoreButton from "./FleetCoreButton.vue";
 import { typeLabel, type TRobotType } from "../../utils/robot-display";
 
 withDefaults(

package/composables/useRobots.ts

@@ -400,6 +400,18 @@ export default function useRobots() {
     });
   }
 
+  /**
+   * HERO Fleet Core sign-in pass (web only): `{ url: "<console>/#token=...", expiresAt }`.
+   * `check: true` only asks whether this account may open the console (mints nothing).
+   * 404 where Fleet Core is not set up, 403 for anyone but Super Admin / Property Management.
+   */
+  function getFleetCoreSession({ check = false }: { check?: boolean } = {}) {
+    return useNuxtApp().$api<{ url?: string; expiresAt?: string; available?: boolean }>("/api/robots/fleet-core/session", {
+      method: "GET",
+      query: check ? { check: "1" } : {},
+    });
+  }
+
   /* ------------------------------------------ alerts + activity log */
 
   /**
@@ -566,6 +578,7 @@ export default function useRobots() {
     listBuildingMaps,
     listSiteBuildingMaps,
     getFleetCoreBuilding,
+    getFleetCoreSession,
     getSiteFaults,
     getSiteActivity,
     getNetworkActivity,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.111.0",
+  "version": "4.112.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/robot-fleet-core.ts

@@ -55,3 +55,41 @@ export function fleetLiftItems(map: Record<string, any> | null | undefined, rows
     };
   });
 }
+
+/* ---- "Open HERO Fleet Core" (web only, owner 2026-10-09) ---------------- */
+
+/**
+ * Is this a console URL we may open? https, and the pass in the fragment
+ * (`#token=`) - the only form the console reads, and one no server ever logs.
+ */
+export function isFleetCoreConsoleUrl(url: unknown): url is string {
+  if (typeof url !== "string") return false;
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && /^#token=[\w-]+\.[\w-]+\.[\w-]+$/.test(u.hash);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Open the console in a new tab. The tab is opened BEFORE the pass is fetched
+ * (inside the click), so popup blockers allow it; it is then pointed at the
+ * console, or closed if no pass came back. Returns false when it failed.
+ */
+export async function openFleetCoreConsole(
+  getSession: () => Promise<{ url?: unknown } | null | undefined>,
+  openTab: () => { location: { href: string }; opener: unknown; close: () => void } | null,
+): Promise<boolean> {
+  const tab = openTab();
+  if (tab) tab.opener = null; // the console never gets a handle on this app
+  try {
+    const session = await getSession();
+    if (!tab || !isFleetCoreConsoleUrl(session?.url)) throw new Error("no pass");
+    tab.location.href = session!.url as string;
+    return true;
+  } catch {
+    tab?.close();
+    return false;
+  }
+}