@7365admin1/layer-common 4.118.10 → 4.119.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.119.0
+
+### Minor Changes
+
+- 51b87b6: Security Ops: new `security-ops` resource (`start-site-visit`, `see-all-site-visits`) in the security role catalogue, and `site-settings:manage-geofence` added to the site-settings vocabulary so a Master Admin role can be given the Geofencing panel. The security catalogue cherry-picks site-settings entries rather than spreading them, so `manage-geofence` is listed there explicitly too, and `useSettingsPermission` exposes `canManageGeofence` (also folded into `canManageSiteSettings`).
+
 ## 4.118.10
 
 ### Patch Changes

package/composables/useCommonPermission.ts

@@ -280,6 +280,16 @@ export function useCommonPermissions() {
         check: true,
         description: "Allows the user to manage work order settings.",
       },
+      // Security Ops site visits. The boundary is one half; the guardhouse
+      // code an Ops Executive scans to open a visit is the other, and it is the
+      // proof the whole module rests on - so this is the right that decides who
+      // may re-register it. In the COMMON catalogue because site settings are
+      // shared across verticals, not only security.
+      "manage-geofence": {
+        check: true,
+        description:
+          "Allows the user to set a site's boundary and register the guardhouse check-in code used for Security Ops site visits.",
+      },
       "manage-billing-and-soa-configuration": {
         check: true,
         description:

package/composables/useSecurityPermission.ts

@@ -735,6 +735,38 @@ export default function useSecurityPermission() {
         description: "Allows the user to delete routes.",
       },
     },
+    /**
+     * NEW. Security Ops - the site visit and its checklists.
+     *
+     * NO ROLE HOLDS THESE YET. The module is new, so every one of these strings
+     * has a count of zero today. API-core's `siteVisit` gate is therefore
+     * COUNTED, not enforcing (`SITE_VISIT_PERMISSION_MODE`, default `log`): it
+     * records who WOULD be refused and refuses nobody, the same way the NFC
+     * patrol and incident report gates shipped. Provision roles against that
+     * count before anyone sets it to `enforce`.
+     *
+     * THREE PLACES, BY HAND. These spellings have to match API-core
+     * (`SITE_VISIT_PERMISSIONS` in `site-authz.util.ts`) and the RN app
+     * (`permission.catalog.ts`), which does NOT import this file - it keeps a
+     * literal copy and compares strings exactly. `roles-picker-covers-mobile-gates`
+     * in web-app-security is the test that holds the three together.
+     *
+     * The geofence right is NOT here: it is a site setting, so it lives in
+     * `useCommonPermission.ts` as `site-settings:manage-geofence` beside the
+     * other panels.
+     */
+    "security-ops": {
+      "start-site-visit": {
+        check: true,
+        description:
+          "Allows the user to check in at a site, fill in the visit checklists and check out.",
+      },
+      "see-all-site-visits": {
+        check: true,
+        description:
+          "Allows the user to view site visits across the sites they can reach, including other executives' visits.",
+      },
+    },
     // NEW. Seeing the CCTV wall, as distinct from setting cameras up
     // (`site-settings:manage-cctv-camera`).
     "cctv-mgmt": {
@@ -768,6 +800,12 @@ export default function useSecurityPermission() {
       "manage-nfc-management": siteSettingsPermissions["manage-nfc-management"],
       "manage-nfc-patrol-settings":
         siteSettingsPermissions["manage-nfc-patrol-settings"],
+      // Security Ops geofencing. This block CHERRY-PICKS from
+      // `siteSettingsPermissions` rather than spreading it, so a new entry in
+      // the common catalogue does not reach the security role editor on its own
+      // - without this line no administrator on a security site could grant the
+      // right, and the Geofencing panel would be invisible to everyone.
+      "manage-geofence": siteSettingsPermissions["manage-geofence"],
       "manage-red-dot-settings": {
         check: true,
         description:

package/composables/useSettingsPermission.ts

@@ -129,6 +129,20 @@ export function useSettingsPermission() {
       "update-vehicle": { check: true, description: "Allows the user to update vehicle details." },
     },
   };
+  /**
+   * The Geofencing panel - Security Ops site visits.
+   *
+   * MUST ALSO BE IN `canManageSiteSettings` BELOW. That computed is an OR of
+   * every panel gate and it is what decides whether the Settings page renders at
+   * all, so a role holding ONLY this right would otherwise be given a page it
+   * cannot open. Adding a panel is always two lines, never one.
+   */
+  const canManageGeofence = computed(() => {
+    if (!userAppRole.value) return false;
+    if (userAppRole.value.permissions.includes("*")) return true;
+    return hasPermission(userAppRole.value, permissions, "site-settings", "manage-geofence");
+  });
+
   const canManageVehicleQr = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
@@ -136,7 +150,7 @@ export function useSettingsPermission() {
   });
 
   const canManageSiteSettings = computed(() => {
-    return canManageSiteInformation.value || canManageANPRCamera.value || canManageCCTVCamera.value || canManageDeliveryCompanies.value || canManageResidentVisitors.value || canManageWorkOrderSettings.value || canManageBillingAndSOAConfiguration.value || canManageNFCManagement.value || canManageNFCPatrolSettings.value || canManageEntryPass.value || canManageRedDotSettings.value
+    return canManageSiteInformation.value || canManageANPRCamera.value || canManageCCTVCamera.value || canManageDeliveryCompanies.value || canManageResidentVisitors.value || canManageWorkOrderSettings.value || canManageBillingAndSOAConfiguration.value || canManageNFCManagement.value || canManageNFCPatrolSettings.value || canManageEntryPass.value || canManageRedDotSettings.value || canManageGeofence.value
   })
 
   return {
@@ -151,6 +165,7 @@ export function useSettingsPermission() {
     canManageNFCPatrolSettings,
     canManageEntryPass,
     canManageRedDotSettings,
+    canManageGeofence,
     canManageVehicleQr,
     canManageSiteSettings
 

package/constants/permissions.ts

@@ -150,6 +150,9 @@ export const PERMISSIONS = {
     "manage-nfc-patrol-settings",
     "manage-entry-pass",
     "manage-red-dot-settings",
+    // Security Ops: the site boundary and the guardhouse check-in code. The
+    // server reads this one too - API-core `GEOFENCE_MANAGE_PERMISSIONS`.
+    "manage-geofence",
   ],
 
   // ---- module apps (cleaning, landscape, M&E, pest, pool) ----

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.118.10",
+  "version": "4.119.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",