@7365admin1/layer-common 4.118.10 → 4.120.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @iservice365/layer-common
 
+## 4.120.0
+
+### Minor Changes
+
+- bccdbb9: Data retention (PDPA) per site: `SiteDataRetention` settings card (switch with confirmation, keep-for months per record type, notice days, preview, removal records with certificate download), `SiteDataRemovalDialog` for the staff contract-end removal, and `useDataRetention`.
+- bccdbb9: Site Settings "Feedback handling" card (`FeedbackHandlingSettings`): office hours, public holidays, who receives new feedback per category, escalation steps and auto-close categories, saved as `site.metadata.feedbackSettings`. `useFeedback().sendToProvider` for "Send to another provider".
+- bccdbb9: Passes & keys site settings (key presses, daily unreturned-key list, stop check-out while a key is out), `KeyPressSelect` and `useKeyPresses`, and the key press shown under each key in the visitor key pickers. Nothing changes for a site until it adds a key press or turns a switch on.
+- bccdbb9: Room handover / takeover checklists (setup with ready-made starters, records with PDF) and an optional "Managing agent staff" contractor type behind a site switch.
+- bccdbb9: Site Settings: Incident report emails. Documents: Archived tab with archive/restore. Create role: Guardhouse officer preset. New ListCsvExport component for list CSV downloads.
+- bccdbb9: Site Settings gains a "Visitor registration" panel (Ask for NRIC / FIN, Contact number, Vehicle number), and the visitor form follows it. Sites that never saved it keep today's form.
+
+### Patch Changes
+
+- d4ae8bb: Show NRIC as last 4 characters only (e.g. **\***567A) in the remaining places that printed it in full: visitor autofill search result and pick dialog, the non-checked-out / Skip NRIC prompt, member autofill, vehicle owner list, unit vehicles table, vehicle-number user picker and access card details. Display only — the value typed into or saved by the forms is unchanged.
+
+## 4.119.0
+
+### Minor Changes
+
+- 51b87b6: Security Ops: new `security-ops` resource (`start-site-visit`, `see-all-site-visits`) in the security role catalogue, and `site-settings:manage-geofence` added to the site-settings vocabulary so a Master Admin role can be given the Geofencing panel. The security catalogue cherry-picks site-settings entries rather than spreading them, so `manage-geofence` is listed there explicitly too, and `useSettingsPermission` exposes `canManageGeofence` (also folded into `canManageSiteSettings`).
+
 ## 4.118.10
 
 ### Patch Changes
@@ -3188,11 +3209,11 @@ Monthly report: a month that had patrols opens the list of that month's patrol r
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                                                              GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                                                              GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                                                              owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                                                              staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/AccessCardDetailsDialog.vue

@@ -79,7 +79,7 @@
 
             <div v-if="details.userCred.nric">
               <div class="card-details__label">NRIC</div>
-              <div class="card-details__value">{{ details.userCred.nric }}</div>
+              <div class="card-details__value">{{ maskNRIC(details.userCred.nric) }}</div>
             </div>
 
             <div v-if="details.userCred.contact">
@@ -162,7 +162,7 @@
                   <template v-if="entry.type === 'assigned' || entry.visitorId">
                     <div class="card-details__value">{{ entry.name ?? "N/A" }}</div>
                     <div class="card-details__sub">
-                      <span v-if="entry.nric">NRIC: {{ entry.nric }}</span>
+                      <span v-if="entry.nric">NRIC: {{ maskNRIC(entry.nric) }}</span>
                       <span v-if="entry.contact" class="ml-2">· {{ entry.contact }}</span>
                       <span v-if="entry.email && !entry.nric && !entry.contact">{{ entry.email }}</span>
                     </div>
@@ -193,6 +193,7 @@
 </template>
 
 <script setup lang="ts">
+const { maskNRIC } = useUtils();
 const props = defineProps({
   modelValue: {
     type: Boolean,

package/components/AddPassKeyToVisitor.vue

@@ -102,6 +102,7 @@
             :items="keyItems"
             item-title="prefixAndName"
             item-value="_id"
+            :item-props="keyItemProps"
             :label="existingKeys.length > 0 ? 'Add more keys' : undefined"
             multiple
             variant="outlined"
@@ -147,6 +148,7 @@
 import type { PropType } from "vue";
 import usePassKey from "../composables/usePassKey";
 import useVisitor from "../composables/useVisitor";
+import useKeyPresses from "../composables/useKeyPresses";
 
 const prop = defineProps({
   visitor: {
@@ -195,6 +197,9 @@ const existingKeys = ref<
 
 const isEditMode = computed(() => prop.mode === "edit");
 const showKeys = computed(() => prop.visitor.type === "contractor");
+// The key's press (if the site has any) under each key in the picker. Read
+// only when the key picker is shown.
+const { keyItemProps } = useKeyPresses(() => (showKeys.value ? prop.site : ""));
 
 const passTypesComputed = computed(() => {
   const type = prop.visitor.type;

package/components/BuildingUnitFormEdit.vue

@@ -163,6 +163,8 @@
         <TableMain :headers="vehicleHeaders" :show-header="true" :page="vehiclePage" :pages="vehicleTotalPages"
         :pageRange="vehiclePageRange"  :items="unitVehicleItems"  @refresh="getUnitVehiclesRefresh"  @update:page="handleUpdateVehiclePage">
 
+          <template #item.nric="{ value }">{{ maskNRIC(value) || "-" }}</template>
+
           <template #item.status="{value}">
             <v-chip :color="formatVehicleStatus(value).color" class="ma-0" small>
               {{ formatVehicleStatus(value).label }}
@@ -404,7 +406,7 @@ const validForm = ref(false);
 
 const { getAll } = useBuilding();
 const { getPeopleByUnit, updateById: updatePeopleById } = usePeople();
-const { debounce } = useUtils();
+const { debounce, maskNRIC } = useUtils();
 const { searchMultipleVehiclesByUnitId, formatVehicleStatus } = useVehicle();
 
 const loading = reactive({

package/components/DocumentManagement.vue

@@ -66,7 +66,12 @@
       >
         <v-tab value="active" class="text-none">Documents</v-tab>
         <v-tab value="expired" class="text-none">Document (Expired)</v-tab>
+        <v-tab value="archived" class="text-none" data-test="doc-tab-archived">Archived</v-tab>
       </v-tabs>
+      <p v-if="isArchivedTab" class="text-caption text-medium-emphasis mt-2 mb-0">
+        Archived documents are kept but hidden from the main list. Archiving a folder archives everything in it, and
+        restoring the folder brings it all back.
+      </p>
     </v-col>
 
     <!--
@@ -74,7 +79,7 @@
       place in the folder tree, so a breadcrumb there would name a folder whose
       contents are not what is on screen.
     -->
-    <v-col cols="12" class="mb-2" v-if="isInsideFolder && !isExpiredTab">
+    <v-col cols="12" class="mb-2" v-if="isInsideFolder && !isExpiredTab && !isArchivedTab">
       <div class="folder-path-bar d-flex align-center ga-2 px-3 py-2">
         <v-btn
           icon="mdi-arrow-left"
@@ -227,6 +232,15 @@
                 >
                   <v-list-item-title class="text-body-2">Edit</v-list-item-title>
                 </v-list-item>
+                <v-list-item
+                  v-if="canUpdateDocument"
+                  class="folder-action-item"
+                  @click.stop="archiveItem(item._raw, !isArchivedTab)"
+                >
+                  <v-list-item-title class="text-body-2">
+                    {{ isArchivedTab ? "Restore" : "Archive" }}
+                  </v-list-item-title>
+                </v-list-item>
                 <v-list-item
                   v-if="canDeleteDocument"
                   class="folder-action-item"
@@ -265,6 +279,15 @@
               >
                 <v-list-item-title class="text-body-2">Edit</v-list-item-title>
               </v-list-item>
+              <v-list-item
+                v-if="canUpdateDocument"
+                class="folder-action-item"
+                @click.stop="archiveItem(item._raw, !isArchivedTab)"
+              >
+                <v-list-item-title class="text-body-2">
+                  {{ isArchivedTab ? "Restore" : "Archive" }}
+                </v-list-item-title>
+              </v-list-item>
               <v-list-item
                 class="folder-action-item"
                 @click.stop="openDeleteFolderDialog(item._raw)"
@@ -776,6 +799,7 @@ const documentService = useDocument();
 const {
   getAll: _getAllDocuments,
   deleteById,
+  setArchived,
   deleteFolderById,
   updateFolderById,
   createFolder,
@@ -841,8 +865,10 @@ const selectedFileType = ref("all");
  * Which half of the list is on screen. The value is sent straight to the API as
  * its `expiry` filter, so the tab and the query cannot drift apart.
  */
-const activeTab = ref<"active" | "expired">("active");
+const activeTab = ref<"active" | "expired" | "archived">("active");
 const isExpiredTab = computed(() => activeTab.value === "expired");
+// Archived: every archived item at the site, wherever it was filed (like Expired).
+const isArchivedTab = computed(() => activeTab.value === "archived");
 
 const {
   data: getDocumentReq,
@@ -859,7 +885,8 @@ const {
       parentId: activeParentId.value,
       type:
         selectedFileType.value === "all" ? undefined : selectedFileType.value,
-      expiry: activeTab.value,
+      expiry: isArchivedTab.value ? "all" : activeTab.value,
+      archived: isArchivedTab.value,
     }),
   {
     watch: [page, headerSearch, activeParentId, selectedFileType, activeTab],
@@ -1043,6 +1070,8 @@ function tableRowClickHandler(data: any) {
   const rowData = (data?._raw || data) as TDocument;
 
   if (isFolderItem(rowData)) {
+    // An archived folder is restored, not browsed: the Archived tab is a flat list.
+    if (isArchivedTab.value) return;
     openFolder(rowData);
     return;
   }
@@ -1142,6 +1171,30 @@ function setDocument({
   }
 }
 
+/** Archive / restore one row (document or folder). Same right as editing it. */
+async function archiveItem(item: TDocument, archive: boolean) {
+  const id = String((item as any)?._id || "");
+  if (!id) return;
+  documentActionMenu.value[id] = false;
+  folderActionMenu.value[id] = false;
+  try {
+    await setArchived(id, archive);
+    showMessage(
+      archive
+        ? "Archived. Find it under the Archived tab."
+        : "Restored to the main list.",
+      "success"
+    );
+    await getDocuments();
+  } catch (error: any) {
+    showMessage(
+      error?.data?.message ||
+        (archive ? "Could not archive it." : "Could not restore it."),
+      "error"
+    );
+  }
+}
+
 function showMessage(msg: string, color: string) {
   message.value = msg;
   messageColor.value = color;

package/components/FeedbackHandlingSettings.vue

@@ -0,0 +1,385 @@
+<!--
+  FEEDBACK HANDLING - per-site office hours, who receives new feedback, the
+  escalation steps and the categories that close themselves (TLR, 2026-10-13).
+
+  Saved as the one switch `site.metadata.feedbackSettings`
+  (`useSiteFeatureSettings`). Only the site's owning organisation (or Seven365)
+  may change it - the server checks. Until a site saves this card nothing
+  changes for it: no routes, no escalation, no auto-close (see
+  `utils/feedback-handling-settings.ts`).
+-->
+<template>
+  <div class="feedback-handling">
+    <v-skeleton-loader v-if="loading" type="article" />
+
+    <template v-else>
+      <div v-if="!canEdit" class="screen-hint fh-note mb-4" data-test="fh-owner-only">
+        Only the client that owns this site can change feedback handling.
+      </div>
+      <!-- Office hours -->
+      <section class="mb-6">
+        <div class="fh-label">Office hours</div>
+        <div class="screen-hint fh-note mt-1 mb-3">
+          Used to decide who receives new feedback and, if you choose, how escalation time is counted.
+        </div>
+
+        <v-chip-group v-model="form.workingDays" multiple column selected-class="text-primary" :disabled="!canEdit">
+          <v-chip v-for="day in WEEK_DAYS" :key="day.value" :value="day.value" filter variant="outlined" size="small">
+            {{ day.title }}
+          </v-chip>
+        </v-chip-group>
+
+        <v-row dense class="mt-2">
+          <v-col cols="6" sm="3">
+            <v-text-field v-model="form.officeStart" type="time" label="Opens" density="comfortable" hide-details :disabled="!canEdit" />
+          </v-col>
+          <v-col cols="6" sm="3">
+            <v-text-field v-model="form.officeEnd" type="time" label="Closes" density="comfortable" hide-details :disabled="!canEdit" />
+          </v-col>
+        </v-row>
+
+        <v-switch
+          v-model="form.excludePublicHolidays"
+          class="app-switch mt-2"
+          hide-details
+          :disabled="!canEdit"
+          label="Treat public holidays as non-working days"
+        />
+        <div class="screen-hint fh-note">Uses the Singapore public holiday list kept up to date by Seven365.</div>
+      </section>
+
+      <v-divider class="mb-6" />
+
+      <!-- Routing -->
+      <section class="mb-6">
+        <div class="fh-label">Who receives new feedback</div>
+        <div class="screen-hint fh-note mt-1 mb-3">
+          The managing agent always sees every feedback. Choosing the provider also sends it straight to them.
+          Categories not listed here work as they do today.
+        </div>
+
+        <div v-for="(route, i) in form.routes" :key="i" class="fh-row pa-3 mb-2">
+          <v-row dense align="center">
+            <v-col cols="12" md="3">
+              <v-select
+                v-model="route.category"
+                :items="categoryItems(route.category)"
+                label="Category"
+                density="comfortable"
+                hide-details
+                :disabled="!canEdit"
+              />
+            </v-col>
+            <v-col cols="12" md="3">
+              <v-select
+                v-model="route.provider"
+                :items="providerItems"
+                label="Provider"
+                density="comfortable"
+                hide-details
+                clearable
+                :no-data-text="'No active providers at this site'"
+                :disabled="!canEdit"
+              />
+            </v-col>
+            <v-col cols="12" sm="6" md="3">
+              <v-select
+                v-model="route.officeHours"
+                :items="targetItems"
+                label="During office hours"
+                density="comfortable"
+                hide-details
+                :disabled="!canEdit"
+              />
+            </v-col>
+            <v-col cols="10" sm="5" md="2">
+              <v-select
+                v-model="route.afterHours"
+                :items="targetItems"
+                label="Weekends & public holidays"
+                density="comfortable"
+                hide-details
+                :disabled="!canEdit"
+              />
+            </v-col>
+            <v-col cols="2" sm="1" class="d-flex justify-end">
+              <v-btn
+                v-if="canEdit"
+                icon="mdi-delete-outline"
+                variant="text"
+                size="small"
+                aria-label="Remove this category"
+                @click="form.routes.splice(i, 1)"
+              />
+            </v-col>
+          </v-row>
+        </div>
+
+        <AppButton
+          v-if="canEdit"
+          variant="ghost"
+          icon="mdi-plus"
+          :disabled="!categoryItems('').length"
+          @click="form.routes.push({ category: '', provider: '', officeHours: 'ma', afterHours: 'ma' })"
+        >
+          Add category
+        </AppButton>
+      </section>
+
+      <v-divider class="mb-6" />
+
+      <!-- Escalation -->
+      <section class="mb-6">
+        <v-switch
+          v-model="form.escalationEnabled"
+          class="app-switch"
+          hide-details
+          :disabled="!canEdit"
+          label="Escalate unresolved feedback"
+        />
+        <div class="screen-hint fh-note mb-3">
+          Tell more people when a feedback is still not completed after the time you set.
+        </div>
+
+        <template v-if="form.escalationEnabled">
+          <div v-for="(level, i) in form.levels" :key="i" class="fh-row pa-3 mb-2">
+            <div class="fh-step mb-2">Step {{ i + 1 }}</div>
+            <v-row dense align="center">
+              <v-col cols="12" sm="4" md="3">
+                <v-text-field
+                  v-model.number="level.afterHours"
+                  type="number"
+                  min="1"
+                  max="1440"
+                  label="If not completed after (hours)"
+                  density="comfortable"
+                  hide-details
+                  :disabled="!canEdit"
+                />
+              </v-col>
+              <v-col cols="12" sm="8" md="4">
+                <v-autocomplete
+                  v-model="level.users"
+                  :items="peopleItems"
+                  label="Notify these people"
+                  multiple
+                  chips
+                  closable-chips
+                  density="comfortable"
+                  hide-details
+                  :disabled="!canEdit"
+                />
+              </v-col>
+              <v-col cols="10" md="4">
+                <v-combobox
+                  v-model="level.emails"
+                  label="And these email addresses"
+                  multiple
+                  chips
+                  closable-chips
+                  density="comfortable"
+                  hide-details
+                  :disabled="!canEdit"
+                />
+              </v-col>
+              <v-col cols="2" md="1" class="d-flex justify-end">
+                <v-btn
+                  v-if="canEdit"
+                  icon="mdi-delete-outline"
+                  variant="text"
+                  size="small"
+                  aria-label="Remove this step"
+                  @click="form.levels.splice(i, 1)"
+                />
+              </v-col>
+            </v-row>
+          </div>
+
+          <AppButton
+            v-if="canEdit && form.levels.length < MAX_ESCALATION_LEVELS"
+            variant="ghost"
+            icon="mdi-plus"
+            @click="form.levels.push({ id: '', afterHours: 24, users: [], emails: [] })"
+          >
+            Add step
+          </AppButton>
+
+          <v-switch
+            v-model="form.workingTimeOnly"
+            class="app-switch mt-3"
+            hide-details
+            :disabled="!canEdit"
+            label="Count office hours only"
+          />
+          <div class="screen-hint fh-note">
+            Time outside office hours (and public holidays, if treated as non-working) does not count.
+          </div>
+        </template>
+      </section>
+
+      <v-divider class="mb-6" />
+
+      <!-- Auto-close -->
+      <section class="mb-6">
+        <div class="fh-label">Close automatically when the provider marks done</div>
+        <div class="screen-hint fh-note mt-1 mb-3">
+          Use only for simple jobs like cleaning. The managing agent can still re-open.
+        </div>
+        <v-select
+          v-model="form.autoCloseCategories"
+          :items="subjectTitles"
+          label="Categories"
+          multiple
+          chips
+          closable-chips
+          density="comfortable"
+          hide-details
+          :disabled="!canEdit"
+        />
+      </section>
+
+      <div v-if="errors.length && tried" class="text-error text-caption mb-3">
+        <div v-for="e in errors" :key="e">{{ e }}</div>
+      </div>
+
+      <div v-if="canEdit" class="d-flex justify-end">
+        <AppButton :disabled="saving || !loaded" @click="save">{{ saving ? "Saving" : "Save feedback handling" }}</AppButton>
+      </div>
+    </template>
+
+    <Snackbar v-model="snackbar" :text="message" :color="messageColor" />
+  </div>
+</template>
+
+<script setup lang="ts">
+import {
+  MAX_ESCALATION_LEVELS,
+  WEEK_DAYS,
+  feedbackHandlingErrors,
+  feedbackHandlingForm,
+  feedbackSettingsFromForm,
+  type TFeedbackHandlingForm,
+} from "../utils/feedback-handling-settings";
+
+const props = withDefaults(
+  defineProps<{
+    siteId: string;
+    orgId?: string;
+    canEdit?: boolean;
+  }>(),
+  { orgId: "", canEdit: false },
+);
+
+const emit = defineEmits<{ saved: [] }>();
+
+const { getSiteById } = useSiteSettings();
+const { saveSiteFeature } = useSiteFeatureSettings();
+const { getAll: getProviders } = useServiceProvider();
+const { getAll: getMembers } = useMember();
+const { subjects } = useLocal();
+
+const loading = ref(true);
+/** The stored settings were read; Save stays off until then (a failed read must not save defaults). */
+const loaded = ref(false);
+const saving = ref(false);
+const tried = ref(false);
+const form = ref<TFeedbackHandlingForm>(feedbackHandlingForm(null));
+const providers = ref<Array<{ title: string; value: string }>>([]);
+const people = ref<Array<{ title: string; value: string }>>([]);
+
+const snackbar = ref(false);
+const message = ref("");
+const messageColor = ref("");
+
+const subjectTitles = subjects.map((s) => s.value);
+const targetItems = [
+  { title: "Managing agent", value: "ma" },
+  { title: "Provider", value: "provider" },
+];
+const providerItems = computed(() => providers.value);
+const peopleItems = computed(() => people.value);
+const errors = computed(() => feedbackHandlingErrors(form.value));
+
+/** The subject list minus categories already routed (a row keeps its own). */
+function categoryItems(current: string) {
+  const used = new Set(form.value.routes.map((r) => r.category).filter((c) => c && c !== current));
+  return subjectTitles.filter((s) => !used.has(s));
+}
+
+function notify(text: string, color: string) {
+  message.value = text;
+  messageColor.value = color;
+  snackbar.value = true;
+}
+
+async function load() {
+  loading.value = true;
+  try {
+    const site: any = await getSiteById(props.siteId);
+    form.value = feedbackHandlingForm(site?.metadata?.feedbackSettings ?? site?.data?.metadata?.feedbackSettings);
+    loaded.value = !!site;
+    const [p, m] = await Promise.allSettled([
+      getProviders({ siteId: props.siteId, limit: 100, status: "active" }),
+      getMembers({ siteId: props.siteId, org: props.orgId, limit: 100 }),
+    ]);
+    if (p.status === "fulfilled") {
+      providers.value = (p.value?.items ?? []).map((i: any) => ({
+        title: i.name || i.orgName || "Provider",
+        value: String(i._id),
+      }));
+    }
+    if (m.status === "fulfilled") {
+      const seen = new Set<string>();
+      people.value = (m.value?.items ?? [])
+        .map((i: any) => ({ title: i.name || i.email || "Member", value: String(i.user?._id ?? i.user ?? "") }))
+        .filter((i: { value: string }) => /^[a-f0-9]{24}$/i.test(i.value) && !seen.has(i.value) && !!seen.add(i.value));
+    }
+  } catch (error) {
+    notify(errorConverter(error), "error");
+  } finally {
+    loading.value = false;
+  }
+}
+
+async function save() {
+  tried.value = true;
+  if (errors.value.length || !loaded.value) return;
+  saving.value = true;
+  try {
+    await saveSiteFeature(props.siteId, "feedbackSettings", feedbackSettingsFromForm(form.value));
+    tried.value = false;
+    notify("Feedback handling saved", "success");
+    emit("saved");
+  } catch (error) {
+    notify(errorConverter(error), "error");
+  } finally {
+    saving.value = false;
+  }
+}
+
+onMounted(load);
+</script>
+
+<style scoped>
+.fh-label {
+  font-family: var(--font-sans);
+  font-size: 14px;
+  font-weight: 800;
+  color: var(--text);
+}
+
+.fh-note {
+  font-size: 13px;
+  font-weight: 600;
+}
+
+.fh-step {
+  font-size: 13px;
+  font-weight: 700;
+}
+
+.fh-row {
+  border: 1px solid var(--border, rgba(0, 0, 0, 0.12));
+  border-radius: 8px;
+}
+</style>