@7365admin1/layer-common 4.118.9 → 4.118.10

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.118.10
+
+### Patch Changes
+
+- 5fd7f77: Accept Terms & Privacy gate now runs on every page (global middleware), not only pages that declare 01-auth.
+
 ## 4.118.9
 
 ### Patch Changes
@@ -3182,11 +3188,11 @@ Monthly report: a month that had patrols opens the list of that month's patrol r
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/middleware/01.auth.ts

@@ -1,5 +1,3 @@
-import { termsGateSkips } from "../utils/terms-gate";
-
 export default defineNuxtRouteMiddleware(async (route) => {
   const { cookieConfig } = useRuntimeConfig().public;
 
@@ -14,13 +12,5 @@ export default defineNuxtRouteMiddleware(async (route) => {
     // Redirect to login page if no access token
     return navigateTo({ name: "index" });
   }
-
-  // Terms and Privacy Policy: ask once per account per published version.
-  // Fails open; print/PDF/preview/kiosk/public (plain layout) pages are skipped.
-  if (import.meta.client && !termsGateSkips(route, navigator.userAgent)) {
-    const { check } = useTermsGate();
-    if (await check()) {
-      return navigateTo({ path: "/accept-terms", query: { redirect: route.fullPath } });
-    }
-  }
+  // Terms and Privacy gate: see terms-gate.global.ts (runs on every page).
 });

package/middleware/terms-gate.global.ts

@@ -0,0 +1,19 @@
+import { termsGateRedirect } from "../utils/terms-gate";
+
+/**
+ * "Accept Terms and Privacy Policy" gate for EVERY page in every app that
+ * extends layer-common. It was in the named `01-auth` middleware, so pages that
+ * did not declare it were never gated. Client-only, only with a `sid`, fails
+ * open, and reuses useTermsGate's cached answer (no extra call per navigation).
+ */
+export default defineNuxtRouteMiddleware(async (to) => {
+  const { cookieConfig } = useRuntimeConfig().public;
+  const redirect = await termsGateRedirect({
+    client: import.meta.client,
+    sid: useCookie("sid", cookieConfig).value,
+    to,
+    userAgent: import.meta.client ? navigator.userAgent : "",
+    check: () => useTermsGate().check(),
+  });
+  if (redirect) return navigateTo(redirect);
+});

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.118.9",
+  "version": "4.118.10",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/terms-gate.ts

@@ -19,6 +19,17 @@ export function shouldPrompt(reply: TermsGateReply | null | undefined): boolean
 
 const NEVER_GATED_LAYOUTS = ["plain", "plain-dark"];
 
+// Pre-login and public pages. Most are also `plain` layout; listed by path as a
+// second net so a public page can never loop through the gate.
+const PUBLIC_PATHS = [
+  "/sign-in", "/sign-up", "/sign-up-invite", "/forgot-password", "/reset-password",
+  "/verify", "/logout", "/public-view", "/terms-and-conditions", "/privacy-policy",
+];
+
+function isPublicPath(path = ""): boolean {
+  return PUBLIC_PATHS.some((p) => path === p || path.startsWith(p + "/"));
+}
+
 /**
  * Pages that must never be interrupted: print/PDF/preview/kiosk/public pages
  * (they use the plain layouts), the accept page itself, an explicit opt-out,
@@ -29,6 +40,7 @@ export function termsGateSkips(
   userAgent = "",
 ): boolean {
   if (to.path === "/accept-terms") return true;
+  if (isPublicPath(to.path)) return true;
   const meta = to.meta ?? {};
   if (meta.skipTermsGate) return true;
   if (typeof meta.layout === "string" && NEVER_GATED_LAYOUTS.includes(meta.layout)) return true;
@@ -43,3 +55,25 @@ export function safeRedirect(value: unknown): string {
   }
   return path;
 }
+
+/**
+ * The global gate's decision: the path to redirect to, or null to let the page
+ * through. `check` (useTermsGate().check) already fails open and is cached, so
+ * this adds no API call per navigation.
+ */
+export async function termsGateRedirect(opts: {
+  client: boolean;
+  sid: unknown;
+  to: { path?: string; fullPath?: string; meta?: Record<string, unknown> };
+  userAgent?: string;
+  check: () => Promise<boolean>;
+}): Promise<{ path: string; query: { redirect: string } } | null> {
+  if (!opts.client || !opts.sid || termsGateSkips(opts.to, opts.userAgent)) return null;
+  let must = false;
+  try {
+    must = await opts.check();
+  } catch {
+    return null;
+  }
+  return must ? { path: "/accept-terms", query: { redirect: opts.to.fullPath ?? opts.to.path ?? "/" } } : null;
+}