@7365admin1/layer-common 4.118.9 → 4.119.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/layer-common
 
+## 4.119.0
+
+### Minor Changes
+
+- 51b87b6: Security Ops: new `security-ops` resource (`start-site-visit`, `see-all-site-visits`) in the security role catalogue, and `site-settings:manage-geofence` added to the site-settings vocabulary so a Master Admin role can be given the Geofencing panel. The security catalogue cherry-picks site-settings entries rather than spreading them, so `manage-geofence` is listed there explicitly too, and `useSettingsPermission` exposes `canManageGeofence` (also folded into `canManageSiteSettings`).
+
+## 4.118.10
+
+### Patch Changes
+
+- 5fd7f77: Accept Terms & Privacy gate now runs on every page (global middleware), not only pages that declare 01-auth.
+
 ## 4.118.9
 
 ### Patch Changes
@@ -3182,11 +3194,11 @@ Monthly report: a month that had patrols opens the list of that month's patrol r
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/composables/useCommonPermission.ts

@@ -280,6 +280,16 @@ export function useCommonPermissions() {
         check: true,
         description: "Allows the user to manage work order settings.",
       },
+      // Security Ops site visits. The boundary is one half; the guardhouse
+      // code an Ops Executive scans to open a visit is the other, and it is the
+      // proof the whole module rests on - so this is the right that decides who
+      // may re-register it. In the COMMON catalogue because site settings are
+      // shared across verticals, not only security.
+      "manage-geofence": {
+        check: true,
+        description:
+          "Allows the user to set a site's boundary and register the guardhouse check-in code used for Security Ops site visits.",
+      },
       "manage-billing-and-soa-configuration": {
         check: true,
         description:

package/composables/useSecurityPermission.ts

@@ -735,6 +735,38 @@ export default function useSecurityPermission() {
         description: "Allows the user to delete routes.",
       },
     },
+    /**
+     * NEW. Security Ops - the site visit and its checklists.
+     *
+     * NO ROLE HOLDS THESE YET. The module is new, so every one of these strings
+     * has a count of zero today. API-core's `siteVisit` gate is therefore
+     * COUNTED, not enforcing (`SITE_VISIT_PERMISSION_MODE`, default `log`): it
+     * records who WOULD be refused and refuses nobody, the same way the NFC
+     * patrol and incident report gates shipped. Provision roles against that
+     * count before anyone sets it to `enforce`.
+     *
+     * THREE PLACES, BY HAND. These spellings have to match API-core
+     * (`SITE_VISIT_PERMISSIONS` in `site-authz.util.ts`) and the RN app
+     * (`permission.catalog.ts`), which does NOT import this file - it keeps a
+     * literal copy and compares strings exactly. `roles-picker-covers-mobile-gates`
+     * in web-app-security is the test that holds the three together.
+     *
+     * The geofence right is NOT here: it is a site setting, so it lives in
+     * `useCommonPermission.ts` as `site-settings:manage-geofence` beside the
+     * other panels.
+     */
+    "security-ops": {
+      "start-site-visit": {
+        check: true,
+        description:
+          "Allows the user to check in at a site, fill in the visit checklists and check out.",
+      },
+      "see-all-site-visits": {
+        check: true,
+        description:
+          "Allows the user to view site visits across the sites they can reach, including other executives' visits.",
+      },
+    },
     // NEW. Seeing the CCTV wall, as distinct from setting cameras up
     // (`site-settings:manage-cctv-camera`).
     "cctv-mgmt": {
@@ -768,6 +800,12 @@ export default function useSecurityPermission() {
       "manage-nfc-management": siteSettingsPermissions["manage-nfc-management"],
       "manage-nfc-patrol-settings":
         siteSettingsPermissions["manage-nfc-patrol-settings"],
+      // Security Ops geofencing. This block CHERRY-PICKS from
+      // `siteSettingsPermissions` rather than spreading it, so a new entry in
+      // the common catalogue does not reach the security role editor on its own
+      // - without this line no administrator on a security site could grant the
+      // right, and the Geofencing panel would be invisible to everyone.
+      "manage-geofence": siteSettingsPermissions["manage-geofence"],
       "manage-red-dot-settings": {
         check: true,
         description:

package/composables/useSettingsPermission.ts

@@ -129,6 +129,20 @@ export function useSettingsPermission() {
       "update-vehicle": { check: true, description: "Allows the user to update vehicle details." },
     },
   };
+  /**
+   * The Geofencing panel - Security Ops site visits.
+   *
+   * MUST ALSO BE IN `canManageSiteSettings` BELOW. That computed is an OR of
+   * every panel gate and it is what decides whether the Settings page renders at
+   * all, so a role holding ONLY this right would otherwise be given a page it
+   * cannot open. Adding a panel is always two lines, never one.
+   */
+  const canManageGeofence = computed(() => {
+    if (!userAppRole.value) return false;
+    if (userAppRole.value.permissions.includes("*")) return true;
+    return hasPermission(userAppRole.value, permissions, "site-settings", "manage-geofence");
+  });
+
   const canManageVehicleQr = computed(() => {
     if (!userAppRole.value) return false;
     if (userAppRole.value.permissions.includes("*")) return true;
@@ -136,7 +150,7 @@ export function useSettingsPermission() {
   });
 
   const canManageSiteSettings = computed(() => {
-    return canManageSiteInformation.value || canManageANPRCamera.value || canManageCCTVCamera.value || canManageDeliveryCompanies.value || canManageResidentVisitors.value || canManageWorkOrderSettings.value || canManageBillingAndSOAConfiguration.value || canManageNFCManagement.value || canManageNFCPatrolSettings.value || canManageEntryPass.value || canManageRedDotSettings.value
+    return canManageSiteInformation.value || canManageANPRCamera.value || canManageCCTVCamera.value || canManageDeliveryCompanies.value || canManageResidentVisitors.value || canManageWorkOrderSettings.value || canManageBillingAndSOAConfiguration.value || canManageNFCManagement.value || canManageNFCPatrolSettings.value || canManageEntryPass.value || canManageRedDotSettings.value || canManageGeofence.value
   })
 
   return {
@@ -151,6 +165,7 @@ export function useSettingsPermission() {
     canManageNFCPatrolSettings,
     canManageEntryPass,
     canManageRedDotSettings,
+    canManageGeofence,
     canManageVehicleQr,
     canManageSiteSettings
 

package/constants/permissions.ts

@@ -150,6 +150,9 @@ export const PERMISSIONS = {
     "manage-nfc-patrol-settings",
     "manage-entry-pass",
     "manage-red-dot-settings",
+    // Security Ops: the site boundary and the guardhouse check-in code. The
+    // server reads this one too - API-core `GEOFENCE_MANAGE_PERMISSIONS`.
+    "manage-geofence",
   ],
 
   // ---- module apps (cleaning, landscape, M&E, pest, pool) ----

package/middleware/01.auth.ts

@@ -1,5 +1,3 @@
-import { termsGateSkips } from "../utils/terms-gate";
-
 export default defineNuxtRouteMiddleware(async (route) => {
   const { cookieConfig } = useRuntimeConfig().public;
 
@@ -14,13 +12,5 @@ export default defineNuxtRouteMiddleware(async (route) => {
     // Redirect to login page if no access token
     return navigateTo({ name: "index" });
   }
-
-  // Terms and Privacy Policy: ask once per account per published version.
-  // Fails open; print/PDF/preview/kiosk/public (plain layout) pages are skipped.
-  if (import.meta.client && !termsGateSkips(route, navigator.userAgent)) {
-    const { check } = useTermsGate();
-    if (await check()) {
-      return navigateTo({ path: "/accept-terms", query: { redirect: route.fullPath } });
-    }
-  }
+  // Terms and Privacy gate: see terms-gate.global.ts (runs on every page).
 });

package/middleware/terms-gate.global.ts

@@ -0,0 +1,19 @@
+import { termsGateRedirect } from "../utils/terms-gate";
+
+/**
+ * "Accept Terms and Privacy Policy" gate for EVERY page in every app that
+ * extends layer-common. It was in the named `01-auth` middleware, so pages that
+ * did not declare it were never gated. Client-only, only with a `sid`, fails
+ * open, and reuses useTermsGate's cached answer (no extra call per navigation).
+ */
+export default defineNuxtRouteMiddleware(async (to) => {
+  const { cookieConfig } = useRuntimeConfig().public;
+  const redirect = await termsGateRedirect({
+    client: import.meta.client,
+    sid: useCookie("sid", cookieConfig).value,
+    to,
+    userAgent: import.meta.client ? navigator.userAgent : "",
+    check: () => useTermsGate().check(),
+  });
+  if (redirect) return navigateTo(redirect);
+});

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.118.9",
+  "version": "4.119.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/terms-gate.ts

@@ -19,6 +19,17 @@ export function shouldPrompt(reply: TermsGateReply | null | undefined): boolean
 
 const NEVER_GATED_LAYOUTS = ["plain", "plain-dark"];
 
+// Pre-login and public pages. Most are also `plain` layout; listed by path as a
+// second net so a public page can never loop through the gate.
+const PUBLIC_PATHS = [
+  "/sign-in", "/sign-up", "/sign-up-invite", "/forgot-password", "/reset-password",
+  "/verify", "/logout", "/public-view", "/terms-and-conditions", "/privacy-policy",
+];
+
+function isPublicPath(path = ""): boolean {
+  return PUBLIC_PATHS.some((p) => path === p || path.startsWith(p + "/"));
+}
+
 /**
  * Pages that must never be interrupted: print/PDF/preview/kiosk/public pages
  * (they use the plain layouts), the accept page itself, an explicit opt-out,
@@ -29,6 +40,7 @@ export function termsGateSkips(
   userAgent = "",
 ): boolean {
   if (to.path === "/accept-terms") return true;
+  if (isPublicPath(to.path)) return true;
   const meta = to.meta ?? {};
   if (meta.skipTermsGate) return true;
   if (typeof meta.layout === "string" && NEVER_GATED_LAYOUTS.includes(meta.layout)) return true;
@@ -43,3 +55,25 @@ export function safeRedirect(value: unknown): string {
   }
   return path;
 }
+
+/**
+ * The global gate's decision: the path to redirect to, or null to let the page
+ * through. `check` (useTermsGate().check) already fails open and is cached, so
+ * this adds no API call per navigation.
+ */
+export async function termsGateRedirect(opts: {
+  client: boolean;
+  sid: unknown;
+  to: { path?: string; fullPath?: string; meta?: Record<string, unknown> };
+  userAgent?: string;
+  check: () => Promise<boolean>;
+}): Promise<{ path: string; query: { redirect: string } } | null> {
+  if (!opts.client || !opts.sid || termsGateSkips(opts.to, opts.userAgent)) return null;
+  let must = false;
+  try {
+    must = await opts.check();
+  } catch {
+    return null;
+  }
+  return must ? { path: "/accept-terms", query: { redirect: opts.to.fullPath ?? opts.to.path ?? "/" } } : null;
+}