@7365admin1/layer-common 4.119.0 → 4.121.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @iservice365/layer-common
 
+## 4.121.0
+
+### Minor Changes
+
+- 19485b6: Data retention is managed by Seven365 Admin: `SiteDataRetention` becomes a read-only summary (rules, dates, removal certificates still download), and the new `DataRetentionBanner` shows staff of the selected site a scheduled permanent deletion (`useDataRetention().getDataRetentionBanner`).
+- 495ae9c: Site Settings > Visitor registration: the NRIC / FIN setting is now a choice of "Ask and keep in full (as usual)", "Ask, but keep only the last 4 characters" or "Don't ask", with help text for each. On a last-4 site the visitor form tells staff that only the last 4 characters will be kept. Needs @7365admin1/core with visitorFields.nric = "last4".
+- 42cdb65: The Security Ops permissions are registered in the canonical vocabulary, so a misspelling is caught rather than silently false. The role editor offers two one-click sets, Security Ops officer and Head of security, and a Security Ops notification now opens the Ops Review page instead of nothing.
+- f663200: Site access has a switch marking a person as part of Security Ops: the officers who go out, walk a site and fill in the visit checklists. It applies to every site ticked in the dialog, shows a chip on each one, and reads the result back in a sentence. It grants nothing on its own, so the Role column still decides what a member may do.
+
+## 4.120.0
+
+### Minor Changes
+
+- bccdbb9: Data retention (PDPA) per site: `SiteDataRetention` settings card (switch with confirmation, keep-for months per record type, notice days, preview, removal records with certificate download), `SiteDataRemovalDialog` for the staff contract-end removal, and `useDataRetention`.
+- bccdbb9: Site Settings "Feedback handling" card (`FeedbackHandlingSettings`): office hours, public holidays, who receives new feedback per category, escalation steps and auto-close categories, saved as `site.metadata.feedbackSettings`. `useFeedback().sendToProvider` for "Send to another provider".
+- bccdbb9: Passes & keys site settings (key presses, daily unreturned-key list, stop check-out while a key is out), `KeyPressSelect` and `useKeyPresses`, and the key press shown under each key in the visitor key pickers. Nothing changes for a site until it adds a key press or turns a switch on.
+- bccdbb9: Room handover / takeover checklists (setup with ready-made starters, records with PDF) and an optional "Managing agent staff" contractor type behind a site switch.
+- bccdbb9: Site Settings: Incident report emails. Documents: Archived tab with archive/restore. Create role: Guardhouse officer preset. New ListCsvExport component for list CSV downloads.
+- bccdbb9: Site Settings gains a "Visitor registration" panel (Ask for NRIC / FIN, Contact number, Vehicle number), and the visitor form follows it. Sites that never saved it keep today's form.
+
+### Patch Changes
+
+- d4ae8bb: Show NRIC as last 4 characters only (e.g. **\***567A) in the remaining places that printed it in full: visitor autofill search result and pick dialog, the non-checked-out / Skip NRIC prompt, member autofill, vehicle owner list, unit vehicles table, vehicle-number user picker and access card details. Display only — the value typed into or saved by the forms is unchanged.
+
 ## 4.119.0
 
 ### Minor Changes
@@ -3194,11 +3218,11 @@ Monthly report: a month that had patrols opens the list of that month's patrol r
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                                                                GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                                                                GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                                                                owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                                                                staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/AccessCardDetailsDialog.vue

@@ -79,7 +79,7 @@
 
             <div v-if="details.userCred.nric">
               <div class="card-details__label">NRIC</div>
-              <div class="card-details__value">{{ details.userCred.nric }}</div>
+              <div class="card-details__value">{{ maskNRIC(details.userCred.nric) }}</div>
             </div>
 
             <div v-if="details.userCred.contact">
@@ -162,7 +162,7 @@
                   <template v-if="entry.type === 'assigned' || entry.visitorId">
                     <div class="card-details__value">{{ entry.name ?? "N/A" }}</div>
                     <div class="card-details__sub">
-                      <span v-if="entry.nric">NRIC: {{ entry.nric }}</span>
+                      <span v-if="entry.nric">NRIC: {{ maskNRIC(entry.nric) }}</span>
                       <span v-if="entry.contact" class="ml-2">· {{ entry.contact }}</span>
                       <span v-if="entry.email && !entry.nric && !entry.contact">{{ entry.email }}</span>
                     </div>
@@ -193,6 +193,7 @@
 </template>
 
 <script setup lang="ts">
+const { maskNRIC } = useUtils();
 const props = defineProps({
   modelValue: {
     type: Boolean,

package/components/AddPassKeyToVisitor.vue

@@ -102,6 +102,7 @@
             :items="keyItems"
             item-title="prefixAndName"
             item-value="_id"
+            :item-props="keyItemProps"
             :label="existingKeys.length > 0 ? 'Add more keys' : undefined"
             multiple
             variant="outlined"
@@ -147,6 +148,7 @@
 import type { PropType } from "vue";
 import usePassKey from "../composables/usePassKey";
 import useVisitor from "../composables/useVisitor";
+import useKeyPresses from "../composables/useKeyPresses";
 
 const prop = defineProps({
   visitor: {
@@ -195,6 +197,9 @@ const existingKeys = ref<
 
 const isEditMode = computed(() => prop.mode === "edit");
 const showKeys = computed(() => prop.visitor.type === "contractor");
+// The key's press (if the site has any) under each key in the picker. Read
+// only when the key picker is shown.
+const { keyItemProps } = useKeyPresses(() => (showKeys.value ? prop.site : ""));
 
 const passTypesComputed = computed(() => {
   const type = prop.visitor.type;

package/components/BuildingUnitFormEdit.vue

@@ -163,6 +163,8 @@
         <TableMain :headers="vehicleHeaders" :show-header="true" :page="vehiclePage" :pages="vehicleTotalPages"
         :pageRange="vehiclePageRange"  :items="unitVehicleItems"  @refresh="getUnitVehiclesRefresh"  @update:page="handleUpdateVehiclePage">
 
+          <template #item.nric="{ value }">{{ maskNRIC(value) || "-" }}</template>
+
           <template #item.status="{value}">
             <v-chip :color="formatVehicleStatus(value).color" class="ma-0" small>
               {{ formatVehicleStatus(value).label }}
@@ -404,7 +406,7 @@ const validForm = ref(false);
 
 const { getAll } = useBuilding();
 const { getPeopleByUnit, updateById: updatePeopleById } = usePeople();
-const { debounce } = useUtils();
+const { debounce, maskNRIC } = useUtils();
 const { searchMultipleVehiclesByUnitId, formatVehicleStatus } = useVehicle();
 
 const loading = reactive({

package/components/DataRetentionBanner.vue

@@ -0,0 +1,73 @@
+<template>
+  <!--
+    Scheduled data removal at the selected site (owner 2026-10-14). Shown to
+    the people who work the site, never residents (the server answers nothing
+    to them), and only for a removal that will really happen: Seven365 Admin
+    allowed deletion at this site and the site's admins were already told.
+    A site with no data retention never shows it - the request answers
+    `{ banner: null }`.
+  -->
+  <v-alert
+    v-if="banner"
+    type="warning"
+    variant="tonal"
+    density="comfortable"
+    class="drb mb-3"
+    icon="mdi-delete-clock-outline"
+    data-test="drb"
+  >
+    <div class="drb__text">{{ banner.message }}</div>
+    <button type="button" class="drb__toggle" :aria-expanded="open" data-test="drb-details" @click="open = !open">
+      {{ open ? "Hide details" : "Details" }}
+    </button>
+    <div v-if="open" class="drb__details" data-test="drb-details-body">
+      <ul class="drb__list">
+        <li v-for="i in banner.items" :key="i.dataType">
+          {{ i.label }}: {{ Number(i.count).toLocaleString("en-SG") }} created before {{ day(i.cutoff) }}
+        </li>
+      </ul>
+      <div>
+        Only finished records are deleted (closed feedback and work orders, visitors who have checked out, decided
+        incident reports, past days' occurrence books). Use each list's export to keep a copy. To postpone this, contact
+        Seven365.
+      </div>
+    </div>
+  </v-alert>
+</template>
+
+<script lang="ts" setup>
+const props = defineProps({
+  /** The selected site. Anything that is not a site id shows nothing. */
+  siteId: { type: String, default: "" },
+});
+
+const { getDataRetentionBanner } = useDataRetention();
+const banner = ref<Record<string, any> | null>(null);
+const open = ref(false);
+
+const day = (d: string) =>
+  new Date(d).toLocaleDateString("en-SG", { day: "numeric", month: "short", year: "numeric", timeZone: "Asia/Singapore" });
+
+async function load(site: string) {
+  banner.value = null;
+  open.value = false;
+  if (!/^[a-f0-9]{24}$/i.test(site)) return;
+  try {
+    const res = await getDataRetentionBanner(site);
+    // A late answer for a site the user already left is dropped.
+    if (props.siteId === site) banner.value = res?.banner ?? null;
+  } catch {
+    // Not reachable, a resident, or an older server: no banner.
+    banner.value = null;
+  }
+}
+
+watch(() => props.siteId, (s) => load(s), { immediate: true });
+</script>
+
+<style scoped>
+.drb__text { word-break: break-word; }
+.drb__toggle { text-decoration: underline; font-weight: 600; margin-top: 4px; background: none; border: 0; padding: 0; color: inherit; cursor: pointer; }
+.drb__details { margin-top: 8px; font-size: 13px; }
+.drb__list { padding-left: 18px; margin-bottom: 6px; }
+</style>

package/components/DocumentManagement.vue

@@ -66,7 +66,12 @@
       >
         <v-tab value="active" class="text-none">Documents</v-tab>
         <v-tab value="expired" class="text-none">Document (Expired)</v-tab>
+        <v-tab value="archived" class="text-none" data-test="doc-tab-archived">Archived</v-tab>
       </v-tabs>
+      <p v-if="isArchivedTab" class="text-caption text-medium-emphasis mt-2 mb-0">
+        Archived documents are kept but hidden from the main list. Archiving a folder archives everything in it, and
+        restoring the folder brings it all back.
+      </p>
     </v-col>
 
     <!--
@@ -74,7 +79,7 @@
       place in the folder tree, so a breadcrumb there would name a folder whose
       contents are not what is on screen.
     -->
-    <v-col cols="12" class="mb-2" v-if="isInsideFolder && !isExpiredTab">
+    <v-col cols="12" class="mb-2" v-if="isInsideFolder && !isExpiredTab && !isArchivedTab">
       <div class="folder-path-bar d-flex align-center ga-2 px-3 py-2">
         <v-btn
           icon="mdi-arrow-left"
@@ -227,6 +232,15 @@
                 >
                   <v-list-item-title class="text-body-2">Edit</v-list-item-title>
                 </v-list-item>
+                <v-list-item
+                  v-if="canUpdateDocument"
+                  class="folder-action-item"
+                  @click.stop="archiveItem(item._raw, !isArchivedTab)"
+                >
+                  <v-list-item-title class="text-body-2">
+                    {{ isArchivedTab ? "Restore" : "Archive" }}
+                  </v-list-item-title>
+                </v-list-item>
                 <v-list-item
                   v-if="canDeleteDocument"
                   class="folder-action-item"
@@ -265,6 +279,15 @@
               >
                 <v-list-item-title class="text-body-2">Edit</v-list-item-title>
               </v-list-item>
+              <v-list-item
+                v-if="canUpdateDocument"
+                class="folder-action-item"
+                @click.stop="archiveItem(item._raw, !isArchivedTab)"
+              >
+                <v-list-item-title class="text-body-2">
+                  {{ isArchivedTab ? "Restore" : "Archive" }}
+                </v-list-item-title>
+              </v-list-item>
               <v-list-item
                 class="folder-action-item"
                 @click.stop="openDeleteFolderDialog(item._raw)"
@@ -776,6 +799,7 @@ const documentService = useDocument();
 const {
   getAll: _getAllDocuments,
   deleteById,
+  setArchived,
   deleteFolderById,
   updateFolderById,
   createFolder,
@@ -841,8 +865,10 @@ const selectedFileType = ref("all");
  * Which half of the list is on screen. The value is sent straight to the API as
  * its `expiry` filter, so the tab and the query cannot drift apart.
  */
-const activeTab = ref<"active" | "expired">("active");
+const activeTab = ref<"active" | "expired" | "archived">("active");
 const isExpiredTab = computed(() => activeTab.value === "expired");
+// Archived: every archived item at the site, wherever it was filed (like Expired).
+const isArchivedTab = computed(() => activeTab.value === "archived");
 
 const {
   data: getDocumentReq,
@@ -859,7 +885,8 @@ const {
       parentId: activeParentId.value,
       type:
         selectedFileType.value === "all" ? undefined : selectedFileType.value,
-      expiry: activeTab.value,
+      expiry: isArchivedTab.value ? "all" : activeTab.value,
+      archived: isArchivedTab.value,
     }),
   {
     watch: [page, headerSearch, activeParentId, selectedFileType, activeTab],
@@ -1043,6 +1070,8 @@ function tableRowClickHandler(data: any) {
   const rowData = (data?._raw || data) as TDocument;
 
   if (isFolderItem(rowData)) {
+    // An archived folder is restored, not browsed: the Archived tab is a flat list.
+    if (isArchivedTab.value) return;
     openFolder(rowData);
     return;
   }
@@ -1142,6 +1171,30 @@ function setDocument({
   }
 }
 
+/** Archive / restore one row (document or folder). Same right as editing it. */
+async function archiveItem(item: TDocument, archive: boolean) {
+  const id = String((item as any)?._id || "");
+  if (!id) return;
+  documentActionMenu.value[id] = false;
+  folderActionMenu.value[id] = false;
+  try {
+    await setArchived(id, archive);
+    showMessage(
+      archive
+        ? "Archived. Find it under the Archived tab."
+        : "Restored to the main list.",
+      "success"
+    );
+    await getDocuments();
+  } catch (error: any) {
+    showMessage(
+      error?.data?.message ||
+        (archive ? "Could not archive it." : "Could not restore it."),
+      "error"
+    );
+  }
+}
+
 function showMessage(msg: string, color: string) {
   message.value = msg;
   messageColor.value = color;