@7365admin1/layer-common 4.132.0 → 4.133.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.133.0
+
+### Minor Changes
+
+- 2cfd359: Security roles: new permission boxes - See Blocklist, Block / Unblock Vehicles, Invite Visitor / Contractor, See Offline Data (needs core with the same keys). A security role gets a hidden `catalogue:security-v2` marker the first time it is saved in the editor; roles never saved keep today's access (the new boxes are pre-ticked from the old keys when opened). The marker is not counted in permission totals. `VehicleManagement` / `VehicleAddSelection` take optional `canSeeBlocklist` / `canManageBlocklist` props (default true = unchanged). Helper: `utils/security-catalogue`.
+
 ## 4.132.0
 
 ### Minor Changes
@@ -3346,11 +3352,11 @@ Monthly report: a month that had patrols opens the list of that month's patrol r
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                                                                                                                        owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                                                                                                                        staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/RolePermissionFormCreate.vue

@@ -283,6 +283,7 @@ import useRole from "../composables/useRole";
 import useUtils from "../composables/useUtils";
 import useSite from "../composables/useSite";
 import { readApiError } from "../utils/subscription-form";
+import { withSecurityMarker } from "../utils/security-catalogue";
 import { applyRolePreset, ROLE_PRESETS, type TRolePreset } from "../utils/inventory-presets";
 
 /** Shown after "Couldn't save:" when the server gave no reason (network, timeout). */
@@ -533,7 +534,10 @@ async function submit() {
   try {
     await createRole({
       name: name.value,
-      permissions: permState.value.selected,
+      // Security catalogue only (it carries `offline-data`): stamp the v2 marker.
+      permissions: "offline-data" in (props.permissions || {})
+        ? withSecurityMarker(permState.value.selected)
+        : permState.value.selected,
       type: props.type,
       org: props.org,
       site: props.siteId,

package/components/RolePermissionFormPreviewUpdate.vue

@@ -272,6 +272,11 @@ import {
 import useRole from "../composables/useRole";
 import useUtils from "../composables/useUtils";
 import { readApiError } from "../utils/subscription-form";
+import {
+  countRealPermissions,
+  securityV2PreTicks,
+  withSecurityMarker,
+} from "../utils/security-catalogue";
 import {
   holdsPermission,
   withoutPermission,
@@ -348,8 +353,8 @@ const totalLabel = computed(() => {
   const held = definedModel.value ?? [];
   if (holdsWildcard.value) return "All";
   return props.catalogueSize > 0
-    ? `${held.length} / ${props.catalogueSize}`
-    : String(held.length);
+    ? `${countRealPermissions(held)} / ${props.catalogueSize}`
+    : String(countRealPermissions(held));
 });
 
 /**
@@ -638,6 +643,23 @@ const edit = defineModel<boolean>("edit", {
   default: false,
 });
 
+/**
+ * Security catalogue only: the Security tree carries the `offline-data`
+ * module. Other apps' editors never match, so they are untouched.
+ */
+const isSecurityCatalogue = computed(
+  () => "offline-data" in (props.permissions as Record<string, unknown>)
+);
+
+// Opening an UNMARKED security role for edit: pre-tick the new boxes the role
+// already effectively has (legacy fallback), so an unrelated save never strips
+// access. Cancel restores the original list.
+watch(edit, (on) => {
+  if (!on || !isSecurityCatalogue.value) return;
+  const add = securityV2PreTicks(definedModel.value ?? []);
+  if (add.length) definedModel.value = [...definedModel.value, ...add];
+});
+
 /**
  * CANCEL THROWS THE DRAFT AWAY.
  *
@@ -688,7 +710,10 @@ const errorMessages = computed(() => {
     return equalValue;
   }
 
-  const requiredValue = requireListRule(definedModel.value);
+  // The marker is not a permission: a list holding only it is still empty.
+  const requiredValue = requireListRule(
+    (definedModel.value ?? []).filter((p) => countRealPermissions([p]) > 0)
+  );
   if (requiredValue) {
     return requiredValue;
   }
@@ -706,7 +731,12 @@ async function submit() {
   disable.value = true;
   message.value = "";
   try {
-    await updatePermissionById(props.id, definedModel.value);
+    await updatePermissionById(
+      props.id,
+      isSecurityCatalogue.value
+        ? withSecurityMarker(definedModel.value)
+        : definedModel.value
+    );
     emit("success");
   } catch (error: any) {
     // `error.response` is undefined on a network or timeout failure, so the old

package/components/RolePermissionMain.vue

@@ -208,6 +208,7 @@
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
 import { roleLabel, safeReturnTo, showSiteField, sitePickerRoleLabel } from "../utils/role";
 import { holdsPermission } from "../utils/permission-spellings";
+import { countRealPermissions } from "../utils/security-catalogue";
 import {
   catalogueForOrg,
   catalogueForOwnerGrant,
@@ -570,7 +571,8 @@ function getPermissionCount(permissions: unknown): string {
   if (held.includes("*")) return "All";
 
   const offered = permissionCatalogueSize.value;
-  return offered > 0 ? `${held.length} / ${offered}` : String(held.length);
+  const count = countRealPermissions(held);
+  return offered > 0 ? `${count} / ${offered}` : String(count);
 }
 
 function updateRolePermissionsInList(

package/components/VehicleAddSelection.vue

@@ -27,6 +27,8 @@
 type TVehicleAddChoice = TVehicleType | "seasonpass" | "whitelist-bulk";
 
 const prop = defineProps({
+  // Security catalogue v2: false hides the Blocklist choice. Default = today.
+  canManageBlocklist: { type: Boolean, default: true },
 });
 
 const emit = defineEmits(['cancel', 'select']);
@@ -37,7 +39,9 @@ const selection = computed<{label: string, value: TVehicleAddChoice}[]>(() => {
     // Many whitelist vehicles at once, typed or pasted into a sheet.
     { label: "Whitelist (Bulk)", value: "whitelist-bulk" },
     { label: "Season Pass", value: "seasonpass" },
-    { label: "Blocklist", value: "blocklist" },
+    ...(prop.canManageBlocklist
+      ? [{ label: "Blocklist", value: "blocklist" as TVehicleAddChoice }]
+      : []),
   ];
 })
 

package/components/VehicleManagement.vue

@@ -137,7 +137,7 @@
     <!-- <Snackbar v-model="messageSnackbar" :text="message" :color="messageColor" /> -->
 
     <v-dialog v-model="dialog.showSelection" width="450" persistent>
-      <VehicleAddSelection @cancel="dialog.showSelection = false" @select="handleSelectVehicleStatus" />
+      <VehicleAddSelection :can-manage-blocklist="canManageBlocklist" @cancel="dialog.showSelection = false" @select="handleSelectVehicleStatus" />
     </v-dialog>
 
     <!-- Many whitelist vehicles at once. Wider than the one-vehicle form: it
@@ -495,6 +495,9 @@ const props = defineProps({
   canDeleteVehicle: { type: Boolean, default: false },
   canViewVehicleDetails: { type: Boolean, default: false },
   canApproveVehicle: { type: Boolean, default: false },
+  // Security catalogue v2. Defaults keep today's behaviour for every other app.
+  canSeeBlocklist: { type: Boolean, default: true },
+  canManageBlocklist: { type: Boolean, default: undefined },
   site: { type: String, required: true },
   org: { type: String, required: true },
   app: { type: String, required: true },
@@ -578,11 +581,13 @@ const historyHeaders = [
  *                   resident / season pass that was blocked
  */
 type TVehicleTab = "residents" | "season-passes" | "block-listed";
-const vehicleTabs: { name: string; value: TVehicleTab }[] = [
+const vehicleTabs = computed<{ name: string; value: TVehicleTab }[]>(() => [
   { name: "Residents", value: "residents" },
   { name: "Season Passes", value: "season-passes" },
-  { name: "Block Listed", value: "block-listed" },
-]
+  ...(props.canSeeBlocklist
+    ? [{ name: "Block Listed", value: "block-listed" as TVehicleTab }]
+    : []),
+])
 const activeTab = ref<TVehicleTab>("residents");
 
 
@@ -1134,6 +1139,7 @@ const vehiclePermissions = computed(() => ({
   canUpdateVehicle: props.canUpdateVehicle && !revoked.update,
   canDeleteVehicle: props.canDeleteVehicle && !revoked.delete,
   canApproveVehicle: props.canApproveVehicle && !revoked.approve,
+  canManageBlocklist: props.canManageBlocklist,
 }));
 
 /**

package/composables/useSecurityPermission.ts

@@ -115,6 +115,14 @@ export default function useSecurityPermission() {
     },
 
     "vehicle-mgmt": {
+      "see-blocklist": {
+        check: true,
+        description: "See Blocklist",
+      },
+      "manage-blocklist": {
+        check: true,
+        description: "Block / Unblock Vehicles",
+      },
       "add-vehicle": {
         check: true,
         description: "Allows the user to add a new vehicle to the system.",
@@ -291,6 +299,10 @@ export default function useSecurityPermission() {
     },
 
     "visitor-mgmt": {
+      "invite-visitor": {
+        check: true,
+        description: "Invite Visitor / Contractor",
+      },
       "add-visitor": {
         check: true,
         description: "Allows the user to add a new visitor to the system.",
@@ -814,6 +826,13 @@ export default function useSecurityPermission() {
 
     },
 
+    "offline-data": {
+      "see-offline-data": {
+        check: true,
+        description: "See Offline Data",
+      },
+    },
+
   };
 
   return {

package/constants/permissions.ts

@@ -391,7 +391,12 @@ export const PERMISSIONS = {
   ],
 
   // ---- security ----
+  // Security catalogue v2 (2026-10-20). `catalogue:security-v2` is the marker the
+  // role editor stamps on save; it grants nothing (see utils/security-catalogue.ts).
+  "offline-data": ["see-offline-data"],
+  catalogue: ["security-v2"],
   "visitor-mgmt": [
+    "invite-visitor",
     "see-all-visitor",
     "add-visitor",
     "update-visitor",
@@ -399,6 +404,8 @@ export const PERMISSIONS = {
     "delete-visitor",
   ],
   "vehicle-mgmt": [
+    "see-blocklist",
+    "manage-blocklist",
     "see-all-vehicles",
     "add-vehicle",
     "update-vehicle",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.132.0",
+  "version": "4.133.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/org-modules.ts

@@ -54,6 +54,7 @@ export const ALWAYS_ALLOWED_MODULES: readonly string[] = Object.freeze([
   "roles",
   "roles-and-permissions",
   "site-settings",
+  "offline-data",
 ]);
 
 /**
@@ -246,6 +247,21 @@ export function ownerGrant(
   return chosen ? (permissions as unknown[]).map(String) : null;
 }
 
+/**
+ * Legacy grant keys that also carry a newer key split out of them. Mirrors
+ * core `PERMISSION_COVERS` (security catalogue v2 entries only).
+ */
+const GRANT_COVERS: Readonly<Record<string, readonly string[]>> = {
+  "vehicle-mgmt:see-all-vehicles": ["vehicle-mgmt:see-blocklist"],
+  "vehicle-mgmt:update-vehicle": ["vehicle-mgmt:manage-blocklist"],
+  "visitor-mgmt:add-visitor": ["visitor-mgmt:invite-visitor"],
+  "visitorManagement:add-visitor": ["visitor-mgmt:invite-visitor"],
+  "visitor:create": ["visitor-mgmt:invite-visitor"],
+};
+
+const grantHolds = (grant: readonly string[], key: string) =>
+  grant.includes(key) || grant.some((g) => GRANT_COVERS[g]?.includes(key));
+
 /**
  * Narrow a `{ resource: { action } }` catalogue to that grant. Running the
  * organisation (`ALWAYS_ALLOWED_MODULES`) is never narrowed, matching the
@@ -266,7 +282,7 @@ export function catalogueForOwnerGrant<T extends Record<string, unknown>>(
     if (!actions || typeof actions !== "object") continue;
     const kept = Object.fromEntries(
       Object.entries(actions as Record<string, unknown>).filter(([action]) =>
-        grant.includes(`${resource}:${action}`),
+        grantHolds(grant, `${resource}:${action}`),
       ),
     );
     if (Object.keys(kept).length) narrowed[resource] = kept;

package/utils/security-catalogue.ts

@@ -0,0 +1,59 @@
+import { holdsPermission } from "./permission-spellings.ts";
+
+/**
+ * Security catalogue v2 marker. The role editor adds it on save (security roles
+ * only). It grants nothing -- it only says "this role was saved with the new
+ * boxes, so check them exactly". A role without it keeps today's behaviour.
+ * Mirrors core/API-core; keep the three in step.
+ */
+export const SECURITY_CATALOGUE_MARKER = "catalogue:security-v2";
+
+/** new key -> legacy keys that stand in for it on an UNMARKED role. null = open to all. */
+export const SECURITY_V2_FALLBACKS: Readonly<Record<string, readonly string[] | null>> = {
+  "vehicle-mgmt:see-blocklist": ["vehicle-mgmt:see-all-vehicles"],
+  "vehicle-mgmt:manage-blocklist": ["vehicle-mgmt:update-vehicle"],
+  "visitor-mgmt:invite-visitor": [
+    "visitor-mgmt:add-visitor",
+    "visitorManagement:add-visitor",
+    "visitor:create",
+  ],
+  "offline-data:see-offline-data": null,
+};
+
+export const isSecurityV2Marked = (perms?: readonly string[] | null) =>
+  !!perms?.includes(SECURITY_CATALOGUE_MARKER);
+
+/** Real keys = anything that is not the marker or the wildcard. */
+export const countRealPermissions = (perms?: readonly string[] | null) =>
+  (perms ?? []).filter((p) => p !== SECURITY_CATALOGUE_MARKER).length;
+
+/**
+ * Effective grant for a v2 key. Empty list / "*" = allowed (same as
+ * usePermission). Unmarked role -> legacy fallback; marked role -> exact key.
+ */
+export function effectiveSecurityGrant(
+  perms: readonly string[] | undefined | null,
+  key: string,
+): boolean {
+  if (!perms?.length || perms.includes("*")) return true;
+  if (isSecurityV2Marked(perms)) return holdsPermission(perms, key);
+  const legacy = SECURITY_V2_FALLBACKS[key];
+  if (legacy === undefined) return holdsPermission(perms, key);
+  if (legacy === null) return true;
+  return legacy.some((k) => holdsPermission(perms, k));
+}
+
+/** Marker to append on save: only when the list has a real key and no "*". */
+export function withSecurityMarker(perms: readonly string[]): string[] {
+  const keys = perms.filter((p) => p !== SECURITY_CATALOGUE_MARKER);
+  if (!keys.length || keys.includes("*")) return keys;
+  return [...keys, SECURITY_CATALOGUE_MARKER];
+}
+
+/** New keys to pre-tick when opening an UNMARKED role in the editor. */
+export function securityV2PreTicks(perms: readonly string[]): string[] {
+  if (!perms.length || perms.includes("*") || isSecurityV2Marked(perms)) return [];
+  return Object.keys(SECURITY_V2_FALLBACKS).filter(
+    (k) => !perms.includes(k) && effectiveSecurityGrant(perms, k),
+  );
+}

package/utils/vehicle-actions.ts

@@ -27,6 +27,8 @@ export type VehicleActionPermissions = {
   canUpdateVehicle?: boolean;
   canDeleteVehicle?: boolean;
   canApproveVehicle?: boolean;
+  /** Block / Unblock. Omitted = allowed (today's behaviour). */
+  canManageBlocklist?: boolean;
 };
 
 export type VehicleAction = {
@@ -81,6 +83,12 @@ export function vehiclePlateActions(
   const isRestorable = RESTORABLE.has(status);
 
   const canUpdate = !!permissions.canUpdateVehicle;
+  // Server accepts manage-blocklist OR update-vehicle. When the caller passes the
+  // flag it decides alone; absent, block follows update (today's rule).
+  const canBlock =
+    permissions.canManageBlocklist === undefined
+      ? canUpdate
+      : !!permissions.canManageBlocklist;
   const actions: VehicleAction[] = [];
 
   if (canUpdate && (isAllowed || isBlocked)) {
@@ -118,7 +126,7 @@ export function vehiclePlateActions(
   // same thing. A deleted whitelist plate keeps Block - that turns it into a
   // blocked plate, which Restore (back to allowed) does not.
   const restoresToBlocked = isRestorable && type === "blocklist";
-  if (canUpdate && (isAllowed || isUnblocked || (isRestorable && !restoresToBlocked))) {
+  if (canBlock && (isAllowed || isUnblocked || (isRestorable && !restoresToBlocked))) {
     actions.push({
       key: "block",
       title: "Block",
@@ -127,7 +135,7 @@ export function vehiclePlateActions(
     });
   }
 
-  if (canUpdate && isBlocked) {
+  if (canBlock && isBlocked) {
     actions.push({
       key: "unblock",
       title: "Unblock",