@7365admin1/layer-common 4.132.0 → 4.134.0

package/constants/permissions.ts

@@ -391,7 +391,12 @@ export const PERMISSIONS = {
   ],
 
   // ---- security ----
+  // Security catalogue v2 (2026-10-20). `catalogue:security-v2` is the marker the
+  // role editor stamps on save; it grants nothing (see utils/security-catalogue.ts).
+  "offline-data": ["see-offline-data"],
+  catalogue: ["security-v2"],
   "visitor-mgmt": [
+    "invite-visitor",
     "see-all-visitor",
     "add-visitor",
     "update-visitor",
@@ -399,6 +404,8 @@ export const PERMISSIONS = {
     "delete-visitor",
   ],
   "vehicle-mgmt": [
+    "see-blocklist",
+    "manage-blocklist",
     "see-all-vehicles",
     "add-vehicle",
     "update-vehicle",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.132.0",
+  "version": "4.134.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/types/cleaner-schedule.d.ts

@@ -53,5 +53,5 @@ declare type TFlattenedUnitItem = TUnitChecklistItem & {
   set: number;
 };
 
-declare type TScheduleAreaStatus = "All" | "Open" | "Ongoing" | "Completed";
+declare type TScheduleAreaStatus = "All" | "Open" | "Ongoing" | "Completed" | "Closed";
 declare type TAreaType = "all" | "common" | "toilet";

package/utils/org-modules.ts

@@ -54,6 +54,7 @@ export const ALWAYS_ALLOWED_MODULES: readonly string[] = Object.freeze([
   "roles",
   "roles-and-permissions",
   "site-settings",
+  "offline-data",
 ]);
 
 /**
@@ -246,6 +247,21 @@ export function ownerGrant(
   return chosen ? (permissions as unknown[]).map(String) : null;
 }
 
+/**
+ * Legacy grant keys that also carry a newer key split out of them. Mirrors
+ * core `PERMISSION_COVERS` (security catalogue v2 entries only).
+ */
+const GRANT_COVERS: Readonly<Record<string, readonly string[]>> = {
+  "vehicle-mgmt:see-all-vehicles": ["vehicle-mgmt:see-blocklist"],
+  "vehicle-mgmt:update-vehicle": ["vehicle-mgmt:manage-blocklist"],
+  "visitor-mgmt:add-visitor": ["visitor-mgmt:invite-visitor"],
+  "visitorManagement:add-visitor": ["visitor-mgmt:invite-visitor"],
+  "visitor:create": ["visitor-mgmt:invite-visitor"],
+};
+
+const grantHolds = (grant: readonly string[], key: string) =>
+  grant.includes(key) || grant.some((g) => GRANT_COVERS[g]?.includes(key));
+
 /**
  * Narrow a `{ resource: { action } }` catalogue to that grant. Running the
  * organisation (`ALWAYS_ALLOWED_MODULES`) is never narrowed, matching the
@@ -266,7 +282,7 @@ export function catalogueForOwnerGrant<T extends Record<string, unknown>>(
     if (!actions || typeof actions !== "object") continue;
     const kept = Object.fromEntries(
       Object.entries(actions as Record<string, unknown>).filter(([action]) =>
-        grant.includes(`${resource}:${action}`),
+        grantHolds(grant, `${resource}:${action}`),
       ),
     );
     if (Object.keys(kept).length) narrowed[resource] = kept;

package/utils/schedule-task.ts

@@ -0,0 +1,281 @@
+/**
+ * EXTRA VISITS (SCHEDULE TASKS) - the rules and the wording, in one place.
+ *
+ * Mirrors the server (module-hygiene `schedule-task-rules.util.ts`) so the form
+ * can say "this will never run" BEFORE the user saves, and the list and the
+ * summary can speak plain English. The server stays the authority; every
+ * message it sends is still shown. All times are Singapore time (UTC+8).
+ *
+ * Pure: no Vue, no imports, so it is unit-tested with `node --test`.
+ */
+
+export type TRepeat = "none" | "daily" | "weekdays" | "weekly" | "monthly";
+
+export const REPEAT_OPTIONS: { title: string; value: TRepeat }[] = [
+  { title: "Once", value: "none" },
+  { title: "Every day", value: "daily" },
+  { title: "Weekdays (Mon to Fri)", value: "weekdays" },
+  { title: "Weekly", value: "weekly" },
+  { title: "Monthly", value: "monthly" },
+];
+
+/** Sunday = 0, as the server stores it. Shown Monday first. */
+export const WEEK_DAYS: { title: string; value: number }[] = [
+  { title: "Mon", value: 1 },
+  { title: "Tue", value: 2 },
+  { title: "Wed", value: 3 },
+  { title: "Thu", value: 4 },
+  { title: "Fri", value: 5 },
+  { title: "Sat", value: 6 },
+  { title: "Sun", value: 0 },
+];
+
+export type TScheduleForm = {
+  title: string;
+  time: string; // HH:mm
+  repeat: TRepeat;
+  dates: string[]; // YYYY-MM-DD, used when repeat is "none"
+  daysOfWeek: number[];
+  startDate: string; // YYYY-MM-DD, when repeating
+  endDate: string; // YYYY-MM-DD or ""
+  areaCount: number;
+};
+
+export type TScheduleErrors = Partial<
+  Record<"title" | "areas" | "time" | "dates" | "daysOfWeek" | "startDate" | "endDate" | "never", string>
+>;
+
+const SGT_MS = 8 * 60 * 60 * 1000;
+const TIME_RE = /^([0-1]\d|2[0-3]):([0-5]\d)$/;
+const pad = (n: number) => String(n).padStart(2, "0");
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+const DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+
+/** Singapore calendar date, minutes since midnight, weekday (0 = Sunday). */
+export function sgtParts(now: Date = new Date()) {
+  const s = new Date(now.getTime() + SGT_MS);
+  return {
+    date: `${s.getUTCFullYear()}-${pad(s.getUTCMonth() + 1)}-${pad(s.getUTCDate())}`,
+    minutes: s.getUTCHours() * 60 + s.getUTCMinutes(),
+    weekday: s.getUTCDay(),
+  };
+}
+
+const toMinutes = (time: string) => {
+  const [h, m] = time.split(":").map(Number);
+  return h * 60 + m;
+};
+const utc = (date: string) => {
+  const [y, m, d] = date.split("-").map(Number);
+  return new Date(Date.UTC(y, m - 1, d));
+};
+const weekdayOf = (date: string) => utc(date).getUTCDay();
+const daysInMonth = (date: string) => {
+  const [y, m] = date.split("-").map(Number);
+  return new Date(Date.UTC(y, m, 0)).getUTCDate();
+};
+const addDays = (date: string, n: number) => {
+  const t = utc(date);
+  t.setUTCDate(t.getUTCDate() + n);
+  return `${t.getUTCFullYear()}-${pad(t.getUTCMonth() + 1)}-${pad(t.getUTCDate())}`;
+};
+
+/** "21 Oct" (the year is added only when it is not the current one). */
+export function fmtDate(date: string, nowYear = sgtParts().date.slice(0, 4)): string {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(date || "")) return date || "";
+  const [y, m, d] = date.split("-");
+  return `${Number(d)} ${MONTHS[Number(m) - 1]}${y === nowYear ? "" : ` ${y}`}`;
+}
+
+/** "Tue 21 Oct, 08:00" from a server ISO string ("2026-10-21T08:00:00+08:00") - read as written, no time zone maths. */
+export function fmtMoment(iso: string | null | undefined, nowYear?: string): string {
+  const m = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2})/.exec(iso || "");
+  if (!m) return "";
+  return `${DAYS[weekdayOf(m[1])]} ${fmtDate(m[1], nowYear)}, ${m[2]}`;
+}
+
+type TRule = Pick<TScheduleForm, "repeat" | "dates" | "daysOfWeek" | "startDate" | "endDate" | "time">;
+
+const isRepeating = (r: Pick<TRule, "repeat">) => !!r.repeat && r.repeat !== "none";
+
+function occursOn(r: TRule, date: string): boolean {
+  if (r.endDate && date > r.endDate) return false;
+  if (!isRepeating(r)) return r.dates.includes(date);
+  if (r.startDate && date < r.startDate) return false;
+  const wd = weekdayOf(date);
+  switch (r.repeat) {
+    case "daily":
+      return true;
+    case "weekdays":
+      return wd >= 1 && wd <= 5;
+    case "weekly":
+      return r.daysOfWeek.includes(wd);
+    case "monthly": {
+      const wanted = r.startDate ? Number(r.startDate.slice(8, 10)) : 1;
+      return Number(date.slice(8, 10)) === Math.min(wanted, daysInMonth(date));
+    }
+    default:
+      return false;
+  }
+}
+
+/**
+ * The next day this would run if saved right now ("YYYY-MM-DD"), or null when it never would.
+ * A day whose time has already passed does not count: a task saved after its time waits for its next day.
+ */
+export function nextRunDate(r: TRule, now: Date = new Date()): string | null {
+  if (r.time && !TIME_RE.test(r.time)) return null;
+  const { date: today, minutes } = sgtParts(now);
+  const due = r.time ? toMinutes(r.time) : 0;
+  if (occursOn(r, today) && minutes < due) return today;
+  if (!isRepeating(r)) {
+    const later = r.dates.filter((d) => d > today && (!r.endDate || d <= r.endDate)).sort();
+    return later[0] ?? null;
+  }
+  const from = r.startDate && r.startDate > today ? r.startDate : today;
+  // 400 days covers the longest gap (a monthly rule on the 31st).
+  for (let i = from === today ? 1 : 0; i <= 400; i++) {
+    const d = addDays(from, i);
+    if (r.endDate && d > r.endDate) return null;
+    if (occursOn(r, d)) return d;
+  }
+  return null;
+}
+
+/** Plain-English problems with the form, mirroring the server's checks. Empty object = fine. */
+export function validateSchedule(f: TScheduleForm, now: Date = new Date()): TScheduleErrors {
+  const e: TScheduleErrors = {};
+  const { date: today, minutes } = sgtParts(now);
+  const repeating = isRepeating(f);
+
+  if (!f.title.trim()) e.title = "Please enter a title.";
+  if (f.areaCount < 1) e.areas = "Pick at least one area.";
+  if (!TIME_RE.test(f.time || "")) e.time = "Please choose a time (24-hour, like 08:30).";
+
+  if (repeating) {
+    if (!f.startDate) e.startDate = "Please choose a start date.";
+    if (f.repeat === "weekly" && !f.daysOfWeek.length) e.daysOfWeek = "Pick at least one weekday.";
+  } else if (!f.dates.length) {
+    e.dates = "Pick at least one date.";
+  }
+
+  const start = repeating ? f.startDate : [...f.dates].sort()[0];
+  if (f.endDate && start && start > f.endDate) e.endDate = "The end date must be on or after the start date.";
+  else if (f.endDate && f.endDate < today) e.endDate = "The end date has already passed.";
+
+  if (!repeating && f.dates.length && !e.time) {
+    if (f.dates.every((d) => d < today)) e.dates = "All the dates you picked have already passed. Pick today or a later date.";
+    else if (f.dates.every((d) => d <= today) && f.dates.includes(today) && toMinutes(f.time) <= minutes) {
+      e.dates = "That time has already passed today. Pick a later time or another date.";
+    }
+  }
+
+  if (!Object.keys(e).length && !nextRunDate(f, now)) {
+    e.never = "This schedule would never run. Check the dates, end date and time.";
+  }
+  return e;
+}
+
+/** "at 08:00 every weekday from 21 Oct until 31 Dec" - the When, as a sentence fragment. */
+export function describeWhen(
+  t: Partial<TRule> & { time?: string },
+  nowYear?: string,
+): string {
+  const time = t.time ? `at ${t.time} ` : "";
+  const repeat = t.repeat || "none";
+  const dates = t.dates || [];
+  const range =
+    (t.startDate ? ` from ${fmtDate(t.startDate, nowYear)}` : "") +
+    (t.endDate ? ` until ${fmtDate(t.endDate, nowYear)}` : "");
+  switch (repeat) {
+    case "daily":
+      return `${time}every day${range}`;
+    case "weekdays":
+      return `${time}every weekday${range}`;
+    case "weekly": {
+      const names = WEEK_DAYS.filter((d) => (t.daysOfWeek || []).includes(d.value)).map((d) => d.title);
+      return `${time}every ${names.join(", ") || "week"}${range}`;
+    }
+    case "monthly": {
+      const day = t.startDate ? Number(t.startDate.slice(8, 10)) : null;
+      const on = day === null ? "every month" : day === 31 ? "on the last day of every month" : `on day ${day} of every month`;
+      return `${time}${on}${range}`;
+    }
+    default: {
+      const sorted = [...dates].sort();
+      if (!sorted.length) return `${time}on no date`.trim();
+      const shown = sorted.slice(0, 3).map((d) => fmtDate(d, nowYear)).join(", ");
+      return `${time}on ${shown}${sorted.length > 3 ? ` +${sorted.length - 3} more` : ""}${
+        t.endDate ? ` (until ${fmtDate(t.endDate, nowYear)})` : ""
+      }`;
+    }
+  }
+}
+
+/** The sentence shown before saving. */
+export function buildSummary(
+  f: TScheduleForm,
+  unitCount: number,
+  now: Date = new Date(),
+): string {
+  const year = sgtParts(now).date.slice(0, 4);
+  const areas = `${f.areaCount} area${f.areaCount === 1 ? "" : "s"}`;
+  const units = `${unitCount} unit${unitCount === 1 ? "" : "s"}`;
+  const next = nextRunDate(f, now);
+  const nextText = next ? `${DAYS[weekdayOf(next)]} ${fmtDate(next, year)}` : "never";
+  return `Adds 1 extra visit to ${areas} (${units}) ${describeWhen(f, year)} — next: ${nextText}.`;
+}
+
+export const STATUS_LABELS: Record<string, string> = { active: "Active", paused: "Paused", ended: "Ended" };
+
+/** "Done 20 Oct" / "Missed 20 Oct" / "Not run yet". */
+export function lastRunLabel(row: { lastRun?: string | null; lastRunStatus?: string | null }): string {
+  if (!row.lastRun) return "Not run yet";
+  const m = /^(\d{4}-\d{2}-\d{2})/.exec(row.lastRun);
+  const day = m ? fmtDate(m[1]) : "";
+  const word = { done: "Done", missed: "Missed", pending: "In progress" }[row.lastRunStatus || ""] || "Ran";
+  return `${word} ${day}`.trim();
+}
+
+/**
+ * One name and one page path per trade. The names are the web menu names (M&E
+ * is "Technician Schedule" - the mobile app mirrors it); the path is the folder
+ * the trade app serves its daily schedule from.
+ */
+export const SCHEDULE_NAMES: Record<string, { title: string; route: string }> = {
+  cleaning_services: { title: "Cleaning Schedule", route: "cleaning-schedule" },
+  landscaping_services: { title: "Landscape Schedule", route: "landscape-schedule" },
+  pest_control_services: { title: "Pest Schedule", route: "pest-schedule" },
+  pool_maintenance_services: { title: "Pool Schedule", route: "pool-schedule" },
+  mechanical_electrical_services: { title: "Technician Schedule", route: "technician-schedule" },
+};
+
+export const scheduleNameFor = (serviceType?: string) =>
+  SCHEDULE_NAMES[serviceType || ""] || SCHEDULE_NAMES.cleaning_services;
+
+/** Singapore "today" as YYYY-MM-DD, for "is today's list there yet". */
+export const sgtToday = (now: Date = new Date()) => sgtParts(now).date;
+
+/** True when any row in the list was created today (Singapore time). */
+export function hasListForToday(rows: { createdAt?: string | Date }[], now: Date = new Date()): boolean {
+  const today = sgtToday(now);
+  return rows.some((r) => {
+    const t = r.createdAt ? new Date(r.createdAt) : null;
+    return !!t && !Number.isNaN(t.getTime()) && sgtParts(t).date === today;
+  });
+}
+
+/** One spelling for the in-flight state ("Ongoing" / "On-going" -> "In progress"); other words pass through. */
+export function dailyStatusLabel(status: string | null | undefined): string {
+  const s = String(status ?? "").trim();
+  if (!s) return "No status";
+  return /^on-?going$/i.test(s) ? "In progress" : s;
+}
+
+/** A unit's result in the history view: Done, Needs redo (rejected by a supervisor) or Missed (never done). */
+export function historyUnitLabel(status: string | null | undefined): "Done" | "Needs redo" | "Missed" {
+  const s = String(status ?? "").trim().toLowerCase();
+  if (s === "completed" || s === "done" || s === "approved") return "Done";
+  if (s === "rejected" || s === "needs redo") return "Needs redo";
+  return "Missed";
+}

package/utils/security-catalogue.ts

@@ -0,0 +1,59 @@
+import { holdsPermission } from "./permission-spellings.ts";
+
+/**
+ * Security catalogue v2 marker. The role editor adds it on save (security roles
+ * only). It grants nothing -- it only says "this role was saved with the new
+ * boxes, so check them exactly". A role without it keeps today's behaviour.
+ * Mirrors core/API-core; keep the three in step.
+ */
+export const SECURITY_CATALOGUE_MARKER = "catalogue:security-v2";
+
+/** new key -> legacy keys that stand in for it on an UNMARKED role. null = open to all. */
+export const SECURITY_V2_FALLBACKS: Readonly<Record<string, readonly string[] | null>> = {
+  "vehicle-mgmt:see-blocklist": ["vehicle-mgmt:see-all-vehicles"],
+  "vehicle-mgmt:manage-blocklist": ["vehicle-mgmt:update-vehicle"],
+  "visitor-mgmt:invite-visitor": [
+    "visitor-mgmt:add-visitor",
+    "visitorManagement:add-visitor",
+    "visitor:create",
+  ],
+  "offline-data:see-offline-data": null,
+};
+
+export const isSecurityV2Marked = (perms?: readonly string[] | null) =>
+  !!perms?.includes(SECURITY_CATALOGUE_MARKER);
+
+/** Real keys = anything that is not the marker or the wildcard. */
+export const countRealPermissions = (perms?: readonly string[] | null) =>
+  (perms ?? []).filter((p) => p !== SECURITY_CATALOGUE_MARKER).length;
+
+/**
+ * Effective grant for a v2 key. Empty list / "*" = allowed (same as
+ * usePermission). Unmarked role -> legacy fallback; marked role -> exact key.
+ */
+export function effectiveSecurityGrant(
+  perms: readonly string[] | undefined | null,
+  key: string,
+): boolean {
+  if (!perms?.length || perms.includes("*")) return true;
+  if (isSecurityV2Marked(perms)) return holdsPermission(perms, key);
+  const legacy = SECURITY_V2_FALLBACKS[key];
+  if (legacy === undefined) return holdsPermission(perms, key);
+  if (legacy === null) return true;
+  return legacy.some((k) => holdsPermission(perms, k));
+}
+
+/** Marker to append on save: only when the list has a real key and no "*". */
+export function withSecurityMarker(perms: readonly string[]): string[] {
+  const keys = perms.filter((p) => p !== SECURITY_CATALOGUE_MARKER);
+  if (!keys.length || keys.includes("*")) return keys;
+  return [...keys, SECURITY_CATALOGUE_MARKER];
+}
+
+/** New keys to pre-tick when opening an UNMARKED role in the editor. */
+export function securityV2PreTicks(perms: readonly string[]): string[] {
+  if (!perms.length || perms.includes("*") || isSecurityV2Marked(perms)) return [];
+  return Object.keys(SECURITY_V2_FALLBACKS).filter(
+    (k) => !perms.includes(k) && effectiveSecurityGrant(perms, k),
+  );
+}

package/utils/status.ts

@@ -73,6 +73,12 @@ const TONES: Record<string, TStatusTone> = {
 
   complete: "ok",
 
+  // Extra visits (schedule tasks): the last run's result and the task's state.
+  done: "ok",
+  missed: "err",
+  paused: "warn",
+  "needs redo": "warn",
+
   inactive: "neutral", // was `grey`
   "in active": "neutral", // the same word, printed "In-Active"
   declined: "neutral", // was Vuetify's `default`

package/utils/vehicle-actions.ts

@@ -27,6 +27,8 @@ export type VehicleActionPermissions = {
   canUpdateVehicle?: boolean;
   canDeleteVehicle?: boolean;
   canApproveVehicle?: boolean;
+  /** Block / Unblock. Omitted = allowed (today's behaviour). */
+  canManageBlocklist?: boolean;
 };
 
 export type VehicleAction = {
@@ -81,6 +83,12 @@ export function vehiclePlateActions(
   const isRestorable = RESTORABLE.has(status);
 
   const canUpdate = !!permissions.canUpdateVehicle;
+  // Server accepts manage-blocklist OR update-vehicle. When the caller passes the
+  // flag it decides alone; absent, block follows update (today's rule).
+  const canBlock =
+    permissions.canManageBlocklist === undefined
+      ? canUpdate
+      : !!permissions.canManageBlocklist;
   const actions: VehicleAction[] = [];
 
   if (canUpdate && (isAllowed || isBlocked)) {
@@ -118,7 +126,7 @@ export function vehiclePlateActions(
   // same thing. A deleted whitelist plate keeps Block - that turns it into a
   // blocked plate, which Restore (back to allowed) does not.
   const restoresToBlocked = isRestorable && type === "blocklist";
-  if (canUpdate && (isAllowed || isUnblocked || (isRestorable && !restoresToBlocked))) {
+  if (canBlock && (isAllowed || isUnblocked || (isRestorable && !restoresToBlocked))) {
     actions.push({
       key: "block",
       title: "Block",
@@ -127,7 +135,7 @@ export function vehiclePlateActions(
     });
   }
 
-  if (canUpdate && isBlocked) {
+  if (canBlock && isBlocked) {
     actions.push({
       key: "unblock",
       title: "Unblock",

package/composables/useScheduleTaskArea.ts

@@ -1,85 +0,0 @@
-export default function useScheduleTaskArea() {
-  async function getAreas({
-    site = "",
-    search = "",
-    page = 1,
-    limit = 10,
-  } = {}) {
-    return useNuxtApp().$api<Record<string, any>>(
-      "/api/hygiene-schedule-task-area",
-      {
-        method: "GET",
-        query: {
-          site,
-          search,
-          page,
-          limit,
-        },
-      }
-    );
-  }
-
-  function createArea(name: string, site: string) {
-    return useNuxtApp().$api<Record<string, any>>(
-      "/api/hygiene-schedule-task-area",
-      {
-        method: "POST",
-        body: {
-          name,
-          site,
-        },
-      }
-    );
-  }
-
-  function updateArea(id: string, name: string) {
-    return useNuxtApp().$api<Record<string, any>>(
-      `/api/hygiene-schedule-task-area/id/${id}`,
-      {
-        method: "PATCH",
-        body: { name },
-      }
-    );
-  }
-
-  function deleteArea(id: string) {
-    return useNuxtApp().$api<Record<string, any>>(
-      `/api/hygiene-schedule-task-area/id/${id}`,
-      {
-        method: "DELETE",
-      }
-    );
-  }
-
-  function getAreaById(id: string) {
-    return useNuxtApp().$api<Record<string, any>>(
-      `/api/hygiene-schedule-task-area/id/${id}`,
-      {
-        method: "GET",
-      }
-    );
-  }
-
-  function uploadAreas(file: File, site: string) {
-    const formData = new FormData();
-    formData.append("file", file);
-    formData.append("site", site);
-
-    return useNuxtApp().$api<Record<string, any>>(
-      "/api/hygiene-schedule-task-area/upload",
-      {
-        method: "POST",
-        body: formData,
-      }
-    );
-  }
-
-  return {
-    getAreas,
-    createArea,
-    updateArea,
-    deleteArea,
-    getAreaById,
-    uploadAreas,
-  };
-}