@7365admin1/layer-common 4.2.10 → 4.2.11

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @iservice365/layer-common
 
+## 4.2.11
+
+### Patch Changes
+
+- 6b6e083: Say why the dashboard is empty instead of drawing nothing.
+
+  Every widget on `DashboardMain` is permission-gated and the gate fails closed,
+  so a role holding none of the widget permissions renders the header, the site
+  name and the Customize / Export / range controls — and then nothing at all. On
+  2026-09-04 a security-agency member whose role carried only Vehicle Mgmt and
+  Daily Occurrence Books reported that as a broken page; the gating was correct
+  and the blankness was the whole defect.
+
+  The dashboard now says which of the two reasons it is empty for, because they
+  need different people to act: the role grants no widget (an administrator has
+  to add the permission) or every widget was hidden in Customize (the reader can
+  put them back). Nothing is granted and no gate is loosened. The message is
+  suppressed while the role is still resolving and when the role fetch failed, so
+  it never flashes on load and never blames a role for a failed request.
+
 ## 4.2.10
 
 ### Patch Changes
@@ -554,11 +574,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                    GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                    GET /api/roles/id/:role                  that membership's role document
+                                      GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                      GET /api/roles/id/:role                  that membership's role document
 
-                                    owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                    staff  = member.type === "admin" && role.type === "admin"
+                                      owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                      staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/DashboardMain.vue

@@ -276,6 +276,39 @@
       }}). The figures for it are missing, not zero — refresh to try again.
     </v-alert>
 
+    <!--
+      A BLANK DASHBOARD MUST SAY WHY IT IS BLANK.
+
+      Every widget on this page is permission-gated (`canViewWidget`), and the
+      gate fails closed. A role holding none of the widget permissions therefore
+      renders the header, the range control and the Customize button — and then
+      nothing at all, with no way for the reader to tell an empty role from a
+      broken page. That cost a production escalation on 2026-09-04: a security
+      member whose role carried only Vehicle Mgmt and Daily Occurrence Books saw
+      an empty dashboard and reported it as a fault.
+
+      Two different sentences, because they need two different actions: the role
+      grants no widget (an administrator has to grant one), or the reader hid
+      them all in Customize (they can put them back themselves).
+    -->
+    <v-alert
+      v-if="noWidgetsGranted || noWidgetsShown"
+      type="info"
+      variant="tonal"
+      density="compact"
+      icon="mdi-view-dashboard-outline"
+      class="mb-4"
+    >
+      <template v-if="noWidgetsGranted">
+        Your role doesn't include any of the dashboard widgets, so there is
+        nothing to show here. Ask an administrator to add the permissions for
+        the areas you work in.
+      </template>
+      <template v-else>
+        Every widget is hidden. Use Customize to choose which ones to show.
+      </template>
+    </v-alert>
+
     <!-- ── KPI Cards ───────────────────────────────────────────────────────── -->
     <v-row dense class="mb-1 align-stretch">
       <v-col
@@ -2485,6 +2518,29 @@ const visibleKpiCards = computed(() =>
   kpiCards.value.filter((card) => isWidgetVisible(card.key))
 );
 
+/**
+ * Nothing to draw, and which of the two reasons it is.
+ *
+ * `noWidgetsGranted` asks the permission gate alone, over this mode's whole
+ * widget set — not over the reader's Customize choice — so hiding every widget
+ * by hand is never reported as a missing permission.
+ */
+const noWidgetsGranted = computed(
+  () =>
+    // Only once a role is actually loaded. `canViewWidget` fails closed while
+    // it is still resolving and if the fetch fails outright, and "your role
+    // grants nothing" is the wrong sentence for both of those — it would flash
+    // on every load and would lie about a failed request.
+    Boolean(userAppRole.value) &&
+    !defaultVisibleWidgetKeys.value.some((key) => canViewWidget(key))
+);
+
+const noWidgetsShown = computed(
+  () =>
+    Boolean(userAppRole.value) &&
+    !visibleWidgetKeys.value.some((key) => isWidgetVisible(key))
+);
+
 /**
  * The percentage pill's label. Same number the chip has always shown, written
  * the way the handoff prints it - `+0%` / `-6.4%`, the sign carrying what the

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.2.10",
+  "version": "4.2.11",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",