@7365admin1/layer-common 4.2.2-staging.267 → 4.2.3

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @iservice365/layer-common
 
+## 4.2.3
+
+### Patch Changes
+
+- b2d7f77: Render a plain sentence when a request fails without reaching the API.
+
+  `errorConverter` — the app-wide error mapper used by 29 call sites in this layer — only understood a JSON API error. A gateway 502, a 503/504, an nginx or Cloudflare HTML error page, a timeout or a dropped connection fell through it, so `ofetch`'s own developer string reached the screen: `[PUT] "/api/vehicles/6a9691f25648d7633171c9e3": 502`. It now maps those to a sentence chosen from the status, never renders HTML, a JSON dump or a raw object, and still returns our own API's message unchanged whenever there is one.
+
+  The vehicle dialogs had their own local copy of that logic (`readServerMessage`), which fell back to `error.message` and was where the leak was seen. It is gone; delete, restore, update-type, approve and the add/edit form all use the shared mapper.
+
+## 4.2.2
+
+### Patch Changes
+
+- 329b7e8: Self-service onboarding: a member can give an email, and every row can ask for its pass again (DV-0080).
+
+  `ContractorRegistrationForm` now requires an email per member in the Members dialog, so a member is
+  sent their OWN pass link rather than having to be handed it by the lead contractor. Both email
+  fields (the lead's, still optional, and each member's) validate their format inline — the API
+  validates them with Joi and would otherwise reject the whole submission over a field the visitor
+  could not see.
+
+  `VisitorQrCodeLinksCard` gains a Resend button on every row. A row that already has an address just
+  sends; a row with none opens an inline field, and what is typed there is saved onto that
+  registration and used. The lead row and the member rows were the same three-button row written
+  twice and are now one `v-for`.
+
+  The server's refusals are shown on the row in its own words — the 60-second per-record cooldown says
+  how many seconds are left, and a rejected address says so.
+
+  New `utils/self-service-links.ts` holds the pure part: building a pass link, deciding whether a row
+  still needs an address, and the loose format check that mirrors the API's own.
+
+- 6ae8d37: A snackbar no longer swallows clicks meant for the dialog underneath it
+
+  Every snackbar in the layer is drawn far above Vuetify's dialog stack, and its wrapper is a solid box that takes clicks. The realtime "New plate detected" toast landed over the Add Vehicle dialog's Submit button and made the button unclickable, so on a busy gate a vehicle could not be added at all. The shared `Snackbar.vue` is mounted by 57 screens, so any toast that fired while any dialog was open could do the same.
+
+  Toasts stay above dialogs — a camera-fault warning still has to be seen — but only their own buttons and links take clicks now. Everything else passes through to what is underneath.
+
+- 1945d95: Vehicle Management: complete row actions, per-plate targeting, readable camera errors and a form that says why it will not save
+
+  - The row menu now offers the correct action set for every status — Approve for pending, Unblock for a blocked vehicle, Block/Unblock, Edit and Delete — decided by one function shared with the Preview dialog, so a kebab can no longer open an empty menu.
+  - A row that groups several plates lists each plate under its own number instead of silently acting on the first one.
+  - Approve, Restore and Block failures are shown in the still-open dialog rather than a five-second toast.
+  - The add/edit form reports what the server says happened instead of a hardcoded "added successfully", and the Update button is no longer disabled without saying which fields are missing.
+  - Removed the debug logging that shipped with the vehicle form.
+
+- a0bd471: Vehicle Management: surface Edit and Delete on the table row, and stop a refused delete from failing silently.
+
+  Edit and Delete were already built and already shipping, but only reachable two clicks deep — click a row, then the kebab on the nested plate table inside the read-only Preview dialog. The main table now carries the same row kebab every other table in this package draws, calling the same handlers, so there is one code path per operation.
+
+  Also: `canApproveVehicle` was shadowed by a local `computed(() => true)`, so the Approve action rendered for every role regardless of permission; the Edit and Block/Unblock actions now check `canUpdateVehicle`, matching the `vehicle-mgmt:update-vehicle` the server enforces; and a delete the server refuses (the ANPR revoke could not be confirmed on every camera) now shows the reason in the dialog instead of setting a message string that was never displayed.
+
 ## 4.2.1
 
 ### Patch Changes
@@ -415,11 +468,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                  GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                  GET /api/roles/id/:role                  that membership's role document
+                      GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                      GET /api/roles/id/:role                  that membership's role document
 
-                  owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                  staff  = member.type === "admin" && role.type === "admin"
+                      owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                      staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.2.2-staging.267",
+  "version": "4.2.3",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",