@7365admin1/layer-common 4.37.0 → 4.38.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @iservice365/layer-common
 
+## 4.38.0
+
+### Minor Changes
+
+- 59ce7ed: Passes & Keys permissions and the membership the app is working in (DV-0409).
+
+  - Passes And Keys Management: new `add-passes-and-keys`, `update-passes-and-keys` and `delete-passes-and-keys` permissions in both the Security and the Property Management role catalogues (`useSecurityPermission`, `usePropertyPermission`). API-core now enforces them on `/api/keys` and `/api/qr-code-templates`; "See All Passes And Keys" is what shows the Templates and Passes & Keys pages.
+  - `plugins/API.ts` sends `X-App` (this app's member type, from `runtimeConfig.public.APP`) and `X-Org` (the organisation in the address) with every request, so core checks the role of the membership the screen is using when a person holds several memberships at one site. Only chooses among the user's own memberships; grants nothing. A server that does not read them is unaffected.
+
+- 27c17b7: Service-provider invitations can be answered in the app: the notification bell opens "<Company> has invited you to <site>" on the organisation app's Invitations page (other apps send the click there by URL), the new `ServiceProviderInvitationsReceived` section lists invitations from other organisations with Accept / Decline, `useServiceProviderInvitation` gains `acceptInvitation` and `getReceivedInvitations`, and the invitation card shows a failed accept or decline instead of swallowing it.
+
 ## 4.37.0
 
 ### Minor Changes
@@ -1430,11 +1441,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/NotificationBell.vue

@@ -134,7 +134,7 @@ import {
   timeAgo,
   type TInboxItem,
 } from "../utils/notification-inbox";
-import { notificationTarget } from "../utils/notification-target";
+import { externalTargetUrl, notificationTarget } from "../utils/notification-target";
 
 /**
  * The top-bar notification feed for the web, in every signed-in app.
@@ -168,6 +168,7 @@ const { getAll, getUnreadCount, markAsRead, markAllAsRead } = useNotification();
 const { currentUser } = useLocalAuth();
 const route = useRoute();
 const router = useRouter();
+const appConfig = useRuntimeConfig();
 
 const open = ref(false);
 const loading = ref(false);
@@ -305,14 +306,24 @@ function markRead(item: Record<string, any>) {
  */
 async function goToSubject(item: Record<string, any>) {
   const target = notificationTarget(item as any, {
-    organization: String(route.params?.organization ?? ""),
+    // The org app nests under `organization`; the service apps under `org`.
+    organization: String(route.params?.organization ?? route.params?.org ?? ""),
   });
   if (!target) return;
-  if (typeof router.hasRoute !== "function" || !router.hasRoute(target.name)) return;
+
+  if (typeof router.hasRoute !== "function" || !router.hasRoute(target.name)) {
+    // The page lives in another web app (the invitation is answered in the
+    // organisation app): go there by URL, or stay put if it is not configured.
+    const href = externalTargetUrl(target, { org: String(appConfig?.public?.APP_ORG ?? "") });
+    if (!href) return;
+    open.value = false;
+    window.location.assign(href);
+    return;
+  }
 
   open.value = false;
   try {
-    await router.push(target);
+    await router.push({ name: target.name, params: target.params, query: target.query });
   } catch {
     // A cancelled or duplicate navigation is not worth an error in the top bar.
   }

package/components/ServiceProviderInvitationPrompt.vue

@@ -57,6 +57,11 @@
         :label="invitation.statusLabel"
       />
     </div>
+
+    <!-- An accept or decline that failed: said on the card, not swallowed. -->
+    <div v-if="error" class="px-4 pb-4 text-error sp-invite-prompt__body" role="alert">
+      {{ error }}
+    </div>
   </AppCard>
 
   <AppCard v-else-if="error">
@@ -82,8 +87,8 @@ const props = defineProps({
 
 const emit = defineEmits<{ (e: "answered", status: string): void }>();
 
-const { getInvitation, declineInvitation } = useServiceProviderInvitation();
-const { addViaInvite } = useCustomerSite();
+const { getInvitation, declineInvitation, acceptInvitation } =
+  useServiceProviderInvitation();
 
 const invitation = ref<any>(null);
 const error = ref("");
@@ -112,9 +117,10 @@ async function load() {
 }
 
 async function accept() {
+  error.value = "";
   working.value = "accept";
   try {
-    await addViaInvite(props.invitationId);
+    await acceptInvitation(props.invitationId);
     await load();
     emit("answered", "complete");
   } catch (err: any) {
@@ -125,6 +131,7 @@ async function accept() {
 }
 
 async function decline() {
+  error.value = "";
   working.value = "decline";
   try {
     await declineInvitation(props.invitationId);

package/components/ServiceProviderInvitationsReceived.vue

@@ -0,0 +1,113 @@
+<template>
+  <!-- Nothing to answer and nothing linked: the section stays out of the way. -->
+  <section v-if="ids.length" class="sp-received mb-4" aria-labelledby="sp-received-title">
+    <div class="mb-2">
+      <div id="sp-received-title" class="screen-card-title">
+        Invitations from other organisations
+      </div>
+      <div class="screen-hint">
+        Another organisation has asked your company to provide services at one
+        of its sites. Accept to add the site to your Sites list, or decline.
+      </div>
+    </div>
+
+    <div class="d-flex flex-column ga-3">
+      <div
+        v-for="id in ids"
+        :key="id"
+        :class="{ 'sp-received__linked': id === linked }"
+      >
+        <Suspense>
+          <ServiceProviderInvitationPrompt
+            :invitation-id="id"
+            @answered="(status: string) => onAnswered(id, status)"
+          />
+        </Suspense>
+
+        <div v-if="answered[id] === 'complete'" class="sp-received__done mt-2">
+          {{ doneLine(id) }}
+          <NuxtLink v-if="sitesLink(id)" :to="sitesLink(id)">Open Sites</NuxtLink>
+        </div>
+      </div>
+    </div>
+  </section>
+</template>
+
+<script setup lang="ts">
+/**
+ * "Invitations from other organisations" — where a service provider answers an
+ * invitation another organisation sent it (owner report 2026-09-24: the bell
+ * said "Open the invitation to accept or decline" and there was nowhere to do
+ * either).
+ *
+ * The list comes from the server keyed on the signed-in account, so it is the
+ * same whichever organisation is on screen. The row the bell linked to
+ * (`?invite=<id>`) is always shown — even once answered or expired, so the
+ * person sees what happened to it — and is outlined.
+ */
+import type { TReceivedServiceProviderInvitation } from "../composables/useServiceProviderInvitation";
+
+const route = useRoute();
+const { getReceivedInvitations } = useServiceProviderInvitation();
+
+const items = ref<TReceivedServiceProviderInvitation[]>([]);
+const answered = reactive<Record<string, string>>({});
+
+const linked = computed(() => {
+  const value = String(route.query?.invite ?? "").trim();
+  return /^[a-f0-9]{24}$/i.test(value) ? value : "";
+});
+
+const ids = computed(() => {
+  const listed = items.value.map((i) => String(i._id));
+  return linked.value && !listed.includes(linked.value)
+    ? [linked.value, ...listed]
+    : listed;
+});
+
+function itemFor(id: string) {
+  return items.value.find((i) => String(i._id) === id);
+}
+
+function doneLine(id: string) {
+  const item = itemFor(id);
+  const whose = item?.providerOrgName ? `${item.providerOrgName}'s` : "your";
+  return item?.siteName
+    ? `${item.siteName} is now on ${whose} Sites list.`
+    : `The site is now on ${whose} Sites list.`;
+}
+
+function sitesLink(id: string) {
+  const org = itemFor(id)?.providerOrgId || String(route.params?.organization ?? "");
+  return org ? `/org/${org}/sites` : "";
+}
+
+function onAnswered(id: string, status: string) {
+  answered[id] = status;
+}
+
+async function load() {
+  try {
+    const res = await getReceivedInvitations();
+    items.value = Array.isArray(res?.items) ? res.items : [];
+  } catch {
+    // The section is an addition to the Invitations page; if it cannot load,
+    // the rest of the page must still work. A linked row still renders and
+    // reports its own error.
+    items.value = [];
+  }
+}
+
+await load();
+</script>
+
+<style scoped>
+.sp-received__linked :deep(.app-card) {
+  outline: 2px solid rgb(var(--v-theme-primary));
+  outline-offset: 2px;
+}
+
+.sp-received__done {
+  font-size: var(--fs-cell);
+}
+</style>

package/composables/usePropertyPermission.ts

@@ -579,6 +579,23 @@ export default function usePropertyPermission() {
         description:
           "Allows the user to view the list of all passes and keys on mobile. Checked by the iMA365 mobile app.",
       },
+      // DV-0396: the same three writes Security offers, enforced by API-core on
+      // /api/keys and /api/qr-code-templates for every app that calls them.
+      "add-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to add pass templates and to create or generate passes and keys.",
+      },
+      "update-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to edit pass templates, passes and keys, restore them, and change a pass or key back to Available.",
+      },
+      "delete-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to delete pass templates, passes and keys.",
+      },
     },
     "online-forms": {
       "see-all-online-forms": {

package/composables/useSecurityPermission.ts

@@ -669,12 +669,31 @@ export default function useSecurityPermission() {
     },
     // Property's descriptions minus its "Checked by the iMA365 mobile app."
     // sentence, which is not true of this application.
+    // Add / update / delete (DV-0396), also offered by Property Management and
+    // enforced by API-core on /api/keys and /api/qr-code-templates. The security web app's
+    // Templates and Passes & Keys pages and the guard app's pass & key screen
+    // read them. See All is also what shows those two web pages.
     "passes-and-keys-mgmt": {
       "see-all-passes-and-keys": {
         check: true,
         description:
           "Allows the user to view the list of all passes and keys on mobile.",
       },
+      "add-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to add pass templates and to create or generate passes and keys.",
+      },
+      "update-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to edit pass templates, passes and keys, restore them, and change a pass or key back to Available.",
+      },
+      "delete-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to delete pass templates, passes and keys.",
+      },
     },
     "resident-transactions": {
       "see-all-resident-transactions": {

package/composables/useServiceProviderInvitation.ts

@@ -26,6 +26,19 @@ export type TServiceProviderInvitation = {
   }>;
 };
 
+/** One row of "Invitations from other organisations". */
+export type TReceivedServiceProviderInvitation = {
+  _id: string;
+  orgName: string;
+  siteName: string;
+  status: string;
+  statusLabel: string;
+  expireAt?: string;
+  /** The invited company's own organisation (the one whose list gains the site). */
+  providerOrgId?: string;
+  providerOrgName?: string;
+};
+
 /** The words on screen. Kept beside the server's own list on purpose — a
  *  status the server invents must never render as a raw stored value. */
 export const SERVICE_PROVIDER_INVITE_LABELS: Record<string, string> = {
@@ -130,6 +143,23 @@ export default function useServiceProviderInvitation() {
     });
   }
 
+  /** Adds the site to the invited company's list. The invited account only. */
+  function acceptInvitation(id: string) {
+    return useNuxtApp().$api<{ message: string }>(`${base}/${id}/accept`, {
+      method: "PUT",
+    });
+  }
+
+  /**
+   * Invitations from other organisations still waiting for the signed-in
+   * account's answer — keyed on the account, not on the organisation on screen.
+   */
+  function getReceivedInvitations(): Promise<{
+    items: TReceivedServiceProviderInvitation[];
+  }> {
+    return useNuxtApp().$api(`${base}/received`, { method: "GET" });
+  }
+
   return {
     getInvitations,
     cancelInvitation,
@@ -141,5 +171,7 @@ export default function useServiceProviderInvitation() {
     rejectInvitation,
     getInvitation,
     declineInvitation,
+    acceptInvitation,
+    getReceivedInvitations,
   };
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.37.0",
+  "version": "4.38.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/plugins/API.ts

@@ -11,6 +11,17 @@ export default defineNuxtPlugin((nuxtApp) => {
     onRequest({ options }) {
       const sid = useCookie("sid", cookieConfig).value ?? "";
       options.headers.set("Authorization", sid);
+      // Which of the user's memberships this screen is working in (DV-0396):
+      // this app's member type and the organisation in the address. With
+      // several memberships pinned to one site, the server then checks the
+      // same role the screen was drawn from (core `requireSiteReach`). Only
+      // chooses among the user's own memberships; it grants nothing.
+      const app = useRuntimeConfig().public.APP;
+      if (app) options.headers.set("X-App", String(app));
+      const org = (nuxtApp as any).$router?.currentRoute?.value?.params?.org;
+      if (typeof org === "string" && /^[0-9a-f]{24}$/i.test(org)) {
+        options.headers.set("X-Org", org);
+      }
     },
     // "You do not have permission to ..." - the role changed since the page
     // read it. Re-read it in the background (plugins/secure-member.client.ts)

package/utils/notification-target.ts

@@ -31,7 +31,8 @@
 /** Only the fields a destination is decided from. */
 export type TTargetRow = {
   module?: string;
-  params?: { id?: string } | null;
+  screen?: string;
+  params?: { id?: string; org?: string } | null;
 };
 
 /** What the surrounding app knows that the stored row does not. */
@@ -43,6 +44,13 @@ export type TTargetContext = {
 export type TNotificationTarget = {
   name: string;
   params: Record<string, string>;
+  query?: Record<string, string>;
+  /**
+   * Set when the page lives in another web app. The bell opens
+   * `<that app's URL><path>` when its own router has no route by `name`.
+   */
+  app?: "org";
+  path?: string;
 };
 
 /** Nuxt's generated names for `pages/org/[organization]/marketplace/orders/`. */
@@ -52,12 +60,42 @@ export const ORDER_DETAIL_ROUTE = "org-organization-marketplace-orders-id";
 /** The stored `module` tag on a row sent to a vendor's staff. */
 export const VENDOR_ORDER_MODULE = "marketplace-vendor-order";
 
+/**
+ * "<Company> has invited you to <site>" — core `serviceProviderInvited` stores
+ * `module: "other"` (the apps route on it; it never changes) with this
+ * `screen`, the invitation id in `params.id`, and, since 2026-09-24, the
+ * invited company's own organisation in `params.org`.
+ *
+ * It opens the organisation app's Invitations page, where "Invitations from
+ * other organisations" lists it with Accept / Decline. Only the organisation
+ * app has that page; every other app sends the click there by URL.
+ */
+export const SP_INVITATION_SCREEN = "/service-provider-invitation";
+export const INVITATIONS_ROUTE = "org-organization-invitations-status-status";
+
 export function notificationTarget(
   item: TTargetRow | null | undefined,
   context: TTargetContext = {},
 ): TNotificationTarget | null {
   const organization = String(context.organization ?? "").trim();
 
+  if (String(item?.screen ?? "") === SP_INVITATION_SCREEN) {
+    // The invited company's organisation when the row names it (the invitation
+    // belongs there), otherwise the one on screen. The list on that page is
+    // keyed on the signed-in account, so either shows the invitation.
+    const org = String(item?.params?.org ?? "").trim() || organization;
+    if (!org) return null;
+    const id = String(item?.params?.id ?? "").trim();
+    const query: Record<string, string> = id ? { invite: id } : {};
+    return {
+      name: INVITATIONS_ROUTE,
+      params: { organization: org, status: "pending" },
+      query,
+      app: "org",
+      path: `/org/${encodeURIComponent(org)}/invitations/status/pending`,
+    };
+  }
+
   if (String(item?.module ?? "") !== VENDOR_ORDER_MODULE) return null;
 
   // Every order route is nested under the organization. Without one there is no
@@ -73,3 +111,18 @@ export function notificationTarget(
 
   return { name: ORDER_DETAIL_ROUTE, params: { organization, id } };
 }
+
+/**
+ * The full URL for a target whose page lives in another web app, or "" when
+ * there is none to build (no path, or that app's URL is not configured).
+ */
+export function externalTargetUrl(
+  target: TNotificationTarget | null | undefined,
+  appUrls: { org?: string } = {},
+): string {
+  if (!target?.app || !target.path) return "";
+  const base = String(appUrls[target.app] ?? "").trim().replace(/\/+$/, "");
+  if (!base) return "";
+  const qs = new URLSearchParams(target.query ?? {}).toString();
+  return `${base}${target.path}${qs ? `?${qs}` : ""}`;
+}