@7365admin1/layer-common 4.43.1 → 4.45.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @iservice365/layer-common
 
+## 4.45.0
+
+### Minor Changes
+
+- c6a8606: Invite member: from inside a site the Site field is fixed to that site (read-only), and the Role list shows only the organisation's own active roles for the invited app and that site, each labelled "Site role" or "Organisation role". Org-less template roles are no longer offered on an invitation into an organisation.
+- 1c0aea4: Settings → Site Information is read-only on a site the organisation serves but does not own: a note says "This site belongs to <Client>. Only they can change its details.", cover photo, description and documents are inert and Save is hidden. Blocks and guard posts stay editable. Driven by `detailsEditable`/`ownerOrgName` on the site read (core); absent on an older API = unchanged.
+
+## 4.44.0
+
+### Minor Changes
+
+- 8d20975: Notification Settings: Email per module, with an "Email address for notifications" card (send code, verify, resend, change). New `/notifications/open` page turns a notification email link into the right page, using the bell's own target table.
+
 ## 4.43.1
 
 ### Patch Changes
@@ -1496,11 +1509,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                              GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                              GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                  GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                  GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                              owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                              staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                  owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                  staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/InvitationForm.vue

@@ -46,9 +46,10 @@
               <v-col cols="12">
                 <v-autocomplete
                   v-model="invite.role"
-                  :items="roles"
-                  item-title="name"
+                  :items="roleOptions"
+                  item-title="title"
                   item-value="_id"
+                  :item-props="(item: any) => ({ subtitle: item.subtitle })"
                   :rules="[requiredRule]"
                   class="filter-field"
                   density="comfortable"
@@ -61,7 +62,23 @@
             <v-row no-gutters>
               <InputLabel class="text-capitalize" title="Site" />
               <v-col cols="12">
+                <!--
+                  Inviting from inside a site invites INTO that site. The owner
+                  (2026-09-25): other sites in this list were confusing, so the
+                  site is shown, not chosen.
+                -->
+                <v-text-field
+                  v-if="fixedSite"
+                  :model-value="invite.siteName || 'This site'"
+                  class="filter-field"
+                  density="comfortable"
+                  readonly
+                  hint="Invitations from this site are for this site."
+                  persistent-hint
+                  data-test="invite-fixed-site"
+                ></v-text-field>
                 <v-autocomplete
+                  v-else
                   v-model="invite.site"
                   :items="sites"
                   class="filter-field"
@@ -133,6 +150,8 @@ import useCustomerSite from '../composables/useCustomerSite';
 import useLocal from '../composables/useLocal';
 import { useLocalSetup } from '../composables/useLocalSetup';
 import useRole from '../composables/useRole';
+import useSite from '../composables/useSite';
+import { inviteRoleOptions } from '../utils/invite-role-options';
 import useUser from '../composables/useUser';
 import useUtils from '../composables/useUtils';
 
@@ -169,6 +188,16 @@ const props = defineProps({
    * which is about the site created in step 4) had no way to say so. It is
    * wired to `invite` below.
    */
+  /*
+   * The site the invitation is being made FROM (every site-level Invitations
+   * page passes it through InvitationMain). When set, the Site field is fixed
+   * to it and the Role list is that site's roles plus the organisation-wide
+   * ones.
+   */
+  siteId: {
+    type: String,
+    default: "",
+  },
   site: {
     type: Object as PropType<TCustomerSite>,
     default: () => ({
@@ -262,6 +291,18 @@ watch(
   },
   { immediate: true, deep: true }
 )
+
+/* The site this form is fixed to, if any: the page's site, or onboarding's. */
+const fixedSite = computed(() => props.siteId || props.site?.site || "")
+
+watch(
+  () => props.siteId,
+  (siteId) => {
+    if (!siteId) return
+    invite.value.site = siteId
+  },
+  { immediate: true }
+)
 // invite.value.app = props.app;
 // invite.value.org = props.org ?? "";
 
@@ -357,6 +398,27 @@ watchEffect(() => {
   }
 });
 
+/* Name the fixed site: from the organisation's site list, else read it. */
+const { getSiteById } = useSite();
+watch(
+  [fixedSite, sites],
+  async ([siteId]) => {
+    if (!siteId || invite.value.siteName) return
+    const listed = sites.value.find((x) => x?.value === siteId)
+    if (listed?.title) {
+      invite.value.siteName = listed.title
+      return
+    }
+    try {
+      const site: any = await getSiteById(siteId)
+      invite.value.siteName = site?.name || site?.data?.name || ""
+    } catch {
+      // The field still reads "This site"; the invitation carries the id.
+    }
+  },
+  { immediate: true }
+)
+
 watchEffect(() => {
   if (hasSite.value) {
     refreshSiteData();
@@ -384,26 +446,47 @@ const roles = ref<Array<Record<string, any>>>([]);
  */
 const { getInvitableRoles } = useRole();
 
+/*
+ * 2026-09-25 (owner report, Wing Tai / Winsland House I): the list now asks for
+ * the app actually being invited into (`invite.app`, which the App field can
+ * change - it used to keep asking for `props.app`) and for the chosen site, so
+ * it holds only this organisation's roles for this app and site. The org-less
+ * templates are gone from any invitation that names an organisation - the
+ * server refuses them there (`core roleInvitable`).
+ */
 const { data: RolesData, refresh: refreshRoles } = await useLazyAsyncData(
-  "get-roles-by-type-" + props.org + "-" + props.app,
+  "get-roles-by-type-" + props.org + "-" + props.app + "-" + fixedSite.value,
   () =>
     getInvitableRoles({
       org: props.org,
-      type: props.app,
-      limit: 50,
+      type: invite.value.app || props.app,
+      site: invite.value.site,
+      limit: 100,
     }),
-  { watch: [() => props.app] }
+  { watch: [() => props.app, () => invite.value.app, () => invite.value.site] }
 );
 
 watchEffect(() => {
   if (RolesData.value) {
     roles.value = RolesData.value.items;
+    // A role picked for a different site is not valid for this one.
+    if (
+      invite.value.role &&
+      !roles.value.some((r: any) => String(r._id) === String(invite.value.role))
+    ) {
+      invite.value.role = "";
+    }
   }
 });
 
+const roleOptions = computed(() => inviteRoleOptions(roles.value));
+
 async function handleUpdateApp(value: string)  {
   invite.value.role = "";
-  invite.value.site = "";
+  if (!fixedSite.value) {
+    invite.value.site = "";
+    invite.value.siteName = "";
+  }
   await refreshRoles()
 }
 

package/components/InvitationMain.vue

@@ -124,6 +124,7 @@
       <InvitationForm
         title="Invite member"
         :org="org"
+        :site-id="props.siteId"
         :invite-member="true"
         @cancel="dialogMember = false"
         @success="handleSuccess"

package/components/NotificationBell.vue

@@ -137,7 +137,7 @@ import {
   timeAgo,
   type TInboxItem,
 } from "../utils/notification-inbox";
-import { chooseNavigation, notificationTarget } from "../utils/notification-target";
+import { appUrlsFrom, chooseNavigation, notificationTarget } from "../utils/notification-target";
 
 /**
  * The top-bar notification feed for the web, in every signed-in app.
@@ -331,17 +331,7 @@ function hasLocalPage(path: string) {
 
 /** Every web app's URL, keyed like `TAppKey`, from the layer's runtime config. */
 function appUrls() {
-  const p = appConfig?.public ?? {};
-  return {
-    org: String(p.APP_ORG ?? ""),
-    security: String(p.APP_SECURITY ?? ""),
-    "property-management": String(p.APP_PROPERTY_MANAGEMENT ?? ""),
-    hygiene: String(p.APP_HYGIENE ?? ""),
-    "mechanical-electrical": String(p.APP_MECHANICAL_ELECTRICAL ?? ""),
-    "pest-control": String(p.APP_PEST_CONTROL ?? ""),
-    landscaping: String(p.APP_LANDSCAPING ?? ""),
-    "pool-maintenance": String(p.APP_POOL_MAINTENANCE ?? ""),
-  };
+  return appUrlsFrom(appConfig?.public as Record<string, unknown>);
 }
 
 /** The decision is `chooseNavigation` (unit-tested); this only carries it out. */

package/components/NotificationSettings.vue

@@ -56,6 +56,90 @@
             </AppCard>
           </v-col>
 
+          <!-- where notification emails go. Only when the server offers email to
+               this person; a module's Email switch does nothing until the
+               address below is verified. -->
+          <v-col v-if="email?.available" cols="12" class="mt-4">
+            <AppCard>
+              <div class="pa-6">
+                <div class="screen-card-title">Email address for notifications</div>
+
+                <!-- verified, nothing waiting -->
+                <template v-if="emailMode === 'verified'">
+                  <div class="screen-hint summary-line mt-1">
+                    Emails go to <strong>{{ email.address }}</strong>.
+                  </div>
+                  <AppButton variant="ghost" class="mt-4" :disabled="emailBusy" @click="startChange">
+                    Change
+                  </AppButton>
+                </template>
+
+                <!-- a code is on its way -->
+                <template v-else-if="emailMode === 'pending'">
+                  <div class="screen-hint summary-line mt-1">
+                    We sent a 6-digit code to <strong>{{ email.pendingAddress }}</strong>.
+                    Enter it here.
+                  </div>
+                  <div v-if="email.verified" class="screen-hint summary-line mt-1">
+                    Emails still go to {{ email.address }} until then.
+                  </div>
+                  <div class="d-flex flex-wrap align-end ga-3 mt-4">
+                    <AppField
+                      v-model="codeInput"
+                      label="Code"
+                      inputmode="numeric"
+                      autocomplete="one-time-code"
+                      maxlength="6"
+                      aria-label="6-digit code"
+                      :disabled="emailBusy"
+                      class="email-code"
+                    />
+                    <AppButton :disabled="emailBusy || codeInput.trim().length !== 6" @click="verifyCode">
+                      Verify
+                    </AppButton>
+                    <AppButton variant="ghost" :disabled="emailBusy" @click="sendCode(email.pendingAddress || '')">
+                      Resend code
+                    </AppButton>
+                    <AppButton variant="ghost" :disabled="emailBusy" @click="startChange">
+                      Change
+                    </AppButton>
+                  </div>
+                </template>
+
+                <!-- no address yet, or changing it -->
+                <template v-else>
+                  <div class="d-flex flex-wrap align-end ga-3 mt-4">
+                    <AppField
+                      v-model="addressInput"
+                      label="Email address"
+                      type="email"
+                      autocomplete="email"
+                      aria-label="Email address for notifications"
+                      :disabled="emailBusy"
+                      class="email-address"
+                    />
+                    <AppButton :disabled="emailBusy || !addressInput.trim()" @click="sendCode(addressInput)">
+                      Send code
+                    </AppButton>
+                    <AppButton
+                      v-if="changing"
+                      variant="ghost"
+                      :disabled="emailBusy"
+                      @click="changing = false"
+                    >
+                      Cancel
+                    </AppButton>
+                  </div>
+                </template>
+
+                <div v-if="emailError" class="email-error mt-3" role="alert">{{ emailError }}</div>
+                <div v-if="!email.verified" class="screen-hint summary-line mt-3">
+                  Emails start once your address is verified.
+                </div>
+              </div>
+            </AppCard>
+          </v-col>
+
           <!-- one panel per module, collapsed by default so a person with many
                modules gets a short list rather than a wall of switches -->
           <v-col cols="12" class="mt-4">
@@ -174,9 +258,18 @@
 import type {
   TNotificationCategorySetting,
   TNotificationChannelSetting,
+  TNotificationEmailSetting,
 } from "../composables/useNotificationPreference";
 
-const { getPreferences, savePreferences } = useNotificationPreference();
+const { getPreferences, savePreferences, requestEmailCode, verifyEmailCode } =
+  useNotificationPreference();
+
+const email = ref<TNotificationEmailSetting | null>(null);
+const addressInput = ref("");
+const codeInput = ref("");
+const changing = ref(false);
+const emailBusy = ref(false);
+const emailError = ref("");
 
 const categories = ref<TNotificationCategorySetting[]>([]);
 const loading = ref(true);
@@ -193,8 +286,20 @@ let confirmAccept: (() => void) | null = null;
 const switchableIn = (category: TNotificationCategorySetting) =>
   category.channels.filter((c) => c.supported);
 
+/**
+ * In the app and Phone alerts. "All on" is measured on these alone: Email is
+ * opt-in, so a module with Email off is still "all on" - and no bulk "on"
+ * button ever turns Email on (nobody gets email they did not pick one by one).
+ */
+const alertChannelsIn = (category: TNotificationCategorySetting) =>
+  switchableIn(category).filter((c) => c.key !== "email");
+
+/** What a bulk switch moves: every channel when turning off, never Email when turning on. */
+const bulkChannelsIn = (category: TNotificationCategorySetting, value: boolean) =>
+  value ? alertChannelsIn(category) : switchableIn(category);
+
 const categoryAllOn = (category: TNotificationCategorySetting) =>
-  switchableIn(category).every((c) => c.enabled);
+  alertChannelsIn(category).every((c) => c.enabled);
 
 const allOn = computed(
   () =>
@@ -230,6 +335,7 @@ async function load() {
   try {
     const res = await getPreferences();
     categories.value = res.data.categories;
+    setEmail(res.data.email);
   } catch {
     loadError.value =
       "We could not load your notification settings. Please refresh the page and try again.";
@@ -247,6 +353,7 @@ async function persist(previous: TNotificationCategorySetting[]) {
   try {
     const res = await savePreferences({ channels: [], categories: categories.value });
     categories.value = res.data.categories;
+    if (res.data.email) setEmail(res.data.email);
     notice.value = "Saved.";
   } catch {
     categories.value = previous;
@@ -276,7 +383,8 @@ function onToggle(
   const commit = () => apply(() => (channel.enabled = value));
 
   // switching a safety alert OFF is the only thing worth stopping to confirm
-  if (category.safety && !value) {
+  // Email is opt-in, so turning it off needs no warning.
+  if (category.safety && !value && channel.key !== "email") {
     confirmText.value = safetyOffConfirmation(category.label, channel.label);
     confirmAccept = commit;
     confirmOpen.value = true;
@@ -289,7 +397,7 @@ function onToggle(
 function setCategory(category: TNotificationCategorySetting, value: boolean) {
   const commit = () =>
     apply(() => {
-      for (const channel of switchableIn(category)) channel.enabled = value;
+      for (const channel of bulkChannelsIn(category, value)) channel.enabled = value;
     });
 
   if (category.safety && !value) {
@@ -306,7 +414,7 @@ function setAll(value: boolean) {
   const commit = () =>
     apply(() => {
       for (const category of categories.value) {
-        for (const channel of switchableIn(category)) channel.enabled = value;
+        for (const channel of bulkChannelsIn(category, value)) channel.enabled = value;
       }
     });
 
@@ -320,6 +428,67 @@ function setAll(value: boolean) {
   commit();
 }
 
+/** "pending" and "verified" show the address; "enter" shows the field. */
+const emailMode = computed(() => {
+  if (changing.value || !email.value) return "enter";
+  if (email.value.pendingAddress) return "pending";
+  if (email.value.verified) return "verified";
+  return "enter";
+});
+
+function setEmail(next?: TNotificationEmailSetting) {
+  email.value = next ?? null;
+  if (!addressInput.value) {
+    addressInput.value = next?.address || next?.pendingAddress || next?.accountEmail || "";
+  }
+}
+
+/** The server's own sentence when it has one ("That code is not right..."). */
+function messageOf(err: any, fallback: string) {
+  return String(err?.data?.message || err?.response?._data?.message || fallback);
+}
+
+function startChange() {
+  changing.value = true;
+  emailError.value = "";
+  addressInput.value = email.value?.pendingAddress || email.value?.address || email.value?.accountEmail || "";
+}
+
+async function sendCode(address: string) {
+  emailBusy.value = true;
+  emailError.value = "";
+  try {
+    const res = await requestEmailCode(address.trim());
+    categories.value = res.data.categories;
+    setEmail(res.data.email);
+    changing.value = false;
+    codeInput.value = "";
+    notice.value = res.data.email?.pendingAddress ? "Code sent. Check your email." : "Saved.";
+    noticeOpen.value = true;
+  } catch (err) {
+    emailError.value = messageOf(err, "We could not send the code. Please try again.");
+  } finally {
+    emailBusy.value = false;
+  }
+}
+
+async function verifyCode() {
+  emailBusy.value = true;
+  emailError.value = "";
+  try {
+    const res = await verifyEmailCode(codeInput.value.trim());
+    categories.value = res.data.categories;
+    setEmail(res.data.email);
+    codeInput.value = "";
+    notice.value = "Email address verified.";
+    noticeOpen.value = true;
+  } catch (err) {
+    emailError.value = messageOf(err, "We could not check that code. Please try again.");
+  } finally {
+    emailBusy.value = false;
+  }
+}
+
 function acceptConfirm() {
   confirmOpen.value = false;
   confirmAccept?.();
@@ -354,6 +523,20 @@ onMounted(load);
   color: var(--text);
 }
 
+.email-address {
+  flex: 1 1 260px;
+  max-width: 360px;
+}
+
+.email-code {
+  width: 140px;
+}
+
+.email-error {
+  font-size: var(--fs-breadcrumb);
+  color: rgb(var(--v-theme-error));
+}
+
 .channel-note {
   font-family: var(--font-sans);
   font-size: var(--fs-breadcrumb);

package/components/SiteSettings.vue

@@ -28,7 +28,17 @@
         <v-expansion-panel-text>
           <v-row no-gutters class="d-flex justify-center py-10">
             <v-form class="w-100">
-              <v-row>
+              <!--
+                Owner decision 2026-09-25: a site's details are its owning
+                client's. A provider that serves the site sees them read-only;
+                the server refuses the save too. Blocks and guard posts below
+                stay editable - they are the provider's operational settings.
+              -->
+              <v-alert v-if="siteDetailsLocked" type="info" variant="tonal" density="compact" class="mb-4"
+                data-test="site-info-owner-only">
+                {{ siteOwnerNote }}
+              </v-alert>
+              <v-row :inert="siteDetailsLocked" :class="{ 'opacity-60': siteDetailsLocked }">
                 <!-- Cover Photo + Preview -->
                 <v-col cols="12" lg="5" class="pt-0">
                   <InputLabel title="Cover Photo (displayed in resident app)" class="d-block mb-2" />
@@ -58,10 +68,12 @@
                 </v-col>
 
                 <!-- Submit -->
-                <v-col cols="12" class="pt-0 d-flex justify-end">
+                <v-col v-if="!siteDetailsLocked" cols="12" class="pt-0 d-flex justify-end">
                   <v-btn color="primary-button" class="text-none" size="large" variant="flat" text="Save"
                     :loading="savingSiteInfo" @click="saveSiteInfo" />
                 </v-col>
+              </v-row>
+              <v-row>
 
                 <!-- Divider -->
                 <v-col cols="12" class="my-2">
@@ -290,6 +302,13 @@ const orgId = computed(
   () => props.orgId || String((siteData.value as TSite | null)?.orgId ?? "")
 );
 
+// The site read says whether this caller may change the site's details (core
+// 3.103). Absent on an older API = unknown, so nothing is locked here.
+const siteDetailsLocked = computed(
+  () => (siteData.value as any)?.detailsEditable === false
+);
+const siteOwnerNote = computed(() => siteOwnerOnlyNote((siteData.value as any)?.ownerOrgName));
+
 watch(
   siteData,
   (val: TSite) => {

package/composables/useNotificationPreference.ts

@@ -32,17 +32,59 @@ export type TNotificationCategorySetting = {
   channels: TNotificationChannelSetting[];
 };
 
+/**
+ * Where notification emails go. Sent only because this screen asks with
+ * `?include=email`; `available: false` means email is not offered to this
+ * person yet and the screen shows nothing about it.
+ */
+export type TNotificationEmailSetting = {
+  available: boolean;
+  /** the VERIFIED address emails go to */
+  address: string | null;
+  verified: boolean;
+  verifiedAt: string | null;
+  /** an address waiting for its 6-digit code */
+  pendingAddress: string | null;
+  /** the sign-in address, suggested when nothing is set */
+  accountEmail: string;
+};
+
 export type TNotificationPreferences = {
   channels: Array<{ key: string; label: string }>;
   categories: TNotificationCategorySetting[];
+  email?: TNotificationEmailSetting;
 };
 
 const EMPTY: TNotificationPreferences = { channels: [], categories: [] };
 
+const PREF_URL = "/api/notification-preferences";
+
+/**
+ * The PUT body: the switches that are OFF for in-app/phone (absent is on), and
+ * the modules with Email ON (email is opt-in, so it is sent as its own list).
+ */
+export function preferencesBody(preferences: Pick<TNotificationPreferences, "categories">) {
+  const off = preferences.categories.flatMap((category) =>
+    category.channels
+      .filter((channel) => channel.key !== "email" && channel.supported && !channel.enabled)
+      .map((channel) => ({ category: category.key, channel: channel.key })),
+  );
+  // No Email row on screen (email not offered to this person): send no list,
+  // so the server leaves whatever is saved alone.
+  const hasEmail = preferences.categories.some((c) => c.channels.some((ch) => ch.key === "email"));
+  if (!hasEmail) return { off };
+  const email = preferences.categories
+    .filter((category) =>
+      category.channels.some((c) => c.key === "email" && c.supported && c.enabled),
+    )
+    .map((category) => category.key);
+  return { off, email };
+}
+
 export default function useNotificationPreference() {
   function getPreferences() {
     return useNuxtApp().$api<{ data: TNotificationPreferences }>(
-      "/api/notification-preferences",
+      `${PREF_URL}?include=email`,
       { method: "GET" },
     );
   }
@@ -55,19 +97,35 @@ export default function useNotificationPreference() {
    * all, and behaves exactly as they did before this screen existed.
    */
   function savePreferences(preferences: TNotificationPreferences) {
-    const off = preferences.categories.flatMap((category) =>
-      category.channels
-        .filter((channel) => channel.supported && !channel.enabled)
-        .map((channel) => ({ category: category.key, channel: channel.key })),
-    );
-
     return useNuxtApp().$api<{ data: TNotificationPreferences }>(
-      "/api/notification-preferences",
-      { method: "PUT", body: { off } },
+      `${PREF_URL}?include=email`,
+      { method: "PUT", body: preferencesBody(preferences) },
     );
   }
 
-  return { getPreferences, savePreferences, EMPTY_PREFERENCES: EMPTY };
+  /** Email a 6-digit code to the address the person wants emails at. */
+  function requestEmailCode(address: string) {
+    return useNuxtApp().$api<{ data: TNotificationPreferences }>(`${PREF_URL}/email`, {
+      method: "POST",
+      body: { address },
+    });
+  }
+
+  /** The code from that email. Verifies the address; emails start after this. */
+  function verifyEmailCode(code: string) {
+    return useNuxtApp().$api<{ data: TNotificationPreferences }>(`${PREF_URL}/email/verify`, {
+      method: "POST",
+      body: { code },
+    });
+  }
+
+  return {
+    getPreferences,
+    savePreferences,
+    requestEmailCode,
+    verifyEmailCode,
+    EMPTY_PREFERENCES: EMPTY,
+  };
 }
 
 /**

package/composables/useRole.ts

@@ -73,17 +73,34 @@ export default function useRole() {
       limit?: number;
     }
   ) {
+    /*
+     * An invitation INTO an organisation offers that organisation's own roles
+     * only (owner, 2026-09-25: the org-less templates "Org Owner", "Org - Admin
+     * Doan623"... in a site's Invite member list were never this client's).
+     * The server refuses a template on such an invitation (`core
+     * roleInvitable`). Templates are still what an invitation naming NO
+     * organisation offers, e.g. the console's new-client flows.
+     *
+     * A role pinned to a site is offered only for THAT site: the server's site
+     * filter returns this site's roles plus the org-wide ones, and with no site
+     * chosen yet only the org-wide ones are valid.
+     */
     const [tenant, templates] = await Promise.all([
       org
         ? getRoles({ search, org, site, type, limit })
         : Promise.resolve({ items: [] } as Record<string, any>),
-      getRoles({ search, type: "organization", limit }),
+      org
+        ? Promise.resolve({ items: [] } as Record<string, any>)
+        : getRoles({ search, type: "organization", limit }),
     ]);
 
     const seen = new Set<string>();
     const items = [...(tenant?.items ?? []), ...(templates?.items ?? [])].filter(
       (role: Record<string, any>) => {
         if (role?.type === "admin") return false;
+        if (role?.status && role.status !== "active") return false;
+        const roleSite = String(role?.site ?? "");
+        if (roleSite && roleSite !== String(site ?? "")) return false;
         const id = String(role?._id ?? "");
         if (!id || seen.has(id)) return false;
         seen.add(id);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.43.1",
+  "version": "4.45.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/pages/notifications/open.vue

@@ -0,0 +1,85 @@
+<template>
+  <v-row no-gutters class="pa-8" justify="center">
+    <v-col cols="12" md="6">
+      <v-skeleton-loader v-if="!nowhere" type="list-item-two-line" />
+      <AppCard v-else>
+        <div class="pa-6">
+          <div class="screen-card-title">Open it in the app</div>
+          <div class="screen-hint mt-2">
+            This opens in the iService365 app on your phone.
+          </div>
+          <AppButton class="mt-6" @click="router.replace('/notification-settings')">
+            Notification settings
+          </AppButton>
+        </div>
+      </AppCard>
+    </v-col>
+  </v-row>
+</template>
+
+<script setup lang="ts">
+/**
+ * Where the "Open in iService365" button in a notification email lands.
+ *
+ * The email carries what the notification is about (`?kind=&id=&site=&org=&app=`,
+ * core `openLink`); this page turns it into the page for it with the SAME table
+ * and the same rules as the bell (`notificationTarget` + `chooseNavigation`), so
+ * there is one list of destinations. A link grants nothing: the page it opens
+ * still checks the person may see it.
+ */
+import {
+  appUrlsFrom,
+  chooseNavigation,
+  notificationTarget,
+  rowFromEmailLink,
+} from "../../utils/notification-target";
+
+definePageMeta({
+  middleware: ["01-auth"],
+});
+
+const { authenticate, currentUser } = useLocalAuth();
+const route = useRoute();
+const router = useRouter();
+const appConfig = useRuntimeConfig();
+const nowhere = ref(false);
+authenticate();
+
+/** The link's organisation, else the person's own default one (as the bell does). */
+async function organizationFor(fromLink: string): Promise<string> {
+  if (fromLink) return fromLink;
+  if (currentUser.value?.defaultOrg) return String(currentUser.value.defaultOrg);
+  try {
+    const { cookieConfig } = appConfig.public as any;
+    const id = useCookie("user", cookieConfig).value;
+    const user = await useNuxtApp().$api<Record<string, any>>(`/api/users/id/${id}`);
+    return String(user?.defaultOrg ?? "");
+  } catch {
+    return "";
+  }
+}
+
+function hasLocalPage(path: string) {
+  try {
+    const resolved = router.resolve(path);
+    return resolved.matched.length > 0 && !resolved.matched.some((m) => m.path.includes("pathMatch"));
+  } catch {
+    return false;
+  }
+}
+
+onMounted(async () => {
+  const { row, organization } = rowFromEmailLink(route.query as Record<string, unknown>);
+  const nav = chooseNavigation(
+    notificationTarget(row, { organization: await organizationFor(organization) }),
+    {
+      hasRoute: (name) => typeof router.hasRoute === "function" && router.hasRoute(name),
+      hasPage: hasLocalPage,
+      appUrls: appUrlsFrom(appConfig?.public as Record<string, unknown>),
+    },
+  );
+  if (nav?.type === "href") return window.location.replace(nav.href);
+  if (nav?.type === "route") return router.replace(nav.to as any).catch(() => (nowhere.value = true));
+  nowhere.value = true;
+});
+</script>

package/utils/invite-role-options.ts

@@ -0,0 +1,22 @@
+/**
+ * The Invite member Role list, labelled so an inviter can tell a role made for
+ * this site from one that applies across the organisation (owner report
+ * 2026-09-25). The roles themselves are already scoped by
+ * `useRole.getInvitableRoles`.
+ */
+export type TInviteRoleOption = { _id: string; title: string; subtitle: string };
+
+export const SITE_ROLE_LABEL = "Site role";
+export const ORG_ROLE_LABEL = "Organisation role";
+
+export function inviteRoleOptions(
+  roles: Array<Record<string, any>> | null | undefined,
+): TInviteRoleOption[] {
+  return (roles ?? [])
+    .filter((role) => role && role._id)
+    .map((role) => ({
+      _id: String(role._id),
+      title: String(role.name ?? ""),
+      subtitle: role.site ? SITE_ROLE_LABEL : ORG_ROLE_LABEL,
+    }));
+}

package/utils/notification-target.ts

@@ -342,3 +342,43 @@ export function chooseNavigation(
   const href = externalTargetUrl(target, app.appUrls);
   return href ? { type: "href", href } : null;
 }
+
+/** Every web app's URL, keyed like `TAppKey`, from the layer's public runtime config. */
+export function appUrlsFrom(p: Record<string, unknown> | null | undefined): Record<TAppKey, string> {
+  const c = p ?? {};
+  return {
+    org: String(c.APP_ORG ?? ""),
+    security: String(c.APP_SECURITY ?? ""),
+    "property-management": String(c.APP_PROPERTY_MANAGEMENT ?? ""),
+    hygiene: String(c.APP_HYGIENE ?? ""),
+    "mechanical-electrical": String(c.APP_MECHANICAL_ELECTRICAL ?? ""),
+    "pest-control": String(c.APP_PEST_CONTROL ?? ""),
+    landscaping: String(c.APP_LANDSCAPING ?? ""),
+    "pool-maintenance": String(c.APP_POOL_MAINTENANCE ?? ""),
+  };
+}
+
+/**
+ * The row a notification-email link stands for. The email's button carries
+ * `?kind=&id=&site=&org=&app=` (core `openLink`); this turns that back into
+ * the same shape a bell row has, so the same table decides where it lands.
+ */
+export function rowFromEmailLink(query: Record<string, unknown>): {
+  row: TTargetRow;
+  organization: string;
+} {
+  const one = (k: string) => {
+    const v = query?.[k];
+    return String((Array.isArray(v) ? v[0] : v) ?? "").trim();
+  };
+  const kind = one("kind");
+  const id = one("id");
+  return {
+    row: {
+      params: kind || id ? { kind, id, ...(one("org") ? { org: one("org") } : {}) } : null,
+      siteId: one("site") || null,
+      appSlug: one("app"),
+    },
+    organization: one("org"),
+  };
+}

package/utils/site-owner-note.ts

@@ -0,0 +1,9 @@
+/**
+ * What a service provider is told on a site it serves but does not own
+ * (owner decision 2026-09-25: only the owning client changes a site's
+ * details). Same words as the server's refusal.
+ */
+export function siteOwnerOnlyNote(ownerName?: string | null): string {
+  const name = String(ownerName ?? "").trim() || "another organisation";
+  return `This site belongs to ${name}. Only they can change its details.`;
+}