@7365admin1/layer-common 4.46.0 → 4.48.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/layer-common
 
+## 4.48.0
+
+### Minor Changes
+
+- c9871b2: Members list: the role chip shows the member's real role name, and a clear warning ("No role assigned - assign one", "<name> (deleted) - assign a new role", "Invalid role - assign a new role") when the server's roleState says the role is missing, deleted or another organisation's. Rows from an older server render as before.
+
+## 4.47.0
+
+### Minor Changes
+
+- cde8389: `getVerifications` takes `origin`; the console Client List's Pending tab lists only invitations Seven365 sent.
+
 ## 4.46.0
 
 ### Minor Changes
@@ -1515,11 +1527,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                    GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                    GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                        GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                        GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                    owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                    staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                        owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                        staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/ClientMain.vue

@@ -636,6 +636,8 @@ async function fetchPending() {
   const res = await getVerifications({
     status: 'pending',
     type:   'user-invite',
+    // Only what Seven365 sent - never a client's own invitations (owner, 2026-09-25).
+    origin: 'seven365',
     page:   page.value,
     search: search.value,
     email: search.value,

package/components/MemberMain.vue

@@ -73,11 +73,19 @@
           <template #item.nature="{ item }">
             {{ replaceMatch(item.nature, "_", " ") }}
           </template>
-          <!-- The role is a soft pill in the design, not a plain word. Same
-               text, same column, same source field. -->
+          <!-- The role is a soft pill in the design, not a plain word. The
+               member's REAL role name; a deleted / other-organisation / missing
+               role says so instead of reading as a working grant
+               (memberRoleChip in utils/role.ts, server roleState). -->
           <template #item.roleName="{ item }">
-            <StatusChip v-if="item.roleName" :dot="false" pill tone="info">
-              {{ item.roleName }}
+            <StatusChip
+              v-if="memberRoleChip(item)"
+              :dot="false"
+              pill
+              :tone="memberRoleChip(item)?.tone"
+              data-test="member-role-chip"
+            >
+              {{ memberRoleChip(item)?.text }}
             </StatusChip>
           </template>
           <template #item.dateInvited="{ item }">
@@ -258,7 +266,7 @@
 </template>
 
 <script setup lang="ts">
-import { withCurrentRole } from "../utils/role";
+import { memberRoleChip, withCurrentRole } from "../utils/role";
 
 const props = defineProps({
   /** The design's page title. Every app that mounts this screen calls it

package/composables/useVerification.ts

@@ -9,6 +9,8 @@ export default function useVerification() {
     siteId = "",
     orgId = "",
     limit = 20,
+    // "seven365": only the invitations Seven365 sent (the console's lists).
+    origin = "",
   } = {}): Promise<{
     items: TMiniVerification[];
     pages: number;
@@ -16,7 +18,11 @@ export default function useVerification() {
   }> {
     return useNuxtApp().$api("/api/verifications", {
       method: "GET",
-      query: { status, search, page, type, email, app, siteId, orgId, limit },
+      query: {
+        status, search, page, type, email, app, siteId, orgId, limit,
+        // Sent only when asked for: an older API refuses a key it does not know.
+        ...(origin && { origin }),
+      },
     });
   }
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.46.0",
+  "version": "4.48.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/role.ts

@@ -26,3 +26,29 @@ export function withCurrentRole<T extends { _id?: unknown; name?: unknown }>(
   if (!currentId || list.some((r) => String(r?._id) === currentId)) return list;
   return [...list, { _id: currentId, name: currentName || currentId }];
 }
+
+/**
+ * What the Members list's "Roles and Permission" chip says for one row.
+ *
+ * The server's `roleState` (core 2026-09-25) says whether `roleName` is a role
+ * the member can really use. A bare name for a deleted role, another
+ * organisation's role, or no role at all read as a working grant (owner report:
+ * a member showed "Security" and Assign Role could not fix it). Rows from an
+ * older server carry no `roleState` and render exactly as before.
+ */
+export function memberRoleChip(item: {
+  roleName?: unknown;
+  roleState?: unknown;
+}): { text: string; tone: "info" | "warn" } | null {
+  const name = typeof item?.roleName === "string" ? item.roleName : "";
+  switch (item?.roleState) {
+    case "missing":
+      return { text: "No role assigned - assign one", tone: "warn" };
+    case "deleted":
+      return { text: `${name || "Role"} (deleted) - assign a new role`, tone: "warn" };
+    case "other-org":
+      return { text: "Invalid role - assign a new role", tone: "warn" };
+    default:
+      return name ? { text: name, tone: "info" } : null;
+  }
+}