@7365admin1/layer-common 4.67.2 → 4.68.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @iservice365/layer-common
 
+## 4.68.0
+
+### Minor Changes
+
+- f07fc1e: Members → Site access (organisation-level Members screen, owner request 2026-09-28):
+  the organisation's owner/admin chooses which of the organisation's sites a member
+  can open and the role at each (only roles created for that site), with "Same role
+  for all selected sites", and can remove the member's organisation-wide access so
+  they see only the chosen sites. New `MemberSiteAccess.vue`, `utils/site-access.ts`,
+  `useMember().getSiteAccess/saveSiteAccess`.
+
+  Fix: Assign Role pre-fills the member's current role again when the server marks it
+  usable (`roleState: "ok"`); 4.65.3 treated "ok" as unusable.
+
 ## 4.67.2
 
 ### Patch Changes
@@ -1817,11 +1831,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                        GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                        GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                        owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                        staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/MemberMain.vue

@@ -168,6 +168,14 @@
                   Assign Role
                 </v-list-item>
 
+                <v-list-item
+                  v-if="siteAccessAllowed && item.user"
+                  data-test="member-site-access"
+                  @click="openSiteAccess(item)"
+                >
+                  Site access
+                </v-list-item>
+
                 <v-list-item
                   v-if="currentStatus === 'active' && canSuspendMembers"
                   @click="openUpdateDialog(item._id, 'suspended')"
@@ -241,6 +249,17 @@
       INSIDE the `v-form` because Submit is a `type="submit"` and moving it out
       would break the form's own submit.
     -->
+    <v-dialog v-model="siteAccessDialog" max-width="640">
+      <MemberSiteAccess
+        v-if="siteAccessDialog && siteAccessUser"
+        :org="props.orgId"
+        :user="siteAccessUser"
+        :name="siteAccessName"
+        @cancel="siteAccessDialog = false"
+        @saved="onSiteAccessSaved"
+      />
+    </v-dialog>
+
     <v-dialog v-model="assignRoleDialog" max-width="520">
       <v-card class="screen-modal">
         <v-card-title>Assign Role</v-card-title>
@@ -578,6 +597,24 @@ function setMember({
   if (dialog) refreshRoles();
 }
 
+/* Site access (owner request 2026-09-28): on the organisation-level Members
+   screen, whoever may assign roles can choose a member's sites. The server
+   decides again (owner / org-wide admin only). */
+const siteAccessAllowed = computed(() => props.assignRole && !props.siteId);
+const siteAccessDialog = ref(false);
+const siteAccessUser = ref("");
+const siteAccessName = ref("");
+function openSiteAccess(item: Record<string, any>) {
+  siteAccessUser.value = String(item.user ?? "");
+  siteAccessName.value = String(item.name || item.email || "");
+  siteAccessDialog.value = true;
+}
+function onSiteAccessSaved(msg: string) {
+  siteAccessDialog.value = false;
+  showMessage(msg, "success");
+  getAll();
+}
+
 const roles = ref<Array<Record<string, any>>>([]);
 // Web audit M1: the member's own role is always offered, even when the
 // site-scoped list below does not return it (widen-only, `utils/role.ts`).

package/components/MemberSiteAccess.vue

@@ -0,0 +1,135 @@
+<template>
+  <v-card class="screen-modal" data-test="site-access">
+    <v-card-title>Site access{{ props.name ? ` — ${props.name}` : "" }}</v-card-title>
+    <v-card-text class="screen-modal__body">
+      <p class="text-body-2 mb-3">
+        Choose the sites this person can open and their role at each. They will see only these sites.
+      </p>
+
+      <div v-if="loading" class="py-4 text-center"><v-progress-circular indeterminate /></div>
+      <p v-else-if="loadError" class="text-error">{{ loadError }}</p>
+      <template v-else>
+        <div v-if="orgWide.length" class="mb-4" data-test="site-access-org-wide">
+          <p class="text-body-2 mb-1">
+            <strong>Organisation access:</strong>
+            {{ orgWide.map((m) => m.roleName || "role").join(", ") }} — this reaches <strong>every</strong> site.
+          </p>
+          <v-checkbox
+            v-model="removeOrgAccess"
+            density="compact"
+            hide-details
+            label="Remove organisation access and limit this person to the sites below"
+          />
+          <p v-if="removeOrgAccess" class="text-caption">
+            They will no longer appear on the Organization app's Members list. You can change their sites again here from any site's member, or invite them again.
+          </p>
+        </div>
+
+        <p v-if="!choices.length" class="text-body-2">This organisation has no sites yet.</p>
+
+        <div v-else>
+          <div class="d-flex align-center ga-2 mb-2">
+            <v-select
+              v-model="sameRole"
+              :items="sharedNames"
+              label="Same role for all selected sites"
+              density="compact"
+              hide-details
+              clearable
+              class="filter-field"
+              data-test="site-access-same-role"
+            />
+            <v-btn variant="outlined" :disabled="!sameRole" @click="applySame()">Apply</v-btn>
+          </div>
+
+          <div v-for="(c, i) in choices" :key="c.site" class="d-flex align-center ga-2 py-1" data-test="site-access-row">
+            <v-checkbox v-model="choices[i].on" density="compact" hide-details :label="c.name" style="min-width: 220px" />
+            <v-select
+              v-if="c.roles.length"
+              v-model="choices[i].role"
+              :items="c.roles"
+              item-title="name"
+              item-value="_id"
+              :disabled="!c.on"
+              label="Role"
+              density="compact"
+              hide-details
+              class="filter-field"
+            />
+            <span v-else class="text-caption">No roles created for {{ c.name }} yet — create one in that site's Roles &amp; Permissions.</span>
+          </div>
+          <p v-for="c in choices.filter((x) => x.on && !x.role && x.replacedRole)" :key="`r-${c.site}`" class="text-caption">
+            {{ c.name }}: "{{ c.replacedRole }}" is not one of this site's own roles — choose one of {{ c.name }}'s roles.
+          </p>
+        </div>
+
+        <p v-if="missing.length" class="text-error text-caption mt-2">Choose a role for: {{ missing.join(", ") }}</p>
+        <p v-if="saveError" class="text-error mt-2">{{ saveError }}</p>
+      </template>
+    </v-card-text>
+    <div class="screen-modal__footer">
+      <v-btn class="screen-btn-ghost" variant="outlined" @click="emit('cancel')">Cancel</v-btn>
+      <v-btn class="screen-btn-primary" variant="flat" :loading="saving" :disabled="loading || !!loadError || missing.length > 0" @click="save()">
+        Save
+      </v-btn>
+    </div>
+  </v-card>
+</template>
+
+<script setup lang="ts">
+// Relative import: this layer's `utils/` is not auto-imported into consumers.
+import { applySameRole, initialChoices, sharedRoleNames, toPayload, type SiteChoice } from "../utils/site-access";
+
+const props = defineProps({
+  org: { type: String, required: true },
+  user: { type: String, required: true },
+  name: { type: String, default: "" },
+});
+const emit = defineEmits<{ (e: "cancel"): void; (e: "saved", message: string): void }>();
+
+const { getSiteAccess, saveSiteAccess } = useMember();
+
+const loading = ref(true);
+const loadError = ref("");
+const saving = ref(false);
+const saveError = ref("");
+const choices = ref<SiteChoice[]>([]);
+const orgWide = ref<Array<{ roleName?: string }>>([]);
+const removeOrgAccess = ref(false);
+const sameRole = ref<string | null>(null);
+
+const sharedNames = computed(() => sharedRoleNames(choices.value));
+const missing = computed(() => toPayload(choices.value).missing);
+
+function applySame() {
+  if (sameRole.value) choices.value = applySameRole(choices.value, sameRole.value);
+}
+
+async function load() {
+  loading.value = true;
+  loadError.value = "";
+  try {
+    const res = await getSiteAccess(props.org, props.user);
+    choices.value = initialChoices(res?.sites ?? []);
+    orgWide.value = res?.orgWide ?? [];
+  } catch (e: any) {
+    loadError.value = e?.data?.message || "Site access could not be loaded. Only the organisation's owner or an admin can change it.";
+  }
+  loading.value = false;
+}
+
+async function save() {
+  saving.value = true;
+  saveError.value = "";
+  try {
+    const { sites } = toPayload(choices.value);
+    await saveSiteAccess({ org: props.org, user: props.user, sites, removeOrgAccess: removeOrgAccess.value });
+    emit("saved", sites.length ? `Site access saved: ${sites.length} site(s).` : "Site access saved: no sites.");
+  } catch (e: any) {
+    saveError.value = e?.data?.message || "Site access could not be saved.";
+  }
+  saving.value = false;
+}
+
+load();
+</script>

package/composables/useMember.ts

@@ -173,7 +173,30 @@ export default function useMember() {
     );
   }
 
+  /** One member's sites and the role at each (org owner / admin only). */
+  function getSiteAccess(org: string, user: string) {
+    return useNuxtApp().$api<Record<string, any>>("/api/members/site-access", {
+      method: "GET",
+      query: { org, user },
+    });
+  }
+
+  /** Replace one member's sites: [{ site, role }]; optionally drop org-wide access. */
+  function saveSiteAccess(body: {
+    org: string;
+    user: string;
+    sites: Array<{ site: string; role: string }>;
+    removeOrgAccess?: boolean;
+  }) {
+    return useNuxtApp().$api<Record<string, any>>("/api/members/site-access", {
+      method: "PUT",
+      body,
+    });
+  }
+
   return {
+    getSiteAccess,
+    saveSiteAccess,
     members,
     member,
     page,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.67.2",
+  "version": "4.68.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/role.ts

@@ -76,12 +76,13 @@ export function otherSiteBannerText(count: unknown): string | null {
 
 /**
  * Can this member's CURRENT role be used on the screen's site? The server's
- * `roleState` is empty for a usable role and names the problem otherwise
+ * `roleState` is "ok" (or absent, older servers) for a usable role and names the problem otherwise
  * ("other-site", "other-org", "deleted", "missing"). An unusable role is never
  * pre-filled in Assign Role nor offered in its list (owner report 2026-09-28).
  */
 export function roleUsableHere(member: { role?: unknown; roleState?: unknown }): boolean {
-  return !!member?.role && !member?.roleState;
+  // The server sends "ok" for a usable role (older servers send nothing).
+  return !!member?.role && (!member?.roleState || member.roleState === "ok");
 }
 
 /** Assign Role's empty state when the site has no role of its own yet. */

package/utils/site-access.ts

@@ -0,0 +1,52 @@
+/**
+ * Site access editor state (owner request 2026-09-28). One row per site of the
+ * organisation; a chosen site needs one of ITS OWN roles (the server refuses an
+ * organisation-level role for a site, because it would reach every site).
+ */
+export type SiteAccessRole = { _id: string; name: string; type?: string };
+export type SiteAccessRow = {
+  site: string;
+  name: string;
+  membership: { role: string; roleName?: string } | null;
+  roles: SiteAccessRole[];
+};
+export type SiteChoice = { site: string; name: string; on: boolean; role: string; roles: SiteAccessRole[]; replacedRole?: string };
+
+/** Start from what the member has now. A current role that is not one of the site's roles is dropped. */
+export function initialChoices(rows: SiteAccessRow[]): SiteChoice[] {
+  return (rows ?? []).map((r) => {
+    const current = r.membership?.role ?? "";
+    const valid = r.roles.some((x) => x._id === current);
+    return {
+      site: r.site, name: r.name, on: !!r.membership, role: valid ? current : "", roles: r.roles ?? [],
+      // their current role here is not one of this site's own roles (e.g. an
+      // organisation role from an invitation) - say so rather than blank it silently
+      ...(r.membership && !valid ? { replacedRole: r.membership.roleName || "their current role" } : {}),
+    };
+  });
+}
+
+/** Role names offered by "Same role for all selected sites". */
+export function sharedRoleNames(choices: SiteChoice[]): string[] {
+  const names = new Set<string>();
+  for (const c of choices) if (c.on) for (const r of c.roles) names.add(r.name);
+  return [...names].sort((a, b) => a.localeCompare(b));
+}
+
+/** Give every selected site the role with this name, where that site has one. */
+export function applySameRole(choices: SiteChoice[], roleName: string): SiteChoice[] {
+  return choices.map((c) => {
+    if (!c.on) return c;
+    const match = c.roles.find((r) => r.name === roleName);
+    return match ? { ...c, role: match._id } : c;
+  });
+}
+
+/** What to send, and what still blocks saving (a chosen site with no role). */
+export function toPayload(choices: SiteChoice[]): { sites: Array<{ site: string; role: string }>; missing: string[] } {
+  const chosen = choices.filter((c) => c.on);
+  return {
+    sites: chosen.filter((c) => c.role).map((c) => ({ site: c.site, role: c.role })),
+    missing: chosen.filter((c) => !c.role).map((c) => c.name),
+  };
+}