@7365admin1/layer-common 4.73.1-staging.461 → 4.73.1-staging.463

package/components/AccessCardDetailsDialog.vue

@@ -47,14 +47,22 @@
           <div>
             <div class="card-details__label">User</div>
             <div class="card-details__value">
-              {{ details.userCred?.name ?? details.user?.name ?? "N/A" }}
-              <template v-if="details.user?.email">({{ details.user.email }})</template>
+              <template v-if="holderState === 'named'">
+                {{ holderName }}
+                <template v-if="details.user?.email">({{ details.user.email }})</template>
+              </template>
+              <!-- Assigned, but the server did not send the name back. Saying
+                   so beats "N/A", which reads as "nobody holds this card". -->
+              <template v-else-if="holderState === 'assigned'">
+                <span class="text-medium-emphasis">Assigned — name unavailable</span>
+              </template>
+              <template v-else>Unassigned</template>
             </div>
           </div>
 
-          <div v-if="details.userType">
+          <div v-if="holderType">
             <div class="card-details__label">User Type</div>
-            <div class="card-details__value">{{ details.userType }}</div>
+            <div class="card-details__value">{{ holderType }}</div>
           </div>
 
           <!-- Visitor / Resident Credentials -->
@@ -216,6 +224,51 @@ const sortedHistory = computed(() =>
   )
 );
 
+/**
+ * WHO HOLDS THIS CARD.
+ *
+ * `userCred` is written by the visitor-pass flow and carries the person's
+ * details on the card itself. `user` is the resolved account - the card only
+ * stores `userId`, so the server has to join it.
+ *
+ * `card-details` does not do that join today (the lookup is commented out in
+ * core's `getCardDetailsRepo`), so this is empty for every card assigned
+ * through Assign to Person and the field falls through to `holderState`.
+ * Nothing here needs to change when the join is restored.
+ */
+const holderName = computed(
+  () => details.value?.userCred?.name ?? details.value?.user?.name ?? "",
+);
+
+/**
+ * A card with a `userId` IS assigned, whether or not the name came back.
+ *
+ * Printing "N/A" for both cases is the actual defect here: it reads as "nobody
+ * holds this card", which is the opposite of the truth for an assigned one and
+ * could have someone hand out a card that is already in use.
+ */
+const holderState = computed<"named" | "assigned" | "unassigned">(() => {
+  if (holderName.value) return "named";
+  return details.value?.userId ? "assigned" : "unassigned";
+});
+
+/**
+ * WHICH KIND OF PERSON HOLDS THIS CARD — Visitor/Resident, Management or
+ * Service Provider, matching the groups Assign to Person offers.
+ *
+ * `holderType` is what the server should send once it records the category the
+ * card was assigned under. `userType` is NOT that: it is the card's own pool,
+ * and `getCardDetailsRepo` filters on `EAccessCardUserTypes.DEFAULT`, so every
+ * card this dialog can load has the literal value "Visitor/Resident" whoever
+ * actually holds it. Preferring `holderType` means a card given to Management
+ * stops describing itself as a resident's the day the field arrives.
+ *
+ * Falls back to `userType` so nothing disappears in the meantime.
+ */
+const holderType = computed(
+  () => details.value?.holderType ?? details.value?.userType ?? "",
+);
+
 watch(
   () => props.modelValue,
   async (val) => {

package/components/AccessCardPreviewDialog.vue

@@ -453,7 +453,7 @@ const emit = defineEmits<{
 const { getResidents, assignUser } = useAccessManagement();
 const { getEncryptedAcmUrl } = useSiteEntryPassSettings();
 const { getAll: getMembers } = useMember();
-const { getAll: getServiceProviders } = useServiceProvider();
+const { getSiteMembers } = useServiceProvider();
 
 const historyDialog = ref(false);
 const showAssignForm = ref(false);
@@ -552,14 +552,12 @@ const personTypeLabel = (person: Record<string, any>) => {
 const assignNoDataText = computed(() => {
   if (peopleLoading.value) return "Loading...";
   if (assignCategory.value === "management") return "No management members assigned to this unit";
-  if (assignCategory.value === "providers") return "No service providers assigned to this unit";
+  if (assignCategory.value === "providers") return "No service provider members assigned to this unit";
   return "No residents or tenants found for this unit";
 });
 
-const assignUnassignableText = computed(() =>
-  assignCategory.value === "providers"
-    ? "A card is held by a person, and this is the provider company. Assigning to service providers needs the server to say which account the card belongs to."
-    : "This person has no user account, so a card cannot be assigned to them.",
+const assignUnassignableText = computed(
+  () => "This person has no account on record, so a card cannot be assigned to them.",
 );
 
 /** Residents and tenants of THIS UNIT - the list the dialog has always shown. */
@@ -619,41 +617,48 @@ async function loadManagementRows(): Promise<AssignRow[]> {
 }
 
 /**
- * Service Providers ATTACHED TO THIS UNIT.
+ * Service Providers - the provider PEOPLE attached to this unit.
  *
- * `GET /api/service-providers?siteId&status=active&unit=<id>` - the same list
- * and the same unit filter the Unit Management tab uses (core #2515), so the
- * providers offered are the ones this unit actually has.
+ * `GET /api/service-providers/site-members?siteId&unit=<id>`. A card is held by
+ * a person, so this lists provider staff rather than the companies
+ * `GET /api/service-providers` returns, and the `unit` filter keeps it to the
+ * people that unit actually has - the same scoping Management uses.
  *
- * These rows are COMPANIES, not people: the list has `name`, `email` and the
- * service `type`, and there is no user account behind a company. See
- * `assigneeId` below.
+ * The response also carries a `companies` summary; only `items` is people.
  */
 async function loadProviderRows(): Promise<AssignRow[]> {
   if (!props.siteId || !props.unit?._id) return [];
-  const res: any = await getServiceProviders({
-    siteId: props.siteId,
-    unit: props.unit._id,
-    status: "active",
-    page: 1,
-    limit: 50,
-  });
-  const rows: Record<string, any>[] = res?.items ?? [];
-  return rows.map((provider) => ({
+  const res = await getSiteMembers(props.siteId, props.unit._id);
+  const rows = res?.items ?? [];
+  return rows.map((member: Record<string, any>) => ({
+    /*
+     * `user` when the endpoint returns it, otherwise the MEMBERSHIP `_id`.
+     *
+     * `site-members` does not carry `user` today (the repository projects it,
+     * the service layer drops it), and the product decision is to assign on
+     * `_id` rather than wait. Worth knowing what that means: the card's
+     * `userId` then holds a `service-provider-members` id, so the card list's
+     * `userId -> users` lookup finds nothing and the holder column reads blank
+     * for these cards. The door access itself is unaffected - the ACM command
+     * is built from the CARD's id, not the assignee's.
+     *
+     * `user` is preferred so that the day it starts arriving, these cards
+     * begin resolving to real people with no change here.
+     */
+    assigneeId: String(member.user ?? member._id ?? ""),
+    name: member.name || member.email || "",
+    subtitle: member.email ?? "",
     /*
-     * Empty on purpose, and not a missing field: a card is assigned by writing
-     * a USER id onto it, and a provider company has no user account. Which id a
-     * company-held card should carry - the `service-providers` row, the
-     * provider `orgId`, or a person from that company - is a backend decision
-     * that has not been made. Sending one anyway would write an id the server
-     * stores without checking and that matches no user.
+     * The service the company provides, plus this person's role - two people
+     * from the same company differ only by role ("VMS Access" vs "Security
+     * Access"). `typeLabel` is computed by the endpoint; the local converter is
+     * the fallback for a row that predates it.
      */
-    assigneeId: "",
-    name: provider.name ?? "",
-    subtitle: provider.email ?? "",
-    // The service code is a database value; show what people call it.
-    meta: serviceTypeLabel(provider.type),
-    raw: provider,
+    meta:
+      [member.typeLabel || serviceTypeLabel(member.type), member.role]
+        .filter(Boolean)
+        .join(" · "),
+    raw: member,
   }));
 }
 

package/components/MemberSiteAccess.vue

@@ -4,6 +4,12 @@
     <v-card-text class="screen-modal__body">
       <p class="text-body-2 mb-3">
         Choose the sites this person can open and their role at each. They will see only these sites.
+        A role can be one made for that site, or an <strong>organisation role</strong> (made once in Roles &amp;
+        Permissions) - either way it gives its permissions at that site only.
+      </p>
+      <p class="text-body-2 mb-3">
+        <a href="#" data-test="site-access-create-org-role" @click.prevent="createOrgRole()">Create an organisation role</a>
+        to use at many sites.
       </p>
 
       <div v-if="loading" class="py-4 text-center"><v-progress-circular indeterminate /></div>
@@ -31,7 +37,9 @@
           <div class="d-flex align-center ga-2 mb-2">
             <v-select
               v-model="sameRole"
-              :items="sharedNames"
+              :items="sharedItems"
+              item-title="title"
+              item-value="value"
               label="Same role for all selected sites"
               density="compact"
               hide-details
@@ -39,27 +47,28 @@
               class="filter-field"
               data-test="site-access-same-role"
             />
-            <v-btn variant="outlined" :disabled="!sameRole" @click="applySame()">Apply</v-btn>
+            <v-btn variant="outlined" :disabled="!sameRole || !anyOn" @click="applySame()">Apply</v-btn>
           </div>
+          <p v-if="sameRole && !anyOn" class="text-caption mb-2">Tick the sites first, then Apply.</p>
 
           <div v-for="(c, i) in choices" :key="c.site" class="d-flex align-center ga-2 py-1" data-test="site-access-row">
             <v-checkbox v-model="choices[i].on" density="compact" hide-details :label="c.name" style="min-width: 220px" />
             <v-select
               v-if="c.roles.length"
               v-model="choices[i].role"
-              :items="c.roles"
-              item-title="name"
-              item-value="_id"
+              :items="roleItems(c)"
+              item-title="title"
+              item-value="value"
               :disabled="!c.on"
               label="Role"
               density="compact"
               hide-details
               class="filter-field"
             />
-            <span v-else class="text-caption">No roles created for {{ c.name }} yet — create one in that site's Roles &amp; Permissions.</span>
+            <span v-else class="text-caption">No roles for {{ c.name }} yet — create an organisation role (link above) or one in that site's Roles &amp; Permissions.</span>
           </div>
           <p v-for="c in choices.filter((x) => x.on && !x.role && x.replacedRole)" :key="`r-${c.site}`" class="text-caption">
-            {{ c.name }}: "{{ c.replacedRole }}" is not one of this site's own roles — choose one of {{ c.name }}'s roles.
+            {{ c.name }}: "{{ c.replacedRole }}" is not a role for this site — choose an organisation role or one of {{ c.name }}'s roles.
           </p>
         </div>
 
@@ -78,7 +87,7 @@
 
 <script setup lang="ts">
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
-import { applySameRole, initialChoices, sharedRoleNames, toPayload, type SiteChoice } from "../utils/site-access";
+import { applySameRole, initialChoices, roleItems, sharedRoleItems, toPayload, type SiteChoice } from "../utils/site-access";
 
 const props = defineProps({
   org: { type: String, required: true },
@@ -98,7 +107,16 @@ const orgWide = ref<Array<{ roleName?: string }>>([]);
 const removeOrgAccess = ref(false);
 const sameRole = ref<string | null>(null);
 
-const sharedNames = computed(() => sharedRoleNames(choices.value));
+const sharedItems = computed(() => sharedRoleItems(choices.value));
+const anyOn = computed(() => choices.value.some((c) => c.on));
+
+// Organization app -> Roles & Permissions, on the organisation's own service;
+// Create there comes back here (`returnTo`), and the box reloads its roles on open.
+function createOrgRole() {
+  emit("cancel");
+  const back = useRoute().fullPath;
+  navigateTo({ path: `/org/${props.org}/roles-permissions`, query: { service: "own", returnTo: back } });
+}
 const missing = computed(() => toPayload(choices.value).missing);
 
 function applySame() {

package/components/RolePermissionMain.vue

@@ -227,6 +227,11 @@ const props = defineProps({
     type: String,
     default: "",
   },
+  /** "organisation": list only roles with no site (Organization app service roles). */
+  scope: {
+    type: String,
+    default: "",
+  },
   /*
    * Whether the Create-role dialog shows its (read-only) Site field.
    * The dialog defaulted this to `true` but this component never declared or
@@ -429,6 +434,7 @@ const {
       type: props.listType ?? props.type,
       org: props.orgId,
       site: props.siteId,
+      scope: props.scope,
     }),
   {
     watch: [page, headerSearch],

package/composables/useRole.ts

@@ -24,10 +24,12 @@ export default function useRole() {
     type = "",
     org = "",
     site = "",
+    /** "organisation": only roles with no site (needs core 3.134.0+ - an older API refuses the key with 400) */
+    scope = "",
   } = {}) {
     return useNuxtApp().$api<Record<string, any>>("/api/roles", {
       method: "GET",
-      query: { search, page, limit, type, org, site },
+      query: { search, page, limit, type, org, site, ...(scope ? { scope } : {}) },
     });
   }
 

package/composables/useServiceProvider.ts

@@ -18,6 +18,13 @@ export type TSiteProviderMember = {
   /** The building unit this person is attached to (a unit's Management tab). */
   unit?: string | null;
   unitName?: string;
+  /**
+   * The person's user account. NOT yet returned by the endpoint — the
+   * repository projects it but the service layer drops it. Anything acting on
+   * the PERSON (assigning an access card writes it onto the card as `userId`)
+   * needs this rather than `_id`, which identifies the membership.
+   */
+  user?: string | null;
 };
 
 export type TSiteProviderCompany = {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.73.1-staging.461",
+  "version": "4.73.1-staging.463",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/site-access.ts

@@ -1,9 +1,10 @@
 /**
  * Site access editor state (owner request 2026-09-28). One row per site of the
- * organisation; a chosen site needs one of ITS OWN roles (the server refuses an
- * organisation-level role for a site, because it would reach every site).
+ * organisation; a chosen site needs a role: one created FOR that site, or one of
+ * the organisation's service roles (owner request 2026-09-30, `scope:
+ * "organisation"`). Either way the server confines the membership to that site.
  */
-export type SiteAccessRole = { _id: string; name: string; type?: string };
+export type SiteAccessRole = { _id: string; name: string; type?: string; scope?: "site" | "organisation" };
 export type SiteAccessRow = {
   site: string;
   name: string;
@@ -11,33 +12,57 @@ export type SiteAccessRow = {
   roles: SiteAccessRole[];
 };
 export type SiteChoice = { site: string; name: string; on: boolean; role: string; roles: SiteAccessRole[]; replacedRole?: string };
+/** A v-select entry: a role, or a group heading. */
+export type RoleItem = { title: string; value?: string; type?: "subheader" };
 
-/** Start from what the member has now. A current role that is not one of the site's roles is dropped. */
+const isOrgRole = (r: SiteAccessRole) => r.scope === "organisation";
+
+/** Start from what the member has now. A current role the site does not offer is dropped. */
 export function initialChoices(rows: SiteAccessRow[]): SiteChoice[] {
   return (rows ?? []).map((r) => {
     const current = r.membership?.role ?? "";
     const valid = r.roles.some((x) => x._id === current);
     return {
       site: r.site, name: r.name, on: !!r.membership, role: valid ? current : "", roles: r.roles ?? [],
-      // their current role here is not one of this site's own roles (e.g. an
-      // organisation role from an invitation) - say so rather than blank it silently
+      // their current role here is not one this site offers (e.g. another site's
+      // role) - say so rather than blank it silently
       ...(r.membership && !valid ? { replacedRole: r.membership.roleName || "their current role" } : {}),
     };
   });
 }
 
-/** Role names offered by "Same role for all selected sites". */
-export function sharedRoleNames(choices: SiteChoice[]): string[] {
-  const names = new Set<string>();
-  for (const c of choices) if (c.on) for (const r of c.roles) names.add(r.name);
-  return [...names].sort((a, b) => a.localeCompare(b));
+/** One site's Role list: "Organisation roles" first, then "<Site> roles". */
+export function roleItems(choice: Pick<SiteChoice, "name" | "roles">): RoleItem[] {
+  const org = choice.roles.filter(isOrgRole);
+  const own = choice.roles.filter((r) => !isOrgRole(r));
+  const items: RoleItem[] = [];
+  if (org.length) items.push({ title: "Organisation roles", type: "subheader" }, ...org.map((r) => ({ title: r.name, value: r._id })));
+  if (own.length) items.push({ title: `${choice.name} roles`, type: "subheader" }, ...own.map((r) => ({ title: r.name, value: r._id })));
+  return items;
+}
+
+/**
+ * "Same role for all selected sites", grouped: the organisation's roles (they
+ * work at every site, so they are listed even before a site is ticked), then
+ * the names of the ticked sites' own roles.
+ */
+export function sharedRoleItems(choices: SiteChoice[]): RoleItem[] {
+  const org = new Set<string>();
+  for (const c of choices) for (const r of c.roles) if (isOrgRole(r)) org.add(r.name);
+  const own = new Set<string>();
+  for (const c of choices) if (c.on) for (const r of c.roles) if (!isOrgRole(r) && !org.has(r.name)) own.add(r.name);
+  const sorted = (s: Set<string>) => [...s].sort((a, b) => a.localeCompare(b)).map((n) => ({ title: n, value: n }));
+  const items: RoleItem[] = [];
+  if (org.size) items.push({ title: "Organisation roles", type: "subheader" }, ...sorted(org));
+  if (own.size) items.push({ title: "Roles of the selected sites", type: "subheader" }, ...sorted(own));
+  return items;
 }
 
-/** Give every selected site the role with this name, where that site has one. */
+/** Give every selected site the role with this name (an organisation role first), where that site has one. */
 export function applySameRole(choices: SiteChoice[], roleName: string): SiteChoice[] {
   return choices.map((c) => {
     if (!c.on) return c;
-    const match = c.roles.find((r) => r.name === roleName);
+    const match = c.roles.find((r) => r.name === roleName && isOrgRole(r)) ?? c.roles.find((r) => r.name === roleName);
     return match ? { ...c, role: match._id } : c;
   });
 }