@7365admin1/layer-common 4.78.0 → 4.79.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.79.0
+
+### Minor Changes
+
+- 324da82: Site access lists "Organisation roles" and "<Site> roles" in every site's Role list and in "Same role for all selected sites" (organisation roles offered before any site is ticked), with a "Create an organisation role" link. RolePermissionMain takes `scope` ("organisation" = roles with no site); getRoles sends it only when set.
+
 ## 4.78.0
 
 ### Minor Changes
@@ -1926,11 +1932,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                        GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                        GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                        owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                        staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/MemberSiteAccess.vue

@@ -4,6 +4,12 @@
     <v-card-text class="screen-modal__body">
       <p class="text-body-2 mb-3">
         Choose the sites this person can open and their role at each. They will see only these sites.
+        A role can be one made for that site, or an <strong>organisation role</strong> (made once in Roles &amp;
+        Permissions) - either way it gives its permissions at that site only.
+      </p>
+      <p class="text-body-2 mb-3">
+        <a href="#" data-test="site-access-create-org-role" @click.prevent="createOrgRole()">Create an organisation role</a>
+        to use at many sites.
       </p>
 
       <div v-if="loading" class="py-4 text-center"><v-progress-circular indeterminate /></div>
@@ -31,7 +37,9 @@
           <div class="d-flex align-center ga-2 mb-2">
             <v-select
               v-model="sameRole"
-              :items="sharedNames"
+              :items="sharedItems"
+              item-title="title"
+              item-value="value"
               label="Same role for all selected sites"
               density="compact"
               hide-details
@@ -39,27 +47,28 @@
               class="filter-field"
               data-test="site-access-same-role"
             />
-            <v-btn variant="outlined" :disabled="!sameRole" @click="applySame()">Apply</v-btn>
+            <v-btn variant="outlined" :disabled="!sameRole || !anyOn" @click="applySame()">Apply</v-btn>
           </div>
+          <p v-if="sameRole && !anyOn" class="text-caption mb-2">Tick the sites first, then Apply.</p>
 
           <div v-for="(c, i) in choices" :key="c.site" class="d-flex align-center ga-2 py-1" data-test="site-access-row">
             <v-checkbox v-model="choices[i].on" density="compact" hide-details :label="c.name" style="min-width: 220px" />
             <v-select
               v-if="c.roles.length"
               v-model="choices[i].role"
-              :items="c.roles"
-              item-title="name"
-              item-value="_id"
+              :items="roleItems(c)"
+              item-title="title"
+              item-value="value"
               :disabled="!c.on"
               label="Role"
               density="compact"
               hide-details
               class="filter-field"
             />
-            <span v-else class="text-caption">No roles created for {{ c.name }} yet — create one in that site's Roles &amp; Permissions.</span>
+            <span v-else class="text-caption">No roles for {{ c.name }} yet — create an organisation role (link above) or one in that site's Roles &amp; Permissions.</span>
           </div>
           <p v-for="c in choices.filter((x) => x.on && !x.role && x.replacedRole)" :key="`r-${c.site}`" class="text-caption">
-            {{ c.name }}: "{{ c.replacedRole }}" is not one of this site's own roles — choose one of {{ c.name }}'s roles.
+            {{ c.name }}: "{{ c.replacedRole }}" is not a role for this site — choose an organisation role or one of {{ c.name }}'s roles.
           </p>
         </div>
 
@@ -78,7 +87,7 @@
 
 <script setup lang="ts">
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
-import { applySameRole, initialChoices, sharedRoleNames, toPayload, type SiteChoice } from "../utils/site-access";
+import { applySameRole, initialChoices, roleItems, sharedRoleItems, toPayload, type SiteChoice } from "../utils/site-access";
 
 const props = defineProps({
   org: { type: String, required: true },
@@ -98,7 +107,16 @@ const orgWide = ref<Array<{ roleName?: string }>>([]);
 const removeOrgAccess = ref(false);
 const sameRole = ref<string | null>(null);
 
-const sharedNames = computed(() => sharedRoleNames(choices.value));
+const sharedItems = computed(() => sharedRoleItems(choices.value));
+const anyOn = computed(() => choices.value.some((c) => c.on));
+
+// Organization app -> Roles & Permissions, on the organisation's own service;
+// Create there comes back here (`returnTo`), and the box reloads its roles on open.
+function createOrgRole() {
+  emit("cancel");
+  const back = useRoute().fullPath;
+  navigateTo({ path: `/org/${props.org}/roles-permissions`, query: { service: "own", returnTo: back } });
+}
 const missing = computed(() => toPayload(choices.value).missing);
 
 function applySame() {

package/components/RolePermissionMain.vue

@@ -227,6 +227,11 @@ const props = defineProps({
     type: String,
     default: "",
   },
+  /** "organisation": list only roles with no site (Organization app service roles). */
+  scope: {
+    type: String,
+    default: "",
+  },
   /*
    * Whether the Create-role dialog shows its (read-only) Site field.
    * The dialog defaulted this to `true` but this component never declared or
@@ -429,6 +434,7 @@ const {
       type: props.listType ?? props.type,
       org: props.orgId,
       site: props.siteId,
+      scope: props.scope,
     }),
   {
     watch: [page, headerSearch],

package/composables/useRole.ts

@@ -24,10 +24,12 @@ export default function useRole() {
     type = "",
     org = "",
     site = "",
+    /** "organisation": only roles with no site (needs core 3.134.0+ - an older API refuses the key with 400) */
+    scope = "",
   } = {}) {
     return useNuxtApp().$api<Record<string, any>>("/api/roles", {
       method: "GET",
-      query: { search, page, limit, type, org, site },
+      query: { search, page, limit, type, org, site, ...(scope ? { scope } : {}) },
     });
   }
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.78.0",
+  "version": "4.79.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/site-access.ts

@@ -1,9 +1,10 @@
 /**
  * Site access editor state (owner request 2026-09-28). One row per site of the
- * organisation; a chosen site needs one of ITS OWN roles (the server refuses an
- * organisation-level role for a site, because it would reach every site).
+ * organisation; a chosen site needs a role: one created FOR that site, or one of
+ * the organisation's service roles (owner request 2026-09-30, `scope:
+ * "organisation"`). Either way the server confines the membership to that site.
  */
-export type SiteAccessRole = { _id: string; name: string; type?: string };
+export type SiteAccessRole = { _id: string; name: string; type?: string; scope?: "site" | "organisation" };
 export type SiteAccessRow = {
   site: string;
   name: string;
@@ -11,33 +12,57 @@ export type SiteAccessRow = {
   roles: SiteAccessRole[];
 };
 export type SiteChoice = { site: string; name: string; on: boolean; role: string; roles: SiteAccessRole[]; replacedRole?: string };
+/** A v-select entry: a role, or a group heading. */
+export type RoleItem = { title: string; value?: string; type?: "subheader" };
 
-/** Start from what the member has now. A current role that is not one of the site's roles is dropped. */
+const isOrgRole = (r: SiteAccessRole) => r.scope === "organisation";
+
+/** Start from what the member has now. A current role the site does not offer is dropped. */
 export function initialChoices(rows: SiteAccessRow[]): SiteChoice[] {
   return (rows ?? []).map((r) => {
     const current = r.membership?.role ?? "";
     const valid = r.roles.some((x) => x._id === current);
     return {
       site: r.site, name: r.name, on: !!r.membership, role: valid ? current : "", roles: r.roles ?? [],
-      // their current role here is not one of this site's own roles (e.g. an
-      // organisation role from an invitation) - say so rather than blank it silently
+      // their current role here is not one this site offers (e.g. another site's
+      // role) - say so rather than blank it silently
       ...(r.membership && !valid ? { replacedRole: r.membership.roleName || "their current role" } : {}),
     };
   });
 }
 
-/** Role names offered by "Same role for all selected sites". */
-export function sharedRoleNames(choices: SiteChoice[]): string[] {
-  const names = new Set<string>();
-  for (const c of choices) if (c.on) for (const r of c.roles) names.add(r.name);
-  return [...names].sort((a, b) => a.localeCompare(b));
+/** One site's Role list: "Organisation roles" first, then "<Site> roles". */
+export function roleItems(choice: Pick<SiteChoice, "name" | "roles">): RoleItem[] {
+  const org = choice.roles.filter(isOrgRole);
+  const own = choice.roles.filter((r) => !isOrgRole(r));
+  const items: RoleItem[] = [];
+  if (org.length) items.push({ title: "Organisation roles", type: "subheader" }, ...org.map((r) => ({ title: r.name, value: r._id })));
+  if (own.length) items.push({ title: `${choice.name} roles`, type: "subheader" }, ...own.map((r) => ({ title: r.name, value: r._id })));
+  return items;
+}
+
+/**
+ * "Same role for all selected sites", grouped: the organisation's roles (they
+ * work at every site, so they are listed even before a site is ticked), then
+ * the names of the ticked sites' own roles.
+ */
+export function sharedRoleItems(choices: SiteChoice[]): RoleItem[] {
+  const org = new Set<string>();
+  for (const c of choices) for (const r of c.roles) if (isOrgRole(r)) org.add(r.name);
+  const own = new Set<string>();
+  for (const c of choices) if (c.on) for (const r of c.roles) if (!isOrgRole(r) && !org.has(r.name)) own.add(r.name);
+  const sorted = (s: Set<string>) => [...s].sort((a, b) => a.localeCompare(b)).map((n) => ({ title: n, value: n }));
+  const items: RoleItem[] = [];
+  if (org.size) items.push({ title: "Organisation roles", type: "subheader" }, ...sorted(org));
+  if (own.size) items.push({ title: "Roles of the selected sites", type: "subheader" }, ...sorted(own));
+  return items;
 }
 
-/** Give every selected site the role with this name, where that site has one. */
+/** Give every selected site the role with this name (an organisation role first), where that site has one. */
 export function applySameRole(choices: SiteChoice[], roleName: string): SiteChoice[] {
   return choices.map((c) => {
     if (!c.on) return c;
-    const match = c.roles.find((r) => r.name === roleName);
+    const match = c.roles.find((r) => r.name === roleName && isOrgRole(r)) ?? c.roles.find((r) => r.name === roleName);
     return match ? { ...c, role: match._id } : c;
   });
 }