@7365admin1/layer-common 4.81.1-staging.468 → 4.82.0

package/components/InvitationClientForm.vue

@@ -388,27 +388,9 @@ watch(
 const roles = ref<any[]>([])
 const { getRoles } = useRole()
 
-/*
- * `type` is the ROLE type, not the service the client subscribes to, and the
- * only caller (`ClientMain.vue` "Invite Client") passes no `app` prop -- so
- * this sent `type: ""` and the endpoint applied no type filter at all. The
- * dropdown therefore listed every org-less role of every type, which includes
- * the platform's OWN staff roles (`type: "admin"` -- the two rows the console's
- * `/super-admin/role-permissions` screen edits). Offering a Seven365 console
- * staff role on a CLIENT invitation is the defect.
- *
- * A client admin's role is `type: "organization"`, which is what the client
- * roles screen (`org/[organization]/roles-permissions.vue`) already lists. This
- * narrows to exactly that. It is a narrowing of this one picker only: no role
- * changes, no permission changes, and the org-less `organization` roles that
- * were already being picked are all still offered.
- *
- * Keying off the selected service instead would empty the dropdown -- no
- * org-less role carries a service type -- so `props.app` is not the filter.
- */
 const { data: roleData, refresh: refreshRoles } = await useLazyAsyncData(
   "roles",
-  () => getRoles({ org: org.value?._id, type: "organization", limit: 50 }),
+  () => getRoles({ org: org.value?._id, type: props.app, limit: 50 }),
   { watch: [() => props.app] }
 )
 

package/components/VisitorForm.vue

@@ -910,20 +910,8 @@ const hidQrReaderId = computed(() => (
   hidQrConfiguredReaderId.value || String(hidQrReader.value?._id || "")
 ));
 
-/*
- * Visitor QR passes are hidden at the manager's request (2026-09-23).
- *
- * A flag rather than a deletion: issuing, the preview dialog, printing and the
- * regenerate handler below are all intact and untouched, so bringing the
- * feature back is this one line. Every surface that offers a Visitor QR reads
- * `hidQrCodePassAllowed`, which is why the switch belongs here and not in each
- * of them.
- */
-const HID_VISITOR_QR_ENABLED = false;
-
 const hidQrCodePassAllowed = computed(() => {
   return (
-    HID_VISITOR_QR_ENABLED &&
     hidQrCodePassEnabled.value &&
     ["guest", "contractor", "walk-in"].includes(prop.type)
   );

package/components/VisitorManagement.vue

@@ -749,35 +749,11 @@
                 class="visitor-preview__row"
               >
                 <div class="visitor-preview__label">{{ label }}</div>
-                <div>
-                  <!-- Was a hover tooltip on the value: the full NRIC only
-                       reachable by hovering, which says nothing is there to
-                       reach and cannot be reached at all on a touch screen.
-                       The eye alone, at the 14px the Incident Report screens
-                       draw it, is a 14px target - the floor is 24px. So the
-                       NUMBER is the control and the eye is its affordance:
-                       the whole masked value is pressable, which makes the
-                       target the width of the digits rather than of a glyph,
-                       and being a real `button` it also takes a tab stop,
-                       which a `v-icon` with a click handler never did. -->
-                  <button
-                    type="button"
-                    class="visitor-preview__reveal"
-                    :aria-label="showVisitorNric ? 'Hide NRIC' : 'Show NRIC'"
-                    :aria-pressed="showVisitorNric"
-                    @click="showVisitorNric = !showVisitorNric"
-                  >
-                    <span class="visitor-preview__value">
-                      {{
-                        showVisitorNric
-                          ? selectedVisitorObject[key]
-                          : maskNRIC(selectedVisitorObject[key])
-                      }}
-                    </span>
-                    <v-icon size="16" class="visitor-preview__eye">
-                      {{ showVisitorNric ? "mdi-eye-off-outline" : "mdi-eye-outline" }}
-                    </v-icon>
-                  </button>
+                <div
+                  v-tooltip:top="selectedVisitorObject[key]"
+                  class="visitor-preview__value"
+                >
+                  {{ maskNRIC(selectedVisitorObject[key]) }}
                 </div>
               </div>
 
@@ -827,84 +803,6 @@
                 </div>
               </div>
 
-              <!--
-                THE CONTRACTOR'S PARTY.
-
-                The list row has always said `( +2 members)` beside the name
-                and then had nowhere to send you for the names themselves. The
-                block spans both columns rather than sitting in the 116px
-                value track: a member is a record, not a value, and several of
-                them in a 250px column is unreadable.
-
-                Read off `selectedVisitorDataObject` (the raw row) and not
-                `selectedVisitorObject`, which filters itself down to
-                `typeFieldMap` plus five fixed keys - `members` is on neither
-                list, and widening that computed would change what four other
-                dialogs on this screen see.
-              -->
-              <div
-                v-else-if="key === 'members' && selectedVisitorMembers.length"
-                class="visitor-preview__row visitor-preview__row--block"
-              >
-                <div class="visitor-preview__label">
-                  {{ label }} ({{ selectedVisitorMembers.length }})
-                </div>
-                <div class="visitor-preview__members">
-                  <div
-                    v-for="(member, index) in selectedVisitorMembers"
-                    :key="member?.nric || member?.name || index"
-                    class="visitor-preview__member"
-                  >
-                    <div class="visitor-preview__value">
-                      {{ member?.name || "N/A" }}
-                    </div>
-                    <template v-for="field in memberDetailFields" :key="field.key">
-                      <div
-                        v-if="member?.[field.key]"
-                        class="visitor-preview__member-line"
-                      >
-                        <span class="visitor-preview__member-key">
-                          {{ field.label }}
-                        </span>
-                        <!-- A member's NRIC is the same class of data as the
-                             visitor's, so it gets the same control. Each
-                             member reveals separately - one toggle for the
-                             whole card would show three people's NRICs to
-                             read one. -->
-                        <button
-                          v-if="field.key === 'nric'"
-                          type="button"
-                          class="visitor-preview__reveal"
-                          :aria-label="
-                            isMemberNricShown(index)
-                              ? `Hide NRIC for ${member?.name || 'this member'}`
-                              : `Show NRIC for ${member?.name || 'this member'}`
-                          "
-                          :aria-pressed="isMemberNricShown(index)"
-                          @click="toggleMemberNric(index)"
-                        >
-                          <span>
-                            {{
-                              isMemberNricShown(index)
-                                ? member.nric
-                                : maskNRIC(member.nric)
-                            }}
-                          </span>
-                          <v-icon size="16" class="visitor-preview__eye">
-                            {{
-                              isMemberNricShown(index)
-                                ? "mdi-eye-off-outline"
-                                : "mdi-eye-outline"
-                            }}
-                          </v-icon>
-                        </button>
-                        <span v-else>{{ member[field.key] }}</span>
-                      </div>
-                    </template>
-                  </div>
-                </div>
-              </div>
-
               <!-- The vehicle number, with Block on its right: the Registered
                    tab only, for someone who may add vehicles. It opens the
                    Vehicle Mgmt Block Listed form with the category taken from
@@ -2225,71 +2123,6 @@ const isSelectedVisitorPendingApproval = computed(
   () => selectedVisitorStatus.value === "pending"
 );
 
-/**
- * The members a contractor brought with them. Not gated on the Guests tab: the
- * list row's own `( +N members)` count is not either, and a contractor with a
- * party has one wherever the screen shows it.
- *
- * Blank entries are dropped rather than drawn as an empty card - the payload
- * carries `""` for every detail nobody filled in, so a member with no name and
- * no details would otherwise render as a bare inset box.
- */
-const selectedVisitorMembers = computed<Record<string, any>[]>(() => {
-  const members = selectedVisitorDataObject.value?.members;
-  if (!Array.isArray(members)) return [];
-
-  return members.filter(
-    (member: Record<string, any>) =>
-      member?.name || member?.nric || member?.contact || member?.plateNumber
-  );
-});
-
-/**
- * WHICH NRICs ARE UNCOVERED RIGHT NOW.
- *
- * Per member and not per card, so revealing one person's number does not
- * uncover the rest of the party's. Both are cleared when the dialog closes -
- * a preview must not open on the next visitor with the last one's NRIC
- * already showing, and it is the same `selectedVisitorId` that would carry it
- * across if the same row were reopened.
- */
-const showVisitorNric = ref(false);
-const shownMemberNrics = ref<number[]>([]);
-
-function isMemberNricShown(index: number) {
-  return shownMemberNrics.value.includes(index);
-}
-
-function toggleMemberNric(index: number) {
-  shownMemberNrics.value = isMemberNricShown(index)
-    ? shownMemberNrics.value.filter((x) => x !== index)
-    : [...shownMemberNrics.value, index];
-}
-
-watch(
-  () => dialog.viewVisitor,
-  (open) => {
-    if (open) return;
-    showVisitorNric.value = false;
-    shownMemberNrics.value = [];
-  }
-);
-
-/**
- * What a member row prints under the name, in order. `plateNumber` is in here
- * because the API returns it on `members[]` even though neither
- * `TMemberInfo` (this package) nor `TContractorMembers` (API-core's visitor
- * model, name and nric only) declares it - the two types have drifted from the
- * document and from each other. Reading the key defensively costs nothing and
- * shows the vehicle a member actually arrived in; the types are somebody's to
- * reconcile separately.
- */
-const memberDetailFields = [
-  { key: "nric", label: "NRIC" },
-  { key: "contact", label: "Contact" },
-  { key: "plateNumber", label: "Vehicle" },
-] as const;
-
 const formatType = (item: any) =>
   (item.deliveryType ? item.deliveryType + "-" : "") + item.type;
 
@@ -2303,7 +2136,6 @@ const formattedFields = {
   level: "Level",
   unit: "Unit",
   purpose: "Purpose",
-  members: "Members",
   checkIn: "Check In",
   snapshotEntryImage: "Entry Image",
   checkOut: "Check Out",
@@ -3310,100 +3142,6 @@ watchEffect(async () => {
   word-break: break-word;
 }
 
-/* A row whose value is a set of records rather than a value - it drops the
-   two-column grid and runs the full width of the card body. */
-.visitor-preview__row--block {
-  display: block;
-}
-
-.visitor-preview__members {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  margin-top: 8px;
-}
-
-/*
- * An added member reads as an inset on the card it sits in - `--hover` on
- * `--border` at the inner radius. Those are `Card/MemberInfoSummary`'s three
- * decisions, unchanged, so a member looks the same in the preview as it does
- * in the form that created it. Only the TYPE differs: that card still prints
- * `<strong>Label:</strong> value`, which is the pattern this dialog just moved
- * off, so the lines below are set on the scale rather than inherited.
- */
-.visitor-preview__member {
-  padding: 9px 12px;
-  border: 1px solid var(--border);
-  border-radius: var(--r-inner);
-  background: var(--hover);
-}
-
-.visitor-preview__member-line {
-  display: flex;
-  gap: 8px;
-  margin-top: 3px;
-  font-size: var(--fs-breadcrumb);
-  color: var(--text2);
-  word-break: break-word;
-}
-
-.visitor-preview__member-key {
-  flex: 0 0 52px;
-  color: var(--muted);
-}
-
-/*
- * THE NRIC REVEAL.
- *
- * The pressable thing is the masked number, not the glyph beside it: an eye on
- * its own is a 14-16px target where 24px is the floor, and on a 12.5px member
- * line an `AppButton variant="icon"` - the layer's 32px icon square - would
- * make the NRIC line half again the height of the Contact line under it.
- * Pressing the digits gives a target the width of the value at no cost to the
- * rhythm, and reads the right way round: the number is what changes.
- *
- * It inherits its type rather than setting any, so the visitor's NRIC stays on
- * `--fs-cell` and a member's on the `--fs-breadcrumb` of the line it sits in.
- * The negative margin pays back the padding, so a revealed value starts on the
- * same left edge as every other value in the card.
- */
-.visitor-preview__reveal {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  margin: -3px -7px;
-  padding: 3px 7px;
-  border: none;
-  border-radius: var(--r-inner-sm);
-  background: transparent;
-  font: inherit;
-  color: inherit;
-  text-align: left;
-  cursor: pointer;
-  transition: background var(--motion) ease;
-}
-
-.visitor-preview__reveal:hover {
-  background: var(--hover);
-}
-
-.visitor-preview__reveal:focus-visible {
-  outline: 2px solid var(--accent);
-  outline-offset: 1px;
-}
-
-/* The design's interactive ink - not Vuetify's fixed blue, which is one colour
-   on both themes. `affectedEntities` gives its NRIC eye the same value. */
-.visitor-preview__eye {
-  color: var(--accent-text);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .visitor-preview__reveal {
-    transition: none;
-  }
-}
-
 /* The width the type filter carried as `max-width="200"` on the v-select. */
 .visitor-type-filter {
   max-width: 200px;

package/composables/useDocument.ts

@@ -6,7 +6,6 @@ export default function useDocument() {
     type = "all",
     site = "",
     parentId = "",
-    expiry = "all",
   }: {
     page?: number;
     search?: string;
@@ -14,11 +13,6 @@ export default function useDocument() {
     type?: string;
     site?: string;
     parentId?: string;
-    /**
-     * Which tab is asking: "active" for Documents, "expired" for
-     * Document (Expired). Defaults to "all" so existing callers are unaffected.
-     */
-    expiry?: string;
   } = {}) {
     const query: Record<string, any> = {
       page,
@@ -27,7 +21,6 @@ export default function useDocument() {
       type,
       site,
       parentId,
-      expiry,
     };
 
     return useNuxtApp().$api<Record<string, any>>(`/api/documents`, {

package/composables/useFacility.ts

@@ -76,8 +76,6 @@ export default function usetFacility() {
     hourInterval?: number;
     isBookingFeeEnabled: boolean;
     isGuestEnabled: boolean;
-    isResidentChecklistEnabled: boolean;
-    isSecurityChecklistEnabled: boolean;
     bookingAmount: number | null;
     peakBookingFeeAmount?: number | null;
     bookingFeeGuestAmount?: number | null;
@@ -175,8 +173,6 @@ export default function usetFacility() {
         hourInterval = 1,
         isBookingFeeEnabled = false,
         isGuestEnabled = false,
-        isResidentChecklistEnabled = false,
-        isSecurityChecklistEnabled = false,
         bookingAmount = 0,
         peakBookingFeeAmount = 0,
         bookingFeeGuestAmount = 0,
@@ -240,13 +236,6 @@ export default function usetFacility() {
       this.hourInterval = hourInterval;
       this.isBookingFeeEnabled = isBookingFeeEnabled;
       this.isGuestEnabled = isGuestEnabled;
-      // Exactly one owner, always. `isResidentChecklistEnabled` is the flag
-      // the apps gate on, so it decides, and security is its complement —
-      // stored rather than computed so each app can read its own flag without
-      // knowing the rule. A facility predating both fields lands on security,
-      // which is how every one of them already behaved.
-      this.isResidentChecklistEnabled = isResidentChecklistEnabled === true;
-      this.isSecurityChecklistEnabled = !this.isResidentChecklistEnabled;
       this.bookingAmount = bookingAmount;
       this.peakBookingFeeAmount = peakBookingFeeAmount;
       this.bookingFeeGuestAmount = bookingFeeGuestAmount;

package/composables/useHidAmico.ts

@@ -28,22 +28,6 @@ export type HidReaderPayload = {
   lastCallbackType?: string;
 };
 
-export type HidProfileQr = {
-  readerId: string;
-  userId: string;
-  memberId: string;
-  hidUserId: string;
-  registration: string;
-  readerName: string;
-  portalName: string;
-  qrEnabled: boolean;
-  issued: boolean;
-  qrValue: string;
-  issuedAt: string;
-  /** null when the permission lookup itself failed, so "unknown" stays distinct from "no". */
-  assigned: boolean | null;
-};
-
 type HidIdentityPayload = {
   site?: string;
   hidUserId?: string | number;
@@ -155,28 +139,6 @@ export type HidSipAccountData = {
   provisionedAt: string;
 };
 
-/** One row of the site's SIP account list - who owns the extension, never its password. */
-export type HidSipAccountListItem = {
-  _id: string;
-  userId: string;
-  name: string;
-  email: string;
-  /**
-   * What the owner is called after their name on the contact list: their
-   * "Blk 1/Level 1/Unit 1" when they live here, and their membership type -
-   * "Security Agency" - when they do not. "" only when the site knows neither.
-   *
-   * Optional because an API still on the `@7365admin1/core` release that
-   * predates it answers without the field; the contact picker falls back to the
-   * bare name rather than showing a dangling separator.
-   */
-  unitLabel?: string;
-  extension: string;
-  username: string;
-  status: string;
-  provisionedAt: string;
-};
-
 /**
  * True only for the specific validation error an API that predates core #1878
  * returns when the discover body carries `site`. Deliberately narrow: after
@@ -204,36 +166,6 @@ export default function useHidAmico() {
     });
   }
 
-  /**
-   * The signed-in member's own QR code on one reader.
-   *
-   * No user id in the path: the server takes the caller from the session, so
-   * these cannot be pointed at somebody else. `assigned` in the response says
-   * whether the HID permissions screen actually admits this member to the
-   * reader - issuing a code does not grant access, and the screen has to be
-   * able to say so.
-   */
-  function getProfileQr(readerId: string) {
-    return useNuxtApp().$api<{ data: HidProfileQr }>(
-      `${basePath}/readers/${readerId}/profile-qr`,
-      { method: "GET" },
-    );
-  }
-
-  function issueProfileQr(readerId: string) {
-    return useNuxtApp().$api<{ data: HidProfileQr }>(
-      `${basePath}/readers/${readerId}/profile-qr`,
-      { method: "POST" },
-    );
-  }
-
-  function deleteProfileQr(readerId: string) {
-    return useNuxtApp().$api<{ data: HidProfileQr }>(
-      `${basePath}/readers/${readerId}/profile-qr`,
-      { method: "DELETE" },
-    );
-  }
-
   function createReader(payload: HidReaderPayload) {
     return useNuxtApp().$api<HidApiRecord>(`${basePath}/readers`, {
       method: "POST",
@@ -325,36 +257,6 @@ export default function useHidAmico() {
     });
   }
 
-  /**
-   * Which credentials a reader accepts at the door.
-   *
-   * Separate from `setReaderConfiguration` on purpose. That one is the generic
-   * configuration endpoint, gated by an allowlist of writable objects; this is
-   * a dedicated route that validates the four methods against the reader's own
-   * `capabilities` and confirms the write by reading the device back, so a
-   * refusal here names the credential the hardware would not take.
-   */
-  function setReaderIdentificationMethods(readerId: string, payload: HidApiRecord) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/identification-methods`,
-      { method: "PUT", body: payload },
-    );
-  }
-
-  /**
-   * Put a reader back to the settings iService holds for it.
-   *
-   * A POST rather than a GET because it WRITES: reading the reader's
-   * configuration is only the first half, and anything that drifted is
-   * re-applied before this returns.
-   */
-  function reconcileReaderIdentificationMethods(readerId: string) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/identification-methods/reconcile`,
-      { method: "POST" },
-    );
-  }
-
   function getIdentities(readerId: string, query: HidApiRecord = {}) {
     return useNuxtApp().$api<HidApiRecord>(`${basePath}/readers/${readerId}/identities`, {
       method: "GET",
@@ -512,27 +414,6 @@ export default function useHidAmico() {
     );
   }
 
-  function getUserPasswordStatus(readerId: string, hidUserId: string | number) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/users/${hidUserId}/password`,
-      { method: "GET" },
-    );
-  }
-
-  function setUserPassword(readerId: string, hidUserId: string | number, password: string) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/users/${hidUserId}/password`,
-      { method: "PUT", body: { password } },
-    );
-  }
-
-  function deleteUserPassword(readerId: string, hidUserId: string | number) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/users/${hidUserId}/password`,
-      { method: "DELETE" },
-    );
-  }
-
   function deleteUserPin(readerId: string, hidUserId: string | number) {
     return useNuxtApp().$api<{ data: { pinEnrolled: boolean } }>(
       `${basePath}/readers/${readerId}/users/${hidUserId}/pin`,
@@ -593,42 +474,6 @@ export default function useHidAmico() {
     );
   }
 
-  /**
-   * The site's SIP accounts for the intercom contact picker. Site-scoped only:
-   * the organisation never decided who may read this — the site guard does —
-   * and sending one narrowed the list on a customer site whose accounts were
-   * provisioned by a managing agent.
-   */
-  function getSipAccounts(siteId: string) {
-    return useNuxtApp().$api<{ data: HidSipAccountListItem[] }>(
-      `${basePath}/sites/${siteId}/intercom/sip-accounts`,
-      { method: "GET" },
-    );
-  }
-
-  /**
-   * Wake the resident's phone for a call the web phone has just placed.
-   *
-   * The SIP INVITE is the call and travels over the WebSocket, not through the
-   * API; this only rings the resident's mobile so somebody is there to answer
-   * it. It is therefore fired after the INVITE and never awaited in a way that
-   * could fail the call — see `startWebCall` in `HidIntercomManagement.vue`.
-   *
-   * `notified: false` with a reason is a normal response, not an error: staff
-   * extensions and external SIP addresses have no resident behind them.
-   */
-  function notifyIntercomCall(
-    siteId: string,
-    payload: { orgId: string; destination: string; callId: string; readerId?: string },
-  ) {
-    return useNuxtApp().$api<{
-      data: { notified: boolean; delivered?: number; reason?: string };
-    }>(
-      `${basePath}/sites/${siteId}/intercom/notify-call`,
-      { method: "POST", body: payload },
-    );
-  }
-
   function getPermissionCandidates(
     siteId: string,
     query: {
@@ -660,9 +505,6 @@ export default function useHidAmico() {
 
   return {
     getReaders,
-    getProfileQr,
-    issueProfileQr,
-    deleteProfileQr,
     discoverReader,
     createReader,
     updateReader,
@@ -677,8 +519,6 @@ export default function useHidAmico() {
     issueVisitorQr,
     getReaderConfiguration,
     setReaderConfiguration,
-    setReaderIdentificationMethods,
-    reconcileReaderIdentificationMethods,
     getLogs,
     setUserImage,
     deleteUserImage,
@@ -690,9 +530,6 @@ export default function useHidAmico() {
     getUserPinStatus,
     setUserPin,
     deleteUserPin,
-    getUserPasswordStatus,
-    setUserPassword,
-    deleteUserPassword,
     getIdentities,
     getReaderUsers,
     getReaderAccessLogs,
@@ -703,8 +540,6 @@ export default function useHidAmico() {
     makeIntercomCall,
     finalizeIntercomCall,
     ensureSipAccount,
-    getSipAccounts,
-    notifyIntercomCall,
     getSitePermissions,
     getPermissionCandidates,
     updateSitePermissions,

package/composables/useHidNavigation.ts

@@ -46,33 +46,9 @@ export default function useHidNavigation() {
           },
         },
         {
-          // "HID Reader Users" now points at `access-mgmt/administrator`, not at
-          // `access-mgmt/hid-users`.
-          //
-          // Both routes mount a roster of the reader's users, but only this one
-          // can act on them. `administrator` renders HidUserEnrollment WITHOUT
-          // `card-management`, and that prop is what gates the Enroll action:
-          //   <template v-if="!props.cardManagement" #actions>
-          // `hid-users` renders HidReaderUserRoster, which is read-only apart
-          // from PIN management. So the menu entry with this name used to lead
-          // to the screen that cannot enrol, while the screen that can was
-          // reachable only by typing the URL.
-          //
-          // `hid-users` is left in place and simply unlisted - the same state
-          // `administrator` was in - so any existing link to it still resolves.
           title: "HID Reader Users",
           route: {
-            name: "org-site-access-mgmt-administrator",
-            params: { org, site },
-          },
-        },
-        {
-          // The signed-in member's own pass, not somebody else's. Every other
-          // entry in this group acts on a resident or a visitor; this one has
-          // no subject but the caller.
-          title: "HID QR Code",
-          route: {
-            name: "org-site-access-mgmt-hid-qr-code",
+            name: "org-site-access-mgmt-hid-users",
             params: { org, site },
           },
         },