@7365admin1/layer-common 4.82.0 → 4.82.1-staging.470

package/components/InvitationClientForm.vue

@@ -388,9 +388,27 @@ watch(
 const roles = ref<any[]>([])
 const { getRoles } = useRole()
 
+/*
+ * `type` is the ROLE type, not the service the client subscribes to, and the
+ * only caller (`ClientMain.vue` "Invite Client") passes no `app` prop -- so
+ * this sent `type: ""` and the endpoint applied no type filter at all. The
+ * dropdown therefore listed every org-less role of every type, which includes
+ * the platform's OWN staff roles (`type: "admin"` -- the two rows the console's
+ * `/super-admin/role-permissions` screen edits). Offering a Seven365 console
+ * staff role on a CLIENT invitation is the defect.
+ *
+ * A client admin's role is `type: "organization"`, which is what the client
+ * roles screen (`org/[organization]/roles-permissions.vue`) already lists. This
+ * narrows to exactly that. It is a narrowing of this one picker only: no role
+ * changes, no permission changes, and the org-less `organization` roles that
+ * were already being picked are all still offered.
+ *
+ * Keying off the selected service instead would empty the dropdown -- no
+ * org-less role carries a service type -- so `props.app` is not the filter.
+ */
 const { data: roleData, refresh: refreshRoles } = await useLazyAsyncData(
   "roles",
-  () => getRoles({ org: org.value?._id, type: props.app, limit: 50 }),
+  () => getRoles({ org: org.value?._id, type: "organization", limit: 50 }),
   { watch: [() => props.app] }
 )
 

package/components/Layout/Header.vue

@@ -10,6 +10,8 @@
     application has loaded and the route the router is on. It fetches nothing
     and navigates nowhere; it is a label.
   -->
+  <!-- Seven365 staff view: persistent banner with Exit (only while one is open). -->
+  <StaffViewBanner />
   <v-app-bar
     :height="58"
     flat

package/components/StaffViewBanner.vue

@@ -0,0 +1,67 @@
+<!--
+  "SEVEN365 STAFF VIEW" BANNER (owner, 2026-10-01).
+
+  Shown on every page of every app while this sign-in has a staff view open
+  (the server holds it against the session - see `useStaffView`). It cannot be
+  dismissed: the only ways out are Exit here, or signing out, and both end the
+  view on the server.
+-->
+<template>
+  <v-system-bar
+    v-if="staffView"
+    :height="36"
+    color="warning"
+    class="staff-view-banner"
+    data-test="staff-view-banner"
+    role="status"
+  >
+    <v-icon icon="mdi-shield-account" size="18" class="me-2" />
+    <span class="staff-view-banner__text">
+      Seven365 staff view — {{ staffView.orgName || "Client" }}<template v-if="staffView.siteName"> · {{ staffView.siteName }}</template>
+    </span>
+    <v-spacer />
+    <v-btn
+      size="small"
+      variant="flat"
+      color="surface"
+      :loading="leaving"
+      data-test="staff-view-exit"
+      @click="exit"
+    >
+      Exit
+    </v-btn>
+  </v-system-bar>
+</template>
+
+<script setup lang="ts">
+const { staffView, loadStaffView, exitStaffView } = useStaffView();
+const { APP_ORG } = useRuntimeConfig().public;
+const leaving = ref(false);
+
+onMounted(() => {
+  loadStaffView().catch(() => undefined);
+});
+
+async function exit() {
+  leaving.value = true;
+  try {
+    const org = await exitStaffView();
+    // Back to the console page staff opened it from.
+    window.location.href = `${APP_ORG}/super-admin/client-details${org ? `?org=${org}` : ""}`;
+  } catch {
+    leaving.value = false;
+  }
+}
+</script>
+
+<style scoped>
+.staff-view-banner {
+  font-weight: 600;
+  z-index: 1010;
+}
+.staff-view-banner__text {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+</style>

package/components/TableMain.vue

@@ -59,17 +59,32 @@
             >
               {{ createLabel }}
             </v-btn>
-            <v-text-field
+            <!--
+              The design's search field. This was a `v-text-field` with only a
+              `max-width`, so inside the actions row it shrank to its minimum
+              and showed "Se" and a magnifier, at a different height and
+              border from the button beside it. Same `search` model; clearing
+              now sets "" instead of Vuetify's null.
+            -->
+            <AppField
               v-if="canSearch"
               v-model="searchInput"
-              density="compact"
+              search
               placeholder="Search"
-              clearable
-              max-width="300"
-              append-inner-icon="mdi-magnify"
-              hide-details
+              aria-label="Search"
               class="table-card__search"
-            />
+            >
+              <template v-if="searchInput" #trailing>
+                <button
+                  type="button"
+                  class="app-field__trailing"
+                  aria-label="Clear search"
+                  @click="searchInput = ''"
+                >
+                  <v-icon icon="mdi-close" size="16" />
+                </button>
+              </template>
+            </AppField>
             <!-- Ghost/secondary, as the design specifies for Scan QR Code. -->
             <v-btn
               v-if="canScanVisitorQRCode"

package/components/VisitorForm.vue

@@ -910,8 +910,20 @@ const hidQrReaderId = computed(() => (
   hidQrConfiguredReaderId.value || String(hidQrReader.value?._id || "")
 ));
 
+/*
+ * Visitor QR passes are hidden at the manager's request (2026-09-23).
+ *
+ * A flag rather than a deletion: issuing, the preview dialog, printing and the
+ * regenerate handler below are all intact and untouched, so bringing the
+ * feature back is this one line. Every surface that offers a Visitor QR reads
+ * `hidQrCodePassAllowed`, which is why the switch belongs here and not in each
+ * of them.
+ */
+const HID_VISITOR_QR_ENABLED = false;
+
 const hidQrCodePassAllowed = computed(() => {
   return (
+    HID_VISITOR_QR_ENABLED &&
     hidQrCodePassEnabled.value &&
     ["guest", "contractor", "walk-in"].includes(prop.type)
   );

package/components/VisitorManagement.vue

@@ -749,11 +749,35 @@
                 class="visitor-preview__row"
               >
                 <div class="visitor-preview__label">{{ label }}</div>
-                <div
-                  v-tooltip:top="selectedVisitorObject[key]"
-                  class="visitor-preview__value"
-                >
-                  {{ maskNRIC(selectedVisitorObject[key]) }}
+                <div>
+                  <!-- Was a hover tooltip on the value: the full NRIC only
+                       reachable by hovering, which says nothing is there to
+                       reach and cannot be reached at all on a touch screen.
+                       The eye alone, at the 14px the Incident Report screens
+                       draw it, is a 14px target - the floor is 24px. So the
+                       NUMBER is the control and the eye is its affordance:
+                       the whole masked value is pressable, which makes the
+                       target the width of the digits rather than of a glyph,
+                       and being a real `button` it also takes a tab stop,
+                       which a `v-icon` with a click handler never did. -->
+                  <button
+                    type="button"
+                    class="visitor-preview__reveal"
+                    :aria-label="showVisitorNric ? 'Hide NRIC' : 'Show NRIC'"
+                    :aria-pressed="showVisitorNric"
+                    @click="showVisitorNric = !showVisitorNric"
+                  >
+                    <span class="visitor-preview__value">
+                      {{
+                        showVisitorNric
+                          ? selectedVisitorObject[key]
+                          : maskNRIC(selectedVisitorObject[key])
+                      }}
+                    </span>
+                    <v-icon size="16" class="visitor-preview__eye">
+                      {{ showVisitorNric ? "mdi-eye-off-outline" : "mdi-eye-outline" }}
+                    </v-icon>
+                  </button>
                 </div>
               </div>
 
@@ -803,6 +827,84 @@
                 </div>
               </div>
 
+              <!--
+                THE CONTRACTOR'S PARTY.
+
+                The list row has always said `( +2 members)` beside the name
+                and then had nowhere to send you for the names themselves. The
+                block spans both columns rather than sitting in the 116px
+                value track: a member is a record, not a value, and several of
+                them in a 250px column is unreadable.
+
+                Read off `selectedVisitorDataObject` (the raw row) and not
+                `selectedVisitorObject`, which filters itself down to
+                `typeFieldMap` plus five fixed keys - `members` is on neither
+                list, and widening that computed would change what four other
+                dialogs on this screen see.
+              -->
+              <div
+                v-else-if="key === 'members' && selectedVisitorMembers.length"
+                class="visitor-preview__row visitor-preview__row--block"
+              >
+                <div class="visitor-preview__label">
+                  {{ label }} ({{ selectedVisitorMembers.length }})
+                </div>
+                <div class="visitor-preview__members">
+                  <div
+                    v-for="(member, index) in selectedVisitorMembers"
+                    :key="member?.nric || member?.name || index"
+                    class="visitor-preview__member"
+                  >
+                    <div class="visitor-preview__value">
+                      {{ member?.name || "N/A" }}
+                    </div>
+                    <template v-for="field in memberDetailFields" :key="field.key">
+                      <div
+                        v-if="member?.[field.key]"
+                        class="visitor-preview__member-line"
+                      >
+                        <span class="visitor-preview__member-key">
+                          {{ field.label }}
+                        </span>
+                        <!-- A member's NRIC is the same class of data as the
+                             visitor's, so it gets the same control. Each
+                             member reveals separately - one toggle for the
+                             whole card would show three people's NRICs to
+                             read one. -->
+                        <button
+                          v-if="field.key === 'nric'"
+                          type="button"
+                          class="visitor-preview__reveal"
+                          :aria-label="
+                            isMemberNricShown(index)
+                              ? `Hide NRIC for ${member?.name || 'this member'}`
+                              : `Show NRIC for ${member?.name || 'this member'}`
+                          "
+                          :aria-pressed="isMemberNricShown(index)"
+                          @click="toggleMemberNric(index)"
+                        >
+                          <span>
+                            {{
+                              isMemberNricShown(index)
+                                ? member.nric
+                                : maskNRIC(member.nric)
+                            }}
+                          </span>
+                          <v-icon size="16" class="visitor-preview__eye">
+                            {{
+                              isMemberNricShown(index)
+                                ? "mdi-eye-off-outline"
+                                : "mdi-eye-outline"
+                            }}
+                          </v-icon>
+                        </button>
+                        <span v-else>{{ member[field.key] }}</span>
+                      </div>
+                    </template>
+                  </div>
+                </div>
+              </div>
+
               <!-- The vehicle number, with Block on its right: the Registered
                    tab only, for someone who may add vehicles. It opens the
                    Vehicle Mgmt Block Listed form with the category taken from
@@ -2123,6 +2225,71 @@ const isSelectedVisitorPendingApproval = computed(
   () => selectedVisitorStatus.value === "pending"
 );
 
+/**
+ * The members a contractor brought with them. Not gated on the Guests tab: the
+ * list row's own `( +N members)` count is not either, and a contractor with a
+ * party has one wherever the screen shows it.
+ *
+ * Blank entries are dropped rather than drawn as an empty card - the payload
+ * carries `""` for every detail nobody filled in, so a member with no name and
+ * no details would otherwise render as a bare inset box.
+ */
+const selectedVisitorMembers = computed<Record<string, any>[]>(() => {
+  const members = selectedVisitorDataObject.value?.members;
+  if (!Array.isArray(members)) return [];
+
+  return members.filter(
+    (member: Record<string, any>) =>
+      member?.name || member?.nric || member?.contact || member?.plateNumber
+  );
+});
+
+/**
+ * WHICH NRICs ARE UNCOVERED RIGHT NOW.
+ *
+ * Per member and not per card, so revealing one person's number does not
+ * uncover the rest of the party's. Both are cleared when the dialog closes -
+ * a preview must not open on the next visitor with the last one's NRIC
+ * already showing, and it is the same `selectedVisitorId` that would carry it
+ * across if the same row were reopened.
+ */
+const showVisitorNric = ref(false);
+const shownMemberNrics = ref<number[]>([]);
+
+function isMemberNricShown(index: number) {
+  return shownMemberNrics.value.includes(index);
+}
+
+function toggleMemberNric(index: number) {
+  shownMemberNrics.value = isMemberNricShown(index)
+    ? shownMemberNrics.value.filter((x) => x !== index)
+    : [...shownMemberNrics.value, index];
+}
+
+watch(
+  () => dialog.viewVisitor,
+  (open) => {
+    if (open) return;
+    showVisitorNric.value = false;
+    shownMemberNrics.value = [];
+  }
+);
+
+/**
+ * What a member row prints under the name, in order. `plateNumber` is in here
+ * because the API returns it on `members[]` even though neither
+ * `TMemberInfo` (this package) nor `TContractorMembers` (API-core's visitor
+ * model, name and nric only) declares it - the two types have drifted from the
+ * document and from each other. Reading the key defensively costs nothing and
+ * shows the vehicle a member actually arrived in; the types are somebody's to
+ * reconcile separately.
+ */
+const memberDetailFields = [
+  { key: "nric", label: "NRIC" },
+  { key: "contact", label: "Contact" },
+  { key: "plateNumber", label: "Vehicle" },
+] as const;
+
 const formatType = (item: any) =>
   (item.deliveryType ? item.deliveryType + "-" : "") + item.type;
 
@@ -2136,6 +2303,7 @@ const formattedFields = {
   level: "Level",
   unit: "Unit",
   purpose: "Purpose",
+  members: "Members",
   checkIn: "Check In",
   snapshotEntryImage: "Entry Image",
   checkOut: "Check Out",
@@ -3142,6 +3310,100 @@ watchEffect(async () => {
   word-break: break-word;
 }
 
+/* A row whose value is a set of records rather than a value - it drops the
+   two-column grid and runs the full width of the card body. */
+.visitor-preview__row--block {
+  display: block;
+}
+
+.visitor-preview__members {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  margin-top: 8px;
+}
+
+/*
+ * An added member reads as an inset on the card it sits in - `--hover` on
+ * `--border` at the inner radius. Those are `Card/MemberInfoSummary`'s three
+ * decisions, unchanged, so a member looks the same in the preview as it does
+ * in the form that created it. Only the TYPE differs: that card still prints
+ * `<strong>Label:</strong> value`, which is the pattern this dialog just moved
+ * off, so the lines below are set on the scale rather than inherited.
+ */
+.visitor-preview__member {
+  padding: 9px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--r-inner);
+  background: var(--hover);
+}
+
+.visitor-preview__member-line {
+  display: flex;
+  gap: 8px;
+  margin-top: 3px;
+  font-size: var(--fs-breadcrumb);
+  color: var(--text2);
+  word-break: break-word;
+}
+
+.visitor-preview__member-key {
+  flex: 0 0 52px;
+  color: var(--muted);
+}
+
+/*
+ * THE NRIC REVEAL.
+ *
+ * The pressable thing is the masked number, not the glyph beside it: an eye on
+ * its own is a 14-16px target where 24px is the floor, and on a 12.5px member
+ * line an `AppButton variant="icon"` - the layer's 32px icon square - would
+ * make the NRIC line half again the height of the Contact line under it.
+ * Pressing the digits gives a target the width of the value at no cost to the
+ * rhythm, and reads the right way round: the number is what changes.
+ *
+ * It inherits its type rather than setting any, so the visitor's NRIC stays on
+ * `--fs-cell` and a member's on the `--fs-breadcrumb` of the line it sits in.
+ * The negative margin pays back the padding, so a revealed value starts on the
+ * same left edge as every other value in the card.
+ */
+.visitor-preview__reveal {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  margin: -3px -7px;
+  padding: 3px 7px;
+  border: none;
+  border-radius: var(--r-inner-sm);
+  background: transparent;
+  font: inherit;
+  color: inherit;
+  text-align: left;
+  cursor: pointer;
+  transition: background var(--motion) ease;
+}
+
+.visitor-preview__reveal:hover {
+  background: var(--hover);
+}
+
+.visitor-preview__reveal:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+
+/* The design's interactive ink - not Vuetify's fixed blue, which is one colour
+   on both themes. `affectedEntities` gives its NRIC eye the same value. */
+.visitor-preview__eye {
+  color: var(--accent-text);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .visitor-preview__reveal {
+    transition: none;
+  }
+}
+
 /* The width the type filter carried as `max-width="200"` on the v-select. */
 .visitor-type-filter {
   max-width: 200px;

package/composables/useDocument.ts

@@ -6,6 +6,7 @@ export default function useDocument() {
     type = "all",
     site = "",
     parentId = "",
+    expiry = "all",
   }: {
     page?: number;
     search?: string;
@@ -13,6 +14,11 @@ export default function useDocument() {
     type?: string;
     site?: string;
     parentId?: string;
+    /**
+     * Which tab is asking: "active" for Documents, "expired" for
+     * Document (Expired). Defaults to "all" so existing callers are unaffected.
+     */
+    expiry?: string;
   } = {}) {
     const query: Record<string, any> = {
       page,
@@ -21,6 +27,7 @@ export default function useDocument() {
       type,
       site,
       parentId,
+      expiry,
     };
 
     return useNuxtApp().$api<Record<string, any>>(`/api/documents`, {

package/composables/useFacility.ts

@@ -76,6 +76,8 @@ export default function usetFacility() {
     hourInterval?: number;
     isBookingFeeEnabled: boolean;
     isGuestEnabled: boolean;
+    isResidentChecklistEnabled: boolean;
+    isSecurityChecklistEnabled: boolean;
     bookingAmount: number | null;
     peakBookingFeeAmount?: number | null;
     bookingFeeGuestAmount?: number | null;
@@ -173,6 +175,8 @@ export default function usetFacility() {
         hourInterval = 1,
         isBookingFeeEnabled = false,
         isGuestEnabled = false,
+        isResidentChecklistEnabled = false,
+        isSecurityChecklistEnabled = false,
         bookingAmount = 0,
         peakBookingFeeAmount = 0,
         bookingFeeGuestAmount = 0,
@@ -236,6 +240,13 @@ export default function usetFacility() {
       this.hourInterval = hourInterval;
       this.isBookingFeeEnabled = isBookingFeeEnabled;
       this.isGuestEnabled = isGuestEnabled;
+      // Exactly one owner, always. `isResidentChecklistEnabled` is the flag
+      // the apps gate on, so it decides, and security is its complement —
+      // stored rather than computed so each app can read its own flag without
+      // knowing the rule. A facility predating both fields lands on security,
+      // which is how every one of them already behaved.
+      this.isResidentChecklistEnabled = isResidentChecklistEnabled === true;
+      this.isSecurityChecklistEnabled = !this.isResidentChecklistEnabled;
       this.bookingAmount = bookingAmount;
       this.peakBookingFeeAmount = peakBookingFeeAmount;
       this.bookingFeeGuestAmount = bookingFeeGuestAmount;