@7365admin1/layer-common 4.82.1-staging.475 → 4.82.1-staging.476

package/composables/useSiteActions.ts

@@ -0,0 +1,29 @@
+import { NO_SITE_ACTIONS, siteActionsOf, type TSiteActions } from "../utils/site-actions";
+
+/**
+ * May the signed-in person add / delete sites (and add organisations) in this
+ * organisation? Re-asked whenever the organisation changes; hidden until core
+ * answers. See `utils/site-actions.ts`.
+ */
+export default function useSiteActions(org: MaybeRefOrGetter<string>) {
+  const actions = ref<TSiteActions>({ ...NO_SITE_ACTIONS });
+
+  watch(
+    () => toValue(org),
+    async (id) => {
+      actions.value = { ...NO_SITE_ACTIONS };
+      if (!id) return;
+      try {
+        const res = await useNuxtApp().$api<Record<string, any>>("/api/customer-sites", {
+          query: { org: id, status: "active", limit: 1, withActions: true },
+        });
+        if (toValue(org) === id) actions.value = siteActionsOf(res);
+      } catch {
+        // stays hidden - the server refuses the action anyway
+      }
+    },
+    { immediate: true },
+  );
+
+  return actions;
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.82.1-staging.475",
+  "version": "4.82.1-staging.476",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/site-actions.ts

@@ -0,0 +1,18 @@
+/**
+ * What the signed-in person may do with an organisation's sites, as core
+ * answers it (`GET /api/customer-sites?withActions=true` -> `siteActions`).
+ *
+ * Owner rule 2026-10-01: creating, deleting or removing sites is for Seven365
+ * Super Admin, the organisation's owner and organisation-level members with the
+ * right; a member confined to sites never - whatever their role says. The
+ * server decides and refuses (403); the UI only hides what would be refused.
+ * Anything missing or unreadable reads as "no" (the button stays hidden).
+ */
+export type TSiteActions = { create: boolean; delete: boolean; createCustomer: boolean };
+
+export const NO_SITE_ACTIONS: TSiteActions = Object.freeze({ create: false, delete: false, createCustomer: false });
+
+export function siteActionsOf(response: unknown): TSiteActions {
+  const a = (response as { siteActions?: Record<string, unknown> } | null)?.siteActions ?? {};
+  return { create: a.create === true, delete: a.delete === true, createCustomer: a.createCustomer === true };
+}