@7365admin1/layer-common 4.82.1-staging.475 → 4.83.0

package/composables/useAttendancePermission.ts

@@ -57,30 +57,6 @@ export function useAttendancePermission() {
     );
   });
 
-  // Site device mode switch. Widened, never swapped: the new key OR the existing
-  // settings key OR `*` - the same three the server accepts (core
-  // `SITE_DEVICE_MODE_PERMISSIONS`), so an admin who manages attendance
-  // settings today can use it without a role change.
-  const canManageSiteDeviceMode = computed(() => {
-    if (!userAppRole.value) return false;
-    if (moduleDenied("attendance-mgmt")) return false;
-    if (userAppRole.value.permissions.includes("*")) return true;
-    return (
-      hasPermission(
-        userAppRole.value,
-        permissions,
-        "attendance-mgmt",
-        "manage-site-device-mode"
-      ) ||
-      hasPermission(
-        userAppRole.value,
-        permissions,
-        "attendance-mgmt",
-        "manage-attendance-settings"
-      )
-    );
-  });
-
   const canViewOwnAttendance = computed(() => {
     if (!userAppRole.value) return false;
     if (moduleDenied("my-attendance")) return false;
@@ -109,7 +85,6 @@ export function useAttendancePermission() {
     canViewAllAttendance,
     canViewAttendanceDetails,
     canManageAttendanceSettings,
-    canManageSiteDeviceMode,
     canViewOwnAttendance,
     canCheckInOut,
   };

package/composables/useCleaningPermission.ts

@@ -221,11 +221,6 @@ export default function useCleaningPermission() {
         description:
           "Allows the user to configure and manage attendance settings.",
       },
-      "manage-site-device-mode": {
-        check: true,
-        description:
-          "Allows the user to turn Site device mode on or off: one shared phone at the site checks staff in and out with a photo, their name and the last 4 characters of their NRIC.",
-      },
     },
     // my attendance permissions
     "my-attendance": {

package/composables/useDocument.ts

@@ -6,7 +6,6 @@ export default function useDocument() {
     type = "all",
     site = "",
     parentId = "",
-    expiry = "all",
   }: {
     page?: number;
     search?: string;
@@ -14,11 +13,6 @@ export default function useDocument() {
     type?: string;
     site?: string;
     parentId?: string;
-    /**
-     * Which tab is asking: "active" for Documents, "expired" for
-     * Document (Expired). Defaults to "all" so existing callers are unaffected.
-     */
-    expiry?: string;
   } = {}) {
     const query: Record<string, any> = {
       page,
@@ -27,7 +21,6 @@ export default function useDocument() {
       type,
       site,
       parentId,
-      expiry,
     };
 
     return useNuxtApp().$api<Record<string, any>>(`/api/documents`, {

package/composables/useFacility.ts

@@ -76,8 +76,6 @@ export default function usetFacility() {
     hourInterval?: number;
     isBookingFeeEnabled: boolean;
     isGuestEnabled: boolean;
-    isResidentChecklistEnabled: boolean;
-    isSecurityChecklistEnabled: boolean;
     bookingAmount: number | null;
     peakBookingFeeAmount?: number | null;
     bookingFeeGuestAmount?: number | null;
@@ -175,8 +173,6 @@ export default function usetFacility() {
         hourInterval = 1,
         isBookingFeeEnabled = false,
         isGuestEnabled = false,
-        isResidentChecklistEnabled = false,
-        isSecurityChecklistEnabled = false,
         bookingAmount = 0,
         peakBookingFeeAmount = 0,
         bookingFeeGuestAmount = 0,
@@ -240,13 +236,6 @@ export default function usetFacility() {
       this.hourInterval = hourInterval;
       this.isBookingFeeEnabled = isBookingFeeEnabled;
       this.isGuestEnabled = isGuestEnabled;
-      // Exactly one owner, always. `isResidentChecklistEnabled` is the flag
-      // the apps gate on, so it decides, and security is its complement —
-      // stored rather than computed so each app can read its own flag without
-      // knowing the rule. A facility predating both fields lands on security,
-      // which is how every one of them already behaved.
-      this.isResidentChecklistEnabled = isResidentChecklistEnabled === true;
-      this.isSecurityChecklistEnabled = !this.isResidentChecklistEnabled;
       this.bookingAmount = bookingAmount;
       this.peakBookingFeeAmount = peakBookingFeeAmount;
       this.bookingFeeGuestAmount = bookingFeeGuestAmount;

package/composables/useHidAmico.ts

@@ -28,22 +28,6 @@ export type HidReaderPayload = {
   lastCallbackType?: string;
 };
 
-export type HidProfileQr = {
-  readerId: string;
-  userId: string;
-  memberId: string;
-  hidUserId: string;
-  registration: string;
-  readerName: string;
-  portalName: string;
-  qrEnabled: boolean;
-  issued: boolean;
-  qrValue: string;
-  issuedAt: string;
-  /** null when the permission lookup itself failed, so "unknown" stays distinct from "no". */
-  assigned: boolean | null;
-};
-
 type HidIdentityPayload = {
   site?: string;
   hidUserId?: string | number;
@@ -155,28 +139,6 @@ export type HidSipAccountData = {
   provisionedAt: string;
 };
 
-/** One row of the site's SIP account list - who owns the extension, never its password. */
-export type HidSipAccountListItem = {
-  _id: string;
-  userId: string;
-  name: string;
-  email: string;
-  /**
-   * What the owner is called after their name on the contact list: their
-   * "Blk 1/Level 1/Unit 1" when they live here, and their membership type -
-   * "Security Agency" - when they do not. "" only when the site knows neither.
-   *
-   * Optional because an API still on the `@7365admin1/core` release that
-   * predates it answers without the field; the contact picker falls back to the
-   * bare name rather than showing a dangling separator.
-   */
-  unitLabel?: string;
-  extension: string;
-  username: string;
-  status: string;
-  provisionedAt: string;
-};
-
 /**
  * True only for the specific validation error an API that predates core #1878
  * returns when the discover body carries `site`. Deliberately narrow: after
@@ -204,36 +166,6 @@ export default function useHidAmico() {
     });
   }
 
-  /**
-   * The signed-in member's own QR code on one reader.
-   *
-   * No user id in the path: the server takes the caller from the session, so
-   * these cannot be pointed at somebody else. `assigned` in the response says
-   * whether the HID permissions screen actually admits this member to the
-   * reader - issuing a code does not grant access, and the screen has to be
-   * able to say so.
-   */
-  function getProfileQr(readerId: string) {
-    return useNuxtApp().$api<{ data: HidProfileQr }>(
-      `${basePath}/readers/${readerId}/profile-qr`,
-      { method: "GET" },
-    );
-  }
-
-  function issueProfileQr(readerId: string) {
-    return useNuxtApp().$api<{ data: HidProfileQr }>(
-      `${basePath}/readers/${readerId}/profile-qr`,
-      { method: "POST" },
-    );
-  }
-
-  function deleteProfileQr(readerId: string) {
-    return useNuxtApp().$api<{ data: HidProfileQr }>(
-      `${basePath}/readers/${readerId}/profile-qr`,
-      { method: "DELETE" },
-    );
-  }
-
   function createReader(payload: HidReaderPayload) {
     return useNuxtApp().$api<HidApiRecord>(`${basePath}/readers`, {
       method: "POST",
@@ -325,36 +257,6 @@ export default function useHidAmico() {
     });
   }
 
-  /**
-   * Which credentials a reader accepts at the door.
-   *
-   * Separate from `setReaderConfiguration` on purpose. That one is the generic
-   * configuration endpoint, gated by an allowlist of writable objects; this is
-   * a dedicated route that validates the four methods against the reader's own
-   * `capabilities` and confirms the write by reading the device back, so a
-   * refusal here names the credential the hardware would not take.
-   */
-  function setReaderIdentificationMethods(readerId: string, payload: HidApiRecord) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/identification-methods`,
-      { method: "PUT", body: payload },
-    );
-  }
-
-  /**
-   * Put a reader back to the settings iService holds for it.
-   *
-   * A POST rather than a GET because it WRITES: reading the reader's
-   * configuration is only the first half, and anything that drifted is
-   * re-applied before this returns.
-   */
-  function reconcileReaderIdentificationMethods(readerId: string) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/identification-methods/reconcile`,
-      { method: "POST" },
-    );
-  }
-
   function getIdentities(readerId: string, query: HidApiRecord = {}) {
     return useNuxtApp().$api<HidApiRecord>(`${basePath}/readers/${readerId}/identities`, {
       method: "GET",
@@ -512,27 +414,6 @@ export default function useHidAmico() {
     );
   }
 
-  function getUserPasswordStatus(readerId: string, hidUserId: string | number) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/users/${hidUserId}/password`,
-      { method: "GET" },
-    );
-  }
-
-  function setUserPassword(readerId: string, hidUserId: string | number, password: string) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/users/${hidUserId}/password`,
-      { method: "PUT", body: { password } },
-    );
-  }
-
-  function deleteUserPassword(readerId: string, hidUserId: string | number) {
-    return useNuxtApp().$api<HidApiRecord>(
-      `${basePath}/readers/${readerId}/users/${hidUserId}/password`,
-      { method: "DELETE" },
-    );
-  }
-
   function deleteUserPin(readerId: string, hidUserId: string | number) {
     return useNuxtApp().$api<{ data: { pinEnrolled: boolean } }>(
       `${basePath}/readers/${readerId}/users/${hidUserId}/pin`,
@@ -593,42 +474,6 @@ export default function useHidAmico() {
     );
   }
 
-  /**
-   * The site's SIP accounts for the intercom contact picker. Site-scoped only:
-   * the organisation never decided who may read this — the site guard does —
-   * and sending one narrowed the list on a customer site whose accounts were
-   * provisioned by a managing agent.
-   */
-  function getSipAccounts(siteId: string) {
-    return useNuxtApp().$api<{ data: HidSipAccountListItem[] }>(
-      `${basePath}/sites/${siteId}/intercom/sip-accounts`,
-      { method: "GET" },
-    );
-  }
-
-  /**
-   * Wake the resident's phone for a call the web phone has just placed.
-   *
-   * The SIP INVITE is the call and travels over the WebSocket, not through the
-   * API; this only rings the resident's mobile so somebody is there to answer
-   * it. It is therefore fired after the INVITE and never awaited in a way that
-   * could fail the call — see `startWebCall` in `HidIntercomManagement.vue`.
-   *
-   * `notified: false` with a reason is a normal response, not an error: staff
-   * extensions and external SIP addresses have no resident behind them.
-   */
-  function notifyIntercomCall(
-    siteId: string,
-    payload: { orgId: string; destination: string; callId: string; readerId?: string },
-  ) {
-    return useNuxtApp().$api<{
-      data: { notified: boolean; delivered?: number; reason?: string };
-    }>(
-      `${basePath}/sites/${siteId}/intercom/notify-call`,
-      { method: "POST", body: payload },
-    );
-  }
-
   function getPermissionCandidates(
     siteId: string,
     query: {
@@ -660,9 +505,6 @@ export default function useHidAmico() {
 
   return {
     getReaders,
-    getProfileQr,
-    issueProfileQr,
-    deleteProfileQr,
     discoverReader,
     createReader,
     updateReader,
@@ -677,8 +519,6 @@ export default function useHidAmico() {
     issueVisitorQr,
     getReaderConfiguration,
     setReaderConfiguration,
-    setReaderIdentificationMethods,
-    reconcileReaderIdentificationMethods,
     getLogs,
     setUserImage,
     deleteUserImage,
@@ -690,9 +530,6 @@ export default function useHidAmico() {
     getUserPinStatus,
     setUserPin,
     deleteUserPin,
-    getUserPasswordStatus,
-    setUserPassword,
-    deleteUserPassword,
     getIdentities,
     getReaderUsers,
     getReaderAccessLogs,
@@ -703,8 +540,6 @@ export default function useHidAmico() {
     makeIntercomCall,
     finalizeIntercomCall,
     ensureSipAccount,
-    getSipAccounts,
-    notifyIntercomCall,
     getSitePermissions,
     getPermissionCandidates,
     updateSitePermissions,

package/composables/useHidNavigation.ts

@@ -46,33 +46,9 @@ export default function useHidNavigation() {
           },
         },
         {
-          // "HID Reader Users" now points at `access-mgmt/administrator`, not at
-          // `access-mgmt/hid-users`.
-          //
-          // Both routes mount a roster of the reader's users, but only this one
-          // can act on them. `administrator` renders HidUserEnrollment WITHOUT
-          // `card-management`, and that prop is what gates the Enroll action:
-          //   <template v-if="!props.cardManagement" #actions>
-          // `hid-users` renders HidReaderUserRoster, which is read-only apart
-          // from PIN management. So the menu entry with this name used to lead
-          // to the screen that cannot enrol, while the screen that can was
-          // reachable only by typing the URL.
-          //
-          // `hid-users` is left in place and simply unlisted - the same state
-          // `administrator` was in - so any existing link to it still resolves.
           title: "HID Reader Users",
           route: {
-            name: "org-site-access-mgmt-administrator",
-            params: { org, site },
-          },
-        },
-        {
-          // The signed-in member's own pass, not somebody else's. Every other
-          // entry in this group acts on a resident or a visitor; this one has
-          // no subject but the caller.
-          title: "HID QR Code",
-          route: {
-            name: "org-site-access-mgmt-hid-qr-code",
+            name: "org-site-access-mgmt-hid-users",
             params: { org, site },
           },
         },

package/composables/useLandscapingPermission.ts

@@ -198,11 +198,6 @@ export default function useLandscapingPermission() {
         check: true,
         description: "Allows the user to configure and manage attendance settings.",
       },
-      "manage-site-device-mode": {
-        check: true,
-        description:
-          "Allows the user to turn Site device mode on or off: one shared phone at the site checks staff in and out with a photo, their name and the last 4 characters of their NRIC.",
-      },
     },
     // my attendance permissions
     "my-attendance": {

package/composables/useMember.ts

@@ -70,8 +70,6 @@ export default function useMember() {
     status = "active",
     siteId = "",
     roleState = "",
-    /** A building unit id, or "none": members on no unit yet. */
-    unit = "",
     people = false,
   } = {}) {
     const query: Record<string, any> = { page, limit, type, status };
@@ -85,7 +83,6 @@ export default function useMember() {
     if (user) query.user = user;
     if (org) query.org = org;
     if (siteId) query.siteId = siteId;
-    if (unit) query.unit = unit;
     return useNuxtApp().$api<Record<string, any>>("/api/members", {
       method: "GET",
       query,
@@ -161,14 +158,6 @@ export default function useMember() {
     });
   }
 
-  /** Attach a member to a building unit, or detach them (`unit` ""). */
-  function updateMemberUnit(id: string, unit: string) {
-    return useNuxtApp().$api<Record<string, any>>("/api/members/unit", {
-      method: "PUT",
-      body: { id, unit },
-    });
-  }
-
   function getByUserTypeOrg(user: string, type: string, org: string) {
     return useNuxtApp().$api<TMember>(
       `/api/members/user/${user}/app/${type}/org`,
@@ -237,7 +226,6 @@ export default function useMember() {
     undoCrossSiteRoleFix,
     getSiteAccess,
     saveSiteAccess,
-    updateMemberUnit,
     members,
     member,
     page,

package/composables/usePeople.ts

@@ -115,24 +115,6 @@ export default function () {
     });
   }
 
-  /**
-   * The blocks, levels and units at a site that actually have an occupant.
-   * The other half of the unit picker: this narrows the cascade, then
-   * `getPeopleByUnit` answers "which person in this unit?".
-   */
-  async function getOccupiedStructure(
-    site: string,
-    { type = "", status = "active", block = "", level = "" } = {}
-  ) {
-    return await useNuxtApp().$api<Record<string, any>>(
-      `/api/people/site/${site}/occupied-structure`,
-      {
-        method: "GET",
-        query: { type, status, block, level },
-      }
-    );
-  }
-
   async function getPeopleByUnit(
     _id: string,
     { status = "active", type = "" } = {}
@@ -166,7 +148,6 @@ export default function () {
     findPersonByPlateNumberMultipleResult,
     findPersonByContact,
     getPeopleByUnit,
-    getOccupiedStructure,
     searchCompanyList,
     findUsersByPlateNumber,
     reviewResidentPerson,

package/composables/usePestControlPermission.ts

@@ -213,11 +213,6 @@ export default function usePestControlPermission() {
         check: true,
         description: "Allows the user to configure and manage attendance settings.",
       },
-      "manage-site-device-mode": {
-        check: true,
-        description:
-          "Allows the user to turn Site device mode on or off: one shared phone at the site checks staff in and out with a photo, their name and the last 4 characters of their NRIC.",
-      },
     },
     // my attendance permissions
     "my-attendance": {

package/composables/usePoolMaintenancePermission.ts

@@ -213,11 +213,6 @@ export default function usePoolMaintenancePermission() {
         check: true,
         description: "Allows the user to configure and manage attendance settings.",
       },
-      "manage-site-device-mode": {
-        check: true,
-        description:
-          "Allows the user to turn Site device mode on or off: one shared phone at the site checks staff in and out with a photo, their name and the last 4 characters of their NRIC.",
-      },
     },
     // my attendance permissions
     "my-attendance": {

package/composables/useSecurityPermission.ts

@@ -491,11 +491,6 @@ export default function useSecurityPermission() {
         description:
           "Allows the user to configure and manage attendance settings.",
       },
-      "manage-site-device-mode": {
-        check: true,
-        description:
-          "Allows the user to turn Site device mode on or off: one shared phone at the site checks staff in and out with a photo, their name and the last 4 characters of their NRIC.",
-      },
     },
 
     "my-attendance": {

package/composables/useServiceProvider.ts

@@ -15,16 +15,6 @@ export type TSiteProviderMember = {
   lastLoginAt?: string | null;
   /** a subcontractor: the provider that brought its company onto the site */
   invitedVia?: string;
-  /** The building unit this person is attached to (a unit's Management tab). */
-  unit?: string | null;
-  unitName?: string;
-  /**
-   * The person's user account. NOT yet returned by the endpoint — the
-   * repository projects it but the service layer drops it. Anything acting on
-   * the PERSON (assigning an access card writes it onto the card as `userId`)
-   * needs this rather than `_id`, which identifies the membership.
-   */
-  user?: string | null;
 };
 
 export type TSiteProviderCompany = {
@@ -100,8 +90,6 @@ export default function useServiceProvider() {
     status = "",
     /** "engagements": also providers engaged through an accepted invitation. */
     include = "",
-    /** A building unit id, or "none": providers on no unit yet. */
-    unit = "",
   } = {}) {
     return useNuxtApp().$api<Record<string, any>>("/api/service-providers", {
       method: "GET",
@@ -114,7 +102,6 @@ export default function useServiceProvider() {
         siteId,
         ...(status ? { status } : {}),
         ...(include ? { include } : {}),
-        ...(unit ? { unit } : {}),
       },
     });
   }
@@ -282,17 +269,6 @@ export default function useServiceProvider() {
     );
   }
 
-  /** Attach a provider to a building unit, or detach it (`unit` ""). */
-  async function updateUnit(id: string, unit: string) {
-    return useNuxtApp().$api<Record<string, any>>(
-      `/api/service-providers/${id}/unit`,
-      {
-        method: "PATCH",
-        body: { unit },
-      }
-    );
-  }
-
    async function getByEmail({
     email = "",
     orgId = "",
@@ -317,29 +293,17 @@ export default function useServiceProvider() {
    * Members > Service Providers: the provider people with access to this
    * site, and one entry per provider company with its head count. The
    * site's own organisation only - the server refuses anyone else.
-   * `unit`: a building unit id, or "none" (people on no unit yet).
    */
-  function getSiteMembers(siteId: string, unit = ""): Promise<{
+  function getSiteMembers(siteId: string): Promise<{
     items: TSiteProviderMember[];
     companies: TSiteProviderCompany[];
   }> {
     return useNuxtApp().$api("/api/service-providers/site-members", {
       method: "GET",
-      query: { siteId, ...(unit ? { unit } : {}) },
+      query: { siteId },
     });
   }
 
-  /** Attach one of those people to a building unit, or detach them (`unit` ""). */
-  function updateSiteMemberUnit(id: string, unit: string) {
-    return useNuxtApp().$api<Record<string, any>>(
-      `/api/service-providers/site-members/${id}/unit`,
-      {
-        method: "PATCH",
-        body: { unit },
-      }
-    );
-  }
-
   /** The same list as an Excel file, under the same filters. */
   function exportSiteMembers(
     siteId: string,
@@ -356,7 +320,6 @@ export default function useServiceProvider() {
 
   return {
     getSiteMembers,
-    updateSiteMemberUnit,
     exportSiteMembers,
     serviceProviders,
     serviceProvider,
@@ -375,7 +338,6 @@ export default function useServiceProvider() {
     add,
     addViaInvite,
     updateStatus,
-    updateUnit,
     getByEmail,
   };
 }

package/constants/permissions.ts

@@ -206,7 +206,6 @@ export const PERMISSIONS = {
     "see-all-attendance",
     "see-attendance-details",
     "manage-attendance-settings",
-    "manage-site-device-mode",
   ],
   "my-attendance": ["see-own-attendance", "check-in-out"],
   toilet_locations: ["create-toilet-location"],

package/nuxt.config.ts

@@ -1,23 +1,8 @@
 // https://nuxt.com/docs/api/configuration/nuxt-config
 import vuetify, { transformAssetUrls } from "vite-plugin-vuetify";
-import { SECURITY_HEADERS } from "./utils/security-headers";
 export default defineNuxtConfig({
   ssr: false,
   devtools: { enabled: false },
-
-  // Security headers for every app that extends this layer: the HTML shell gets
-  // them from Nitro, the static files from the `_headers` file the Cloudflare
-  // preset writes from these same rules. See utils/security-headers.ts.
-  routeRules: {
-    "/**": { headers: SECURITY_HEADERS },
-    // Stored files read with the signed-in session (API-core
-    // GET /api/files/object/<key>) instead of the public CDN. Unused until an
-    // app's API_DO_STORAGE_ENDPOINT points at /api/storage/<folder>; that switch
-    // goes with SPACES_PRIVATE_PREFIXES - see the storage runbook.
-    ...(process.env.API_CORE
-      ? { "/api/storage/**": { proxy: `${process.env.API_CORE}/api/files/object/**` } }
-      : {}),
-  },
   build: {
     transpile: ["vuetify"],
   },
@@ -63,9 +48,6 @@ export default defineNuxtConfig({
       cookieConfig: {
         domain: (process.env.DOMAIN as string) ?? "localhost",
         secure: true,
-        // Explicit, not the browser default: the API also reads `sid` from the
-        // cookie, so a cross-site form post must never carry it (CSRF).
-        sameSite: "lax",
         maxAge: 30 * 24 * 60 * 60,
       },
       APP: (process.env.APP as string) ?? "App",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.82.1-staging.475",
+  "version": "4.83.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -22,7 +22,6 @@
     "pages",
     "plugins",
     "public",
-    "server",
     "services",
     "types",
     "utils",
@@ -58,9 +57,8 @@
     "@mdi/font": "^7.4.47",
     "@types/qrcode": "^1.5.6",
     "ckeditor5": "47.4.0",
-    "dompurify": "^3.3.1",
     "hls.js": "^1.6.13",
-    "html2pdf.js": "^0.14.0",
+    "html2pdf.js": "^0.10.2",
     "html5-qrcode": "^2.3.8",
     "moment-timezone": "^0.6.0",
     "nuxt-signature-pad": "^1.8.0",

package/pages/[org]/[site]/access-mgmt/administrator/index.vue

@@ -5,7 +5,7 @@
       :org="orgId"
       message="Enable HID as a service for this site before managing HID users."
     >
-      <HidUserEnrollment :site="siteId" :org="orgId" />
+      <HidUserEnrollment :site="siteId" />
     </HidEnabledGate>
   </v-container>
 </template>