@7365admin1/layer-common 4.83.0 → 4.84.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.84.0
+
+### Minor Changes
+
+- 57abba1: Suspended access: when the API answers ACCESS_SUSPENDED (every membership of the person is suspended), the app signs out and the sign-in page shows the server's message. Role names are unique per site, so role pickers and the roles table show "Admin · St. Regis Residences" (`roleLabel`), and the Members role chip uses the same "Role · Site" form.
+
 ## 4.83.0
 
 ### Minor Changes
@@ -1968,11 +1974,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                      GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                      GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                        GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                        GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                      owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                      staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                        owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                        staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/MemberMain.vue

@@ -374,7 +374,7 @@
                       v-model="selectedRole"
                       :items="pickerRoles"
                       item-value="_id"
-                      item-title="name"
+                      :item-title="roleLabel"
                       density="comfortable"
                       :rules="[requiredRule]"
                       :error-messages="
@@ -427,6 +427,7 @@ import {
   safeReturnTo,
   limitedSites,
   withCurrentRole,
+  roleLabel,
 } from "../utils/role";
 import { formatLastActive } from "../utils/last-active";
 import { formatMemberDate, memberAccess, memberPerson } from "../utils/member-row";

package/components/RolePermissionMain.vue

@@ -58,6 +58,8 @@
             else. Two kinds share that list and they are governed differently,
             so the row has to say which it is.
           -->
+          <!-- "Admin · St. Regis Residences": names are unique per site (2026-10-01) -->
+          <template #item.name="{ item }">{{ roleLabel(item) }}</template>
           <template #item.scope="{ item }">
             <StatusChip
               :dot="false"
@@ -164,7 +166,7 @@
                 <v-select
                   v-model="memberReassignments[member._id]"
                   :items="deletionPreview.replacementRoles"
-                  item-title="name"
+                  :item-title="roleLabel"
                   item-value="_id"
                   label="Reassign role"
                   density="comfortable"
@@ -204,7 +206,7 @@
 
 <script setup lang="ts">
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
-import { safeReturnTo, showSiteField } from "../utils/role";
+import { roleLabel, safeReturnTo, showSiteField } from "../utils/role";
 import { holdsPermission } from "../utils/permission-spellings";
 import {
   catalogueForOrg,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.83.0",
+  "version": "4.84.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/plugins/API.ts

@@ -1,7 +1,9 @@
 import { isPermissionRefusal } from "../utils/permission-refusal";
+import { accessSuspendedMessage, SIGNIN_NOTICE_COOKIE } from "../utils/access-suspended";
 
 export default defineNuxtPlugin((nuxtApp) => {
   const { cookieConfig } = useRuntimeConfig().public;
+  let signingOut = false;
 
   const api = $fetch.create({
     baseURL: "/",
@@ -32,6 +34,20 @@ export default defineNuxtPlugin((nuxtApp) => {
     // 401 + "You do not have permission ..." (vehicle writes and every other
     // `requireSiteReach` gate). See utils/permission-refusal.ts.
     onResponseError({ response }) {
+      // Every membership suspended (2026-10-01): the server already ended the
+      // session. Sign out here and let the sign-in page say why, once.
+      const suspended = accessSuspendedMessage((response as any)?._data);
+      if (suspended && import.meta.client && !signingOut) {
+        signingOut = true;
+        void nuxtApp.runWithContext(() => {
+          useCookie(SIGNIN_NOTICE_COOKIE, { ...cookieConfig, maxAge: 300 }).value = suspended;
+          for (const name of ["sid", "user", "organization"]) useCookie(name, cookieConfig).value = null;
+          const { APP_MAIN, APP_NAME } = useRuntimeConfig().public as Record<string, string>;
+          if (String(APP_NAME ?? "").toLowerCase() === "main" || !APP_MAIN) return navigateTo("/sign-in");
+          window.location.href = `${APP_MAIN}/sign-in`;
+        });
+        return;
+      }
       if (!isPermissionRefusal(response?.status, (response as any)?._data)) return;
       if (!import.meta.client) return;
       const refresh = (nuxtApp as any).$refreshAppRole;

package/utils/access-suspended.ts

@@ -0,0 +1,18 @@
+/**
+ * Suspended = no access (owner 2026-10-01). When every membership of the
+ * signed-in person is suspended the API answers any request with 401 +
+ * `code: "ACCESS_SUSPENDED"` and the message "Your access has been suspended
+ * by <org>. Contact your administrator." (core `suspendedSessionGuard`). The
+ * session is already dead server-side; the app signs out and the sign-in page
+ * (web-app-main) shows the message once, from this cookie.
+ */
+export const ACCESS_SUSPENDED_CODE = "ACCESS_SUSPENDED";
+export const SIGNIN_NOTICE_COOKIE = "signin-notice";
+
+export function accessSuspendedMessage(data: unknown): string | null {
+  const body = data as { code?: unknown; message?: unknown } | null | undefined;
+  if (body?.code !== ACCESS_SUSPENDED_CODE) return null;
+  return typeof body.message === "string" && body.message
+    ? body.message
+    : "Your access has been suspended. Contact your administrator.";
+}

package/utils/role.ts

@@ -9,6 +9,19 @@
 export const showSiteField = (siteState: boolean, type: string): boolean =>
   siteState && type !== "admin";
 
+/**
+ * A role's name with its site, "Admin · St. Regis Residences" (owner
+ * 2026-10-01: role names are unique per SITE, so two sites may both have an
+ * "Admin" - two independent roles - and every list that can show both must
+ * say which is which). Organisation-level roles (no site) show the name alone.
+ * `siteName` comes from the role list (`GET /api/roles`, core 2026-10-01).
+ */
+export function roleLabel(role: { name?: unknown; siteName?: unknown; site?: unknown } | null | undefined): string {
+  const name = typeof role?.name === "string" ? role.name : "";
+  const site = typeof role?.siteName === "string" ? role.siteName.trim() : "";
+  return role?.site && site ? `${name} · ${site}` : name;
+}
+
 /**
  * The Assign Role picker's list, with the member's CURRENT role always in it.
  *
@@ -50,13 +63,13 @@ export function memberRoleChip(
   const limited = limitedSites(item);
   if (orgLevel && limited.length) {
     return {
-      text: limited.map((l) => `${l.roleName || "No role"} (${l.siteName || "a site"})`).join(", "),
+      text: limited.map((l) => `${l.roleName || "No role"} · ${l.siteName || "a site"}`).join(", "),
       tone: "info",
     };
   }
   if (orgLevel && item?.roleState === "other-site") {
     const site = typeof item?.roleSiteName === "string" && item.roleSiteName ? item.roleSiteName : "";
-    return { text: site ? `${name || "Role"} (${site})` : name || "Role", tone: "info" };
+    return { text: site ? `${name || "Role"} · ${site}` : name || "Role", tone: "info" };
   }
   switch (item?.roleState) {
     case "missing":