@7365admin1/layer-common 4.85.0 → 4.87.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @iservice365/layer-common
 
+## 4.87.0
+
+### Minor Changes
+
+- 4be2d7c: Notification bell: robot alarms open the site's Robot alerts page, inventory alerts open their store on the right tab (Requests / Stock / My Stock), older "work-order" and "other" inventory rows route, and a click with nowhere to go now says why instead of doing nothing.
+
+## 4.86.0
+
+### Minor Changes
+
+- 4891c16: Security headers on every app (HSTS, nosniff, frame-ancestors/X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, minimal enforced CSP + full Report-Only CSP), drop `x-powered-by`, explicit `SameSite=Lax` on the session cookies, `sanitizeHtml` for rich text rendered with `v-html`, html2pdf.js 0.14 (jsPDF 4.2.1).
+
 ## 4.85.0
 
 ### Minor Changes
@@ -1980,11 +1992,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                              GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                              GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                              owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                              staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/BulletinBoardView.vue

@@ -19,7 +19,7 @@
               <v-col class="font-weight-bold">{{ label }}:</v-col>
 
               <v-col cols="9" class="px-10">
-                <span v-if="key === 'content'" v-html="getFieldValue(key)" />
+                <span v-if="key === 'content'" v-html="sanitizeHtml(getFieldValue(key))" />
                 <span v-else-if="key === 'noExpiration'">
                   <BulletinExpirationChip
                     :value="getFieldValue(key) as boolean"

package/components/InventoryMain.vue

@@ -149,6 +149,9 @@ const props = defineProps({
 });
 
 const movedFromEquipment = useRoute().query.moved === "equipment";
+// A notification link (`?storeId=&tab=`, NotificationBell): open that store on that tab, once.
+const linkQuery = useRoute().query;
+const linked = { storeId: String(linkQuery.storeId ?? ""), tab: String(linkQuery.tab ?? "") };
 
 const { getStores, createStore: apiCreateStore, getRequests, getReport } = useInventory();
 const { getSites } = useSite();
@@ -227,7 +230,10 @@ async function loadStores() {
   loadError.value = "";
   try {
     stores.value = (await getStores(props.siteId)) ?? [];
-    if (!stores.value.some((s) => s._id === storeId.value)) {
+    const fromLink = stores.value.find((s) => s._id === linked.storeId);
+    linked.storeId = "";
+    if (fromLink) storeId.value = fromLink._id;
+    else if (!stores.value.some((s) => s._id === storeId.value)) {
       // A service provider working at a property store sees it first.
       storeId.value = stores.value[0]?._id ?? "";
     }
@@ -295,7 +301,10 @@ async function createStore() {
 }
 
 watch(storeId, () => {
-  tab.value = "stock";
+  // The linked tab only when this person has it (tabs are hidden, never greyed).
+  const wanted = linked.tab;
+  linked.tab = "";
+  tab.value = wanted && tabs.value.some((t) => t.value === wanted) ? wanted : "stock";
   refreshCounts();
   probeCompanyUsage();
 });

package/components/NotificationBell.vue

@@ -127,6 +127,13 @@
         <v-btn variant="text" class="text-none" @click="viewFromToast">View</v-btn>
       </template>
     </v-snackbar>
+
+    <v-snackbar v-model="nowhere.show" location="top right" :timeout="6000" color="surface">
+      <div class="d-flex align-center ga-3">
+        <v-icon icon="mdi-information-outline" color="primary" />
+        <div class="text-body-2">{{ nowhere.text }}</div>
+      </div>
+    </v-snackbar>
   </div>
 </template>
 
@@ -137,7 +144,7 @@ import {
   timeAgo,
   type TInboxItem,
 } from "../utils/notification-inbox";
-import { appUrlsFrom, chooseNavigation, notificationTarget } from "../utils/notification-target";
+import { appUrlsFrom, chooseNavigation, noTargetMessage, notificationTarget } from "../utils/notification-target";
 
 /**
  * The top-bar notification feed for the web, in every signed-in app.
@@ -180,6 +187,8 @@ const markingAll = ref(false);
 const items = ref<Array<Record<string, any>>>([]);
 const unread = ref(0);
 const toast = reactive({ show: false, title: "", body: "" });
+/** Said when a clicked row has no page to open - a click is never a silent nothing. */
+const nowhere = reactive({ show: false, text: "" });
 
 const userId = computed(() => String(currentUser.value?._id ?? ""));
 const badgeLabel = computed(() => badgeText(unread.value));
@@ -341,7 +350,10 @@ async function goToSubject(item: Record<string, any>) {
     hasPage: hasLocalPage,
     appUrls: appUrls(),
   });
-  if (!nav) return;
+  if (!nav) {
+    Object.assign(nowhere, { show: true, text: noTargetMessage(item as any) });
+    return;
+  }
 
   open.value = false;
   if (nav.type === "href") {

package/nuxt.config.ts

@@ -1,8 +1,23 @@
 // https://nuxt.com/docs/api/configuration/nuxt-config
 import vuetify, { transformAssetUrls } from "vite-plugin-vuetify";
+import { SECURITY_HEADERS } from "./utils/security-headers";
 export default defineNuxtConfig({
   ssr: false,
   devtools: { enabled: false },
+
+  // Security headers for every app that extends this layer: the HTML shell gets
+  // them from Nitro, the static files from the `_headers` file the Cloudflare
+  // preset writes from these same rules. See utils/security-headers.ts.
+  routeRules: {
+    "/**": { headers: SECURITY_HEADERS },
+    // Stored files read with the signed-in session (API-core
+    // GET /api/files/object/<key>) instead of the public CDN. Unused until an
+    // app's API_DO_STORAGE_ENDPOINT points at /api/storage/<folder>; that switch
+    // goes with SPACES_PRIVATE_PREFIXES - see the storage runbook.
+    ...(process.env.API_CORE
+      ? { "/api/storage/**": { proxy: `${process.env.API_CORE}/api/files/object/**` } }
+      : {}),
+  },
   build: {
     transpile: ["vuetify"],
   },
@@ -48,6 +63,9 @@ export default defineNuxtConfig({
       cookieConfig: {
         domain: (process.env.DOMAIN as string) ?? "localhost",
         secure: true,
+        // Explicit, not the browser default: the API also reads `sid` from the
+        // cookie, so a cross-site form post must never carry it (CSRF).
+        sameSite: "lax",
         maxAge: 30 * 24 * 60 * 60,
       },
       APP: (process.env.APP as string) ?? "App",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.85.0",
+  "version": "4.87.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -22,6 +22,7 @@
     "pages",
     "plugins",
     "public",
+    "server",
     "services",
     "types",
     "utils",
@@ -57,8 +58,9 @@
     "@mdi/font": "^7.4.47",
     "@types/qrcode": "^1.5.6",
     "ckeditor5": "47.4.0",
+    "dompurify": "^3.3.1",
     "hls.js": "^1.6.13",
-    "html2pdf.js": "^0.10.2",
+    "html2pdf.js": "^0.14.0",
     "html5-qrcode": "^2.3.8",
     "moment-timezone": "^0.6.0",
     "nuxt-signature-pad": "^1.8.0",

package/server/plugins/no-powered-by.ts

@@ -0,0 +1,7 @@
+// Nuxt's renderer stamps `x-powered-by: Nuxt` on the HTML shell. It tells a
+// scanner the framework for free and helps nobody, so drop it.
+export default defineNitroPlugin((nitroApp) => {
+  nitroApp.hooks.hook("render:response", (response) => {
+    if (response?.headers) delete response.headers["x-powered-by"];
+  });
+});

package/utils/notification-target.ts

@@ -45,7 +45,7 @@ export type TTargetRow = {
    * (core `withNotificationKind`); `site` stands in for `siteId` on rows kept
    * unscoped on purpose. Older rows have neither and are read from `module`.
    */
-  params?: { id?: string; org?: string; kind?: string; site?: string } | null;
+  params?: { id?: string; org?: string; kind?: string; site?: string; storeId?: string } | null;
 };
 
 /** What the surrounding app knows that the stored row does not. */
@@ -127,9 +127,26 @@ export function notificationKind(item: TTargetRow | null | undefined): string {
     return "";
   }
   if (module === "other") {
-    return /(accepted|declined) your invitation$/i.test(title) ? "serviceProviderInviteAnswer" : "";
+    if (/(accepted|declined) your invitation$/i.test(title)) return "serviceProviderInviteAnswer";
+    // Inventory alerts sent before core had an inventory module were stored as "other".
+    return /request waiting|request (was )?(approved|rejected)|low (on )?stock|stock handed to you|hand-over (confirmed|declined)/i.test(title)
+      ? "inventory"
+      : "";
   }
-  return module;
+  // Older rows spelled the work order module with a hyphen.
+  return module === "work-order" ? "workOrder" : module;
+}
+
+/**
+ * Which inventory tab an alert is about. Alerts carry the store id but no tab,
+ * so the tab follows the alert's fixed title (API-core inventory-notify.service)
+ * - the same rule the mobile apps use. Values are the web tabs' own names.
+ */
+export function inventoryTabForAlert(title: string): "requests" | "stock" | "mine" | "" {
+  if (/stock handed to you|hand-over (confirmed|declined)/i.test(title)) return "mine";
+  if (/request waiting|request (was )?(approved|rejected)/i.test(title)) return "requests";
+  if (/low (on )?stock/i.test(title)) return "stock";
+  return "";
 }
 
 /**
@@ -182,6 +199,8 @@ const SITE_PAGES: Record<string, TSitePage[]> = {
     { apps: ["security"], page: () => "virtual-patrol/cctv" },
     { apps: ["property-management"], page: () => "cctv" },
   ],
+  // A robot at the site raised an alarm (core safety alert, category robotAlert).
+  robotAlert: [{ apps: ["security", "property-management", "hygiene"], page: () => "robot-management/alerts" }],
   // hygiene has its Service Providers page too since 2026-09-28
   serviceProviderInviteAnswer: [{ apps: SERVICE_APPS, page: () => "service-providers" }],
 };
@@ -214,7 +233,12 @@ function sitePageTarget(
     const list = apps === "any" ? [home, ...SERVICE_APPS.filter((a) => a !== home)] : apps;
     for (const app of list) candidates.push({ app, path: base + page(id) });
   }
-  return { candidates };
+  if (kind !== "inventory") return { candidates };
+  // Open the alert's own store on the tab it is about (InventoryMain reads ?storeId=&tab=).
+  const storeId = String(item.params?.storeId ?? item.params?.id ?? "").trim();
+  const tab = inventoryTabForAlert(String(item.title ?? ""));
+  const query: Record<string, string> = { ...(storeId ? { storeId } : {}), ...(tab ? { tab } : {}) };
+  return Object.keys(query).length ? { candidates, query } : { candidates };
 }
 
 /** Seven365 staff pages, in the organisation app. */
@@ -294,6 +318,21 @@ export function notificationTarget(
   };
 }
 
+/** Kinds that only the iService365 phone apps can open (residents' own screens). */
+const PHONE_ONLY_KINDS = new Set(["prelovedMarketplace", "marketplace-order"]);
+
+/**
+ * What the bell says when a click has nowhere to go, so a click is never a
+ * silent nothing. A link grants nothing either way: the page opened still
+ * checks the person may see it.
+ */
+export function noTargetMessage(item: TTargetRow | null | undefined): string {
+  if (PHONE_ONLY_KINDS.has(notificationKind(item))) {
+    return "This notification opens in the iService365 app on your phone.";
+  }
+  return "There is no page to open for this notification here. It has been marked as read.";
+}
+
 /**
  * The full URL for a target whose page lives in another web app, or "" when
  * there is none to build (no path, or that app's URL is not configured).

package/utils/sanitize-html.ts

@@ -0,0 +1,16 @@
+import DOMPurify from "dompurify";
+
+/**
+ * The one way rich text typed by a user (announcements, facility descriptions,
+ * policies) reaches `v-html`. Keeps formatting, drops scripts, event handlers,
+ * `javascript:` links and embedded frames/forms. Browser-only (the apps are
+ * `ssr: false`); without a DOM it returns "" rather than unsanitised HTML.
+ */
+export function sanitizeHtml(html: unknown): string {
+  if (html === null || html === undefined || html === "") return "";
+  if (typeof window === "undefined" || !DOMPurify.isSupported) return "";
+  return DOMPurify.sanitize(String(html), {
+    USE_PROFILES: { html: true },
+    FORBID_TAGS: ["style", "form", "input", "button", "iframe", "object", "embed"],
+  });
+}

package/utils/security-headers.ts

@@ -0,0 +1,52 @@
+/**
+ * Response headers every web app sends, on the HTML shell (Nitro route rules)
+ * and on the static files (nitro writes the same rules into Cloudflare's
+ * `_headers`). One list, so the eleven apps cannot drift apart.
+ *
+ * The ENFORCED Content-Security-Policy only carries the directives that cannot
+ * break a screen: who may frame us (clickjacking), no plugins, no <base> swap.
+ * The full policy ships as Report-Only first: the apps load Google Fonts,
+ * camera players and documents in iframes, sockets and the Spaces CDN, and a
+ * wrong guess there blanks a page. Violations show in the browser console;
+ * once a release runs clean, move it to the enforced header.
+ *
+ * HSTS deliberately has no `preload`: preload is decided for the whole
+ * iservice365.org domain at the apex and is hard to undo (owner/leads action).
+ */
+export const CSP_ENFORCED = [
+  "frame-ancestors 'self'",
+  "object-src 'none'",
+  "base-uri 'self'",
+].join("; ");
+
+export const CSP_REPORT_ONLY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+  "font-src 'self' data: https://fonts.gstatic.com",
+  "img-src 'self' data: blob: https:",
+  "media-src 'self' blob: https:",
+  "connect-src 'self' https: wss:",
+  "frame-src 'self' https:",
+  "worker-src 'self' blob:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'self'",
+  "form-action 'self' https:",
+  "upgrade-insecure-requests",
+].join("; ");
+
+export const SECURITY_HEADERS: Record<string, string> = {
+  "strict-transport-security": "max-age=31536000; includeSubDomains",
+  "x-content-type-options": "nosniff",
+  "x-frame-options": "SAMEORIGIN",
+  "referrer-policy": "strict-origin-when-cross-origin",
+  // camera/mic: QR scan, photo capture; geolocation: attendance;
+  // usb/serial/hid: card readers (useWebUsb). Everything else is off.
+  "permissions-policy":
+    "camera=(self), microphone=(self), geolocation=(self), usb=(self), serial=(self), hid=(self), payment=(self), display-capture=(self), bluetooth=(), midi=(), magnetometer=(), gyroscope=(), accelerometer=()",
+  // allow-popups: payment and document windows we open keep working.
+  "cross-origin-opener-policy": "same-origin-allow-popups",
+  "content-security-policy": CSP_ENFORCED,
+  "content-security-policy-report-only": CSP_REPORT_ONLY,
+};