@7365admin1/layer-common 4.87.0 → 4.88.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.88.0
+
+### Minor Changes
+
+- d635323: Add `useSiteActions(org)` and `utils/site-actions.ts`: whether the signed-in person may add or delete sites (and add organisations) in an organisation, as core answers it. Site-confined members are never offered these buttons.
+
 ## 4.87.0
 
 ### Minor Changes
@@ -1992,11 +1998,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                              GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                              GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                              owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                              staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/composables/useSiteActions.ts

@@ -0,0 +1,29 @@
+import { NO_SITE_ACTIONS, siteActionsOf, type TSiteActions } from "../utils/site-actions";
+
+/**
+ * May the signed-in person add / delete sites (and add organisations) in this
+ * organisation? Re-asked whenever the organisation changes; hidden until core
+ * answers. See `utils/site-actions.ts`.
+ */
+export default function useSiteActions(org: MaybeRefOrGetter<string>) {
+  const actions = ref<TSiteActions>({ ...NO_SITE_ACTIONS });
+
+  watch(
+    () => toValue(org),
+    async (id) => {
+      actions.value = { ...NO_SITE_ACTIONS };
+      if (!id) return;
+      try {
+        const res = await useNuxtApp().$api<Record<string, any>>("/api/customer-sites", {
+          query: { org: id, status: "active", limit: 1, withActions: true },
+        });
+        if (toValue(org) === id) actions.value = siteActionsOf(res);
+      } catch {
+        // stays hidden - the server refuses the action anyway
+      }
+    },
+    { immediate: true },
+  );
+
+  return actions;
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.87.0",
+  "version": "4.88.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/site-actions.ts

@@ -0,0 +1,18 @@
+/**
+ * What the signed-in person may do with an organisation's sites, as core
+ * answers it (`GET /api/customer-sites?withActions=true` -> `siteActions`).
+ *
+ * Owner rule 2026-10-01: creating, deleting or removing sites is for Seven365
+ * Super Admin, the organisation's owner and organisation-level members with the
+ * right; a member confined to sites never - whatever their role says. The
+ * server decides and refuses (403); the UI only hides what would be refused.
+ * Anything missing or unreadable reads as "no" (the button stays hidden).
+ */
+export type TSiteActions = { create: boolean; delete: boolean; createCustomer: boolean };
+
+export const NO_SITE_ACTIONS: TSiteActions = Object.freeze({ create: false, delete: false, createCustomer: false });
+
+export function siteActionsOf(response: unknown): TSiteActions {
+  const a = (response as { siteActions?: Record<string, unknown> } | null)?.siteActions ?? {};
+  return { create: a.create === true, delete: a.delete === true, createCustomer: a.createCustomer === true };
+}