@7365admin1/layer-common 4.90.2-staging.487 → 4.90.2-staging.489

package/components/InvitationForm.vue

@@ -88,13 +88,24 @@
                   persistent-hint
                   data-test="invite-fixed-site"
                 ></v-text-field>
+                <!--
+                  Several sites (owner request 2026-10-02): one invitation per
+                  site, one e-mail. One role for all of them, so 2+ sites offer
+                  organisation roles only (see `roleSiteFor`).
+                -->
                 <v-autocomplete
                   v-else
-                  v-model="invite.site"
+                  v-model="invite.sites"
                   :items="sites"
+                  multiple
+                  chips
+                  closable-chips
                   class="filter-field"
                   density="comfortable"
-                  :rules="[requiredRule]"
+                  :rules="[sitesRule]"
+                  :hint="invite.sites.length > 1 ? severalSitesHint : ''"
+                  :persistent-hint="invite.sites.length > 1"
+                  data-test="invite-sites"
                   @update:model-value="handleUpdateSite"
                 ></v-autocomplete>
               </v-col>
@@ -163,6 +174,7 @@ import { useLocalSetup } from '../composables/useLocalSetup';
 import useRole from '../composables/useRole';
 import useSite from '../composables/useSite';
 import { inviteRoleOptions } from '../utils/invite-role-options';
+import { roleSiteFor } from '../utils/invite-sites';
 import useUser from '../composables/useUser';
 import useUtils from '../composables/useUtils';
 
@@ -276,6 +288,8 @@ const invite = ref<Record<string, any>>({
   role: "",
   org: "",
   site: "",
+  // the sites picked in the Site field (several allowed); `site` follows it
+  sites: [] as string[],
   siteName: "",
   isMemberInvite: false,
 });
@@ -501,9 +515,17 @@ watchEffect(() => {
 
 const roleOptions = computed(() => inviteRoleOptions(roles.value));
 
+const severalSitesHint =
+  "Several sites: pick an organisation role - it applies at each site. For a different role per site, invite one site at a time.";
+
+const sitesRule = (v: string[]) =>
+  (Array.isArray(v) && v.length > 0) || "Pick at least one site";
+
 const noRolesText = computed(() =>
   rolesError?.value
     ? "The roles could not be loaded. You may not have access to this organisation's roles; refresh, or sign in again."
+    : !fixedSite.value && invite.value.sites.length > 1
+    ? "No organisation roles for this service yet. Create one in Roles & Permissions (Roles for <service>, use at any site), or invite one site at a time."
     : fixedSite.value
     ? "No roles have been created for this site yet. Create one in Roles & Permissions first."
     : "No roles have been created yet. Create one in Roles & Permissions first."
@@ -525,6 +547,7 @@ const rolesPageLink = computed(() => {
 async function handleUpdateApp(value: string)  {
   invite.value.role = "";
   if (!fixedSite.value) {
+    invite.value.sites = [];
     invite.value.site = "";
     invite.value.siteName = "";
   }
@@ -544,12 +567,16 @@ function resetInvite() {
   invite.value.role = "";
   // Same site as before: a fixed site stays fixed, a picked one is cleared.
   invite.value.site = fixedSite.value;
+  invite.value.sites = [];
   if (!invite.value.site) invite.value.siteName = "";
   message.value = "";
 }
 
-function handleUpdateSite(siteId: string) {
-  const obj = sites.value.find((x) => x?.value === siteId);
+function handleUpdateSite(siteIds: string[]) {
+  // The roles list follows `site`: the one chosen site, or "" for several
+  // (organisation roles only); the role watch clears a role no longer offered.
+  invite.value.site = roleSiteFor(siteIds);
+  const obj = sites.value.find((x) => x?.value === invite.value.site);
   invite.value.siteName = obj?.title || "";
 }
 

package/components/InvitationMain.vue

@@ -262,7 +262,10 @@ const {
       search: headerSearch.value,
       // type: "user-invite,member-invite",
       type: "member-invite",
-      app: props.app,
+      // The org console (organization app, no site) lists every invitation of
+      // the organisation, including the site invitations sent from there
+      // (owner request 2026-10-02); the server's list scoping is unchanged.
+      app: props.app === "organization" && !props.siteId ? "" : props.app,
       orgId: props.org,
       // A site app lists only THIS site's invitations; the server checks the
       // caller reaches it (owner report 2026-09-28: LakeGarden's invitations

package/composables/useUser.ts

@@ -1,3 +1,5 @@
+import { inviteSitePayload } from "../utils/invite-sites";
+
 export default function useUser() {
   function inviteUser({
     email = "",
@@ -65,7 +67,10 @@ export default function useUser() {
     org = "",
     site = "",
     siteName = "",
+    sites = [] as string[],
   } = {}) {
+    // `sites` = the several chosen sites; the old single `site` still works.
+    const chosen = sites.length ? sites : site ? [site] : [];
     return useNuxtApp().$api<Record<string, any>>("/api/auth/invite/member", {
       method: "POST",
       body: {
@@ -74,8 +79,7 @@ export default function useUser() {
         role,
         name,
         org,
-        ...(site && { siteId: site }),
-        ...(siteName && { siteName }),
+        ...inviteSitePayload(chosen, siteName),
       },
     });
   }

package/middleware/01.auth.ts

@@ -4,13 +4,9 @@ export default defineNuxtRouteMiddleware(async (route) => {
   // Get access token from cookies
   const sid = useCookie("sid", cookieConfig).value;
 
-  const serviceProviderEmail = (route.query.email as string) ?? "";
-
-
-  if (serviceProviderEmail) {
-    useCookie("service-provider-email", cookieConfig).value =
-      serviceProviderEmail;
-  }
+  // No longer saves `?email=` as a browser-wide `service-provider-email` cookie
+  // (30 days): nothing reads it, and a leftover from another account sent the
+  // org app's sign-in to that account's create page.
 
   if (!sid) {
     // Redirect to login page if no access token

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.90.2-staging.487",
+  "version": "4.90.2-staging.489",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/invite-sites.ts

@@ -0,0 +1,25 @@
+/**
+ * Which sites an "Invite member" request names (owner request 2026-10-02:
+ * invite one person to several sites). One site keeps the old `siteId` shape;
+ * 2 or more send `siteIds` (the server writes one invitation per site and
+ * names every site in one e-mail).
+ */
+export function inviteSitePayload(
+  sites: string[],
+  siteName = "",
+): Record<string, unknown> {
+  if (!sites.length) return {};
+  if (sites.length === 1) {
+    return { siteId: sites[0], ...(siteName && { siteName }) };
+  }
+  return { siteIds: sites };
+}
+
+/**
+ * The one site a role is looked up for: the single chosen site, or "" for 2+
+ * (a site role is valid at its own site only, so several sites offer
+ * organisation roles only).
+ */
+export function roleSiteFor(sites: string[]): string {
+  return sites.length === 1 ? sites[0] : "";
+}