@7365admin1/layer-common 4.91.0 → 4.93.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @iservice365/layer-common
 
+## 4.93.0
+
+### Minor Changes
+
+- b763487: Invitations list shows ONE row per multi-site invitation (e-mail, role, date, "N sites" with a details dialog listing every site and its status). Row actions: Resend (one request, one e-mail for the whole group), Cancel all, and Cancel one site inside the details. Old single-site invitations look and behave as before. Asks the API for `group=true`; against an API that does not know it, falls back to the plain per-site list. Same component on the org console and every app's Invitations page.
+
+### Patch Changes
+
+- 31c71b3: The auth middleware no longer saves `?email=` as a browser-wide `service-provider-email` cookie (30 days). Nothing reads it any more, and a leftover from another account sent the org app's sign-in to that account's create page. Redirect-to-sign-in behaviour is unchanged.
+
+## 4.92.0
+
+### Minor Changes
+
+- 9883bfd: Invite member: pick several sites in one invitation.
+
+  - `InvitationForm`: when it is the org-level "Invite member" (no fixed site), the Site field is a multi-select with removable chips (at least one site required). One site: roles are that site's roles plus organisation roles, as before. Two or more: only organisation roles are offered (a site role is valid at its own site only), with a hint saying so and how to give different roles per site. Site apps and onboarding keep their fixed single site.
+  - `useUser().inviteMemberClient` takes `sites`: one site sends `siteId` as before, several send `siteIds` (needs the matching `@7365admin1/core` release; older core ignores it). New helper `utils/invite-sites.ts`.
+  - `InvitationMain`: the Organization app's Invitations list no longer filters to `app: organization`, so site invitations sent from there are listed (the "Site Invited To" column shows each site). Site apps are unchanged.
+
 ## 4.91.0
 
 ### Minor Changes
@@ -2034,11 +2054,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/InvitationForm.vue

@@ -88,13 +88,24 @@
                   persistent-hint
                   data-test="invite-fixed-site"
                 ></v-text-field>
+                <!--
+                  Several sites (owner request 2026-10-02): one invitation per
+                  site, one e-mail. One role for all of them, so 2+ sites offer
+                  organisation roles only (see `roleSiteFor`).
+                -->
                 <v-autocomplete
                   v-else
-                  v-model="invite.site"
+                  v-model="invite.sites"
                   :items="sites"
+                  multiple
+                  chips
+                  closable-chips
                   class="filter-field"
                   density="comfortable"
-                  :rules="[requiredRule]"
+                  :rules="[sitesRule]"
+                  :hint="invite.sites.length > 1 ? severalSitesHint : ''"
+                  :persistent-hint="invite.sites.length > 1"
+                  data-test="invite-sites"
                   @update:model-value="handleUpdateSite"
                 ></v-autocomplete>
               </v-col>
@@ -163,6 +174,7 @@ import { useLocalSetup } from '../composables/useLocalSetup';
 import useRole from '../composables/useRole';
 import useSite from '../composables/useSite';
 import { inviteRoleOptions } from '../utils/invite-role-options';
+import { roleSiteFor } from '../utils/invite-sites';
 import useUser from '../composables/useUser';
 import useUtils from '../composables/useUtils';
 
@@ -276,6 +288,8 @@ const invite = ref<Record<string, any>>({
   role: "",
   org: "",
   site: "",
+  // the sites picked in the Site field (several allowed); `site` follows it
+  sites: [] as string[],
   siteName: "",
   isMemberInvite: false,
 });
@@ -501,9 +515,17 @@ watchEffect(() => {
 
 const roleOptions = computed(() => inviteRoleOptions(roles.value));
 
+const severalSitesHint =
+  "Several sites: pick an organisation role - it applies at each site. For a different role per site, invite one site at a time.";
+
+const sitesRule = (v: string[]) =>
+  (Array.isArray(v) && v.length > 0) || "Pick at least one site";
+
 const noRolesText = computed(() =>
   rolesError?.value
     ? "The roles could not be loaded. You may not have access to this organisation's roles; refresh, or sign in again."
+    : !fixedSite.value && invite.value.sites.length > 1
+    ? "No organisation roles for this service yet. Create one in Roles & Permissions (Roles for <service>, use at any site), or invite one site at a time."
     : fixedSite.value
     ? "No roles have been created for this site yet. Create one in Roles & Permissions first."
     : "No roles have been created yet. Create one in Roles & Permissions first."
@@ -525,6 +547,7 @@ const rolesPageLink = computed(() => {
 async function handleUpdateApp(value: string)  {
   invite.value.role = "";
   if (!fixedSite.value) {
+    invite.value.sites = [];
     invite.value.site = "";
     invite.value.siteName = "";
   }
@@ -544,12 +567,16 @@ function resetInvite() {
   invite.value.role = "";
   // Same site as before: a fixed site stays fixed, a picked one is cleared.
   invite.value.site = fixedSite.value;
+  invite.value.sites = [];
   if (!invite.value.site) invite.value.siteName = "";
   message.value = "";
 }
 
-function handleUpdateSite(siteId: string) {
-  const obj = sites.value.find((x) => x?.value === siteId);
+function handleUpdateSite(siteIds: string[]) {
+  // The roles list follows `site`: the one chosen site, or "" for several
+  // (organisation roles only); the role watch clears a role no longer offered.
+  invite.value.site = roleSiteFor(siteIds);
+  const obj = sites.value.find((x) => x?.value === invite.value.site);
   invite.value.siteName = obj?.title || "";
 }
 

package/components/InvitationMain.vue

@@ -61,19 +61,37 @@
           <template #item.createdAt="{ item }">
             {{ item.createdAt ? formatDate(item.createdAt) : "" }}
           </template>
+          <template #item.siteLabel="{ item }">
+            <a
+              v-if="siteCountOf(item) > 1"
+              href="#"
+              class="text-primary"
+              :title="item.sites?.map((s) => s.siteName).join(', ')"
+              @click.prevent="detailItem = item"
+            >
+              {{ siteLabel(item) }}
+            </a>
+            <span v-else>{{ siteLabel(item) }}</span>
+          </template>
           <template #item.action-table="{ item }">
             <v-menu
-              :close-on-content-click="false"
+              :close-on-content-click="true"
               offset-y
-              width="150"
-              v-if="props.cancelInvitation"
+              width="170"
+              v-if="item.status === 'pending' && (props.cancelInvitation || props.inviteMember)"
             >
               <template v-slot:activator="{ props }">
                 <v-icon v-bind="props">mdi-dots-vertical</v-icon>
               </template>
               <v-list>
-                <v-list-item @click="openConfirmDialog(item._id ?? '')" v-if="item.status === 'pending'">
-                  Cancel Invite
+                <v-list-item v-if="props.inviteMember" @click="onResend(item)">
+                  Resend
+                </v-list-item>
+                <v-list-item
+                  v-if="props.cancelInvitation"
+                  @click="openConfirmDialog(groupIds(item))"
+                >
+                  {{ siteCountOf(item) > 1 ? "Cancel all" : "Cancel Invite" }}
                 </v-list-item>
               </v-list>
             </v-menu>
@@ -85,6 +103,34 @@
       </AppCard>
     </v-col>
 
+    <v-dialog :model-value="!!detailItem" max-width="520" @update:model-value="detailItem = null">
+      <v-card v-if="detailItem" class="pa-4">
+        <div class="text-h6 mb-1">{{ siteLabel(detailItem) }}</div>
+        <div class="text-caption mb-3">
+          {{ detailItem.email }} - one invitation e-mail; accepting it adds every site below.
+        </div>
+        <v-list density="compact" style="max-height: 50vh; overflow-y: auto">
+          <v-list-item v-for="s in detailItem.sites" :key="s._id" :title="s.siteName || 'Site'">
+            <template #append>
+              <span class="text-caption me-3">{{ formatStatus(s.status || "") }}</span>
+              <v-btn
+                v-if="s.status === 'pending' && props.cancelInvitation"
+                size="small"
+                variant="text"
+                color="error"
+                @click="openConfirmDialog([s._id])"
+              >
+                Cancel
+              </v-btn>
+            </template>
+          </v-list-item>
+        </v-list>
+        <div class="d-flex justify-end mt-3">
+          <v-btn variant="text" @click="detailItem = null">Close</v-btn>
+        </div>
+      </v-card>
+    </v-dialog>
+
     <ConfirmDialog
       v-model="confirmDialog"
       :loading="cancelLoading"
@@ -95,8 +141,12 @@
       </template>
       <template #description>
         <p class="text-subtitle-2">
-          Are you sure you want to cancel this invitation? This action cannot be
-          undone.
+          {{
+            selectedInviteIds.length > 1
+              ? `Are you sure you want to cancel all ${selectedInviteIds.length} site invitations?`
+              : "Are you sure you want to cancel this invitation?"
+          }}
+          This action cannot be undone.
         </p>
       </template>
       <template #footer>
@@ -140,6 +190,13 @@
 <script setup lang="ts">
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
 import { invitationsEmptyText } from "../utils/invitations-empty-text";
+import {
+  groupIds,
+  resendArgs,
+  siteCountOf,
+  siteLabel,
+} from "../utils/invite-group";
+import useUser from "../composables/useUser";
 
 /** The same two tabs, same labels, same routes. */
 const invitationTabs = [
@@ -205,7 +262,8 @@ const headers = computed(() => {
     },
     {
       title: "Site Invited To",
-      value: "metadata.siteName",
+      value: "siteLabel",
+      sortable: false,
     },
     {
       title: "Status",
@@ -214,7 +272,7 @@ const headers = computed(() => {
 
   ];
 
-  if (props.status === "pending" && props.cancelInvitation) {
+  if (props.status === "pending" && (props.cancelInvitation || props.inviteMember)) {
     baseHeaders.push({
       title: "Action",
       value: "action-table",
@@ -226,6 +284,7 @@ const headers = computed(() => {
 
 const { getVerifications: _getVerifications, cancelUserInvitation } =
   useVerification();
+const { inviteMemberClient } = useUser();
 
 const page = ref(1);
 const pages = ref(0);
@@ -255,20 +314,31 @@ const {
   pageRange: string;
 }>(
   `get-verifications-${props.app}-${props.org}-${props.siteId}-${props.status}`,
-  () =>
-    _getVerifications({
+  async () => {
+    const query = {
       page: page.value,
       status: props.status,
       search: headerSearch.value,
       // type: "user-invite,member-invite",
       type: "member-invite",
-      app: props.app,
+      // The org console (organization app, no site) lists every invitation of
+      // the organisation, including the site invitations sent from there
+      // (owner request 2026-10-02); the server's list scoping is unchanged.
+      app: props.app === "organization" && !props.siteId ? "" : props.app,
       orgId: props.org,
       // A site app lists only THIS site's invitations; the server checks the
       // caller reaches it (owner report 2026-09-28: LakeGarden's invitations
       // showed on every Wing Tai site). The org console passes no site.
       siteId: props.siteId,
-    }),
+    };
+    // One row per multi-site invitation. An API without `group` refuses the
+    // key: fall back to the plain list (one row per site, as before).
+    try {
+      return await _getVerifications({ ...query, group: true });
+    } catch {
+      return await _getVerifications(query);
+    }
+  },
   {
     watch: [() => props.status]
   }
@@ -306,31 +376,63 @@ watch([headerSearch, () => props.status], () => {
 });
 
 const confirmDialog = ref(false);
-const selectedInviteId = ref<string | null>(null);
+const selectedInviteIds = ref<string[]>([]);
 const cancelLoading = ref(false);
+const detailItem = ref<any>(null);
+const resending = ref(false);
 
-function openConfirmDialog(id: string) {
-  selectedInviteId.value = id;
+function openConfirmDialog(ids: string[]) {
+  selectedInviteIds.value = ids;
   confirmDialog.value = true;
 }
 
 async function onConfirmCancel() {
-  if (!selectedInviteId.value) return;
+  if (!selectedInviteIds.value.length) return;
 
   cancelLoading.value = true;
   try {
-    const res = await cancelUserInvitation(selectedInviteId.value);
-
-    showMessage(res.message || "Invitation cancelled successfully", "success");
+    let res: Record<string, any> = {};
+    for (const id of selectedInviteIds.value) {
+      res = await cancelUserInvitation(id);
+    }
+
+    showMessage(
+      selectedInviteIds.value.length > 1
+        ? "All site invitations cancelled"
+        : res.message || "Invitation cancelled successfully",
+      "success",
+    );
+    detailItem.value = null;
     await getVerifications();
     confirmDialog.value = false;
-    selectedInviteId.value = null;
+    selectedInviteIds.value = [];
   } catch (error: any) {
-    showMessage(error?.message || "Failed to cancel invitation", "error");
+    showMessage(error?.data?.message || error?.message || "Failed to cancel invitation", "error");
+    await getVerifications();
   }
   cancelLoading.value = false;
 }
 
+// ONE request = ONE e-mail for the whole group (the server re-uses the
+// pending rows and names every site).
+async function onResend(item: any) {
+  const args = resendArgs(item);
+  if (!args) {
+    showMessage("This invitation cannot be re-sent from here.", "error");
+    return;
+  }
+  if (resending.value) return;
+  resending.value = true;
+  try {
+    await inviteMemberClient(args);
+    showMessage("Invitation re-sent (one e-mail).", "success");
+    await getVerifications();
+  } catch (error: any) {
+    showMessage(error?.data?.message || error?.message || "Failed to resend invitation", "error");
+  }
+  resending.value = false;
+}
+
 function handleSuccess(closeForm: boolean) {
   getVerifications();
   if (closeForm) {

package/composables/useUser.ts

@@ -1,3 +1,5 @@
+import { inviteSitePayload } from "../utils/invite-sites";
+
 export default function useUser() {
   function inviteUser({
     email = "",
@@ -65,7 +67,10 @@ export default function useUser() {
     org = "",
     site = "",
     siteName = "",
+    sites = [] as string[],
   } = {}) {
+    // `sites` = the several chosen sites; the old single `site` still works.
+    const chosen = sites.length ? sites : site ? [site] : [];
     return useNuxtApp().$api<Record<string, any>>("/api/auth/invite/member", {
       method: "POST",
       body: {
@@ -74,8 +79,7 @@ export default function useUser() {
         role,
         name,
         org,
-        ...(site && { siteId: site }),
-        ...(siteName && { siteName }),
+        ...inviteSitePayload(chosen, siteName),
       },
     });
   }

package/composables/useVerification.ts

@@ -11,6 +11,8 @@ export default function useVerification() {
     limit = 20,
     // "seven365": only the invitations Seven365 sent (the console's lists).
     origin = "",
+    // true: one entry per multi-site invitation group, with its `sites`.
+    group = false,
   } = {}): Promise<{
     items: TMiniVerification[];
     pages: number;
@@ -22,6 +24,7 @@ export default function useVerification() {
         status, search, page, type, email, app, siteId, orgId, limit,
         // Sent only when asked for: an older API refuses a key it does not know.
         ...(origin && { origin }),
+        ...(group && { group: "true" }),
       },
     });
   }

package/middleware/01.auth.ts

@@ -4,13 +4,9 @@ export default defineNuxtRouteMiddleware(async (route) => {
   // Get access token from cookies
   const sid = useCookie("sid", cookieConfig).value;
 
-  const serviceProviderEmail = (route.query.email as string) ?? "";
-
-
-  if (serviceProviderEmail) {
-    useCookie("service-provider-email", cookieConfig).value =
-      serviceProviderEmail;
-  }
+  // No longer saves `?email=` as a browser-wide `service-provider-email` cookie
+  // (30 days): nothing reads it, and a leftover from another account sent the
+  // org app's sign-in to that account's create page.
 
   if (!sid) {
     // Redirect to login page if no access token

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.91.0",
+  "version": "4.93.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/invite-group.ts

@@ -0,0 +1,61 @@
+/**
+ * Invitations list, multi-site invitations (owner request 2026-10-02): the
+ * server (`GET /api/verifications?group=true`) returns ONE entry per invitation
+ * group with its `sites`; an old single-site invitation is a group of one.
+ */
+export type InviteSiteRow = {
+  _id: string;
+  siteId?: string;
+  siteName?: string;
+  status?: string;
+};
+
+export type InviteEntry = {
+  _id?: string;
+  email?: string;
+  metadata?: Record<string, any>;
+  sites?: InviteSiteRow[];
+  siteCount?: number;
+};
+
+export function siteCountOf(item: InviteEntry): number {
+  return item.siteCount ?? item.sites?.length ?? 1;
+}
+
+/** "LakeGarden" for one site, "21 sites" for a group (details list them all). */
+export function siteLabel(item: InviteEntry): string {
+  const n = siteCountOf(item);
+  if (n > 1) return `${n} sites`;
+  return item.sites?.[0]?.siteName || item.metadata?.siteName || "";
+}
+
+/** Every verification id the entry stands for (Cancel all). */
+export function groupIds(item: InviteEntry): string[] {
+  const ids = item.sites?.length
+    ? item.sites.map((s) => s._id)
+    : [item._id ?? ""];
+  return ids.filter(Boolean).map(String);
+}
+
+/**
+ * Arguments of `inviteMemberClient` that re-send the invitation: ONE request,
+ * so ONE e-mail for the whole group. `null` when it cannot be rebuilt (no org).
+ */
+export function resendArgs(item: InviteEntry) {
+  const m = item.metadata ?? {};
+  if (!item.email || !m.org) return null;
+  const sites = (item.sites ?? [])
+    .map((s) => s.siteId)
+    .filter(Boolean)
+    .map(String);
+  return {
+    email: item.email,
+    app: m.app ?? "",
+    role: m.role ? String(m.role) : "",
+    name: m.name ?? "",
+    org: String(m.org),
+    sites: sites.length > 1 ? sites : [],
+    site: sites.length === 1 ? sites[0] : m.siteId ? String(m.siteId) : "",
+    siteName: item.sites?.[0]?.siteName || m.siteName || "",
+  };
+}

package/utils/invite-sites.ts

@@ -0,0 +1,25 @@
+/**
+ * Which sites an "Invite member" request names (owner request 2026-10-02:
+ * invite one person to several sites). One site keeps the old `siteId` shape;
+ * 2 or more send `siteIds` (the server writes one invitation per site and
+ * names every site in one e-mail).
+ */
+export function inviteSitePayload(
+  sites: string[],
+  siteName = "",
+): Record<string, unknown> {
+  if (!sites.length) return {};
+  if (sites.length === 1) {
+    return { siteId: sites[0], ...(siteName && { siteName }) };
+  }
+  return { siteIds: sites };
+}
+
+/**
+ * The one site a role is looked up for: the single chosen site, or "" for 2+
+ * (a site role is valid at its own site only, so several sites offer
+ * organisation roles only).
+ */
+export function roleSiteFor(sites: string[]): string {
+  return sites.length === 1 ? sites[0] : "";
+}