@7365admin1/layer-common 4.92.0 → 4.93.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @iservice365/layer-common
 
+## 4.93.0
+
+### Minor Changes
+
+- b763487: Invitations list shows ONE row per multi-site invitation (e-mail, role, date, "N sites" with a details dialog listing every site and its status). Row actions: Resend (one request, one e-mail for the whole group), Cancel all, and Cancel one site inside the details. Old single-site invitations look and behave as before. Asks the API for `group=true`; against an API that does not know it, falls back to the plain per-site list. Same component on the org console and every app's Invitations page.
+
+### Patch Changes
+
+- 31c71b3: The auth middleware no longer saves `?email=` as a browser-wide `service-provider-email` cookie (30 days). Nothing reads it any more, and a leftover from another account sent the org app's sign-in to that account's create page. Redirect-to-sign-in behaviour is unchanged.
+
 ## 4.92.0
 
 ### Minor Changes
@@ -2044,11 +2054,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                                              GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                                              GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                                              owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                                              staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/InvitationMain.vue

@@ -61,19 +61,37 @@
           <template #item.createdAt="{ item }">
             {{ item.createdAt ? formatDate(item.createdAt) : "" }}
           </template>
+          <template #item.siteLabel="{ item }">
+            <a
+              v-if="siteCountOf(item) > 1"
+              href="#"
+              class="text-primary"
+              :title="item.sites?.map((s) => s.siteName).join(', ')"
+              @click.prevent="detailItem = item"
+            >
+              {{ siteLabel(item) }}
+            </a>
+            <span v-else>{{ siteLabel(item) }}</span>
+          </template>
           <template #item.action-table="{ item }">
             <v-menu
-              :close-on-content-click="false"
+              :close-on-content-click="true"
               offset-y
-              width="150"
-              v-if="props.cancelInvitation"
+              width="170"
+              v-if="item.status === 'pending' && (props.cancelInvitation || props.inviteMember)"
             >
               <template v-slot:activator="{ props }">
                 <v-icon v-bind="props">mdi-dots-vertical</v-icon>
               </template>
               <v-list>
-                <v-list-item @click="openConfirmDialog(item._id ?? '')" v-if="item.status === 'pending'">
-                  Cancel Invite
+                <v-list-item v-if="props.inviteMember" @click="onResend(item)">
+                  Resend
+                </v-list-item>
+                <v-list-item
+                  v-if="props.cancelInvitation"
+                  @click="openConfirmDialog(groupIds(item))"
+                >
+                  {{ siteCountOf(item) > 1 ? "Cancel all" : "Cancel Invite" }}
                 </v-list-item>
               </v-list>
             </v-menu>
@@ -85,6 +103,34 @@
       </AppCard>
     </v-col>
 
+    <v-dialog :model-value="!!detailItem" max-width="520" @update:model-value="detailItem = null">
+      <v-card v-if="detailItem" class="pa-4">
+        <div class="text-h6 mb-1">{{ siteLabel(detailItem) }}</div>
+        <div class="text-caption mb-3">
+          {{ detailItem.email }} - one invitation e-mail; accepting it adds every site below.
+        </div>
+        <v-list density="compact" style="max-height: 50vh; overflow-y: auto">
+          <v-list-item v-for="s in detailItem.sites" :key="s._id" :title="s.siteName || 'Site'">
+            <template #append>
+              <span class="text-caption me-3">{{ formatStatus(s.status || "") }}</span>
+              <v-btn
+                v-if="s.status === 'pending' && props.cancelInvitation"
+                size="small"
+                variant="text"
+                color="error"
+                @click="openConfirmDialog([s._id])"
+              >
+                Cancel
+              </v-btn>
+            </template>
+          </v-list-item>
+        </v-list>
+        <div class="d-flex justify-end mt-3">
+          <v-btn variant="text" @click="detailItem = null">Close</v-btn>
+        </div>
+      </v-card>
+    </v-dialog>
+
     <ConfirmDialog
       v-model="confirmDialog"
       :loading="cancelLoading"
@@ -95,8 +141,12 @@
       </template>
       <template #description>
         <p class="text-subtitle-2">
-          Are you sure you want to cancel this invitation? This action cannot be
-          undone.
+          {{
+            selectedInviteIds.length > 1
+              ? `Are you sure you want to cancel all ${selectedInviteIds.length} site invitations?`
+              : "Are you sure you want to cancel this invitation?"
+          }}
+          This action cannot be undone.
         </p>
       </template>
       <template #footer>
@@ -140,6 +190,13 @@
 <script setup lang="ts">
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
 import { invitationsEmptyText } from "../utils/invitations-empty-text";
+import {
+  groupIds,
+  resendArgs,
+  siteCountOf,
+  siteLabel,
+} from "../utils/invite-group";
+import useUser from "../composables/useUser";
 
 /** The same two tabs, same labels, same routes. */
 const invitationTabs = [
@@ -205,7 +262,8 @@ const headers = computed(() => {
     },
     {
       title: "Site Invited To",
-      value: "metadata.siteName",
+      value: "siteLabel",
+      sortable: false,
     },
     {
       title: "Status",
@@ -214,7 +272,7 @@ const headers = computed(() => {
 
   ];
 
-  if (props.status === "pending" && props.cancelInvitation) {
+  if (props.status === "pending" && (props.cancelInvitation || props.inviteMember)) {
     baseHeaders.push({
       title: "Action",
       value: "action-table",
@@ -226,6 +284,7 @@ const headers = computed(() => {
 
 const { getVerifications: _getVerifications, cancelUserInvitation } =
   useVerification();
+const { inviteMemberClient } = useUser();
 
 const page = ref(1);
 const pages = ref(0);
@@ -255,8 +314,8 @@ const {
   pageRange: string;
 }>(
   `get-verifications-${props.app}-${props.org}-${props.siteId}-${props.status}`,
-  () =>
-    _getVerifications({
+  async () => {
+    const query = {
       page: page.value,
       status: props.status,
       search: headerSearch.value,
@@ -271,7 +330,15 @@ const {
       // caller reaches it (owner report 2026-09-28: LakeGarden's invitations
       // showed on every Wing Tai site). The org console passes no site.
       siteId: props.siteId,
-    }),
+    };
+    // One row per multi-site invitation. An API without `group` refuses the
+    // key: fall back to the plain list (one row per site, as before).
+    try {
+      return await _getVerifications({ ...query, group: true });
+    } catch {
+      return await _getVerifications(query);
+    }
+  },
   {
     watch: [() => props.status]
   }
@@ -309,31 +376,63 @@ watch([headerSearch, () => props.status], () => {
 });
 
 const confirmDialog = ref(false);
-const selectedInviteId = ref<string | null>(null);
+const selectedInviteIds = ref<string[]>([]);
 const cancelLoading = ref(false);
+const detailItem = ref<any>(null);
+const resending = ref(false);
 
-function openConfirmDialog(id: string) {
-  selectedInviteId.value = id;
+function openConfirmDialog(ids: string[]) {
+  selectedInviteIds.value = ids;
   confirmDialog.value = true;
 }
 
 async function onConfirmCancel() {
-  if (!selectedInviteId.value) return;
+  if (!selectedInviteIds.value.length) return;
 
   cancelLoading.value = true;
   try {
-    const res = await cancelUserInvitation(selectedInviteId.value);
-
-    showMessage(res.message || "Invitation cancelled successfully", "success");
+    let res: Record<string, any> = {};
+    for (const id of selectedInviteIds.value) {
+      res = await cancelUserInvitation(id);
+    }
+
+    showMessage(
+      selectedInviteIds.value.length > 1
+        ? "All site invitations cancelled"
+        : res.message || "Invitation cancelled successfully",
+      "success",
+    );
+    detailItem.value = null;
     await getVerifications();
     confirmDialog.value = false;
-    selectedInviteId.value = null;
+    selectedInviteIds.value = [];
   } catch (error: any) {
-    showMessage(error?.message || "Failed to cancel invitation", "error");
+    showMessage(error?.data?.message || error?.message || "Failed to cancel invitation", "error");
+    await getVerifications();
   }
   cancelLoading.value = false;
 }
 
+// ONE request = ONE e-mail for the whole group (the server re-uses the
+// pending rows and names every site).
+async function onResend(item: any) {
+  const args = resendArgs(item);
+  if (!args) {
+    showMessage("This invitation cannot be re-sent from here.", "error");
+    return;
+  }
+  if (resending.value) return;
+  resending.value = true;
+  try {
+    await inviteMemberClient(args);
+    showMessage("Invitation re-sent (one e-mail).", "success");
+    await getVerifications();
+  } catch (error: any) {
+    showMessage(error?.data?.message || error?.message || "Failed to resend invitation", "error");
+  }
+  resending.value = false;
+}
+
 function handleSuccess(closeForm: boolean) {
   getVerifications();
   if (closeForm) {

package/composables/useVerification.ts

@@ -11,6 +11,8 @@ export default function useVerification() {
     limit = 20,
     // "seven365": only the invitations Seven365 sent (the console's lists).
     origin = "",
+    // true: one entry per multi-site invitation group, with its `sites`.
+    group = false,
   } = {}): Promise<{
     items: TMiniVerification[];
     pages: number;
@@ -22,6 +24,7 @@ export default function useVerification() {
         status, search, page, type, email, app, siteId, orgId, limit,
         // Sent only when asked for: an older API refuses a key it does not know.
         ...(origin && { origin }),
+        ...(group && { group: "true" }),
       },
     });
   }

package/middleware/01.auth.ts

@@ -4,13 +4,9 @@ export default defineNuxtRouteMiddleware(async (route) => {
   // Get access token from cookies
   const sid = useCookie("sid", cookieConfig).value;
 
-  const serviceProviderEmail = (route.query.email as string) ?? "";
-
-
-  if (serviceProviderEmail) {
-    useCookie("service-provider-email", cookieConfig).value =
-      serviceProviderEmail;
-  }
+  // No longer saves `?email=` as a browser-wide `service-provider-email` cookie
+  // (30 days): nothing reads it, and a leftover from another account sent the
+  // org app's sign-in to that account's create page.
 
   if (!sid) {
     // Redirect to login page if no access token

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.92.0",
+  "version": "4.93.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/invite-group.ts

@@ -0,0 +1,61 @@
+/**
+ * Invitations list, multi-site invitations (owner request 2026-10-02): the
+ * server (`GET /api/verifications?group=true`) returns ONE entry per invitation
+ * group with its `sites`; an old single-site invitation is a group of one.
+ */
+export type InviteSiteRow = {
+  _id: string;
+  siteId?: string;
+  siteName?: string;
+  status?: string;
+};
+
+export type InviteEntry = {
+  _id?: string;
+  email?: string;
+  metadata?: Record<string, any>;
+  sites?: InviteSiteRow[];
+  siteCount?: number;
+};
+
+export function siteCountOf(item: InviteEntry): number {
+  return item.siteCount ?? item.sites?.length ?? 1;
+}
+
+/** "LakeGarden" for one site, "21 sites" for a group (details list them all). */
+export function siteLabel(item: InviteEntry): string {
+  const n = siteCountOf(item);
+  if (n > 1) return `${n} sites`;
+  return item.sites?.[0]?.siteName || item.metadata?.siteName || "";
+}
+
+/** Every verification id the entry stands for (Cancel all). */
+export function groupIds(item: InviteEntry): string[] {
+  const ids = item.sites?.length
+    ? item.sites.map((s) => s._id)
+    : [item._id ?? ""];
+  return ids.filter(Boolean).map(String);
+}
+
+/**
+ * Arguments of `inviteMemberClient` that re-send the invitation: ONE request,
+ * so ONE e-mail for the whole group. `null` when it cannot be rebuilt (no org).
+ */
+export function resendArgs(item: InviteEntry) {
+  const m = item.metadata ?? {};
+  if (!item.email || !m.org) return null;
+  const sites = (item.sites ?? [])
+    .map((s) => s.siteId)
+    .filter(Boolean)
+    .map(String);
+  return {
+    email: item.email,
+    app: m.app ?? "",
+    role: m.role ? String(m.role) : "",
+    name: m.name ?? "",
+    org: String(m.org),
+    sites: sites.length > 1 ? sites : [],
+    site: sites.length === 1 ? sites[0] : m.siteId ? String(m.siteId) : "",
+    siteName: item.sites?.[0]?.siteName || m.siteName || "",
+  };
+}