@7365admin1/layer-common 4.97.1-staging.508 → 4.97.1-staging.510

package/components/HidReaderForm.vue

@@ -77,6 +77,23 @@
             <p class="reader-audience__hint">{{ field.hint }}</p>
           </div>
         </div>
+        <!-- WHAT THIS SAVE TAKES AWAY.
+             Switching an account type off revokes the people already granted
+             this reader - their credentials stay on the device, so they go from
+             authorised to recognised-and-refused and back again if it is switched
+             on later. Said with a number, because "removes access" and "removes
+             access for 40 people" are different decisions. -->
+        <p v-if="revocationWarning" class="reader-discovery-hint reader-audiences__revoking mb-1">
+          {{ revocationWarning }}
+        </p>
+        <!-- And whether anybody is left with a door at all. -->
+        <p v-if="strandedWarning" class="reader-discovery-hint reader-audiences__empty mb-1">
+          {{ strandedWarning }}
+        </p>
+        <p v-if="needsConfirmation && revocationConfirmed" class="reader-discovery-hint reader-audiences__revoking mb-3">
+          Press Save again to apply this.
+        </p>
+
         <p v-if="noAudienceSelected" class="reader-discovery-hint reader-audiences__empty mb-3">
           Nobody can be enrolled on this reader while all four are off. Existing
           people keep the access they already have.
@@ -243,7 +260,7 @@
           :disabled="mode === 'add' && (!draft.deviceId || !draft.portalId || draft.cardReadingMode === 'unconfigured')"
           @click="submit"
         >
-          Submit
+          {{ submitLabel }}
         </v-btn>
       </v-card-actions>
     </v-card>
@@ -255,8 +272,11 @@
    kept in a util with tests because the absent-means-all default is the part
    that could close a door by accident. */
 import {
+  audienceRevocations,
+  audiencesLeftWithNoReader,
   HID_READER_AUDIENCE_FIELDS,
   readerAudiences,
+  type THidPermissionCounts,
   type THidReaderAudiences,
 } from "../utils/hid-reader-audiences";
 
@@ -325,6 +345,23 @@ const props = defineProps({
     type: String,
     default: "",
   },
+  // Which organisation's permission document to read the granted counts from.
+  // The reader's audiences are the reader's, but who is granted under them is
+  // per organisation - see `getSitePermissions`.
+  org: {
+    type: String,
+    default: "",
+  },
+  /*
+   * Every reader at this site, so switching the LAST one serving an account type
+   * can be warned about. Passed in rather than fetched: the parent already holds
+   * the list it draws the table from, and a second request would be a second
+   * answer that could disagree with what is on screen.
+   */
+  siteReaders: {
+    type: Array as () => Array<Record<string, unknown>>,
+    default: () => [],
+  },
 });
 
 const emit = defineEmits<{
@@ -373,6 +410,94 @@ const audiences = reactive<THidReaderAudiences>({
   serviceProvider: true,
 });
 const audienceFields = HID_READER_AUDIENCE_FIELDS;
+
+/*
+ * WHAT THE READER LOOKED LIKE WHEN THE DIALOG OPENED.
+ *
+ * Only an on-to-off change costs anybody their access, so the warnings compare
+ * against this rather than against the stored record - which the switches are
+ * already editing.
+ */
+const audiencesOnOpen = ref<THidReaderAudiences>({ ...audiences });
+
+/** Who is granted on this reader, per category. Read once per opening. */
+const grantedCounts = ref<THidPermissionCounts | null>(null);
+const { getSitePermissions } = useHidAmico();
+
+/**
+ * NEVER THROWS, and a failure means the counts are simply unknown.
+ *
+ * The warning below says how many people a switch-off costs; without the counts
+ * it says that it will remove access without a number, which is still the thing
+ * the operator needs to know. Failing the dialog over a count would be worse.
+ */
+async function loadGrantedCounts() {
+  grantedCounts.value = null;
+  const readerId = String(props.reader?._id ?? "");
+  if (!readerId || !props.site || !props.org) return;
+  try {
+    const response = await getSitePermissions(props.site, props.org, readerId);
+    grantedCounts.value = (response?.data?.counts ?? null) as THidPermissionCounts | null;
+  } catch (error: unknown) {
+    console.error("Unable to read who is granted on this reader:", error);
+  }
+}
+
+/** The account types this edit switches off, and what each costs. */
+const revocations = computed(() => audienceRevocations(
+  audiencesOnOpen.value,
+  audiences,
+  grantedCounts.value,
+));
+
+/** Account types this edit would leave with no reader anywhere at the site. */
+const strandedAudiences = computed(() => audiencesLeftWithNoReader(
+  props.reader?._id,
+  audiences,
+  props.siteReaders,
+));
+
+const revocationWarning = computed(() => {
+  if (!revocations.value.length) return "";
+  return revocations.value
+    .map((item) => {
+      if (item.audience === "residentVisitor") {
+        // Not a revocation: a visitor pass is bound through `user_access_rules`
+        // with its own expiry, so issued passes run out rather than stopping.
+        return `${item.label}: no new passes will be issued. Passes already issued run out on their own.`;
+      }
+      if (!item.people) {
+        return `${item.label}: nobody is currently granted this reader under it.`;
+      }
+      return `${item.label}: removes access for ${item.people} ${item.people === 1 ? "person" : "people"}.`;
+    })
+    .join(" ");
+});
+
+const strandedWarning = computed(() => {
+  if (!strandedAudiences.value.length) return "";
+  const labels = strandedAudiences.value.map((item) => item.label);
+  const subject = labels.length === 1 ? labels[0] : labels.join(", ");
+  return `No other reader at this site serves ${subject}.`
+    + ` Saving this leaves ${labels.length === 1 ? "that account type" : "those account types"} with no way in.`;
+});
+
+/*
+ * A SECOND PRESS when something is being taken away.
+ *
+ * Revoking forty people is not an edit to make on one click, and a dialog over
+ * a dialog for a switch is heavier than it needs to be. Save states what it is
+ * about to do and then does it.
+ */
+const revocationConfirmed = ref(false);
+const needsConfirmation = computed(
+  () => Boolean(revocations.value.length || strandedAudiences.value.length)
+);
+const submitLabel = computed(() => (
+  needsConfirmation.value && !revocationConfirmed.value
+    ? "Review and save"
+    : props.mode === "edit" ? "Save Changes" : "Add Reader"
+));
 /* Switching every audience off leaves a reader nobody can be enrolled on, which
    is legal but almost never meant - so it is said out loud rather than refused. */
 const noAudienceSelected = computed(() =>
@@ -421,6 +546,10 @@ watch(
     // existed opens with all four on rather than all four off - and a save from
     // this form therefore cannot close it by accident.
     Object.assign(audiences, readerAudiences(props.reader as Record<string, unknown> | null));
+    // The baseline the warnings compare against, and the counts behind them.
+    audiencesOnOpen.value = { ...audiences };
+    revocationConfirmed.value = false;
+    void loadGrantedCounts();
     draft.username = props.reader?.username ?? "";
     draft.password = props.reader?.password ?? "";
     monitorEnabled.value = props.reader?.monitorStatus !== "disabled";
@@ -515,6 +644,14 @@ function submit() {
     discoveryError.value = "Select the model printed on the physical HID reader.";
     return;
   }
+  /*
+   * The first press on a save that takes access away only acknowledges it. The
+   * warnings are already on screen; this makes the operator read them.
+   */
+  if (needsConfirmation.value && !revocationConfirmed.value) {
+    revocationConfirmed.value = true;
+    return;
+  }
   const portal = portals.value.find((item) => item.id === Number(draft.portalId));
   const payload: HidReaderFormPayload = {
     ...draft,
@@ -556,6 +693,13 @@ function submit() {
   color: var(--err);
 }
 
+/* A revocation is a warning rather than an error: it is a legitimate thing to
+   do, deliberately, and the colour should not imply the save is refused. */
+.reader-audiences__revoking {
+  color: var(--warn, var(--err));
+  font-weight: 600;
+}
+
 /* Type comes from `.screen-modal .v-card-title`; only the header strip's own
    padding and rule stay here. `#ececec` was a fixed near-white line, i.e.
    invisible on a light card and a bright scratch across a dark one. */

package/components/HidReaderManagement.vue

@@ -111,8 +111,10 @@
     <HidReaderForm
       v-model="formDialog"
       :site="props.site"
+      :org="props.org"
       :mode="selectedReader ? 'edit' : 'add'"
       :reader="selectedReader"
+      :site-readers="readers"
       :loading="saving"
       @submit="saveReader"
     />

package/components/SiteProviderChange.vue

@@ -18,8 +18,8 @@
         <p class="spc-intro">
           <template v-if="kind === 'owner'">
             {{ siteName || "This site" }} moves to a new owner, who takes charge of all of its records.
-            Every service provider at the site keeps working as it is. Only the new owner must already be working at the site
-            (invite them first; Seven365 can pick any company).
+            Every service provider at the site keeps working as it is, and the new owner needs no invitation. Only Seven365
+            can do this.
           </template>
           <template v-else>
             Only {{ preview?.service || "this service" }} at {{ siteName || "this site" }} changes. Other services at the site,
@@ -28,7 +28,7 @@
         </p>
 
         <label class="spc-label" for="spc-to">{{ kind === "owner" ? "New owner" : "New company (optional)" }}</label>
-        <v-select
+        <v-autocomplete
           id="spc-to"
           v-model="to"
           :items="toItems"
@@ -38,7 +38,7 @@
           variant="outlined"
           class="filter-field"
           :disabled="saving"
-          :no-data-text="kind === 'owner' ? 'Invite the new owner to the site first.' : 'Invite the new company to the site first.'"
+          :no-data-text="kind === 'owner' ? 'No company found.' : 'Invite the new company to the site first.'"
           data-test="spc-to"
           @update:model-value="refresh"
         />
@@ -96,7 +96,7 @@
         Provider changes at {{ siteName || "this site" }}
         <v-spacer />
         <v-btn
-          v-if="ownerOrgId"
+          v-if="ownerOrgId && isStaff"
           variant="outlined"
           class="screen-btn-ghost mr-2"
           data-test="spc-change-owner"
@@ -186,11 +186,24 @@ const snackText = ref("");
 const snackColor = ref("success");
 
 const tomorrow = computed(() => new Date(Date.now() + 864e5).toISOString().slice(0, 10));
-const replacements = ref<Array<{ org: string; name: string }>>([]);
+const replacements = ref<Array<{ org: string; name: string; nature?: string }>>([]);
+const OWNER_KIND: Record<string, string> = {
+  property_management_agency: "Property management",
+  real_estate_developer: "Developer",
+  property_owner: "Owner",
+};
 const toItems = computed(() => [
   ...(kind.value === "provider" ? [{ title: "No new company yet - just end", value: null }] : []),
-  ...replacements.value.map((r) => ({ title: r.name, value: r.org })),
+  ...replacements.value.map((r) => ({
+    title: kind.value === "owner" && OWNER_KIND[r.nature ?? ""] ? `${r.name} - ${OWNER_KIND[r.nature ?? ""]}` : r.name,
+    value: r.org,
+  })),
 ]);
+
+// Changing the site's owner is Seven365's job only (owner, 2026-10-06): a
+// property manager must never see which other property managers use the system.
+const { isStaff, load: loadTier } = useConsoleTier();
+onMounted(() => loadTier());
 const canConfirm = computed(
   () =>
     !loading.value &&

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.97.1-staging.508",
+  "version": "4.97.1-staging.510",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/hid-reader-audiences.ts

@@ -177,3 +177,99 @@ export function availableEnrolmentSubjects<T extends { value: unknown }>(
     emptied: !served.length,
   };
 }
+
+/* ── WHAT SWITCHING ONE OFF COSTS ──────────────────────────────────────── */
+
+/** `counts` as `getSitePermissions` returns it, per category. */
+export type THidPermissionCounts = {
+  resident?: number;
+  propertyManagement?: number;
+  serviceProvider?: number;
+  serviceProviderMember?: number;
+};
+
+/**
+ * How many people on this reader lose access if an account type is switched off.
+ *
+ * Both service-provider categories answer to the one switch, so both are
+ * counted - a company grant and a named contractor are the same door to the
+ * person walking through it.
+ *
+ * RESIDENT VISITOR IS ALWAYS ZERO, and that is not an oversight. A visitor pass
+ * is not a permission assignment: it is bound through `user_access_rules` with
+ * its own expiry, so switching the account type off stops new passes being
+ * issued and leaves any already issued to run out on their own. Reporting a
+ * number there would promise a revocation that does not happen.
+ */
+export function peopleLosingAccess(
+  audience: THidReaderAudience,
+  counts: THidPermissionCounts | null | undefined,
+): number {
+  const read = (value: unknown) => {
+    const count = Number(value ?? 0);
+    return Number.isFinite(count) && count > 0 ? Math.floor(count) : 0;
+  };
+  switch (audience) {
+    case "resident":
+      return read(counts?.resident);
+    case "member":
+      return read(counts?.propertyManagement);
+    case "serviceProvider":
+      return read(counts?.serviceProvider) + read(counts?.serviceProviderMember);
+    case "residentVisitor":
+    default:
+      return 0;
+  }
+}
+
+/**
+ * The account types being switched OFF by this edit, with what each one costs.
+ *
+ * Only on-to-off transitions. An account type that was already off costs
+ * nothing to leave off, and listing it would make every save of an unrelated
+ * field look like a revocation.
+ */
+export function audienceRevocations(
+  before: THidReaderAudiences,
+  after: THidReaderAudiences,
+  counts: THidPermissionCounts | null | undefined,
+): Array<{ audience: THidReaderAudience; label: string; people: number }> {
+  return HID_READER_AUDIENCE_FIELDS
+    .filter((field) => before[field.value] === true && after[field.value] === false)
+    .map((field) => ({
+      audience: field.value,
+      label: field.label,
+      people: peopleLosingAccess(field.value, counts),
+    }));
+}
+
+/**
+ * Account types this edit would leave with NO reader at the site.
+ *
+ * A warning rather than a refusal: a site may genuinely have no door for
+ * contractors, and the last reader is sometimes switched off because it is being
+ * decommissioned. But doing it unknowingly means residents - or a whole category
+ * of people - quietly have no way in, and nothing else on the screen would say so.
+ *
+ * The reader being edited is judged by `after`, not by what is stored, so the
+ * warning describes the save about to happen rather than the state before it.
+ */
+export function audiencesLeftWithNoReader(
+  readerId: unknown,
+  after: THidReaderAudiences,
+  siteReaders: ReadonlyArray<Record<string, unknown>>,
+): Array<{ audience: THidReaderAudience; label: string }> {
+  const editing = String(readerId ?? "").trim();
+  return HID_READER_AUDIENCE_FIELDS
+    .filter((field) => {
+      const servedElsewhere = siteReaders.some((reader) => {
+        const id = String(reader?._id ?? "").trim();
+        // The reader being edited is judged by the pending values, not the stored
+        // ones - otherwise saving its own switch-off would never warn.
+        if (editing && id === editing) return false;
+        return readerServesAudience(reader, field.value);
+      });
+      return !servedElsewhere && after[field.value] === false;
+    })
+    .map((field) => ({ audience: field.value, label: field.label }));
+}