@7365admin1/layer-common 4.97.1-staging.575 → 4.97.1-staging.577

package/components/FeedbackMain.vue

@@ -28,6 +28,14 @@
           class="ml-2"
           style="max-width: 250px"
         />
+        <v-autocomplete
+          v-model="filterByCategory"
+          :items="categoryFilterItems"
+          label="Filter by category"
+          hide-details
+          class="ml-2"
+          style="max-width: 250px"
+        />
         <v-text-field
           v-model="startDate"
           :value="standardFormatDate(startDate)"
@@ -684,6 +692,7 @@ const pageRange = ref("-- - -- of --");
 const items = ref<Array<Record<string, any>>>([]);
 
 const filterByStatus = ref("All");
+const filterByCategory = ref("All");
 const getPast30DaysDate = (): Date => {
   const today = new Date();
   const past30Days = new Date(today);
@@ -715,9 +724,10 @@ const {
       dateTo: moment(endDate.value, "DD/MM/YYYY").endOf("day"),
       search: searchText.value,
       status: filterByStatus.value == "All" ? "" : filterByStatus.value,
+      category: filterByCategory.value == "All" ? "" : filterByCategory.value,
     }),
   {
-    watch: [filterByStatus, searchText, page, startDate, endDate],
+    watch: [filterByStatus, filterByCategory, searchText, page, startDate, endDate],
   }
 );
 
@@ -1068,6 +1078,12 @@ const subjectOptions = computed(() => {
     });
 });
 
+// Same categories as the create form, plus "All" (default: nothing hidden).
+const categoryFilterItems = computed(() => [
+  "All",
+  ...subjectOptions.value.map((item) => item.title),
+]);
+
 const isFileUploading = ref<boolean>(false);
 type TFile = {
   name: string;

package/components/RolePermissionFormCreate.vue

@@ -283,6 +283,7 @@ import useRole from "../composables/useRole";
 import useUtils from "../composables/useUtils";
 import useSite from "../composables/useSite";
 import { readApiError } from "../utils/subscription-form";
+import { withSecurityMarker } from "../utils/security-catalogue";
 import { applyRolePreset, ROLE_PRESETS, type TRolePreset } from "../utils/inventory-presets";
 
 /** Shown after "Couldn't save:" when the server gave no reason (network, timeout). */
@@ -533,7 +534,10 @@ async function submit() {
   try {
     await createRole({
       name: name.value,
-      permissions: permState.value.selected,
+      // Security catalogue only (it carries `offline-data`): stamp the v2 marker.
+      permissions: "offline-data" in (props.permissions || {})
+        ? withSecurityMarker(permState.value.selected)
+        : permState.value.selected,
       type: props.type,
       org: props.org,
       site: props.siteId,

package/components/RolePermissionFormPreviewUpdate.vue

@@ -272,6 +272,11 @@ import {
 import useRole from "../composables/useRole";
 import useUtils from "../composables/useUtils";
 import { readApiError } from "../utils/subscription-form";
+import {
+  countRealPermissions,
+  securityV2PreTicks,
+  withSecurityMarker,
+} from "../utils/security-catalogue";
 import {
   holdsPermission,
   withoutPermission,
@@ -348,8 +353,8 @@ const totalLabel = computed(() => {
   const held = definedModel.value ?? [];
   if (holdsWildcard.value) return "All";
   return props.catalogueSize > 0
-    ? `${held.length} / ${props.catalogueSize}`
-    : String(held.length);
+    ? `${countRealPermissions(held)} / ${props.catalogueSize}`
+    : String(countRealPermissions(held));
 });
 
 /**
@@ -638,6 +643,23 @@ const edit = defineModel<boolean>("edit", {
   default: false,
 });
 
+/**
+ * Security catalogue only: the Security tree carries the `offline-data`
+ * module. Other apps' editors never match, so they are untouched.
+ */
+const isSecurityCatalogue = computed(
+  () => "offline-data" in (props.permissions as Record<string, unknown>)
+);
+
+// Opening an UNMARKED security role for edit: pre-tick the new boxes the role
+// already effectively has (legacy fallback), so an unrelated save never strips
+// access. Cancel restores the original list.
+watch(edit, (on) => {
+  if (!on || !isSecurityCatalogue.value) return;
+  const add = securityV2PreTicks(definedModel.value ?? []);
+  if (add.length) definedModel.value = [...definedModel.value, ...add];
+});
+
 /**
  * CANCEL THROWS THE DRAFT AWAY.
  *
@@ -688,7 +710,10 @@ const errorMessages = computed(() => {
     return equalValue;
   }
 
-  const requiredValue = requireListRule(definedModel.value);
+  // The marker is not a permission: a list holding only it is still empty.
+  const requiredValue = requireListRule(
+    (definedModel.value ?? []).filter((p) => countRealPermissions([p]) > 0)
+  );
   if (requiredValue) {
     return requiredValue;
   }
@@ -706,7 +731,12 @@ async function submit() {
   disable.value = true;
   message.value = "";
   try {
-    await updatePermissionById(props.id, definedModel.value);
+    await updatePermissionById(
+      props.id,
+      isSecurityCatalogue.value
+        ? withSecurityMarker(definedModel.value)
+        : definedModel.value
+    );
     emit("success");
   } catch (error: any) {
     // `error.response` is undefined on a network or timeout failure, so the old

package/components/RolePermissionMain.vue

@@ -208,6 +208,7 @@
 // Relative import: this layer's `utils/` is not auto-imported into consumers.
 import { roleLabel, safeReturnTo, showSiteField, sitePickerRoleLabel } from "../utils/role";
 import { holdsPermission } from "../utils/permission-spellings";
+import { countRealPermissions } from "../utils/security-catalogue";
 import {
   catalogueForOrg,
   catalogueForOwnerGrant,
@@ -570,7 +571,8 @@ function getPermissionCount(permissions: unknown): string {
   if (held.includes("*")) return "All";
 
   const offered = permissionCatalogueSize.value;
-  return offered > 0 ? `${held.length} / ${offered}` : String(held.length);
+  const count = countRealPermissions(held);
+  return offered > 0 ? `${count} / ${offered}` : String(count);
 }
 
 function updateRolePermissionsInList(

package/components/VehicleAddSelection.vue

@@ -27,6 +27,8 @@
 type TVehicleAddChoice = TVehicleType | "seasonpass" | "whitelist-bulk";
 
 const prop = defineProps({
+  // Security catalogue v2: false hides the Blocklist choice. Default = today.
+  canManageBlocklist: { type: Boolean, default: true },
 });
 
 const emit = defineEmits(['cancel', 'select']);
@@ -37,7 +39,9 @@ const selection = computed<{label: string, value: TVehicleAddChoice}[]>(() => {
     // Many whitelist vehicles at once, typed or pasted into a sheet.
     { label: "Whitelist (Bulk)", value: "whitelist-bulk" },
     { label: "Season Pass", value: "seasonpass" },
-    { label: "Blocklist", value: "blocklist" },
+    ...(prop.canManageBlocklist
+      ? [{ label: "Blocklist", value: "blocklist" as TVehicleAddChoice }]
+      : []),
   ];
 })
 

package/components/VehicleManagement.vue

@@ -137,7 +137,7 @@
     <!-- <Snackbar v-model="messageSnackbar" :text="message" :color="messageColor" /> -->
 
     <v-dialog v-model="dialog.showSelection" width="450" persistent>
-      <VehicleAddSelection @cancel="dialog.showSelection = false" @select="handleSelectVehicleStatus" />
+      <VehicleAddSelection :can-manage-blocklist="canManageBlocklist" @cancel="dialog.showSelection = false" @select="handleSelectVehicleStatus" />
     </v-dialog>
 
     <!-- Many whitelist vehicles at once. Wider than the one-vehicle form: it
@@ -495,6 +495,9 @@ const props = defineProps({
   canDeleteVehicle: { type: Boolean, default: false },
   canViewVehicleDetails: { type: Boolean, default: false },
   canApproveVehicle: { type: Boolean, default: false },
+  // Security catalogue v2. Defaults keep today's behaviour for every other app.
+  canSeeBlocklist: { type: Boolean, default: true },
+  canManageBlocklist: { type: Boolean, default: undefined },
   site: { type: String, required: true },
   org: { type: String, required: true },
   app: { type: String, required: true },
@@ -578,11 +581,13 @@ const historyHeaders = [
  *                   resident / season pass that was blocked
  */
 type TVehicleTab = "residents" | "season-passes" | "block-listed";
-const vehicleTabs: { name: string; value: TVehicleTab }[] = [
+const vehicleTabs = computed<{ name: string; value: TVehicleTab }[]>(() => [
   { name: "Residents", value: "residents" },
   { name: "Season Passes", value: "season-passes" },
-  { name: "Block Listed", value: "block-listed" },
-]
+  ...(props.canSeeBlocklist
+    ? [{ name: "Block Listed", value: "block-listed" as TVehicleTab }]
+    : []),
+])
 const activeTab = ref<TVehicleTab>("residents");
 
 
@@ -1134,6 +1139,7 @@ const vehiclePermissions = computed(() => ({
   canUpdateVehicle: props.canUpdateVehicle && !revoked.update,
   canDeleteVehicle: props.canDeleteVehicle && !revoked.delete,
   canApproveVehicle: props.canApproveVehicle && !revoked.approve,
+  canManageBlocklist: props.canManageBlocklist,
 }));
 
 /**

package/composables/useFeedback.ts

@@ -73,6 +73,7 @@ export default function useFeedback() {
     provider = "",
     service = "",
     userId = "",
+    category = "",
   }: {
     page?: number;
     limit?: number;
@@ -85,6 +86,8 @@ export default function useFeedback() {
     provider?: string | any;
     service?: string;
     userId?: string;
+    /** Optional: one category (the feedback subject) or a comma list. Empty = all. */
+    category?: string;
   } = {}) {
     try {
       return useNuxtApp().$api<Record<string, any>>("/api/feedbacks2", {
@@ -100,6 +103,7 @@ export default function useFeedback() {
           status,
           provider,
           service,
+          ...(category && { category }),
           ...(currentUser.value?.type != "site" && {
             userId,
           }),

package/composables/useSecurityPermission.ts

@@ -115,6 +115,14 @@ export default function useSecurityPermission() {
     },
 
     "vehicle-mgmt": {
+      "see-blocklist": {
+        check: true,
+        description: "See Blocklist",
+      },
+      "manage-blocklist": {
+        check: true,
+        description: "Block / Unblock Vehicles",
+      },
       "add-vehicle": {
         check: true,
         description: "Allows the user to add a new vehicle to the system.",
@@ -291,6 +299,10 @@ export default function useSecurityPermission() {
     },
 
     "visitor-mgmt": {
+      "invite-visitor": {
+        check: true,
+        description: "Invite Visitor / Contractor",
+      },
       "add-visitor": {
         check: true,
         description: "Allows the user to add a new visitor to the system.",
@@ -834,6 +846,13 @@ export default function useSecurityPermission() {
 
     },
 
+    "offline-data": {
+      "see-offline-data": {
+        check: true,
+        description: "See Offline Data",
+      },
+    },
+
   };
 
   return {

package/constants/permissions.ts

@@ -413,7 +413,12 @@ export const PERMISSIONS = {
   ],
 
   // ---- security ----
+  // Security catalogue v2 (2026-10-20). `catalogue:security-v2` is the marker the
+  // role editor stamps on save; it grants nothing (see utils/security-catalogue.ts).
+  "offline-data": ["see-offline-data"],
+  catalogue: ["security-v2"],
   "visitor-mgmt": [
+    "invite-visitor",
     "see-all-visitor",
     "add-visitor",
     "update-visitor",
@@ -421,6 +426,8 @@ export const PERMISSIONS = {
     "delete-visitor",
   ],
   "vehicle-mgmt": [
+    "see-blocklist",
+    "manage-blocklist",
     "see-all-vehicles",
     "add-vehicle",
     "update-vehicle",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.97.1-staging.575",
+  "version": "4.97.1-staging.577",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",

package/utils/org-modules.ts

@@ -54,6 +54,7 @@ export const ALWAYS_ALLOWED_MODULES: readonly string[] = Object.freeze([
   "roles",
   "roles-and-permissions",
   "site-settings",
+  "offline-data",
 ]);
 
 /**
@@ -246,6 +247,21 @@ export function ownerGrant(
   return chosen ? (permissions as unknown[]).map(String) : null;
 }
 
+/**
+ * Legacy grant keys that also carry a newer key split out of them. Mirrors
+ * core `PERMISSION_COVERS` (security catalogue v2 entries only).
+ */
+const GRANT_COVERS: Readonly<Record<string, readonly string[]>> = {
+  "vehicle-mgmt:see-all-vehicles": ["vehicle-mgmt:see-blocklist"],
+  "vehicle-mgmt:update-vehicle": ["vehicle-mgmt:manage-blocklist"],
+  "visitor-mgmt:add-visitor": ["visitor-mgmt:invite-visitor"],
+  "visitorManagement:add-visitor": ["visitor-mgmt:invite-visitor"],
+  "visitor:create": ["visitor-mgmt:invite-visitor"],
+};
+
+const grantHolds = (grant: readonly string[], key: string) =>
+  grant.includes(key) || grant.some((g) => GRANT_COVERS[g]?.includes(key));
+
 /**
  * Narrow a `{ resource: { action } }` catalogue to that grant. Running the
  * organisation (`ALWAYS_ALLOWED_MODULES`) is never narrowed, matching the
@@ -266,7 +282,7 @@ export function catalogueForOwnerGrant<T extends Record<string, unknown>>(
     if (!actions || typeof actions !== "object") continue;
     const kept = Object.fromEntries(
       Object.entries(actions as Record<string, unknown>).filter(([action]) =>
-        grant.includes(`${resource}:${action}`),
+        grantHolds(grant, `${resource}:${action}`),
       ),
     );
     if (Object.keys(kept).length) narrowed[resource] = kept;

package/utils/security-catalogue.ts

@@ -0,0 +1,59 @@
+import { holdsPermission } from "./permission-spellings.ts";
+
+/**
+ * Security catalogue v2 marker. The role editor adds it on save (security roles
+ * only). It grants nothing -- it only says "this role was saved with the new
+ * boxes, so check them exactly". A role without it keeps today's behaviour.
+ * Mirrors core/API-core; keep the three in step.
+ */
+export const SECURITY_CATALOGUE_MARKER = "catalogue:security-v2";
+
+/** new key -> legacy keys that stand in for it on an UNMARKED role. null = open to all. */
+export const SECURITY_V2_FALLBACKS: Readonly<Record<string, readonly string[] | null>> = {
+  "vehicle-mgmt:see-blocklist": ["vehicle-mgmt:see-all-vehicles"],
+  "vehicle-mgmt:manage-blocklist": ["vehicle-mgmt:update-vehicle"],
+  "visitor-mgmt:invite-visitor": [
+    "visitor-mgmt:add-visitor",
+    "visitorManagement:add-visitor",
+    "visitor:create",
+  ],
+  "offline-data:see-offline-data": null,
+};
+
+export const isSecurityV2Marked = (perms?: readonly string[] | null) =>
+  !!perms?.includes(SECURITY_CATALOGUE_MARKER);
+
+/** Real keys = anything that is not the marker or the wildcard. */
+export const countRealPermissions = (perms?: readonly string[] | null) =>
+  (perms ?? []).filter((p) => p !== SECURITY_CATALOGUE_MARKER).length;
+
+/**
+ * Effective grant for a v2 key. Empty list / "*" = allowed (same as
+ * usePermission). Unmarked role -> legacy fallback; marked role -> exact key.
+ */
+export function effectiveSecurityGrant(
+  perms: readonly string[] | undefined | null,
+  key: string,
+): boolean {
+  if (!perms?.length || perms.includes("*")) return true;
+  if (isSecurityV2Marked(perms)) return holdsPermission(perms, key);
+  const legacy = SECURITY_V2_FALLBACKS[key];
+  if (legacy === undefined) return holdsPermission(perms, key);
+  if (legacy === null) return true;
+  return legacy.some((k) => holdsPermission(perms, k));
+}
+
+/** Marker to append on save: only when the list has a real key and no "*". */
+export function withSecurityMarker(perms: readonly string[]): string[] {
+  const keys = perms.filter((p) => p !== SECURITY_CATALOGUE_MARKER);
+  if (!keys.length || keys.includes("*")) return keys;
+  return [...keys, SECURITY_CATALOGUE_MARKER];
+}
+
+/** New keys to pre-tick when opening an UNMARKED role in the editor. */
+export function securityV2PreTicks(perms: readonly string[]): string[] {
+  if (!perms.length || perms.includes("*") || isSecurityV2Marked(perms)) return [];
+  return Object.keys(SECURITY_V2_FALLBACKS).filter(
+    (k) => !perms.includes(k) && effectiveSecurityGrant(perms, k),
+  );
+}

package/utils/vehicle-actions.ts

@@ -27,6 +27,8 @@ export type VehicleActionPermissions = {
   canUpdateVehicle?: boolean;
   canDeleteVehicle?: boolean;
   canApproveVehicle?: boolean;
+  /** Block / Unblock. Omitted = allowed (today's behaviour). */
+  canManageBlocklist?: boolean;
 };
 
 export type VehicleAction = {
@@ -81,6 +83,12 @@ export function vehiclePlateActions(
   const isRestorable = RESTORABLE.has(status);
 
   const canUpdate = !!permissions.canUpdateVehicle;
+  // Server accepts manage-blocklist OR update-vehicle. When the caller passes the
+  // flag it decides alone; absent, block follows update (today's rule).
+  const canBlock =
+    permissions.canManageBlocklist === undefined
+      ? canUpdate
+      : !!permissions.canManageBlocklist;
   const actions: VehicleAction[] = [];
 
   if (canUpdate && (isAllowed || isBlocked)) {
@@ -118,7 +126,7 @@ export function vehiclePlateActions(
   // same thing. A deleted whitelist plate keeps Block - that turns it into a
   // blocked plate, which Restore (back to allowed) does not.
   const restoresToBlocked = isRestorable && type === "blocklist";
-  if (canUpdate && (isAllowed || isUnblocked || (isRestorable && !restoresToBlocked))) {
+  if (canBlock && (isAllowed || isUnblocked || (isRestorable && !restoresToBlocked))) {
     actions.push({
       key: "block",
       title: "Block",
@@ -127,7 +135,7 @@ export function vehiclePlateActions(
     });
   }
 
-  if (canUpdate && isBlocked) {
+  if (canBlock && isBlocked) {
     actions.push({
       key: "unblock",
       title: "Unblock",