@updraft-solutions/mcrit-sdk 0.14.16 → 0.14.18

package/src/schemas/common.ts

@@ -89,7 +89,11 @@ export type ImpersonationState = z.infer<typeof impersonationStateSchema>;
 export const userSchema = z.object({
   type: z.literal("user"),
   id: z.number(),
-  name: z.string(),
+  // name/firstname/lastname are gate-guarded server-side exactly like
+  // email/mobile below (a `viewName` policy decision, driven by the member's
+  // own `name.visibility` setting) and go null TOGETHER when denied. Render
+  // a placeholder via a display-name helper — never a bare `user.name`.
+  name: z.string().nullable(),
   firstname: z.string().nullable().optional(),
   lastname: z.string().nullable().optional(),
   // email/mobile are gate-guarded server-side (viewMail/viewMobile) and come

package/src/schemas/faq.ts

@@ -7,12 +7,17 @@ export enum FaqStatus {
   REJECTED = "rejected",
 }
 
-// User schema for submitter/reviewer
+// User schema for submitter/reviewer.
+//
+// `name` and `email` are both gate-guarded server-side (`UserPolicy::viewName`
+// / `viewMail`) and come back null for a viewer the member hid them from —
+// a company member without `membership.viewMail` sees the submitter's name
+// but no address. Render a placeholder, never a bare `.email`.
 const UserBasicSchema = z
   .object({
     id: z.number(),
-    name: z.string(),
-    email: z.string().email(),
+    name: z.string().nullable(),
+    email: z.string().email().nullable(),
   })
   .nullable();
 

package/src/schemas/fbo.ts

@@ -149,8 +149,19 @@ export const fboFlightSchema = z.object({
   landings: z.number().nullable(),
   remarks: z.string().nullable(),
 
-  // Null on an assigned company's booking rendered as a movement (see `source`).
-  contact: zContactDTO.nullable(),
+  /**
+   * The filer's contact block. Own-row tier since the 2026-08 hardening: the
+   * key is OMITTED for a reader who is neither the movement's author, a root
+   * decider, nor in `assigned_user_ids` — a tenant colleague browsing a
+   * movement they did not file no longer receives it. Still explicitly `null`
+   * on an assigned company's booking rendered as a movement (see `source`),
+   * so BOTH `undefined` and `null` occur and consumers must use `contact?.…`.
+   *
+   * A client that backfills an empty block to bind a form to must key that on
+   * the KEY BEING PRESENT — `UpdateFlightRequest` accepts `contact` from any
+   * updater, so sending a seeded blank would erase the author's data.
+   */
+  contact: zContactDTO.nullable().optional(),
   ground_services: fboGroundServicesSchema.nullable(),
   acceptance_status: fboAcceptanceStatusSchema,
 

package/src/schemas/models.ts

@@ -27,7 +27,13 @@ export const membershipIdentitySchema = z.object({
   user_id: z.number(),
   user: userSchema.optional(),
   company_id: z.number(),
-  name: z.string(),
+  // The member's display name, lifted off the user row — and gate-guarded on
+  // the way, exactly like `userSchema.name`: `MembershipResource` and
+  // `MembershipIdentityResource` both run it through `UserPolicy::viewName`
+  // (driven by the member's own `name.visibility` setting, default `*`) and
+  // send `null` when denied. Render a placeholder, never a bare
+  // `membership.name`.
+  name: z.string().nullable(),
 });
 
 /**
@@ -310,6 +316,28 @@ export const airplanePermissionSchema = z.object({
     .optional(),
 });
 
+export const teachingPermissionSchema = z.object({
+  type: z.literal("teaching_permission"),
+  id: z.number(),
+  course_id: z.number(),
+  course: z.object({ id: z.number(), name: z.string() }).passthrough().optional(),
+  membership_id: z.number(),
+  membership: nestedMembershipSchema.optional(),
+  status: z.enum(["pending", "approved"]),
+  is_active: z.boolean(),
+  expires_at: z.string().nullable().optional(),
+  notes: z.string().nullable().optional(),
+  conditions: z.string().nullable().optional(),
+  requested_by: userSchema.nullable().optional(),
+  approved_by: userSchema.nullable().optional(),
+  approved_at: z.string().nullable().optional(),
+  created_at: z.string(),
+  updated_at: z.string(),
+  can: z
+    .object({ view: zNullableBool, update: zNullableBool, delete: zNullableBool, approve: zNullableBool })
+    .optional(),
+});
+
 export const landingFeeSchema = z.object({
   id: z.number(),
   airplane_id: z.number(),

package/src/types/compliance.ts

@@ -12,6 +12,12 @@ export interface ComplianceRequirement {
   // isn't the blocker — consumers refine this into an `awaiting_countersign`
   // display state.
   awaiting_countersignature?: boolean;
+  // Whether the displayed submission is visible to the requesting company:
+  // it resolves to that company (company template / membership-issued, e.g.
+  // the Chartervertrag) or the member explicitly shared their user-owned
+  // submission. Stamped by the backend for User targets; absent for other
+  // target types.
+  shared?: boolean;
   // The submission to display for this requirement: the satisfying (final,
   // non-expired) one when present, otherwise the latest expired /
   // awaiting-signatures submission so the UI can explain *why* an unmet

package/src/types/models.ts

@@ -22,6 +22,9 @@ export type ExtendedAirplane = z.infer<
 export type AirplanePermission = z.infer<
   typeof ModelSchemas.airplanePermissionSchema
 >;
+export type TeachingPermission = z.infer<
+  typeof ModelSchemas.teachingPermissionSchema
+>;
 export type AirplaneShareInvite = z.infer<
   typeof ModelSchemas.airplaneShareInviteSchema
 >;