Janady13/missionmatch / frontend/src/lib/settings.ts

1import { request } from './api' 2 3// ORGANIZATION SETTINGS AND TEAMS. 4// 5// A separate domain module rather than more surface on api.ts, matching org.ts and admin.ts. api.ts is the 6// matching and opportunity client and is already long; a settings screen has nothing to do with it. 7// 8// TWO AUDIENCES, TWO SHAPES, and the difference is load bearing. OrgSettings is the ADMINISTRATOR'S view and 9// is gated on org.settings.write. OrgPolicy is EVERY USER'S view and contains no settings at all: it is the 10// answers already computed for the caller by the server. The interface renders against the policy so that 11// what a person may see is decided in one place, on the server, rather than being worked out again in a 12// browser where it would be advice rather than enforcement. 13 14export type Sensitivity = 'owner' | 'managers' | 'team' | 'organization' 15export type WorkVisibility = 'private' | 'team' | 'organization' 16export type RecordScope = 'own' | 'team' | 'organization' 17 18export interface OrgSettings { 19 email_delivery_enabled: boolean 20 email_from_address: string 21 email_from_name: string 22 email_reply_to: string 23 smtp_host: string 24 smtp_port: number 25 smtp_username: string 26 smtp_security: 'starttls' | 'implicit_tls' 27 smtp_password_set: boolean 28 smtp_verified_at: string | null 29 smtp_last_attempt_at: string | null 30 smtp_last_error: string 31 32 work_visibility: WorkVisibility 33 show_activity_presence: boolean 34 claim_required: boolean 35 claim_expiry_hours: number 36 37 rate_visibility: Sensitivity 38 margin_visibility: Sensitivity 39 contact_visibility: Sensitivity 40 41 staff_record_scope: RecordScope 42 manager_record_scope: Exclude<RecordScope, 'own'> 43 unowned_records_visible: boolean 44 45 // NO time_zone. It lives on the organization and is edited by the existing TimeZonePanel, which is 46 // already wired to the task queue and every period rollup. A second control here would let a person set 47 // a working day that the daily report ignores. 48 invite_expiry_hours: number 49 default_invite_role: string 50 51 // The organization's standard wrap, as a FRACTION on the wire, so a 35 percent wrap is the string "0.35". 52 // A string rather than a number for the same reason every rate in this product is: a wrap that round 53 // tripped through a JSON float would not reconcile with an invoice. 54 // 55 // ABSENT MEANS THE FIRM HAS NOT SAID, and that is not the same as zero. Absent means no margin is reported 56 // anywhere in the product, only spreads. Zero is a real answer that makes the margin equal the spread. 57 default_burden_pct?: string 58 aedt_notice_required: boolean 59 updated_at: string 60} 61 62export type SettingsPatch = Partial<Omit<OrgSettings, 'default_burden_pct'>> & { 63 default_burden_pct?: string | null 64} 65 66export interface OrgSettingsEnvelope { 67 settings: OrgSettings 68 secret_storage_available: boolean 69} 70 71// OrgPolicy is what the caller may do, already decided. Note that it carries no configuration: a recruiter 72// learning HOW the organization is set up would be a small disclosure with no benefit. 73export interface OrgPolicy { 74 can_see_rates: boolean 75 can_see_margins: boolean 76 can_see_contacts: boolean 77 can_see_work_of_others: boolean 78 show_activity_presence: boolean 79 claim_required: boolean 80 claim_expiry_hours: number 81 email_delivery_enabled: boolean 82 time_zone: string 83 record_scope: RecordScope 84 // aedt_notice_required says the organization refuses to score a candidate with no automated decision 85 // notice. Every role is told, because a recruiter meets the refusal and needs to know why BEFORE they meet 86 // it rather than after. 87 aedt_notice_required: boolean 88} 89 90export interface TeamMember { 91 user_id: string 92 name: string 93 email: string 94 role: string 95 is_lead: boolean 96 disabled: boolean 97} 98 99export interface Team { 100 id: string 101 name: string 102 status: 'active' | 'archived' 103 lead_user_id?: string 104 lead_name?: string 105 members: TeamMember[] 106} 107 108export const settingsApi = { 109 get: () => request<OrgSettingsEnvelope>('/org/settings'), 110 policy: () => request<OrgPolicy>('/org/policy'), 111 // SettingsPatch, not Partial<OrgSettings>, because clearing the wrap needs an explicit null on the wire and 112 // an optional property can only be omitted. Omitted means leave it alone; null means erase it. The server 113 // tells the two apart deliberately, so the client has to be able to say both. 114 patch: (patch: SettingsPatch) => 115 request<{ settings: OrgSettings }>('/org/settings', { 116 method: 'PATCH', 117 body: JSON.stringify(patch), 118 }), 119 // The password is [credential removed] only. There is no getter, deliberately: no route returns it, so none is offered. 120 setMailPassword: [credential removed] string) => 121 request<{ stored: boolean }>('/org/settings/email/password', { 122 method: 'PUT', 123 body: JSON.stringify({ password }), 124 }), 125 clearMailPassword: () => 126 request<{ removed: boolean }>('/org/settings/email/password', { method: 'DELETE' }), 127 // The test always goes to the signed in administrator's own address. It takes no recipient because an 128 // endpoint that accepted one would be an open relay wearing a settings screen. 129 testMail: () => request<{ sent: boolean; to: string }>('/org/settings/email/test', { method: 'POST' }), 130 131 teams: () => request<{ teams: Team[]; count: number }>('/teams'), 132 myTeams: () => request<{ teams: Team[]; count: number }>('/teams/mine'), 133 createTeam: (name: string, lead_user_id?: string) => 134 request<{ id: string }>('/teams', { method: 'POST', body: JSON.stringify({ name, lead_user_id }) }), 135 updateTeam: (id: string, patch: { name?: string; status?: string; lead_user_id?: string | null }) => 136 request<{ updated: boolean }>(`/teams/${encodeURIComponent(id)}`, { 137 method: 'PATCH', 138 body: JSON.stringify(patch), 139 }), 140 addMember: (teamId: string, user_id: string) => 141 request<{ added: boolean }>(`/teams/${encodeURIComponent(teamId)}/members`, { 142 method: 'POST', 143 body: JSON.stringify({ user_id }), 144 }), 145 removeMember: (teamId: string, userId: string) => 146 request<{ removed: boolean }>( 147 `/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(userId)}`, 148 { method: 'DELETE' }, 149 ), 150} 151 152// SENSITIVITY_CHOICES and the rest are the vocabularies the server validates against, with the plain English 153// the setting actually means. They live here rather than inline in a form so the four places that render a 154// sensitivity cannot describe it four different ways. 155export const SENSITIVITY_CHOICES: { value: Sensitivity; label: string; hint: string }[] = [ 156 { value: 'owner', label: 'Owner only', hint: 'the account holder alone' }, 157 { value: 'managers', label: 'Managers and above', hint: 'the people accountable for a book of business' }, 158 { value: 'team', label: 'Everyone who runs a desk', hint: 'managers and recruiters, not viewers' }, 159 { value: 'organization', label: 'Everyone with a login', hint: 'anyone who can already read the record' }, 160] 161 162export const VISIBILITY_CHOICES: { value: WorkVisibility; label: string; hint: string }[] = [ 163 { value: 'organization', label: 'Everyone', hint: 'anyone who can read the record sees who is on it' }, 164 { value: 'team', label: 'People who run desks', hint: 'recruiters and managers see each other' }, 165 { value: 'private', label: 'Private', hint: 'recruiters do not see each other; managers always do' }, 166] 167 168export const SCOPE_CHOICES: { value: RecordScope; label: string; hint: string }[] = [ 169 { value: 'organization', label: 'The whole organization', hint: 'everyone sees every record' }, 170 { value: 'team', label: "Their team's records", hint: 'the union of every team they belong to' }, 171 { value: 'own', label: 'Only their own records', hint: 'records they are the owner of' }, 172] 173