@aiquants/authz-react-router 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AI Quants / fehde-k
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,118 @@
+# @aiquants/authz-react-router
+
+React Router (v7) adapter for [`@aiquants/authz-core`](https://www.npmjs.com/package/@aiquants/authz-core). Binds `appKey` + DI deps and provides loader/action guards, a hook, and a self-permission indicator component.
+
+## Install
+
+Monorepo (already a pnpm workspace package):
+
+```jsonc
+// consumer package.json
+"dependencies": {
+  "@aiquants/authz-core": "workspace:*",
+  "@aiquants/authz-drizzle": "workspace:*",
+  "@aiquants/authz-react-router": "workspace:*"
+}
+```
+
+External projects:
+
+```bash
+pnpm add @aiquants/authz-react-router react react-router   # peers: react >=18, react-router ^7
+```
+
+`react` / `react-router` are **peer dependencies**; `@aiquants/authz-core` is transitive. Pair with `@aiquants/authz-drizzle` (or another adapter) for `getEffectivePermissions`. Build / test: `pnpm run build` / `pnpm run test`.
+
+## Full integration (zero → guarded endpoint)
+
+This walkthrough takes a React Router v7 app from nothing to a permission-guarded loader. It uses all three TS packages.
+
+**Step 0 — install & create tables.** Install the three packages (above) plus your DB stack. Run the **DDL** and **bootstrap seed** from the `@aiquants/authz-drizzle` README once (this creates `dbo_authz` and an initial admin). You also need a **user table** with a numeric id and a way to resolve the current request to that id (your existing auth/session).
+
+**Step 1 — wire it once.** Bind your `appKey`, how to resolve a user id, and how to load grants (delegated to the drizzle adapter).
+
+```ts
+// app/services/authz/config.ts
+import { defineAuthzSchema, getEffectivePermissions } from "@aiquants/authz-drizzle"
+import { createAuthz } from "@aiquants/authz-react-router"
+import { db } from "~/db.server"            // your drizzle handle
+import { Users } from "~/models/Users"      // your user table (has numeric id)
+import { getSessionUser } from "~/auth.server"
+
+export const authzTables = defineAuthzSchema("dbo_authz", { userTable: Users })
+
+const authz = createAuthz({
+  appKey: "myapp",
+  // request → your user id (or null → denied as "unresolved-user")
+  resolveUserId: async (request) => (await getSessionUser(request))?.id ?? null,
+  // load + merge this user's grants for one (app, resource)
+  getEffectivePermissions: (args) => getEffectivePermissions(db, authzTables, args),
+})
+
+export const { requirePermission, getMyPermissions } = authz
+```
+
+> If your DB pool can be cold at the first request (serverless / lazy connect), have `resolveUserId` and `getEffectivePermissions` await a connection-ready guard first — otherwise a cold-start DB error can surface as a misleading 403 instead of a 500.
+
+**Step 2 — guard a loader/action and apply scope.** On allow you get `{ userId, scope }`, so you can both authorize *and* narrow the data.
+
+```ts
+// app/routes/report.tsx
+import { applyRowScope, maskColumns } from "@aiquants/authz-drizzle"
+import { requirePermission } from "~/services/authz/config"
+import { db } from "~/db.server"
+import { Report } from "~/models/Report"
+
+export async function loader({ request }: { request: Request }) {
+  const { scope } = await requirePermission(request, { resourceKey: "report", action: "read" })
+  // map the scope's logical field names → real columns (per endpoint; the core layer doesn't know your table)
+  const columnMap = { dept: Report.dept, amount: Report.amount }
+  const rows = await applyRowScope(db.select().from(Report), scope.rowScope, columnMap)
+  return { rows: maskColumns(rows, scope.columnScope) }   // deny disallowed columns before returning
+}
+// denied → AuthzDeniedError (throw a 403 Response in your error boundary, or pass options.failureRedirect)
+```
+
+**Step 3 — register the resource + grant.** Insert a `TMResource('myapp','report')` and a `TDRolePermission` for the role(s) that should see it. Either run SQL, or build a tiny admin screen with the CRUD helpers (see the host app's admin guide). Example grant: "role `viewer` may `read` report, rows where dept ∈ {A}, hiding the amount column":
+
+```sql
+-- row_scope / column_scope are the §3.2 JSON from @aiquants/authz-core
+INSERT INTO dbo_authz.TDRolePermission (role_id, resource_id, action, row_scope, column_scope)
+SELECT r.id, res.id, 'read',
+       N'{"filters":[{"field":"dept","op":"in","values":["A"]}]}',
+       N'{"mode":"deny","columns":["amount"]}'
+FROM dbo_authz.TMRole r JOIN dbo_authz.TMResource res ON res.app_key='myapp' AND res.resource_key='report'
+WHERE r.role_key='viewer';
+```
+
+**Step 4 — show the user their permission (optional).** Feed `getMyPermissions` into a loader and render the indicator.
+
+```tsx
+// loader: const myPermissions = await getMyPermissions(request, { resourceKeys: ["report"] })
+import { MyPermissionIndicator } from "@aiquants/authz-react-router"
+<MyPermissionIndicator permission={myPermissions.report} />   // → 読○ 書△ 削除×
+```
+
+## Scope cheat-sheet (§3.2)
+
+The JSON you put in `row_scope` / `column_scope` (full contract in `@aiquants/authz-core`):
+
+```jsonc
+// row_scope — which rows. NULL/empty = all rows. filters are AND'd. op ∈ in|notIn|eq|ne. null in values → IS (NOT) NULL.
+{ "filters": [ { "field": "dept", "op": "in", "values": ["A","B"] } ] }
+// column_scope — which columns. NULL/empty = all columns.
+{ "mode": "deny",  "columns": ["amount"] }   // deny = hide these; allow = show only these
+```
+
+Multiple roles **union** (wider wins): rows OR'd (any `NULL` ⇒ all rows); columns merged to the wider set. Anything unparseable fails **closed** (0 rows / 0 columns).
+
+## API
+
+- `createAuthz({ appKey, resolveUserId, getEffectivePermissions, onDeny? })` → `{ requirePermission, getMyPermissions }`.
+- `requirePermission(request, {resourceKey, action}, options?)` → `{ userId, scope }` on allow (so loaders apply row WHERE / column mask — not just 403). Denies throw `AuthzDeniedError` (403), or `throw redirect(options.failureRedirect)` when set.
+- `getMyPermissions(request, {resourceKeys})` → `Record<resourceKey, PermissionView>` for the UI.
+- `toPermissionView(resourceKey, perm)` → serializable view (loader → client).
+- `usePermission(view)` → ○△× display states (`readState`/`writeState`/`deleteState`); pure, safe in render.
+- `<MyPermissionIndicator permission={view} />` → read / write(create∪update) / delete as ○△×. `read` is △ when row/column-restricted; `write` is ○ only when both create & update are held, △ when one.
+
+MIT

package/dist/index.d.mts

@@ -0,0 +1,474 @@
+import * as react from 'react';
+import { ReactNode, CSSProperties } from 'react';
+import * as _aiquants_authz_core from '@aiquants/authz-core';
+import { EffectivePermission, DenyInfo, AuthzAction, GuardResult, AuthzGrant, AuthzResource, AuthzRole, AuthzAssignment, AuthzUser, AuthzAdminStore } from '@aiquants/authz-core';
+import * as react_router from 'react-router';
+
+type Awaitable<T> = T | Promise<T>;
+type AuthzUserId = string | number;
+type AuthzConfig = {
+    /** Stable app identifier (e.g. "quants"). Bound into every permission query. */
+    appKey: string;
+    /** Resolve the acting user id from the request (cookie/session/openid → TDUsers.id). */
+    resolveUserId: (request: Request) => Awaitable<AuthzUserId | null | undefined>;
+    /** Load effective permissions for (user, app, resource) — typically via @aiquants/authz-drizzle. */
+    getEffectivePermissions: (args: {
+        userId: AuthzUserId;
+        appKey: string;
+        resourceKey: string;
+    }) => Awaitable<EffectivePermission | null | undefined>;
+    /** Default deny handler. If omitted, denies throw AuthzDeniedError (403). */
+    onDeny?: (info: DenyInfo) => void;
+};
+type RequirePermissionOptions = {
+    /** When set, denials `throw redirect(failureRedirect)` instead of throwing 403. */
+    failureRedirect?: string;
+};
+/** Serializable per-resource permission summary for UI (loader → component). */
+type PermissionView = {
+    resourceKey: string;
+    read: boolean;
+    create: boolean;
+    update: boolean;
+    delete: boolean;
+    /** create ∪ update */
+    write: boolean;
+    /** read granted but row and/or column restricted (→ △ partial). */
+    readPartial: boolean;
+    actions: AuthzAction[];
+};
+/** Map an EffectivePermission to a serializable {@link PermissionView}. */
+declare function toPermissionView(resourceKey: string, perm: EffectivePermission | null | undefined): PermissionView;
+/**
+ * React Router adapter. Binds `appKey` and the DI deps, exposing:
+ *  - `requirePermission(request, {resourceKey, action}, options?)` → `{ userId, scope }` on allow
+ *    (apply row WHERE / column mask with the returned scope); denies throw 403 or redirect.
+ *  - `getMyPermissions(request, {resourceKeys})` → `Record<resourceKey, PermissionView>` for the UI.
+ */
+declare function createAuthz(config: AuthzConfig): {
+    requirePermission: (request: Request, query: {
+        resourceKey: string;
+        action: AuthzAction;
+    }, options?: RequirePermissionOptions) => Promise<GuardResult<AuthzUserId>>;
+    getMyPermissions: (request: Request, query: {
+        resourceKeys: string[];
+    }) => Promise<Record<string, PermissionView>>;
+};
+
+/** Authz admin UI strings (i18n). Defaults are English; override per-section via `createAuthzAdminRoutes(..., { labels })`. */
+type AuthzAdminLabels = {
+    title: string;
+    myPermission: string;
+    tabs: {
+        roles: string;
+        resources: string;
+        role_permissions: string;
+        user_roles: string;
+    };
+    common: {
+        add: string;
+        save: string;
+        delete: string;
+        remove: string;
+        assign: string;
+        grant: string;
+        select: string;
+        active: string;
+        inactive: string;
+        optional: string;
+    };
+    roles: {
+        heading: string;
+        note: string;
+        roleKey: string;
+        name: string;
+        description: string;
+        activeHeader: string;
+        empty: string;
+        newHeading: string;
+        hintRoleKey: string;
+    };
+    resources: {
+        heading: string;
+        note: string;
+        appKey: string;
+        resourceKey: string;
+        name: string;
+        description: string;
+        empty: string;
+        newHeading: string;
+        hintAppKey: string;
+        hintResourceKey: string;
+        hintDailyReport: string;
+    };
+    grants: {
+        heading: string;
+        note: string;
+        role: string;
+        resource: string;
+        action: string;
+        rowScope: string;
+        columnScope: string;
+        empty: string;
+        newHeading: string;
+        rowScopeHint: string;
+        columnScopeHint: string;
+        rowScopePlaceholder: string;
+        columnScopePlaceholder: string;
+        nullRows: string;
+        nullCols: string;
+        selectPlaceholder: string;
+    };
+    userRoles: {
+        heading: string;
+        user: string;
+        role: string;
+        empty: string;
+        newHeading: string;
+        selectPlaceholder: string;
+    };
+    error: {
+        forbiddenTitle: string;
+        forbiddenBody: string;
+        genericTitlePrefix: string;
+        genericTitle: string;
+        genericBody: string;
+    };
+    warn: {
+        selfRoleDisable: string;
+        selfRoleDelete: string;
+        selfAssignmentRemove: string;
+    };
+};
+declare const defaultAuthzAdminLabels: AuthzAdminLabels;
+type PartialAuthzAdminLabels = {
+    title?: string;
+    myPermission?: string;
+    tabs?: Partial<AuthzAdminLabels["tabs"]>;
+    common?: Partial<AuthzAdminLabels["common"]>;
+    roles?: Partial<AuthzAdminLabels["roles"]>;
+    resources?: Partial<AuthzAdminLabels["resources"]>;
+    grants?: Partial<AuthzAdminLabels["grants"]>;
+    userRoles?: Partial<AuthzAdminLabels["userRoles"]>;
+    error?: Partial<AuthzAdminLabels["error"]>;
+    warn?: Partial<AuthzAdminLabels["warn"]>;
+};
+/** Shallow per-section merge over the English defaults. */
+declare function resolveLabels(over?: PartialAuthzAdminLabels): AuthzAdminLabels;
+
+type WithLabels = {
+    labels: AuthzAdminLabels;
+};
+type AuthzLayoutData = WithLabels & {
+    myPermissions: Record<string, PermissionView>;
+    adminResourceKey: string;
+    basePath?: string;
+};
+/** ネストルート用レイアウト(子は Outlet)。`routes.ts` でネスト構成にする場合に使う。 */
+declare function AuthzLayout(): react.JSX.Element;
+/**
+ * 認可管理 UI のエラー境界。ErrorBoundary は loader データを読めないため、ラベルは
+ * `makeAuthzErrorBoundary(labels)` で注入する(アプリは自分のロケールで生成する)。
+ * 既定の `AuthzErrorBoundary` は英語(パッケージ既定)。
+ */
+declare function makeAuthzErrorBoundary(over?: PartialAuthzAdminLabels): () => React.ReactElement;
+/** 英語(既定ラベル)のエラー境界。i18n したい場合は {@link makeAuthzErrorBoundary} を使う。 */
+declare const AuthzErrorBoundary: () => React.ReactElement;
+type AuthzRolesData = WithLabels & {
+    roles: AuthzRole[];
+    selfAdminRoleIds?: number[];
+};
+declare function AuthzRolesView(): react.JSX.Element;
+type AuthzResourcesData = WithLabels & {
+    resources: AuthzResource[];
+};
+declare function AuthzResourcesView(): react.JSX.Element;
+type AuthzGrantsData = WithLabels & {
+    grants: AuthzGrant[];
+    roles: Array<{
+        id: number;
+        roleKey: string;
+    }>;
+    resources: Array<{
+        id: number;
+        appKey: string;
+        resourceKey: string;
+    }>;
+};
+declare function AuthzGrantsView(): react.JSX.Element;
+type AuthzUserRolesData = WithLabels & {
+    assignments: AuthzAssignment[];
+    roles: Array<{
+        id: number;
+        roleKey: string;
+    }>;
+    users: AuthzUser[];
+    actorUserId?: number;
+    selfAdminRoleIds?: number[];
+};
+declare function AuthzUserRolesView(): react.JSX.Element;
+/**
+ * スプラット(`authz/*`)1 ルートで認可管理 UI 全体を描画するコンポーネント(store 非依存)。
+ * loader が返す `segment` に応じて該当タブのビューを描画する。レイアウト殻と各ビューは同一の
+ * loader データ(セグメントデータ + myPermissions + labels をトップレベルに統合)を読む。
+ */
+declare function AuthzAdminAppView(): react.JSX.Element;
+
+type Req = {
+    request: Request;
+};
+type PermissionQuery = {
+    resourceKey: string;
+    action: AuthzAction;
+};
+type CreateAuthzAdminServerOptions = {
+    store: AuthzAdminStore;
+    /** 管理画面のガード資源キー(既定 `authz_admin`)。 */
+    resourceKey?: string;
+    /** 未ログインをログインへ誘導する(例: throw redirect(...))。 */
+    requireUser: (request: Request) => Promise<unknown>;
+    /** 認可ガード(アプリの createAuthz 由来)。allow で { userId } を返す。 */
+    requirePermission: (request: Request, query: PermissionQuery) => Promise<{
+        userId: string | number;
+    }>;
+    /** 自己権限表示用(アプリの createAuthz 由来)。 */
+    getMyPermissions: (request: Request, args: {
+        resourceKeys: string[];
+    }) => Promise<Record<string, PermissionView>>;
+    /** 文言の部分上書き(既定は日本語)。 */
+    labels?: PartialAuthzAdminLabels;
+};
+declare function createAuthzAdminServer(opts: CreateAuthzAdminServerOptions): {
+    /** 露出: スプラットマウント(app.ts)がガードを 1 回だけ行うために使う。 */
+    labels: AuthzAdminLabels;
+    resourceKey: string;
+    layoutGuard: (request: Request) => Promise<{
+        userId: string | number;
+    }>;
+    loadMyPermissions: (request: Request) => Promise<Record<string, PermissionView>>;
+    /** /authz レイアウト: requireUser(302) → requirePermission(read, 403) → 自己権限取得。 */
+    layout: {
+        loader({ request }: Req): Promise<AuthzLayoutData>;
+    };
+    /** /authz index → roles へ。 */
+    index: {
+        loader(): never;
+    };
+    roles: {
+        data: (userId?: string | number) => Promise<AuthzRolesData>;
+        loader({ request }: Req): Promise<AuthzRolesData>;
+        action({ request }: Req): Promise<react_router.UNSAFE_DataWithResponseInit<{
+            error: string;
+        }> | {
+            ok: boolean;
+        }>;
+    };
+    resources: {
+        data: () => Promise<AuthzResourcesData>;
+        loader({ request }: Req): Promise<AuthzResourcesData>;
+        action({ request }: Req): Promise<react_router.UNSAFE_DataWithResponseInit<{
+            error: string;
+        }> | {
+            ok: boolean;
+        }>;
+    };
+    grants: {
+        data: () => Promise<AuthzGrantsData>;
+        loader({ request }: Req): Promise<AuthzGrantsData>;
+        action({ request }: Req): Promise<react_router.UNSAFE_DataWithResponseInit<{
+            error: string;
+        }> | {
+            ok: boolean;
+        }>;
+    };
+    userRoles: {
+        data: (userId?: string | number) => Promise<AuthzUserRolesData>;
+        loader({ request }: Req): Promise<AuthzUserRolesData>;
+        action({ request }: Req): Promise<react_router.UNSAFE_DataWithResponseInit<{
+            error: string;
+        }> | {
+            ok: boolean;
+        }>;
+    };
+};
+
+type RouteArgs = {
+    request: Request;
+    params: Record<string, string | undefined>;
+};
+type CreateAuthzAdminAppOptions = CreateAuthzAdminServerOptions & {
+    /** マウントのベースパス(タブリンク/未指定セグメントのリダイレクト先)。既定 `/authz`。 */
+    basePath?: string;
+};
+declare function createAuthzAdminApp(opts: CreateAuthzAdminAppOptions): {
+    loader: (args: RouteArgs) => Promise<{
+        labels: AuthzAdminLabels;
+        roles: _aiquants_authz_core.AuthzRole[];
+        selfAdminRoleIds?: number[];
+        segment: string;
+        basePath: string;
+        myPermissions: Record<string, PermissionView>;
+        adminResourceKey: string;
+    } | {
+        labels: AuthzAdminLabels;
+        resources: _aiquants_authz_core.AuthzResource[];
+        segment: string;
+        basePath: string;
+        myPermissions: Record<string, PermissionView>;
+        adminResourceKey: string;
+    } | {
+        labels: AuthzAdminLabels;
+        grants: _aiquants_authz_core.AuthzGrant[];
+        roles: Array<{
+            id: number;
+            roleKey: string;
+        }>;
+        resources: Array<{
+            id: number;
+            appKey: string;
+            resourceKey: string;
+        }>;
+        segment: string;
+        basePath: string;
+        myPermissions: Record<string, PermissionView>;
+        adminResourceKey: string;
+    } | {
+        labels: AuthzAdminLabels;
+        assignments: _aiquants_authz_core.AuthzAssignment[];
+        roles: Array<{
+            id: number;
+            roleKey: string;
+        }>;
+        users: _aiquants_authz_core.AuthzUser[];
+        actorUserId?: number;
+        selfAdminRoleIds?: number[];
+        segment: string;
+        basePath: string;
+        myPermissions: Record<string, PermissionView>;
+        adminResourceKey: string;
+    }>;
+    action: (args: RouteArgs) => Promise<react_router.UNSAFE_DataWithResponseInit<{
+        error: string;
+    }> | {
+        ok: boolean;
+    }>;
+    server: {
+        labels: AuthzAdminLabels;
+        resourceKey: string;
+        layoutGuard: (request: Request) => Promise<{
+            userId: string | number;
+        }>;
+        loadMyPermissions: (request: Request) => Promise<Record<string, PermissionView>>;
+        layout: {
+            loader({ request }: {
+                request: Request;
+            }): Promise<AuthzLayoutData>;
+        };
+        index: {
+            loader(): never;
+        };
+        roles: {
+            data: (userId?: string | number) => Promise<AuthzRolesData>;
+            loader({ request }: {
+                request: Request;
+            }): Promise<AuthzRolesData>;
+            action({ request }: {
+                request: Request;
+            }): Promise<react_router.UNSAFE_DataWithResponseInit<{
+                error: string;
+            }> | {
+                ok: boolean;
+            }>;
+        };
+        resources: {
+            data: () => Promise<AuthzResourcesData>;
+            loader({ request }: {
+                request: Request;
+            }): Promise<AuthzResourcesData>;
+            action({ request }: {
+                request: Request;
+            }): Promise<react_router.UNSAFE_DataWithResponseInit<{
+                error: string;
+            }> | {
+                ok: boolean;
+            }>;
+        };
+        grants: {
+            data: () => Promise<AuthzGrantsData>;
+            loader({ request }: {
+                request: Request;
+            }): Promise<AuthzGrantsData>;
+            action({ request }: {
+                request: Request;
+            }): Promise<react_router.UNSAFE_DataWithResponseInit<{
+                error: string;
+            }> | {
+                ok: boolean;
+            }>;
+        };
+        userRoles: {
+            data: (userId?: string | number) => Promise<AuthzUserRolesData>;
+            loader({ request }: {
+                request: Request;
+            }): Promise<AuthzUserRolesData>;
+            action({ request }: {
+                request: Request;
+            }): Promise<react_router.UNSAFE_DataWithResponseInit<{
+                error: string;
+            }> | {
+                ok: boolean;
+            }>;
+        };
+    };
+};
+
+declare const ui: Record<string, CSSProperties>;
+/**
+ * ラベルを上、コントロールを下に縦積みするフィールド(重なり防止・一貫レイアウト)。
+ * コントロール側は `aria-label` を持つ前提なので `<div>` で構成する。
+ */
+declare function Field({ label, hint, children }: {
+    label: string;
+    hint?: string;
+    children: ReactNode;
+}): react.JSX.Element;
+/** エラー表示(role="alert")。 */
+declare function ErrorAlert({ message }: {
+    message?: string;
+}): react.JSX.Element | null;
+
+type MyPermissionIndicatorProps = {
+    permission: PermissionView | null | undefined;
+    labels?: {
+        read?: string;
+        write?: string;
+        delete?: string;
+    };
+    /** Show a "（部分）" hint when read is partial. Default true. */
+    showScopeSummary?: boolean;
+    className?: string;
+};
+/**
+ * Compact self-permission indicator: read / write(create∪update) / delete as ○△×.
+ * `write` is ○ only when both create & update are held, △ when one, × when none.
+ */
+declare function MyPermissionIndicator({ permission, labels, showScopeSummary, className }: MyPermissionIndicatorProps): react.JSX.Element;
+
+type PermState = "full" | "partial" | "none";
+type UsePermission = {
+    canRead: boolean;
+    canWrite: boolean;
+    canDelete: boolean;
+    /** read: none(×) / partial(△, row|col restricted) / full(○). */
+    readState: PermState;
+    /** write = create ∪ update: full(○ both) / partial(△ one) / none(×). */
+    writeState: PermState;
+    deleteState: PermState;
+};
+/**
+ * Derive ○△× display states from a {@link PermissionView}. Pure (safe to call in render);
+ * named `usePermission` for ergonomic call-sites.
+ */
+declare function usePermission(view: PermissionView | null | undefined): UsePermission;
+
+export { AuthzAdminAppView, type AuthzAdminLabels, type AuthzConfig, AuthzErrorBoundary, type AuthzGrantsData, AuthzGrantsView, AuthzLayout, type AuthzLayoutData, type AuthzResourcesData, AuthzResourcesView, type AuthzRolesData, AuthzRolesView, type AuthzUserId, type AuthzUserRolesData, AuthzUserRolesView, type CreateAuthzAdminAppOptions, type CreateAuthzAdminServerOptions, ErrorAlert, Field, MyPermissionIndicator, type MyPermissionIndicatorProps, type PartialAuthzAdminLabels, type PermState, type PermissionView, type RequirePermissionOptions, type UsePermission, createAuthz, createAuthzAdminApp, createAuthzAdminServer, defaultAuthzAdminLabels, makeAuthzErrorBoundary, resolveLabels, toPermissionView, ui, usePermission };