@btst/stack 3.0.0-rc.2 → 3.0.0-rc.3

package/dist/packages/stack/src/plugins/form-builder/client/components/forms/form-renderer.cjs

@@ -10,6 +10,8 @@ const schemaConverter = require('../../../../../../../ui/src/lib/schema-converte
 const skeleton = require('../../../../../../../ui/src/components/skeleton.cjs');
 const LucideIcons = require('lucide-react');
 const formBuilderHooks = require('../../hooks/form-builder-hooks.cjs');
+const plugins_formBuilder_permissions = require('../../../../../../../../plugins/form-builder/permissions.cjs');
+const constants = require('../../constants.cjs');
 
 function DefaultLoadingComponent() {
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-4", children: [
@@ -21,7 +23,9 @@ function DefaultLoadingComponent() {
 }
 function DefaultErrorComponent({ error }) {
   const t = context.useTranslate();
-  const { localization } = context.usePluginOverrides("form-builder");
+  const { localization } = context.usePluginOverrides(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex flex-col items-center justify-center py-8 text-center", children: [
     /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rounded-full bg-destructive/10 p-3 mb-4", children: /* @__PURE__ */ jsxRuntime.jsx(LucideIcons.AlertCircle, { className: "h-6 w-6 text-destructive" }) }),
     /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "text-lg font-medium text-foreground mb-2", children: localization?.FORM_BUILDER_RENDERER_LOAD_FAILED ?? t("formBuilder.renderer.loadFailed", "Failed to load form") }),
@@ -33,7 +37,9 @@ function DefaultErrorComponent({ error }) {
 }
 function DefaultSuccessComponent({ message }) {
   const t = context.useTranslate();
-  const { localization } = context.usePluginOverrides("form-builder");
+  const { localization } = context.usePluginOverrides(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex flex-col items-center justify-center py-8 text-center", children: [
     /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rounded-full bg-green-100 dark:bg-green-900 p-3 mb-4", children: /* @__PURE__ */ jsxRuntime.jsx(LucideIcons.CheckCircle, { className: "h-6 w-6 text-green-600 dark:text-green-400" }) }),
     /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "text-lg font-medium text-foreground mb-2", children: localization?.FORM_BUILDER_RENDERER_SUBMITTED_TITLE ?? t("formBuilder.renderer.submittedTitle", "Form Submitted") }),
@@ -52,7 +58,7 @@ function FormRenderer({
   className
 }) {
   const t = context.useTranslate();
-  const { fieldComponents: overrideFieldComponents, localization } = context.usePluginOverrides("form-builder");
+  const { fieldComponents: overrideFieldComponents, localization } = context.usePluginOverrides(constants.FORM_BUILDER_PLUGIN_ID);
   const { form, isLoading, error } = formBuilderHooks.useFormBySlug(slug);
   const submitMutation = formBuilderHooks.useSubmitForm(slug);
   const [submitted, setSubmitted] = React.useState(false);
@@ -142,16 +148,40 @@ function FormRenderer({
   if (submitted && finalSuccessMessage) {
     return /* @__PURE__ */ jsxRuntime.jsx("div", { className, children: /* @__PURE__ */ jsxRuntime.jsx(DefaultSuccessComponent, { message: finalSuccessMessage }) });
   }
-  return /* @__PURE__ */ jsxRuntime.jsx("div", { className, "data-testid": "form-renderer", children: /* @__PURE__ */ jsxRuntime.jsx(
-    steppedAutoForm.default,
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    context.PermissionAccess,
     {
-      formSchema: zodSchema,
-      fieldConfig,
-      onSubmit: (values) => handleSubmit(values),
-      isSubmitting: submitMutation.isPending,
-      submitButtonText: submitButtonText || (localization?.FORM_BUILDER_BUTTON_SUBMIT ?? t("formBuilder.common.buttonSubmit", "Submit"))
+      permission: plugins_formBuilder_permissions.formBuilderPermissions.form.render({
+        slug: form.slug,
+        exists: true,
+        formId: form.id,
+        ...form.createdBy ? { ownerId: form.createdBy } : {},
+        status: form.status
+      }),
+      children: /* @__PURE__ */ jsxRuntime.jsx(
+        context.PermissionAccess,
+        {
+          permission: plugins_formBuilder_permissions.formBuilderPermissions.submission.create({
+            slug: form.slug,
+            exists: true,
+            formId: form.id,
+            ...form.createdBy ? { ownerId: form.createdBy } : {},
+            status: form.status
+          }),
+          children: /* @__PURE__ */ jsxRuntime.jsx("div", { className, "data-testid": "form-renderer", children: /* @__PURE__ */ jsxRuntime.jsx(
+            steppedAutoForm.default,
+            {
+              formSchema: zodSchema,
+              fieldConfig,
+              onSubmit: (values) => handleSubmit(values),
+              isSubmitting: submitMutation.isPending,
+              submitButtonText: submitButtonText || (localization?.FORM_BUILDER_BUTTON_SUBMIT ?? t("formBuilder.common.buttonSubmit", "Submit"))
+            }
+          ) })
+        }
+      )
     }
-  ) });
+  );
 }
 
 exports.FormRenderer = FormRenderer;

package/dist/packages/stack/src/plugins/form-builder/client/components/forms/form-renderer.mjs

@@ -1,13 +1,15 @@
 "use client";
 import { jsx, jsxs } from 'react/jsx-runtime';
 import { useState, useMemo } from 'react';
-import { useTranslate, usePluginOverrides } from '@btst/stack/context';
+import { useTranslate, usePluginOverrides, PermissionAccess } from '@btst/stack/context';
 import SteppedAutoForm from '../../../../../../../ui/src/components/auto-form/stepped-auto-form.mjs';
 import { buildFieldConfigFromJsonSchema } from '../../../../../../../ui/src/components/auto-form/helpers.mjs';
 import { formSchemaToZod } from '../../../../../../../ui/src/lib/schema-converter.mjs';
 import { Skeleton } from '../../../../../../../ui/src/components/skeleton.mjs';
 import { AlertCircle, CheckCircle } from 'lucide-react';
 import { useFormBySlug, useSubmitForm } from '../../hooks/form-builder-hooks.mjs';
+import { formBuilderPermissions } from '../../../../../../../../plugins/form-builder/permissions.mjs';
+import { FORM_BUILDER_PLUGIN_ID } from '../../constants.mjs';
 
 function DefaultLoadingComponent() {
   return /* @__PURE__ */ jsxs("div", { className: "space-y-4", children: [
@@ -19,7 +21,9 @@ function DefaultLoadingComponent() {
 }
 function DefaultErrorComponent({ error }) {
   const t = useTranslate();
-  const { localization } = usePluginOverrides("form-builder");
+  const { localization } = usePluginOverrides(
+    FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center justify-center py-8 text-center", children: [
     /* @__PURE__ */ jsx("div", { className: "rounded-full bg-destructive/10 p-3 mb-4", children: /* @__PURE__ */ jsx(AlertCircle, { className: "h-6 w-6 text-destructive" }) }),
     /* @__PURE__ */ jsx("h3", { className: "text-lg font-medium text-foreground mb-2", children: localization?.FORM_BUILDER_RENDERER_LOAD_FAILED ?? t("formBuilder.renderer.loadFailed", "Failed to load form") }),
@@ -31,7 +35,9 @@ function DefaultErrorComponent({ error }) {
 }
 function DefaultSuccessComponent({ message }) {
   const t = useTranslate();
-  const { localization } = usePluginOverrides("form-builder");
+  const { localization } = usePluginOverrides(
+    FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center justify-center py-8 text-center", children: [
     /* @__PURE__ */ jsx("div", { className: "rounded-full bg-green-100 dark:bg-green-900 p-3 mb-4", children: /* @__PURE__ */ jsx(CheckCircle, { className: "h-6 w-6 text-green-600 dark:text-green-400" }) }),
     /* @__PURE__ */ jsx("h3", { className: "text-lg font-medium text-foreground mb-2", children: localization?.FORM_BUILDER_RENDERER_SUBMITTED_TITLE ?? t("formBuilder.renderer.submittedTitle", "Form Submitted") }),
@@ -50,7 +56,7 @@ function FormRenderer({
   className
 }) {
   const t = useTranslate();
-  const { fieldComponents: overrideFieldComponents, localization } = usePluginOverrides("form-builder");
+  const { fieldComponents: overrideFieldComponents, localization } = usePluginOverrides(FORM_BUILDER_PLUGIN_ID);
   const { form, isLoading, error } = useFormBySlug(slug);
   const submitMutation = useSubmitForm(slug);
   const [submitted, setSubmitted] = useState(false);
@@ -140,16 +146,40 @@ function FormRenderer({
   if (submitted && finalSuccessMessage) {
     return /* @__PURE__ */ jsx("div", { className, children: /* @__PURE__ */ jsx(DefaultSuccessComponent, { message: finalSuccessMessage }) });
   }
-  return /* @__PURE__ */ jsx("div", { className, "data-testid": "form-renderer", children: /* @__PURE__ */ jsx(
-    SteppedAutoForm,
+  return /* @__PURE__ */ jsx(
+    PermissionAccess,
     {
-      formSchema: zodSchema,
-      fieldConfig,
-      onSubmit: (values) => handleSubmit(values),
-      isSubmitting: submitMutation.isPending,
-      submitButtonText: submitButtonText || (localization?.FORM_BUILDER_BUTTON_SUBMIT ?? t("formBuilder.common.buttonSubmit", "Submit"))
+      permission: formBuilderPermissions.form.render({
+        slug: form.slug,
+        exists: true,
+        formId: form.id,
+        ...form.createdBy ? { ownerId: form.createdBy } : {},
+        status: form.status
+      }),
+      children: /* @__PURE__ */ jsx(
+        PermissionAccess,
+        {
+          permission: formBuilderPermissions.submission.create({
+            slug: form.slug,
+            exists: true,
+            formId: form.id,
+            ...form.createdBy ? { ownerId: form.createdBy } : {},
+            status: form.status
+          }),
+          children: /* @__PURE__ */ jsx("div", { className, "data-testid": "form-renderer", children: /* @__PURE__ */ jsx(
+            SteppedAutoForm,
+            {
+              formSchema: zodSchema,
+              fieldConfig,
+              onSubmit: (values) => handleSubmit(values),
+              isSubmitting: submitMutation.isPending,
+              submitButtonText: submitButtonText || (localization?.FORM_BUILDER_BUTTON_SUBMIT ?? t("formBuilder.common.buttonSubmit", "Submit"))
+            }
+          ) })
+        }
+      )
     }
-  ) });
+  );
 }
 
 export { FormRenderer };

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/404-page.cjs

@@ -4,13 +4,16 @@
 const jsxRuntime = require('react/jsx-runtime');
 const button = require('../../../../../../../ui/src/components/button.cjs');
 const context = require('@btst/stack/context');
+const constants = require('../../constants.cjs');
 
 function NotFoundPage() {
   const t = context.useTranslate();
-  const { localization } = context.usePluginOverrides("form-builder");
-  const { router } = context.useStack();
-  const basePath = context.useBasePath();
-  const LinkComponent = router?.Link ?? "a";
+  const { localization } = context.usePluginOverrides(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
+  const { Link: LinkComponent, resolve } = context.usePluginSiteNavigation(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex flex-col items-center justify-center py-12 px-4 text-center", children: [
     /* @__PURE__ */ jsxRuntime.jsx("h1", { className: "text-6xl font-bold text-muted-foreground mb-4", children: "404" }),
     /* @__PURE__ */ jsxRuntime.jsx("h2", { className: "text-xl font-medium text-foreground mb-2", children: localization?.FORM_BUILDER_404_TITLE ?? t("formBuilder.common.404Title", "Page not found") }),
@@ -18,7 +21,7 @@ function NotFoundPage() {
       "formBuilder.common.404Description",
       "The page you're looking for doesn't exist or has been moved."
     ) }),
-    /* @__PURE__ */ jsxRuntime.jsx(button.Button, { asChild: true, children: /* @__PURE__ */ jsxRuntime.jsx(LinkComponent, { href: `${basePath}/forms`, children: localization?.FORM_BUILDER_404_BACK ?? t("formBuilder.common.404Back", "Back to Forms") }) })
+    /* @__PURE__ */ jsxRuntime.jsx(button.Button, { asChild: true, children: /* @__PURE__ */ jsxRuntime.jsx(LinkComponent, { href: resolve("forms").href, children: localization?.FORM_BUILDER_404_BACK ?? t("formBuilder.common.404Back", "Back to Forms") }) })
   ] });
 }
 

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/404-page.mjs

@@ -1,14 +1,17 @@
 "use client";
 import { jsxs, jsx } from 'react/jsx-runtime';
 import { Button } from '../../../../../../../ui/src/components/button.mjs';
-import { useTranslate, usePluginOverrides, useStack, useBasePath } from '@btst/stack/context';
+import { useTranslate, usePluginOverrides, usePluginSiteNavigation } from '@btst/stack/context';
+import { FORM_BUILDER_PLUGIN_ID } from '../../constants.mjs';
 
 function NotFoundPage() {
   const t = useTranslate();
-  const { localization } = usePluginOverrides("form-builder");
-  const { router } = useStack();
-  const basePath = useBasePath();
-  const LinkComponent = router?.Link ?? "a";
+  const { localization } = usePluginOverrides(
+    FORM_BUILDER_PLUGIN_ID
+  );
+  const { Link: LinkComponent, resolve } = usePluginSiteNavigation(
+    FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center justify-center py-12 px-4 text-center", children: [
     /* @__PURE__ */ jsx("h1", { className: "text-6xl font-bold text-muted-foreground mb-4", children: "404" }),
     /* @__PURE__ */ jsx("h2", { className: "text-xl font-medium text-foreground mb-2", children: localization?.FORM_BUILDER_404_TITLE ?? t("formBuilder.common.404Title", "Page not found") }),
@@ -16,7 +19,7 @@ function NotFoundPage() {
       "formBuilder.common.404Description",
       "The page you're looking for doesn't exist or has been moved."
     ) }),
-    /* @__PURE__ */ jsx(Button, { asChild: true, children: /* @__PURE__ */ jsx(LinkComponent, { href: `${basePath}/forms`, children: localization?.FORM_BUILDER_404_BACK ?? t("formBuilder.common.404Back", "Back to Forms") }) })
+    /* @__PURE__ */ jsx(Button, { asChild: true, children: /* @__PURE__ */ jsx(LinkComponent, { href: resolve("forms").href, children: localization?.FORM_BUILDER_404_BACK ?? t("formBuilder.common.404Back", "Back to Forms") }) })
   ] });
 }
 

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/form-builder-page.cjs

@@ -8,6 +8,9 @@ const components = require('@btst/stack/client/components');
 const defaultError = require('../shared/default-error.cjs');
 const formBuilderSkeleton = require('../loading/form-builder-skeleton.cjs');
 const _404Page = require('./404-page.cjs');
+const plugins_formBuilder_permissions = require('../../../../../../../../plugins/form-builder/permissions.cjs');
+const constants = require('../../constants.cjs');
+const formBuilderHooks = require('../../hooks/form-builder-hooks.cjs');
 
 const FormBuilderPage = React.lazy(
   () => import('./form-builder-page.internal.cjs').then((m) => ({
@@ -15,18 +18,19 @@ const FormBuilderPage = React.lazy(
   }))
 );
 function FormBuilderPageComponent({ id }) {
-  const { onRouteError } = context.usePluginOverrides("form-builder");
+  const { onRouteError } = context.usePluginOverrides(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
   const isNew = !id;
   const path = isNew ? "/forms/new" : `/forms/${id}/edit`;
   return /* @__PURE__ */ jsxRuntime.jsx(
     components.ComposedRoute,
     {
       path,
-      PageComponent: FormBuilderPage,
+      PageComponent: AuthorizedFormBuilderPage,
       ErrorComponent: defaultError.DefaultError,
       LoadingComponent: formBuilderSkeleton.FormBuilderSkeleton,
       NotFoundComponent: _404Page.NotFoundPage,
-      permission: isNew ? { resource: "form-builder:form", action: "create" } : { resource: "form-builder:form", action: "update", params: { id } },
       props: { id },
       onError: (error) => {
         if (onRouteError) {
@@ -40,5 +44,34 @@ function FormBuilderPageComponent({ id }) {
     }
   );
 }
+function AuthorizedFormBuilderPage({ id }) {
+  if (!id) {
+    return /* @__PURE__ */ jsxRuntime.jsx(
+      components.PermissionRouteAccess,
+      {
+        permission: plugins_formBuilder_permissions.formBuilderPermissions.form.create(),
+        LoadingComponent: formBuilderSkeleton.FormBuilderSkeleton,
+        children: /* @__PURE__ */ jsxRuntime.jsx(FormBuilderPage, {})
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx(AuthorizedExistingFormBuilderPage, { id });
+}
+function AuthorizedExistingFormBuilderPage({ id }) {
+  const { form } = formBuilderHooks.useSuspenseFormForUpdate(id);
+  if (!form) return /* @__PURE__ */ jsxRuntime.jsx(_404Page.NotFoundPage, {});
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    components.PermissionRouteAccess,
+    {
+      permission: plugins_formBuilder_permissions.formBuilderPermissions.form.update({
+        formId: form.id,
+        ...form.createdBy ? { ownerId: form.createdBy } : {},
+        status: form.status
+      }),
+      LoadingComponent: formBuilderSkeleton.FormBuilderSkeleton,
+      children: /* @__PURE__ */ jsxRuntime.jsx(FormBuilderPage, { id })
+    }
+  );
+}
 
 exports.FormBuilderPageComponent = FormBuilderPageComponent;

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/form-builder-page.internal.cjs

@@ -11,6 +11,9 @@ const select = require('../../../../../../../ui/src/components/select.cjs');
 const LucideIcons = require('lucide-react');
 const index = require('../../../../../../../ui/src/components/form-builder/index.cjs');
 const utils = require('../../../utils.cjs');
+const plugins_formBuilder_permissions = require('../../../../../../../../plugins/form-builder/permissions.cjs');
+const _404Page = require('./404-page.cjs');
+const constants = require('../../constants.cjs');
 const formBuilderHooks = require('../../hooks/form-builder-hooks.cjs');
 
 function FormBuilderPage({ id }) {
@@ -20,7 +23,8 @@ function FormBuilderPage({ id }) {
   return /* @__PURE__ */ jsxRuntime.jsx(CreateFormBuilderPage, {});
 }
 function EditFormBuilderPage({ id }) {
-  const { form: existingForm } = formBuilderHooks.useSuspenseFormById(id);
+  const { form: existingForm } = formBuilderHooks.useSuspenseFormForUpdate(id);
+  if (!existingForm) return /* @__PURE__ */ jsxRuntime.jsx(_404Page.NotFoundPage, {});
   return /* @__PURE__ */ jsxRuntime.jsx(FormBuilderPageContent, { id, existingForm });
 }
 function CreateFormBuilderPage() {
@@ -32,10 +36,14 @@ function FormBuilderPageContent({
 }) {
   const t = context.useTranslate();
   const notify = context.useNotify();
-  const { localization } = context.usePluginOverrides("form-builder");
-  const { router } = context.useStack();
-  const basePath = context.useBasePath();
-  const LinkComponent = router?.Link ?? "a";
+  const { localization } = context.usePluginOverrides(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
+  const {
+    Link: LinkComponent,
+    navigate,
+    resolve
+  } = context.usePluginSiteNavigation(constants.FORM_BUILDER_PLUGIN_ID);
   const [name, setName] = React.useState(existingForm?.name || "");
   const [slug, setSlug] = React.useState(existingForm?.slug || "");
   const [status, setStatus] = React.useState(
@@ -80,7 +88,9 @@ function FormBuilderPageContent({
         status: values.status
       }
     }),
-    redirect: (result, action) => action === "create" && result ? `${basePath}/forms/${result.id}/edit` : false
+    onSuccess: (result) => {
+      if (!id && result) return navigate("forms", result.id, "edit");
+    }
   });
   const handleSave = async () => {
     if (!name.trim()) {
@@ -117,9 +127,13 @@ function FormBuilderPageContent({
     if (!error) return void 0;
     return Array.isArray(error) ? error[0] : error;
   };
+  const saveButton = /* @__PURE__ */ jsxRuntime.jsx("div", { className: "ml-auto", children: /* @__PURE__ */ jsxRuntime.jsxs(button.Button, { onClick: handleSave, disabled: isSaving, children: [
+    /* @__PURE__ */ jsxRuntime.jsx(LucideIcons.Save, { className: "mr-2 h-4 w-4" }),
+    isSaving ? localization?.FORM_BUILDER_STATUS_SAVING ?? t("formBuilder.common.statusSaving", "Saving...") : id ? localization?.FORM_BUILDER_BUTTON_SAVE ?? t("formBuilder.common.buttonSave", "Save") : localization?.FORM_BUILDER_BUTTON_CREATE ?? t("formBuilder.common.buttonCreate", "Create")
+  ] }) });
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex h-full flex-col", "data-testid": "form-builder-page", children: [
     /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex items-center gap-4 border-b p-4", children: [
-      /* @__PURE__ */ jsxRuntime.jsx(button.Button, { variant: "ghost", size: "icon", asChild: true, children: /* @__PURE__ */ jsxRuntime.jsx(LinkComponent, { href: `${basePath}/forms`, children: /* @__PURE__ */ jsxRuntime.jsx(LucideIcons.ArrowLeft, { className: "h-4 w-4" }) }) }),
+      /* @__PURE__ */ jsxRuntime.jsx(button.Button, { variant: "ghost", size: "icon", asChild: true, children: /* @__PURE__ */ jsxRuntime.jsx(LinkComponent, { href: resolve("forms").href, children: /* @__PURE__ */ jsxRuntime.jsx(LucideIcons.ArrowLeft, { className: "h-4 w-4" }) }) }),
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex flex-col gap-1", children: [
         /* @__PURE__ */ jsxRuntime.jsx(label.Label, { htmlFor: "form-name", className: "text-xs text-muted-foreground", children: localization?.FORM_BUILDER_LABEL_NAME ?? t("formBuilder.common.labelName", "Name") }),
         /* @__PURE__ */ jsxRuntime.jsx(
@@ -177,10 +191,17 @@ function FormBuilderPageContent({
           }
         )
       ] }),
-      /* @__PURE__ */ jsxRuntime.jsx("div", { className: "ml-auto", children: /* @__PURE__ */ jsxRuntime.jsxs(button.Button, { onClick: handleSave, disabled: isSaving, children: [
-        /* @__PURE__ */ jsxRuntime.jsx(LucideIcons.Save, { className: "mr-2 h-4 w-4" }),
-        isSaving ? localization?.FORM_BUILDER_STATUS_SAVING ?? t("formBuilder.common.statusSaving", "Saving...") : id ? localization?.FORM_BUILDER_BUTTON_SAVE ?? t("formBuilder.common.buttonSave", "Save") : localization?.FORM_BUILDER_BUTTON_CREATE ?? t("formBuilder.common.buttonCreate", "Create")
-      ] }) })
+      id && existingForm ? /* @__PURE__ */ jsxRuntime.jsx(
+        context.PermissionAccess,
+        {
+          permission: plugins_formBuilder_permissions.formBuilderPermissions.form.update({
+            formId: existingForm.id,
+            ...existingForm.createdBy ? { ownerId: existingForm.createdBy } : {},
+            status: existingForm.status
+          }),
+          children: saveButton
+        }
+      ) : !id ? /* @__PURE__ */ jsxRuntime.jsx(context.PermissionAccess, { permission: plugins_formBuilder_permissions.formBuilderPermissions.form.create(), children: saveButton }) : null
     ] }),
     /* @__PURE__ */ jsxRuntime.jsx(
       index.FormBuilder,

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/form-builder-page.internal.mjs

@@ -1,15 +1,18 @@
 "use client";
 import { jsx, jsxs } from 'react/jsx-runtime';
 import { useState, useEffect, useCallback } from 'react';
-import { useTranslate, useNotify, usePluginOverrides, useStack, useBasePath } from '@btst/stack/context';
+import { useTranslate, useNotify, usePluginOverrides, usePluginSiteNavigation, PermissionAccess } from '@btst/stack/context';
 import { Button } from '../../../../../../../ui/src/components/button.mjs';
 import { Input } from '../../../../../../../ui/src/components/input.mjs';
 import { Label } from '../../../../../../../ui/src/components/label.mjs';
 import { Select, SelectTrigger, SelectValue, SelectContent, SelectItem } from '../../../../../../../ui/src/components/select.mjs';
-import { ArrowLeft, Save } from 'lucide-react';
+import { Save, ArrowLeft } from 'lucide-react';
 import { FormBuilder } from '../../../../../../../ui/src/components/form-builder/index.mjs';
 import { slugify } from '../../../utils.mjs';
-import { useSuspenseFormById, useFormBuilderForm } from '../../hooks/form-builder-hooks.mjs';
+import { formBuilderPermissions } from '../../../../../../../../plugins/form-builder/permissions.mjs';
+import { NotFoundPage } from './404-page.mjs';
+import { FORM_BUILDER_PLUGIN_ID } from '../../constants.mjs';
+import { useSuspenseFormForUpdate, useFormBuilderForm } from '../../hooks/form-builder-hooks.mjs';
 
 function FormBuilderPage({ id }) {
   if (id) {
@@ -18,7 +21,8 @@ function FormBuilderPage({ id }) {
   return /* @__PURE__ */ jsx(CreateFormBuilderPage, {});
 }
 function EditFormBuilderPage({ id }) {
-  const { form: existingForm } = useSuspenseFormById(id);
+  const { form: existingForm } = useSuspenseFormForUpdate(id);
+  if (!existingForm) return /* @__PURE__ */ jsx(NotFoundPage, {});
   return /* @__PURE__ */ jsx(FormBuilderPageContent, { id, existingForm });
 }
 function CreateFormBuilderPage() {
@@ -30,10 +34,14 @@ function FormBuilderPageContent({
 }) {
   const t = useTranslate();
   const notify = useNotify();
-  const { localization } = usePluginOverrides("form-builder");
-  const { router } = useStack();
-  const basePath = useBasePath();
-  const LinkComponent = router?.Link ?? "a";
+  const { localization } = usePluginOverrides(
+    FORM_BUILDER_PLUGIN_ID
+  );
+  const {
+    Link: LinkComponent,
+    navigate,
+    resolve
+  } = usePluginSiteNavigation(FORM_BUILDER_PLUGIN_ID);
   const [name, setName] = useState(existingForm?.name || "");
   const [slug, setSlug] = useState(existingForm?.slug || "");
   const [status, setStatus] = useState(
@@ -78,7 +86,9 @@ function FormBuilderPageContent({
         status: values.status
       }
     }),
-    redirect: (result, action) => action === "create" && result ? `${basePath}/forms/${result.id}/edit` : false
+    onSuccess: (result) => {
+      if (!id && result) return navigate("forms", result.id, "edit");
+    }
   });
   const handleSave = async () => {
     if (!name.trim()) {
@@ -115,9 +125,13 @@ function FormBuilderPageContent({
     if (!error) return void 0;
     return Array.isArray(error) ? error[0] : error;
   };
+  const saveButton = /* @__PURE__ */ jsx("div", { className: "ml-auto", children: /* @__PURE__ */ jsxs(Button, { onClick: handleSave, disabled: isSaving, children: [
+    /* @__PURE__ */ jsx(Save, { className: "mr-2 h-4 w-4" }),
+    isSaving ? localization?.FORM_BUILDER_STATUS_SAVING ?? t("formBuilder.common.statusSaving", "Saving...") : id ? localization?.FORM_BUILDER_BUTTON_SAVE ?? t("formBuilder.common.buttonSave", "Save") : localization?.FORM_BUILDER_BUTTON_CREATE ?? t("formBuilder.common.buttonCreate", "Create")
+  ] }) });
   return /* @__PURE__ */ jsxs("div", { className: "flex h-full flex-col", "data-testid": "form-builder-page", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-4 border-b p-4", children: [
-      /* @__PURE__ */ jsx(Button, { variant: "ghost", size: "icon", asChild: true, children: /* @__PURE__ */ jsx(LinkComponent, { href: `${basePath}/forms`, children: /* @__PURE__ */ jsx(ArrowLeft, { className: "h-4 w-4" }) }) }),
+      /* @__PURE__ */ jsx(Button, { variant: "ghost", size: "icon", asChild: true, children: /* @__PURE__ */ jsx(LinkComponent, { href: resolve("forms").href, children: /* @__PURE__ */ jsx(ArrowLeft, { className: "h-4 w-4" }) }) }),
       /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-1", children: [
         /* @__PURE__ */ jsx(Label, { htmlFor: "form-name", className: "text-xs text-muted-foreground", children: localization?.FORM_BUILDER_LABEL_NAME ?? t("formBuilder.common.labelName", "Name") }),
         /* @__PURE__ */ jsx(
@@ -175,10 +189,17 @@ function FormBuilderPageContent({
           }
         )
       ] }),
-      /* @__PURE__ */ jsx("div", { className: "ml-auto", children: /* @__PURE__ */ jsxs(Button, { onClick: handleSave, disabled: isSaving, children: [
-        /* @__PURE__ */ jsx(Save, { className: "mr-2 h-4 w-4" }),
-        isSaving ? localization?.FORM_BUILDER_STATUS_SAVING ?? t("formBuilder.common.statusSaving", "Saving...") : id ? localization?.FORM_BUILDER_BUTTON_SAVE ?? t("formBuilder.common.buttonSave", "Save") : localization?.FORM_BUILDER_BUTTON_CREATE ?? t("formBuilder.common.buttonCreate", "Create")
-      ] }) })
+      id && existingForm ? /* @__PURE__ */ jsx(
+        PermissionAccess,
+        {
+          permission: formBuilderPermissions.form.update({
+            formId: existingForm.id,
+            ...existingForm.createdBy ? { ownerId: existingForm.createdBy } : {},
+            status: existingForm.status
+          }),
+          children: saveButton
+        }
+      ) : !id ? /* @__PURE__ */ jsx(PermissionAccess, { permission: formBuilderPermissions.form.create(), children: saveButton }) : null
     ] }),
     /* @__PURE__ */ jsx(
       FormBuilder,

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/form-builder-page.mjs

@@ -2,10 +2,13 @@
 import { jsx } from 'react/jsx-runtime';
 import { lazy } from 'react';
 import { usePluginOverrides } from '@btst/stack/context';
-import { ComposedRoute } from '@btst/stack/client/components';
+import { ComposedRoute, PermissionRouteAccess } from '@btst/stack/client/components';
 import { DefaultError } from '../shared/default-error.mjs';
 import { FormBuilderSkeleton } from '../loading/form-builder-skeleton.mjs';
 import { NotFoundPage } from './404-page.mjs';
+import { formBuilderPermissions } from '../../../../../../../../plugins/form-builder/permissions.mjs';
+import { FORM_BUILDER_PLUGIN_ID } from '../../constants.mjs';
+import { useSuspenseFormForUpdate } from '../../hooks/form-builder-hooks.mjs';
 
 const FormBuilderPage = lazy(
   () => import('./form-builder-page.internal.mjs').then((m) => ({
@@ -13,18 +16,19 @@ const FormBuilderPage = lazy(
   }))
 );
 function FormBuilderPageComponent({ id }) {
-  const { onRouteError } = usePluginOverrides("form-builder");
+  const { onRouteError } = usePluginOverrides(
+    FORM_BUILDER_PLUGIN_ID
+  );
   const isNew = !id;
   const path = isNew ? "/forms/new" : `/forms/${id}/edit`;
   return /* @__PURE__ */ jsx(
     ComposedRoute,
     {
       path,
-      PageComponent: FormBuilderPage,
+      PageComponent: AuthorizedFormBuilderPage,
       ErrorComponent: DefaultError,
       LoadingComponent: FormBuilderSkeleton,
       NotFoundComponent: NotFoundPage,
-      permission: isNew ? { resource: "form-builder:form", action: "create" } : { resource: "form-builder:form", action: "update", params: { id } },
       props: { id },
       onError: (error) => {
         if (onRouteError) {
@@ -38,5 +42,34 @@ function FormBuilderPageComponent({ id }) {
     }
   );
 }
+function AuthorizedFormBuilderPage({ id }) {
+  if (!id) {
+    return /* @__PURE__ */ jsx(
+      PermissionRouteAccess,
+      {
+        permission: formBuilderPermissions.form.create(),
+        LoadingComponent: FormBuilderSkeleton,
+        children: /* @__PURE__ */ jsx(FormBuilderPage, {})
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx(AuthorizedExistingFormBuilderPage, { id });
+}
+function AuthorizedExistingFormBuilderPage({ id }) {
+  const { form } = useSuspenseFormForUpdate(id);
+  if (!form) return /* @__PURE__ */ jsx(NotFoundPage, {});
+  return /* @__PURE__ */ jsx(
+    PermissionRouteAccess,
+    {
+      permission: formBuilderPermissions.form.update({
+        formId: form.id,
+        ...form.createdBy ? { ownerId: form.createdBy } : {},
+        status: form.status
+      }),
+      LoadingComponent: FormBuilderSkeleton,
+      children: /* @__PURE__ */ jsx(FormBuilderPage, { id })
+    }
+  );
+}
 
 export { FormBuilderPageComponent };

package/dist/packages/stack/src/plugins/form-builder/client/components/pages/form-list-page.cjs

@@ -8,6 +8,8 @@ const components = require('@btst/stack/client/components');
 const defaultError = require('../shared/default-error.cjs');
 const formListSkeleton = require('../loading/form-list-skeleton.cjs');
 const _404Page = require('./404-page.cjs');
+const plugins_formBuilder_permissions = require('../../../../../../../../plugins/form-builder/permissions.cjs');
+const constants = require('../../constants.cjs');
 
 const FormListPage = React.lazy(
   () => import('./form-list-page.internal.cjs').then((m) => ({
@@ -15,11 +17,14 @@ const FormListPage = React.lazy(
   }))
 );
 function FormListPageComponent() {
-  const { onRouteError } = context.usePluginOverrides("form-builder");
+  const { onRouteError } = context.usePluginOverrides(
+    constants.FORM_BUILDER_PLUGIN_ID
+  );
   return /* @__PURE__ */ jsxRuntime.jsx(
     components.ComposedRoute,
     {
       path: "/forms",
+      permission: plugins_formBuilder_permissions.formBuilderPermissions.form.read({ scope: "collection" }),
       PageComponent: FormListPage,
       ErrorComponent: defaultError.DefaultError,
       LoadingComponent: formListSkeleton.FormListSkeleton,