@datatechsolutions/ui 2.11.81 → 2.11.82

package/dist/chunk-HZ4LOVHM.js

@@ -0,0 +1,46 @@
+"use client";
+'use strict';
+
+// src/platform/rbac.ts
+function matchPermission(pattern, target) {
+  if (pattern === "*") return true;
+  if (pattern === target) return true;
+  const patternParts = pattern.split(":");
+  const targetParts = target.split(":");
+  for (let i = 0; i < patternParts.length; i++) {
+    if (patternParts[i] === "*") return true;
+    if (patternParts[i] !== targetParts[i]) return false;
+  }
+  return patternParts.length === targetParts.length;
+}
+function createPlatformRbac(opts) {
+  const ROLE_DEFINITIONS = opts.roles;
+  const MODULE_PERMISSIONS = opts.modulePermissions ?? {};
+  const PERMISSION_CLAIMS_MAP = opts.permissionClaimsMap;
+  const knownRoles = Object.keys(ROLE_DEFINITIONS);
+  const fallbackRole = opts.defaultRole ?? knownRoles[0];
+  function normalizePlatformRole(input) {
+    if (typeof input === "string" && input in ROLE_DEFINITIONS) {
+      return input;
+    }
+    return fallbackRole;
+  }
+  function can(user, permission) {
+    if (!user) return false;
+    const userClaims = user.permissions ?? [];
+    const requiredClaims = PERMISSION_CLAIMS_MAP[permission] ?? [];
+    return requiredClaims.some(
+      (claim) => userClaims.some((userClaim) => matchPermission(userClaim, claim))
+    );
+  }
+  return {
+    ROLE_DEFINITIONS,
+    MODULE_PERMISSIONS,
+    normalizePlatformRole,
+    can
+  };
+}
+
+exports.createPlatformRbac = createPlatformRbac;
+//# sourceMappingURL=chunk-HZ4LOVHM.js.map
+//# sourceMappingURL=chunk-HZ4LOVHM.js.map

package/dist/chunk-HZ4LOVHM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/platform/rbac.ts"],"names":[],"mappings":";;;AAiDA,SAAS,eAAA,CAAgB,SAAiB,MAAA,EAAyB;AACjE,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAC5B,EAAA,IAAI,OAAA,KAAY,QAAQ,OAAO,IAAA;AAC/B,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,IAAA,IAAI,YAAA,CAAa,CAAC,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AACpC,IAAA,IAAI,aAAa,CAAC,CAAA,KAAM,WAAA,CAAY,CAAC,GAAG,OAAO,KAAA;AAAA,EACjD;AACA,EAAA,OAAO,YAAA,CAAa,WAAW,WAAA,CAAY,MAAA;AAC7C;AAEO,SAAS,mBAGd,IAAA,EAAuF;AACvF,EAAA,MAAM,mBAAmB,IAAA,CAAK,KAAA;AAC9B,EAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,iBAAA,IAAsB,EAAC;AACvD,EAAA,MAAM,wBAAwB,IAAA,CAAK,mBAAA;AAInC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA;AAC/C,EAAA,MAAM,YAAA,GAAsB,IAAA,CAAK,WAAA,IAAgB,UAAA,CAAW,CAAC,CAAA;AAE7D,EAAA,SAAS,sBAAsB,KAAA,EAAuB;AACpD,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAa,KAAA,IAAmB,gBAAA,EAAkB;AACrE,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,SAAS,GAAA,CAAI,MAAuB,UAAA,EAAkC;AACpE,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,IAAA,MAAM,UAAA,GAAc,IAAA,CAAK,WAAA,IAAe,EAAC;AAEzC,IAAA,MAAM,cAAA,GAAiB,qBAAA,CAAsB,UAAU,CAAA,IAAK,EAAC;AAC7D,IAAA,OAAO,cAAA,CAAe,IAAA;AAAA,MAAK,CAAC,UAC1B,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,KAAc,eAAA,CAAgB,SAAA,EAAW,KAAK,CAAC;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,gBAAA;AAAA,IACA,kBAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-HZ4LOVHM.js","sourcesContent":["import type { AuthUser } from '@datatechsolutions/windsock/client'\n\n/**\n * Generic role-based access factory shared across platform apps (astrlabe,\n * kori-erp, etc). Each app instantiates this with its own role + permission\n * unions and seed-claim mapping. The factory closes over the config and\n * exports `ROLE_DEFINITIONS`, `MODULE_PERMISSIONS`, `normalizePlatformRole`,\n * and `can()` — the same surface the per-app file used to expose.\n *\n * The factory deliberately does not hardcode any specific role enum here —\n * astrlabe, kori-erp, and future apps each pick their own union (admin,\n * manager, analyst, viewer, …) and pass the role definitions in.\n */\n\nexport type PlatformRoleDefinition<TRole extends string> = {\n  id: TRole\n  label: string\n  description: string\n}\n\nexport type CreatePlatformRbacOptions<\n  TRole extends string,\n  TPermission extends string,\n> = {\n  /** Definitions for every role the app supports (id/label/description). */\n  roles: Record<TRole, PlatformRoleDefinition<TRole>>\n  /**\n   * Maps each app-level permission to one or more JWT permission claim\n   * strings. `can()` returns true when ANY of the listed claims (using\n   * wildcard matching) is present in the user's JWT permissions.\n   */\n  permissionClaimsMap: Record<TPermission, readonly string[]>\n  /** Optional map from navigation/module IDs to required permissions. */\n  modulePermissions?: Record<string, TPermission>\n  /** Role to fall back to when an unknown role string comes in. */\n  defaultRole?: TRole\n}\n\nexport type PlatformRbac<TRole extends string, TPermission extends string> = {\n  ROLE_DEFINITIONS: Record<TRole, PlatformRoleDefinition<TRole>>\n  MODULE_PERMISSIONS: Record<string, TPermission>\n  normalizePlatformRole: (input: unknown) => TRole\n  can: (user: AuthUser | null, permission: TPermission) => boolean\n}\n\n/**\n * Match a permission string against a pattern (supports wildcards).\n * Same logic as windsock's usePermissionChecker.\n */\nfunction matchPermission(pattern: string, target: string): boolean {\n  if (pattern === '*') return true\n  if (pattern === target) return true\n  const patternParts = pattern.split(':')\n  const targetParts = target.split(':')\n  for (let i = 0; i < patternParts.length; i++) {\n    if (patternParts[i] === '*') return true\n    if (patternParts[i] !== targetParts[i]) return false\n  }\n  return patternParts.length === targetParts.length\n}\n\nexport function createPlatformRbac<\n  TRole extends string,\n  TPermission extends string,\n>(opts: CreatePlatformRbacOptions<TRole, TPermission>): PlatformRbac<TRole, TPermission> {\n  const ROLE_DEFINITIONS = opts.roles\n  const MODULE_PERMISSIONS = opts.modulePermissions ?? ({} as Record<string, TPermission>)\n  const PERMISSION_CLAIMS_MAP = opts.permissionClaimsMap\n\n  // Pick the fallback role: explicit `defaultRole` first, then the first\n  // entry in the roles map. We assume there's at least one role.\n  const knownRoles = Object.keys(ROLE_DEFINITIONS) as TRole[]\n  const fallbackRole: TRole = opts.defaultRole ?? (knownRoles[0] as TRole)\n\n  function normalizePlatformRole(input: unknown): TRole {\n    if (typeof input === 'string' && (input as TRole) in ROLE_DEFINITIONS) {\n      return input as TRole\n    }\n    return fallbackRole\n  }\n\n  function can(user: AuthUser | null, permission: TPermission): boolean {\n    if (!user) return false\n    const userClaims = (user.permissions ?? []) as string[]\n\n    const requiredClaims = PERMISSION_CLAIMS_MAP[permission] ?? []\n    return requiredClaims.some((claim) =>\n      userClaims.some((userClaim) => matchPermission(userClaim, claim))\n    )\n  }\n\n  return {\n    ROLE_DEFINITIONS,\n    MODULE_PERMISSIONS,\n    normalizePlatformRole,\n    can,\n  }\n}\n"]}