@eintrek/erp-shell 0.1.24 → 0.1.25

package/dist/auth/permission-provider.d.ts

@@ -31,13 +31,12 @@ export interface PermissionProviderProps {
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
+ * into the host's `usePermission` probe, and renders one of:
  *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card
- * 3. otherwise → children
- *
- * Role codes are intentionally not shown on the deny screen (they are
- * internal identifiers like `fin_controller` and confuse end users).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 export declare function PermissionProvider({ children, usePermission, fallbackRulesMap, }: PermissionProviderProps): import("react/jsx-runtime").JSX.Element | null;

package/dist/auth/permission-utils.d.ts

@@ -9,14 +9,31 @@ import type { PermissionRulesMap } from "../providers/permission-rules-context";
  * the same management screen with different filters.
  */
 export declare function normalizePathnameForPermissionRules(pathname: string): string;
+export interface UiRoutePermissionLookup {
+    /** True when an exact, pattern, or restrictive parent rule was found. */
+    matched: boolean;
+    /**
+     * Required child-group segments. Empty array means the route is
+     * explicitly public (configured as `required_child_groups: []`).
+     * When `matched` is false this is always `[]` and must be treated as deny.
+     */
+    roles: string[];
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
+ */
+export declare function resolveUiRoutePermission(pathname: string, rulesMap: PermissionRulesMap): UiRoutePermissionLookup;
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
  */
 export declare function getRequiredChildGroups(pathname: string, rulesMap: PermissionRulesMap): string[];

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export { AppSidebar, type AppSidebarProps } from "./navigation/app-sidebar";
 export { AppLayoutShell, type AppLayoutShellProps, type AppLayoutShellOrganization, } from "./navigation/app-layout-shell";
 export { PermissionGateShell, type PermissionGateShellProps, type PermissionGateSkeletonVariant, } from "./auth/permission-gate-shell";
 export { PermissionProvider, type PermissionProviderProps, type PermissionProbe, type UsePermissionHook, } from "./auth/permission-provider";
-export { getRequiredChildGroups, normalizePathnameForPermissionRules, } from "./auth/permission-utils";
+export { getRequiredChildGroups, normalizePathnameForPermissionRules, resolveUiRoutePermission, type UiRoutePermissionLookup, } from "./auth/permission-utils";
 export * from "./navigation/navigation-helpers";
 export type { Module, SubPage, SubModule, Tool, Company, NavigationData, } from "./navigation/navigation-types";
 export { canAccessNavPermissionRoute, filterNavigationToolsByPermission, filterNavigationModulesByPermission, getActiveModule, getActiveSubModule, buildUrlWithCode, } from "./navigation/navigation-data-helpers";

package/dist/index.esm.js

@@ -604,12 +604,19 @@ SidebarMenuSubButton.displayName = "SidebarMenuSubButton";
 
 /**
  * True when the user's child-group segments include at least one of the
- * groups required for `permissionRouteKey`. Missing key / empty required
- * list both fall open (no restriction).
+ * groups required for `permissionRouteKey`.
+ *
+ * Fail-closed:
+ * - Nav item without `permissionRouteKey` → deny (must declare a key)
+ * - Key absent from `rulesMap` → deny (unknown route is not public)
+ * - Key present with `required_child_groups: []` → allow (explicit public)
  */
 function canAccessNavPermissionRoute(permissionRouteKey, rulesMap, userChildSegments) {
     if (!permissionRouteKey)
-        return true;
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(rulesMap, permissionRouteKey)) {
+        return false;
+    }
     const required = rulesMap[permissionRouteKey] ?? [];
     if (required.length === 0)
         return true;
@@ -1197,8 +1204,8 @@ function PermissionRulesProvider({ children, data, isLoading = false, isError =
     return (jsx(PermissionRulesContext.Provider, { value: value, children: children }));
 }
 /**
- * Read the permission rules. Returns empty maps when used outside the
- * provider (lets pages render without a hard-fail in tests).
+ * Read the permission rules. Outside the provider, report loading so
+ * fail-closed consumers (nav / gates) do not treat empty maps as "allow all".
  */
 function usePermissionRules() {
     const ctx = useContext(PermissionRulesContext);
@@ -1206,7 +1213,7 @@ function usePermissionRules() {
         return {
             rulesMap: {},
             policiesMap: {},
-            isLoading: false,
+            isLoading: true,
             isError: false,
             updatedAt: null,
         };
@@ -1228,20 +1235,22 @@ function normalizePathnameForPermissionRules(pathname) {
     const path = parts.length <= 1 ? "/" : "/" + parts.slice(1).join("/");
     return path.replace(/\/user-role\/(purchase-doc|sales-doc)$/, "/user-role/members");
 }
+function hasRule(rulesMap, routeKey) {
+    return Object.prototype.hasOwnProperty.call(rulesMap, routeKey);
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
  */
-function getRequiredChildGroups(pathname, rulesMap) {
+function resolveUiRoutePermission(pathname, rulesMap) {
     const normalized = normalizePathnameForPermissionRules(pathname);
-    if (rulesMap[normalized]) {
-        return rulesMap[normalized];
+    if (hasRule(rulesMap, normalized)) {
+        return { matched: true, roles: rulesMap[normalized] ?? [] };
     }
     const pathSegments = normalized.split("/").filter(Boolean);
     for (const [pattern, roles] of Object.entries(rulesMap)) {
@@ -1264,24 +1273,43 @@ function getRequiredChildGroups(pathname, rulesMap) {
             }
         }
         if (matches) {
-            return roles;
+            return { matched: true, roles: roles ?? [] };
         }
     }
-    return [];
+    // Parent-prefix: /leave/types/abc → /leave/types (non-empty roles only)
+    for (let len = pathSegments.length - 1; len >= 1; len--) {
+        const parent = "/" + pathSegments.slice(0, len).join("/");
+        if (hasRule(rulesMap, parent) && (rulesMap[parent]?.length ?? 0) > 0) {
+            return { matched: true, roles: rulesMap[parent] ?? [] };
+        }
+    }
+    return { matched: false, roles: [] };
+}
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
+ */
+function getRequiredChildGroups(pathname, rulesMap) {
+    return resolveUiRoutePermission(pathname, rulesMap).roles;
 }
 
+function DeniedCard() {
+    return (jsx(Card, { className: "p-6", children: jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsx(AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxs("div", { className: "space-y-1", children: [jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" })] })] }) }));
+}
 /**
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
+ * into the host's `usePermission` probe, and renders one of:
  *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card
- * 3. otherwise → children
- *
- * Role codes are intentionally not shown on the deny screen (they are
- * internal identifiers like `fin_controller` and confuse end users).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
     const pathname = usePathname();
@@ -1292,31 +1320,27 @@ function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
         // live rules win over fallback when both define the same key
         return { ...fallbackRulesMap, ...rulesMap };
     }, [rulesMap, fallbackRulesMap]);
-    const requiredRoles = useMemo(() => getRequiredChildGroups(pathname, mergedMap), [pathname, mergedMap]);
-    // Hook must run unconditionally (rules of hooks); we just ignore the
-    // result on the fast path below.
+    const lookup = useMemo(() => resolveUiRoutePermission(pathname, mergedMap), [pathname, mergedMap]);
+    // Hook must run unconditionally (rules of hooks).
     const { hasPermission, isLoading } = usePermission({
-        requiredRoles,
+        requiredRoles: lookup.roles,
     });
-    // Fast path — no rule covers this pathname, anyone can see it. Skip the
-    // probe UI entirely; flashing "checking permission" or "no access" on an
-    // unrestricted page is pure noise.
-    if (requiredRoles.length === 0) {
+    if (rulesLoading) {
+        return null;
+    }
+    // Unknown route → deny. Only explicit `required_child_groups: []` is public.
+    if (!lookup.matched) {
+        return jsx(DeniedCard, {});
+    }
+    if (lookup.roles.length === 0) {
         return jsx(Fragment$1, { children: children });
     }
-    // While the answer hasn't settled, render nothing and let the surrounding
-    // Next.js loading.tsx / Suspense fallback show. The old behaviour wrapped
-    // a big "กำลังตรวจสอบสิทธิ์..." card over the top, which both duplicated
-    // the app's own loader and — worse — caused a "ไม่มีสิทธิ์" flash on
-    // fast loads because the probe transiently returned `hasPermission:false,
-    // isLoading:false` before its dependencies (org context, role-segments)
-    // arrived.
-    const isLoadingCombined = rulesLoading || isLoading;
+    const isLoadingCombined = isLoading;
     if (isLoadingCombined) {
         return null;
     }
     if (!hasPermission) {
-        return (jsx(Card, { className: "p-6", children: jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsx(AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxs("div", { className: "space-y-1", children: [jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" })] })] }) }));
+        return jsx(DeniedCard, {});
     }
     return jsx(Fragment$1, { children: children });
 }
@@ -1813,5 +1837,5 @@ const getAxiosErrorMessage = (error) => {
     return String(error);
 };
 
-export { ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, FeatureFlagsProvider, HeaderBackground, NavMain, NavTools, NavUser, OrganizationSwitcher, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, instance as axiosInstance, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, decodeJWT, filterNavigationModulesByPermission, filterNavigationToolsByPermission, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequiredChildGroups, isLikelyTransientNetworkError, isPathActive, normalizePathnameForPermissionRules, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
+export { ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, FeatureFlagsProvider, HeaderBackground, NavMain, NavTools, NavUser, OrganizationSwitcher, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, instance as axiosInstance, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, decodeJWT, filterNavigationModulesByPermission, filterNavigationToolsByPermission, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequiredChildGroups, isLikelyTransientNetworkError, isPathActive, normalizePathnameForPermissionRules, resolveUiRoutePermission, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
 //# sourceMappingURL=index.esm.js.map